Communication risk identification method and system based on multimodal behavior fusion

Abstract

The present invention provides a communication risk identification method and system based on multimodal behavior fusion, which relates to the field of communication risk identification. The method includes: fusing the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal in the communication process within a preset time period to obtain a multi-dimensional feature vector; inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector; inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value; and generating a target defense instruction based on the target risk probability value and a preset dynamic defense threshold. The present invention can dynamically adapt to changes in file classification levels and semantic association scenarios, and improve the real-time and accuracy of predictions. The present invention can more comprehensively reflect the behavioral characteristics of the target terminal in the communication process, thereby more accurately identifying potential communication risks, realizing real-time monitoring and early warning of communication risks, effectively reducing false alarm rates and missed alarm rates, and improving the reliability of risk identification.

Description

Technical Field

[0001] The present invention relates to the field of communication risk identification, and in particular to a communication risk identification method and system based on multimodal behavior fusion. Background Art

[0002] In today's digital communications environment, communications security has become a crucial issue. With the rapid development of communications technology and the widespread adoption of smart devices, various communication methods, such as text messages, phone calls, social media, and instant messaging applications, have become an integral part of people's daily lives. However, this also provides opportunities for criminals to exploit these communications to commit fraud, deception, and other illegal activities. Therefore, effectively identifying and preventing potential risks in communications has become a pressing technical challenge.

[0003] Traditional communication risk identification methods primarily rely on single detection methods, such as keyword-based SMS filtering and behavioral pattern-based call blocking. However, these methods often suffer from low detection accuracy, high false positive rates, and poor adaptability. For example, while keyword-based SMS filtering can block some text messages containing sensitive keywords, it is vulnerable to circumvention techniques such as keyword distortion and synonym substitution. Furthermore, the diversity of text message content makes it difficult to construct a comprehensive and accurate keyword library. Furthermore, traditional communication risk identification methods lack comprehensive consideration of user behavioral characteristics. In practice, communication risk is often closely related to multiple factors, including user behavior patterns, network environment, and social relationships. For example, a user sending a large number of text messages containing sensitive information in a short period of time or frequently making calls to unfamiliar numbers may indicate a communication risk. However, traditional detection methods often overlook these behavioral characteristics, resulting in poor detection results.

[0004] To address these issues, communication risk identification methods based on machine learning and artificial intelligence have gained increasing attention in recent years. These methods automatically extract features related to communication risk and construct corresponding risk identification models by analyzing and learning from large amounts of communication data. However, existing machine learning-based communication risk identification methods still have some shortcomings. For example, some methods only consider single communication features, such as text message content and call duration, while ignoring other important behavioral characteristics. Furthermore, some methods may suffer from poor model generalization and low computational efficiency when processing complex and variable communication data. Currently, there is no technical solution that can address these technical issues, nor is there a communication risk identification method or system based on multimodal behavioral fusion. Summary of the Invention

[0005] The present invention provides a communication risk identification method and system based on multimodal behavior fusion, which can solve the technical problems of low accuracy, poor adaptability and high false alarm rate in existing communication risk identification methods.

[0006] In a first aspect, the present invention provides a communication risk identification method based on multimodal behavior fusion, comprising:

[0007] The target terminal's network environment vector, permission feature vector, multimedia vector, and social behavior vector during communication within a preset time period are integrated to obtain a multi-dimensional feature vector. The network environment vector is determined based on the WiFi type, VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined based on the app permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined based on the image risk index and the voiceprint risk index. The social behavior vector is determined based on the social circle mutation rate and the density of emergency-induced keywords.

[0008] Inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model;

[0009] Input the fusion vector into the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model;

[0010] A target defense instruction is generated according to the target risk probability value and a preset dynamic defense threshold, and the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0011] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, before obtaining a multi-dimensional feature vector based on the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period, the method further includes:

[0012] One-hot encoding is used to distinguish home networks, enterprise intranets, and public hotspots among the WiFi types. The VPN identification bit in the VPN status is parsed using the TCP / IP protocol stack. The frequency of abnormal port detection events is counted based on a preset sliding time window, and the frequency is compressed to the interval [0, 1] through logarithmic transformation to determine the network environment vector.

[0013] For any APP in the target terminal, the application frequency of common permissions of similar APPs corresponding to the APP is counted, and a baseline probability distribution of each common permission is constructed. The actual probability distribution of each common permission is determined based on the actual permission application list of the APP. The baseline probability distribution and the actual probability distribution are calculated based on the preset JS divergence, and the JS divergence of the common permission is determined. Each common permission in all APPs is traversed to determine each JS divergence of all common permissions. The APP permission deviation index is determined based on all JS divergences. The common permission is the permission shared by the APP and the similar APPs; all enabled permissions in the APP are input into the preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model; all APPs are traversed to determine the sensitive permission combination risk index based on all sensitive permission combination risks; the APP permission deviation index and the sensitive permission combination risk index are integrated to obtain a permission feature vector;

[0014] Extract all images received within the preset time period, input each image into a preset image risk model, obtain an image risk score output by the preset image risk model, traverse all images, and determine an image risk index based on each image risk score corresponding to all images; extract all voiceprint information received within the preset time period, extract voiceprint MFCC features for each voiceprint information, perform similarity matching between the voiceprint MFCC features and fraudulent voice features in a preset fraud voice library to obtain voiceprint similarity, traverse all voiceprint information, determine a voiceprint risk index based on all voiceprint similarities, and determine the multimedia vector based on the image risk index and the voiceprint risk index;

[0015] The social circle mutation rate is determined based on the number of new contacts added to the target terminal during the preset time period and the historical average number of new contacts, and the session records of each APP of the target terminal during the preset time period are obtained. For each session record, the keyword density of the session record is determined based on the target keywords and the total number of session words in the session record. All session records are traversed, and the emergency induction keyword density is determined based on all keyword densities. The social behavior vector is determined based on the social circle mutation rate and the emergency induction keyword density. The target keywords include at least transfer, verification code, security account, password expiration and system upgrade.

[0016] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, the preset causal graph model includes a modeling enhancement layer, a feature encoding layer and a dense connection layer;

[0017] The step of inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model includes:

[0018] The modeling enhancement layer is used to calculate the causal effect factor corresponding to each feature vector using the front-door criterion for any feature vector in the multi-dimensional feature vector, and perform Hadamard product fusion on the feature vector and the causal effect factor to obtain an enhanced feature;

[0019] The feature encoding layer is used to process the enhanced features using a preset Softmax function to generate normalized weights corresponding to the feature vectors, determine a weight feature vector based on each feature vector and the normalized weights, and traverse all feature vectors to obtain all weight feature vectors;

[0020] The dense connection layer is used to fuse all weighted feature vectors to obtain a final feature vector, and perform dimensionality reduction compression on the final feature vector to obtain a fused vector.

[0021] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, the fusion of all weighted feature vectors to obtain the final feature vector includes:

[0022]

[0023] Among them, F fusion is the final eigenvector, s i is the normalized weight, is the feature vector.

[0024] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, the TCN-Transformer hybrid model includes a TCN layer and a Transformer layer; the inputting the fusion vector to the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model includes:

[0025] Inputting the fusion vector into the TCN layer to obtain a first spatiotemporal feature;

[0026] Input the fused vector to the Transformer layer to obtain the second spatiotemporal feature;

[0027] The first spatiotemporal feature and the second spatiotemporal feature are fused using tensor dot product to obtain a target risk probability value.

[0028] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, before generating a target defense instruction based on the target risk probability value and a preset dynamic defense threshold, the method further includes:

[0029] Determine an initial defense threshold based on historical attack samples, and adjust the initial defense threshold using the gradient information of the adversarial training loss function to obtain an adjusted defense threshold;

[0030] The network load impact value within the preset time period and the user sensitivity of the target terminal are obtained, and the preset dynamic defense threshold is determined according to the adjusted defense threshold, the network load impact value, and the user sensitivity.

[0031] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, the initial defense threshold is adjusted using the gradient information of the adversarial training loss function to obtain the adjusted defense threshold, including:

[0032]

[0033] Among them, T(t) is the adjusted defense threshold, T0 is the initial defense threshold, and γ is the learning rate coefficient that controls the adjustment amplitude. is the reverse gradient of the success rate of adversarial attack, P risk is the target risk probability value.

[0034] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, the user sensitivity is determined based on the occupation and position of the user of the target terminal; and the predetermined dynamic defense threshold is determined based on the adjusted defense threshold, the network load impact value, and the user sensitivity, including:

[0035] T final (t) = T(t) × (1 + α × NL - β × UC)

[0036] Among them, T final (t) is the preset dynamic defense threshold, T(t) is the adjusted defense threshold, α is the network load impact factor, β is the user sensitivity coefficient, NL is the network load impact value, and UC is the user sensitivity.

[0037] According to the communication risk identification method based on multimodal behavior fusion provided by the present invention, generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold includes:

[0038] When the target risk probability value is greater than or equal to the first risk threshold and less than the preset dynamic defense threshold, generating a first defense instruction, wherein the first defense instruction is used to instruct to send a risk SMS to the target terminal;

[0039] If the target risk probability value is greater than or equal to the preset dynamic defense threshold and less than a second risk threshold, a second defense instruction is generated, wherein the second defense instruction is used to restrict the network access rights of the APP with the transfer function, and / or perform a graphic verification code verification, and / or trigger a device fingerprint review;

[0040] When the target risk probability value is greater than or equal to the second risk threshold, facial recognition and voiceprint matching are triggered, and / or the execution time of the transfer operation is delayed.

[0041] Secondly, a communication risk identification system based on multimodal behavior fusion is provided, including:

[0042] a fusion unit, configured to fuse a network environment vector, a permission feature vector, a multimedia vector, and a social behavior vector of a target terminal during a communication process within a preset time period to obtain a multi-dimensional feature vector, wherein the network environment vector is determined based on the WiFi type, VPN status, and frequency of abnormal port detection events; the permission feature vector is determined based on the APP permission deviation index and the sensitive permission combination risk index; the multimedia vector is determined based on the image risk index and the voiceprint risk index; and the social behavior vector is determined based on the social circle mutation rate and the density of emergency-induced keywords;

[0043] A first input unit, the first input unit is used to input the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model;

[0044] A second input unit, the second input unit is used to input the fusion vector into the TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model;

[0045] A generating unit is used to generate a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, and the target defense instruction is used to instruct the target terminal to start a target defense strategy.

[0046] The present invention addresses technical drawbacks of existing communication risk identification methods, such as poor model generalization, low computational efficiency, and insufficient fusion processing of multimodal behavioral features. By integrating multi-dimensional feature vectors such as network environment vectors, permission feature vectors, multimedia vectors, and social behavior vectors, it can more comprehensively reflect the behavioral characteristics of the target terminal during the communication process, thereby more accurately identifying potential communication risks. Utilizing advanced machine learning algorithms and models, such as causal graph models and TCN-Transformer hybrid models, it achieves real-time monitoring and early warning of communication risks, effectively reducing false alarm and missed alarm rates, and improving the reliability of risk identification.

[0047] By introducing dynamic defense strategies and preset dynamic defense thresholds, the present invention can take corresponding defense measures according to the different levels of communication risks, thereby enhancing the generalization and adaptability of the model and better coping with complex and changeable communication environments and fraud methods. The present invention not only improves the accuracy and efficiency of recognition, but also can provide personalized security defense strategies based on the user's behavioral characteristics and risk level, thereby improving user experience and communication security. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 It is a flowchart of the communication risk identification method based on multimodal behavior fusion provided by the present invention;

[0050] Figure 2 It is a structural diagram of a communication risk identification system based on multimodal behavior fusion provided by the present invention;

[0051] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0052] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0053] Figure 1: is a flow chart of a communication risk identification method based on multimodal behavior fusion provided by the present invention, the communication risk identification method based on multimodal behavior fusion includes:

[0054] Step 101: Integrate the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector, wherein the network environment vector is determined based on the WiFi type, VPN status, and the frequency of abnormal port detection events; the permission feature vector is determined based on the APP permission deviation index and the sensitive permission combination risk index; the multimedia vector is determined based on the image risk index and the voiceprint risk index; and the social behavior vector is determined based on the social circle mutation rate and the density of emergency-induced keywords;

[0055] Step 102: input the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model;

[0056] Step 103: Input the fusion vector into the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model;

[0057] Step 104: Generate a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, wherein the target defense instruction is used to instruct the target terminal to enable a target defense strategy.

[0058] In step 101, before obtaining a multi-dimensional feature vector based on the network environment vector, permission feature vector, multimedia vector, and social behavior vector of the target terminal during the communication process within a preset time period, the method further includes using One-Hot coding to distinguish between home networks, corporate intranets, and public hotspots in the WiFi types, parsing the VPN identification bit in the VPN status through the TCP / IP protocol stack, counting the frequency of the abnormal port detection events based on a preset sliding time window, compressing it to the [0,1] interval through logarithmic transformation, and determining the network environment vector.

[0059] Optionally, the present invention constructs a multi-dimensional risk characterization space through four types of heterogeneous feature vectors, wherein, in the acquisition of the network environment vector, one-hot coding is used to distinguish home networks (001), enterprise intranets (010), and public hotspots (100), and the VPN identification bit is parsed through the TCP / IP protocol stack, such as 0 / 1 binarization, and the time axis is divided into continuous preset time windows. The number of abnormal port detection events is independently counted in each window, and the data in the window is updated in real time as new events arrive. When the old data exceeds the preset time range, it is automatically eliminated to ensure that the statistical results reflect the activity characteristics within the latest preset time range. The total number of all port detection events in each window is counted as the original frequency value, for example, 100,000 abnormal detections are counted, and only 100 abnormal detections are counted in another window. A natural logarithm transformation is applied to the original frequency. After the logarithmic transformation, the data is compressed to [0,1] by linear mapping to ensure that all statistical results are within a uniform and comparable range. Finally, the WiFi type, VPN status, and port scan times are combined into a network environment vector V with a dimension of 128. net .

[0060] Optionally, before obtaining the multidimensional feature vector based on the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal during the communication process within a preset time period, the method further includes, for any APP in the target terminal, counting the application frequency of common permissions of similar APPs corresponding to the APP, constructing a baseline probability distribution for each common permission, determining the actual probability distribution of each common permission based on the actual permission application list of the APP, calculating the baseline probability distribution and the actual probability distribution based on a preset JS divergence, determining the JS divergence of the common permission, traversing each common permission in all APPs, determining each JS divergence of all common permissions, and determining the APP permission deviation index based on all JS divergences, where the common permission is the permission shared by the APP and the similar APPs; inputting all enabled permissions in the APP into a preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model, traversing all APPs, and determining the sensitive permission combination risk index based on all sensitive permission combination risks; and fusing the APP permission deviation index and the sensitive permission combination risk index to obtain a permission feature vector.

[0061] Optionally, by counting the frequency of permission applications of similar APPs, a baseline probability distribution Q is established. For example, if the application rate of location permission among similar APPs is 80%, then Q(location) = 0.8, and the actual permission application list of the target APP is converted into a probability distribution P. For example, if an APP has applied for location and address book permissions, then P(location) = 1 / 2. Based on the preset JS divergence, the baseline probability distribution and the actual probability distribution are calculated to determine the JS divergence of the common permission:

[0062]

[0063] Among them, M=(P+Q) / 2 is the mixed distribution, D KL is the KL divergence. The symmetry and boundedness of the JS divergence (range [0, log2]) enable it to stably quantify the degree of abnormality of permission applications. In addition to positioning, it is also possible to traverse all other common permissions, such as camera, address book, etc., to determine each JS divergence of all common permissions, and determine the APP permission deviation index based on all JS divergences. The common permissions are permissions shared by the APP and similar APPs. The APP permission deviation index can be the average value of each JS divergence of all common permissions.

[0064] Those skilled in the art understand that if an APP that should not have obtained permissions obtains relevant permissions, or if an APP that should not have obtained permissions that it should not have obtained enables corresponding permission operations, it is considered that such operations have a greater communication risk, and the permissions enabled are abnormal permission combinations. For example, it is very unreasonable for a calculator APP to apply for address book and location permissions at the same time. The present invention can classify each APP, and for APPs of the same type, design a corresponding preset sensitive permission combination detection model. The preset sensitive permission combination detection model is determined after training based on different sample permission combinations and the sample sensitive permission combination risks corresponding to each sample permission combination. Then, all enabled permissions in the APP are input into the preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model. For each APP, its corresponding APP of the same type is determined, and then all APPs are traversed to obtain the sensitive permission combination risk corresponding to each APP. All sensitive permission combination risks are averaged to determine the sensitive permission combination risk index. Finally, the APP permission deviation index and the sensitive permission combination risk index are integrated to obtain the permission feature vector V perm .

[0065] Optionally, before obtaining the multidimensional feature vector based on the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal during the communication process within the preset time period, the method further includes extracting all pictures received within the preset time period, inputting the picture into a preset picture risk model for each picture, obtaining the picture risk output by the preset picture risk model, traversing all pictures, and determining the picture risk index according to each picture risk corresponding to all pictures; extracting all voiceprint information received within the preset time period, extracting the voiceprint MFCC feature for each voiceprint information, performing similarity matching on the voiceprint MFCC feature with the fraudulent voice feature in a preset fraud voice library to obtain the voiceprint similarity, traversing all voiceprint information, determining the voiceprint risk index according to all voiceprint similarities, and determining the multimedia vector according to the picture risk index and the voiceprint risk index.

[0066] Optionally, the abnormal images with risks referred to in the present invention are mainly those images generated by AI, such as those that violate biometric anomalies, such as abnormal joint angles, abnormal light reflections, abnormal physical laws, such as a person in a squeezed state without obvious wrinkles or deformations, objects with shadows in multiple directions, and the shadows are of different lengths, etc. These images do not really exist. The present invention can be based on the detection formula of the StegDetect algorithm, processing spatial domain images and frequency domain DCT coefficients, etc., or based on discrete cosine transform (DCT) coefficient analysis of steganographic features and other technologies, and then determine the sample risk index of each sample image, and then construct a preset image risk model based on each sample risk index of all sample images, so that after inputting the image into the preset image risk model, the image risk can be obtained, all images are traversed, and each image risk corresponding to all images is averaged to determine the image risk index. Furthermore, for each voiceprint information, Mel-Frequency Cepstral Coefficient (MFCC) is the core feature of voiceprint recognition. The voiceprint MFCC feature is extracted. The voiceprint MFCC feature is similar to the sound ID card. The voiceprint MFCC feature is matched with the fraudulent voice features in the preset fraud voice library for similarity. The voiceprint similarity is obtained including:

[0067]

[0068] in, is the voiceprint MFCC feature, is a fraud voice feature in any preset fraud voice library, T is the number of fraud voice features in the preset fraud voice library, that is, traverse all voiceprint information, determine the voiceprint risk index according to the similarity of all voiceprints, and finally determine the multimedia vector V according to the image risk index and the voiceprint risk index. media,The present invention can compress the original high dimensional features to 128 dimensions through PCA, and also introduce a cross attention mechanism to enhance the image risk index and the voiceprint risk index mutually.

[0069] Optionally, before obtaining a multi-dimensional feature vector based on the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal during the communication process within a preset time period, the method also includes determining a social circle mutation rate based on the number of new contacts added by the target terminal within the preset time period and the historical average number of new contacts, obtaining a session record of each APP of the target terminal within the preset time period, and for each session record, determining a keyword density of the session record based on target keywords and the total number of words in the session record, traversing all session records, determining an emergency induction keyword density based on all keyword densities, and determining the social behavior vector based on the social circle mutation rate and the emergency induction keyword density, wherein the target keywords include at least transfer, verification code, security account, password expiration and system upgrade.

[0070] Optionally, determining the social circle mutation rate according to the number of new contacts added by the target terminal within the preset time period and the historical average number of new contacts includes:

[0071]

[0072] In an optional embodiment, the historical average number of new contacts is the average value of the last 8 weeks, the number of new contacts in a preset period is the number of new contacts this week, and the historical standard deviation is the degree of dispersion of data in the same period.

[0073] Optionally, for the density of emergency-induced keywords, the present invention first converts and extracts the text content of the conversation record to obtain the target keywords and the total number of conversation words in the conversation record, wherein the target keywords include at least transfer, verification code, security account, password expiration and system upgrade, and then determines the keyword density of the conversation record based on the target keywords and the total number of conversation words in the conversation record, for example, determines the proportion of the target keywords in the conversation record in the total number of conversation words, determines the keyword density of the conversation record, traverses all conversation records of the target terminal within a preset time period, and then determines the keyword density corresponding to each conversation record, determines the emergency-induced keyword density based on the average of all keyword densities, and finally, integrates the social circle mutation rate and the emergency-induced keyword density to determine the social behavior vector V social .

[0074] In step 101, the network environment vector V of the target terminal in the communication process within a preset period is integrated net , permission feature vector Vperm , Multimedia Vector V media and social behavior vector V social , obtain the multi-dimensional feature vector [V net , V perm , V media , V social ]∈R 640 In other embodiments, adversarial domain adaptation alignment technology can be used to eliminate feature distribution differences and convert the network environment vector V net , permission feature vector V perm , Multimedia Vector V media and social behavior vector V social After alignment, the multi-dimensional feature vector is determined. Specifically, in order to eliminate the differences in the distribution of multi-source features, a dual alignment mechanism is used to achieve cross-modal feature space unification, Z-Score normalization is performed on each feature dimension, and a reference distribution Vref is introduced. Usually, the mixed distribution of all samples in the training set is taken, and the distribution difference is calculated through the Gaussian kernel function. A generative adversarial network framework is constructed to further align the feature distribution. The results of standardization and adversarial training are combined to obtain the aligned features.

[0075] In step 102, the preset causal graph model includes a modeling enhancement layer, a feature encoding layer, and a dense connection layer;

[0076] The step of inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model includes:

[0077] The modeling enhancement layer is used to calculate the causal effect factor corresponding to each feature vector using the front-door criterion for any feature vector in the multi-dimensional feature vector, and perform Hadamard product fusion on the feature vector and the causal effect factor to obtain an enhanced feature;

[0078] The feature encoding layer is used to process the enhanced features using a preset Softmax function to generate normalized weights corresponding to the feature vectors, determine a weight feature vector based on each feature vector and the normalized weights, and traverse all feature vectors to obtain all weight feature vectors;

[0079] The dense connection layer is used to fuse all weighted feature vectors to obtain a final feature vector, and perform dimensionality reduction compression on the final feature vector to obtain a fused vector.

[0080] Optionally, the present invention can construct a directed acyclic graph (DAG) based on the network environment, authority abuse, multimedia risk, social anomaly, and communication risk to describe the causal relationship between features and risk labels. Based on the conditional independence test (PC algorithm) and Granger causality test, the impact path of features on risks is quantified, and the front-door criterion is used to calculate the causal effect factor C corresponding to each feature vector. i include:

[0081]

[0082] Among them, do(X i ), using the Potential Outcomes framework to calculate the average treatment effect (ATE), for example, when VPN is forced to be closed, the risk probability increases by 0.23. i Align feature V i Perform element-level fusion to obtain enhanced features

[0083] Generate normalized weights through the Softmax function:

[0084]

[0085] Where exp is the natural exponential function, W is the learnable weight matrix, T is the matrix transpose, and the present invention introduces the causal effect factor C i Constrain the direction of weight distribution and suppress non-causal correlation dimensions.

[0086] Furthermore, the fusion of all weighted feature vectors to obtain the final feature vector includes:

[0087]

[0088] Among them, F fusion is the final eigenvector, a i is the normalized weight, For feature vectors, adversarial samples can also be injected during the training phase to ensure weight stability. The 640-dimensional fusion vector is compressed to 512 dimensions through a dense connection layer. The KL divergence constraint is used to ensure distribution consistency before and after dimensionality reduction, and the high-contribution feature combination is visualized through gradient backpropagation.

[0089] In step 103, the TCN-Transformer hybrid model includes a TCN layer and a Transformer layer; the inputting the fusion vector into the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model includes:

[0090] Inputting the fusion vector into the TCN layer to obtain a first spatiotemporal feature;

[0091] Input the fused vector to the Transformer layer to obtain the second spatiotemporal feature;

[0092] The first spatiotemporal feature and the second spatiotemporal feature are fused using tensor dot product to obtain a target risk probability value.

[0093] In such an embodiment, step 103 receives the 512-dimensional causal attention fusion vector Ffusion output by step 102 as input, and implements multi-level modeling of spatiotemporal features through the TCN-Transformer hybrid model. The model combines the local temporal capture capability of the temporal convolutional network (TCN) with the global cross-dimensional interaction characteristics of the Transformer. TCN uses causal convolution to ensure the strict causality of temporal modeling, introduces the dilation rate (DilationRate) d = 2l (l is the number of layers), so that the receptive field of the lth layer is expanded to Receptive Field = (K-1) × d+1. When K = 5 and 4 layers are stacked, the maximum receptive field reaches 72 hours. The gradient disappearance problem is alleviated by the residual connection. The TCN layer outputs the local feature matrix Htcn in the time dimension, that is, the first spatiotemporal feature, where T = 72 hours is the sliding window length, which captures high-frequency fluctuations, periodic behavior, and trend changes.

[0094] Furthermore, the fusion vector F is input fusion To the Transformer layer, multi-head self-attention (MSA) is used to extract cross-dimensional associations. Eight attention heads are set to capture the interaction patterns of different feature combinations such as authority-network and multimedia-social. A two-stage attention (TSA) mechanism is introduced to calculate the attention weight in the time dimension, strengthen key time points (such as the time when the attack occurs), and use the router mechanism to dynamically filter high-correlation feature combinations and output the interaction feature matrix H. trans , which is the second space-time characteristic.

[0095] The first spatiotemporal feature and the second spatiotemporal feature are subjected to feature fusion using tensor dot product to obtain a target risk probability value, which includes:

[0096]

[0097] Among them, the dot product operation strengthens the spatiotemporal consistency characteristics, the Sigmoid function compresses the score to the [0,1] interval and maps it to the risk probability, TCN captures fine-grained temporal patterns within 72 hours (such as the port scanning frequency per hour), and Transformer mines nonlinear associations across permissions, multimedia, and social dimensions to achieve multi-scale coverage of risk identification.

[0098] In step 104, the risk probability value and real-time environmental parameters (such as network load, device location, and user identity sensitivity) output in step 103 are received, and intelligent generation of defense strategies is achieved through an adversarially enhanced dynamic threshold algorithm. This mechanism breaks through the limitations of traditional static thresholds and achieves real-time adaptation of defense responses and attack situations through gradient backpropagation and game theory optimization.

[0099] Optionally, before generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, the method further includes:

[0100] Determine an initial defense threshold based on historical attack samples, and adjust the initial defense threshold using the gradient information of the adversarial training loss function to obtain an adjusted defense threshold;

[0101] The network load impact value within the preset time period and the user sensitivity of the target terminal are obtained, and the preset dynamic defense threshold is determined according to the adjusted defense threshold, the network load impact value, and the user sensitivity.

[0102] Optionally, the initial defense threshold is determined based on historical attack samples, for example, T0 = μ attack +3σ attack , μ attack is the average risk value of historical attack events, σ attack is the standard deviation of the attack sample, if μ attack is 0.52, σ attack is 0.06, then T0 is 0.7.

[0103] Optionally, adjusting the initial defense threshold using the gradient information of the adversarial training loss function to obtain the adjusted defense threshold includes:

[0104]

[0105] Among them, T(t) is the adjusted defense threshold, T0 is the initial defense threshold, and γ is the learning rate coefficient that controls the adjustment amplitude. is the reverse gradient of the success rate of adversarial attack, P riSk is the target risk probability value.

[0106] Optionally, the user sensitivity is determined based on an occupation and a position of a user of the target terminal; and determining the preset dynamic defense threshold based on the adjusted defense threshold, the network load impact value, and the user sensitivity includes:

[0107] T final (t) = T(t) × (1 + α × NL - β × UC)

[0108] Among them, T final (t) is the preset dynamic defense threshold, T(t) is the adjusted defense threshold, α is the network load impact factor, β is the user sensitivity coefficient, NL is the network load impact value, and UC is the user sensitivity.

[0109] Optionally, generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold includes:

[0110] When the target risk probability value is greater than or equal to the first risk threshold and less than the preset dynamic defense threshold, generating a first defense instruction, wherein the first defense instruction is used to instruct to send a risk SMS to the target terminal;

[0111] If the target risk probability value is greater than or equal to the preset dynamic defense threshold and less than a second risk threshold, a second defense instruction is generated, wherein the second defense instruction is used to restrict the network access rights of the APP with the transfer function, and / or perform a graphic verification code verification, and / or trigger a device fingerprint review;

[0112] When the target risk probability value is greater than or equal to the second risk threshold, facial recognition and voiceprint matching are triggered, and / or the execution time of the transfer operation is delayed.

[0113] The present invention generates different defense instructions based on the comparison results of the target risk probability value with the preset dynamic defense threshold and the first risk threshold and the second risk threshold, such as sending risk text messages, restricting APP network access rights, performing graphic verification code verification, triggering device fingerprint review, face recognition and voiceprint matching, delaying transfer operations, etc. It provides a specific method for generating defense instructions based on risk probability values, making defense measures more specific and operational, and improving the timeliness and accuracy of risk response.

[0114] The present invention addresses technical drawbacks of existing communication risk identification methods, such as poor model generalization, low computational efficiency, and insufficient fusion processing of multimodal behavioral features. By integrating multi-dimensional feature vectors such as network environment vectors, permission feature vectors, multimedia vectors, and social behavior vectors, it can more comprehensively reflect the behavioral characteristics of the target terminal during the communication process, thereby more accurately identifying potential communication risks. Utilizing advanced machine learning algorithms and models, such as causal graph models and TCN-Transformer hybrid models, it achieves real-time monitoring and early warning of communication risks, effectively reducing false alarm and missed alarm rates, and improving the reliability of risk identification.

[0115] By introducing dynamic defense strategies and preset dynamic defense thresholds, the present invention can take corresponding defense measures according to the different levels of communication risks, thereby enhancing the generalization and adaptability of the model and better coping with complex and changeable communication environments and fraud methods. The present invention not only improves the accuracy and efficiency of recognition, but also can provide personalized security defense strategies based on the user's behavioral characteristics and risk level, thereby improving user experience and communication security.

[0116] Figure 2 It is a structural diagram of the communication risk identification system based on multimodal behavior fusion provided by the present invention. The communication risk identification system based on multimodal behavior fusion includes a fusion unit 1. The fusion unit 1 is used to fuse the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal in the communication process within a preset time period to obtain a multi-dimensional feature vector. The network environment vector is determined according to the WiFi type, VPN status and the frequency of abnormal port detection events. The permission feature vector is determined according to the APP permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined according to the image risk index and the voiceprint risk index. The social behavior vector is determined according to the social circle mutation rate and the emergency induction keyword density. The working principle of the fusion unit 1 can refer to the aforementioned step 101 and will not be repeated here.

[0117] The communication risk identification system based on multimodal behavior fusion also includes a first input unit 2, which is used to input the multidimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model. The working principle of the first input unit 2 can refer to the aforementioned step 102 and will not be repeated here.

[0118] The communication risk identification system based on multimodal behavior fusion also includes a second input unit 3, which is used to input the fusion vector into the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model. The working principle of the second input unit 3 can be referred to the aforementioned step 103 and will not be repeated here.

[0119] The communication risk identification system based on multimodal behavior fusion also includes a generation unit 4, which is used to generate a target defense instruction based on the target risk probability value and a preset dynamic defense threshold. The target defense instruction is used to instruct the target terminal to activate the target defense policy. The working principle of the generation unit 4 can be referred to the aforementioned step 104 and will not be repeated here.

[0120] The present invention addresses technical drawbacks of existing communication risk identification methods, such as poor model generalization, low computational efficiency, and insufficient fusion processing of multimodal behavioral features. By integrating multi-dimensional feature vectors such as network environment vectors, permission feature vectors, multimedia vectors, and social behavior vectors, it can more comprehensively reflect the behavioral characteristics of the target terminal during the communication process, thereby more accurately identifying potential communication risks. Utilizing advanced machine learning algorithms and models, such as causal graph models and TCN-Transformer hybrid models, it achieves real-time monitoring and early warning of communication risks, effectively reducing false alarm and missed alarm rates, and improving the reliability of risk identification.

[0121] By introducing dynamic defense strategies and preset dynamic defense thresholds, the present invention can take corresponding defense measures according to the different levels of communication risks, thereby enhancing the generalization and adaptability of the model and better coping with complex and changeable communication environments and fraud methods. The present invention not only improves the accuracy and efficiency of recognition, but also can provide personalized security defense strategies based on the user's behavioral characteristics and risk level, thereby improving user experience and communication security.

[0122] Figure 3 Schematic diagram of the structure of the electronic device provided by the present invention. Figure 3As shown, the electronic device may include: a processor (processor) 110, a communication interface (Communications Interface) 120, a memory (memory) 130 and a communication bus 140, wherein the processor 110, the communication interface 120, and the memory 130 communicate with each other through the communication bus 140. The processor 110 can call logic instructions in the memory 130 to execute a communication risk identification method based on multimodal behavior fusion, the method comprising: fusing a network environment vector, a permission feature vector, a multimedia vector, and a social behavior vector of a target terminal during a communication process within a preset time period to obtain a multidimensional feature vector, wherein the network environment vector is determined based on the WiFi type, VPN status, and the frequency of abnormal port detection events; the permission feature vector is determined based on the APP permission deviation index and the sensitive permission combination risk index; the multimedia vector is determined based on the image risk index and the voiceprint risk index; and the social behavior vector is determined based on the social circle mutation rate and the density of emergency-induced keywords; inputting the multidimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model; inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model; and generating a target defense instruction based on the target risk probability value and a preset dynamic defense threshold, wherein the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0123] In addition, the logic instructions in the above-mentioned memory 130 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0124] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute a communication risk identification method based on multimodal behavior fusion provided by the above methods. The method includes: fusing the network environment vector, permission feature vector, multimedia vector and social behavior vector of the target terminal during the communication process within a preset time period to obtain a multi-dimensional feature vector, wherein the network environment vector is determined based on the WiFi type, VPN status and the frequency of abnormal port detection events, and the permission feature vector is determined based on the APP permission deviation index. The multi-dimensional feature vector is determined based on the risk index of the combination of the number of sensitive permissions and the sensitive authority, the multimedia vector is determined based on the image risk index and the voiceprint risk index, and the social behavior vector is determined based on the mutation rate of the social circle and the density of emergency-induced keywords; the multi-dimensional feature vector is input into the preset causal graph model to obtain the fusion vector output by the preset causal graph model; the fusion vector is input into the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model; a target defense instruction is generated based on the target risk probability value and the preset dynamic defense threshold, and the target defense instruction is used to instruct the target terminal to turn on the target defense strategy.

[0125] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the communication risk identification method based on multimodal behavior fusion provided by the above-mentioned methods, the method comprising: fusing a network environment vector, a permission feature vector, a multimedia vector, and a social behavior vector of a target terminal during a communication process within a preset time period to obtain a multidimensional feature vector, wherein the network environment vector is determined based on the WiFi type, VPN status, and the frequency of abnormal port detection events; the permission feature vector is determined based on the APP permission deviation index and the sensitive permission combination risk index; the multimedia vector is determined based on the image risk index and the voiceprint risk index; and the social behavior vector is determined based on the social circle mutation rate and the density of emergency-induced keywords; inputting the multidimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model; inputting the fusion vector into a TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model; and generating a target defense instruction based on the target risk probability value and a preset dynamic defense threshold, wherein the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

[0126] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0127] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A communication risk identification method based on multimodal behavior fusion, characterized in that: include: The target terminal's network environment vector, permission feature vector, multimedia vector, and social behavior vector during communication within a preset time period are integrated to obtain a multi-dimensional feature vector. The network environment vector is determined based on the WiFi type, VPN status, and the frequency of abnormal port detection events. The permission feature vector is determined based on the app permission deviation index and the sensitive permission combination risk index. The multimedia vector is determined based on the image risk index and the voiceprint risk index. The social behavior vector is determined based on the social circle mutation rate and the density of emergency-induced keywords. Inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model; Input the fusion vector into the TCN-Transformer hybrid model to obtain the target risk probability value output by the TCN-Transformer hybrid model; A target defense instruction is generated according to the target risk probability value and a preset dynamic defense threshold, and the target defense instruction is used to instruct the target terminal to activate a target defense strategy.

2. The communication risk identification method based on multimodal behavior fusion according to claim 1 is characterized in that: Before obtaining the multi-dimensional feature vector by integrating the network environment vector, the permission feature vector, the multimedia vector, and the social behavior vector of the target terminal during the communication process within the preset time period, the method further includes: One-hot encoding is used to distinguish home networks, enterprise intranets, and public hotspots among the WiFi types. The VPN identification bit in the VPN status is parsed using the TCP / IP protocol stack. The frequency of abnormal port detection events is counted based on a preset sliding time window, and the frequency is compressed to the interval [0, 1] through logarithmic transformation to determine the network environment vector. For any APP in the target terminal, the application frequency of common permissions of similar APPs corresponding to the APP is counted, and a baseline probability distribution of each common permission is constructed. The actual probability distribution of each common permission is determined based on the actual permission application list of the APP. The baseline probability distribution and the actual probability distribution are calculated based on the preset JS divergence, and the JS divergence of the common permission is determined. Each common permission in all APPs is traversed to determine each JS divergence of all common permissions. The APP permission deviation index is determined based on all JS divergences. The common permission is the permission shared by the APP and the similar APPs; all enabled permissions in the APP are input into the preset sensitive permission combination detection model to obtain the sensitive permission combination risk output by the preset sensitive permission combination detection model; all APPs are traversed to determine the sensitive permission combination risk index based on all sensitive permission combination risks; the APP permission deviation index and the sensitive permission combination risk index are integrated to obtain a permission feature vector; Extract all images received within the preset time period, input each image into a preset image risk model, obtain an image risk score output by the preset image risk model, traverse all images, and determine an image risk index based on each image risk score corresponding to all images; extract all voiceprint information received within the preset time period, extract voiceprint MFCC features for each voiceprint information, perform similarity matching between the voiceprint MFCC features and fraudulent voice features in a preset fraud voice library to obtain voiceprint similarity, traverse all voiceprint information, determine a voiceprint risk index based on all voiceprint similarities, and determine the multimedia vector based on the image risk index and the voiceprint risk index; The social circle mutation rate is determined based on the number of new contacts added to the target terminal during the preset time period and the historical average number of new contacts, and the session records of each APP of the target terminal during the preset time period are obtained. For each session record, the keyword density of the session record is determined based on the target keywords and the total number of session words in the session record. All session records are traversed, and the emergency induction keyword density is determined based on all keyword densities. The social behavior vector is determined based on the social circle mutation rate and the emergency induction keyword density. The target keywords include at least transfer, verification code, security account, password expiration and system upgrade.

3. The communication risk identification method based on multimodal behavior fusion according to claim 1 is characterized in that: The preset causal graph model includes a modeling enhancement layer, a feature encoding layer and a dense connection layer; The step of inputting the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model includes: The modeling enhancement layer is used to calculate the causal effect factor corresponding to each feature vector using the front-door criterion for any feature vector in the multi-dimensional feature vector, and perform Hadamard product fusion on the feature vector and the causal effect factor to obtain an enhanced feature; The feature encoding layer is used to process the enhanced features using a preset Softmax function to generate normalized weights corresponding to the feature vectors, determine a weight feature vector based on each feature vector and the normalized weights, and traverse all feature vectors to obtain all weight feature vectors; The dense connection layer is used to fuse all weighted feature vectors to obtain a final feature vector, and perform dimensionality reduction compression on the final feature vector to obtain a fused vector.

4. The communication risk identification method based on multimodal behavior fusion according to claim 3 is characterized in that: The fusion of all weighted feature vectors to obtain the final feature vector includes: Among them, F fusion is the final eigenvector, a i is the normalized weight, is the feature vector.

5. The communication risk identification method based on multimodal behavior fusion according to claim 1 is characterized in that: The TCN-Transformer hybrid model includes a TCN layer and a Transformer layer; inputting the fusion vector to the TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model includes: Inputting the fusion vector into the TCN layer to obtain a first spatiotemporal feature; Input the fused vector to the Transformer layer to obtain the second spatiotemporal feature; The first spatiotemporal feature and the second spatiotemporal feature are fused using tensor dot product to obtain a target risk probability value.

6. The communication risk identification method based on multimodal behavior fusion according to claim 1 is characterized in that: Before generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, the method further includes: Determine an initial defense threshold based on historical attack samples, and adjust the initial defense threshold using the gradient information of the adversarial training loss function to obtain an adjusted defense threshold; The network load impact value within the preset time period and the user sensitivity of the target terminal are obtained, and the preset dynamic defense threshold is determined according to the adjusted defense threshold, the network load impact value, and the user sensitivity.

7. The communication risk identification method based on multimodal behavior fusion according to claim 6 is characterized in that: The step of adjusting the initial defense threshold using the gradient information of the adversarial training loss function to obtain the adjusted defense threshold includes: Among them, T(t) is the adjusted defense threshold, T0 is the initial defense threshold, and γ is the learning rate coefficient that controls the adjustment amplitude. is the reverse gradient of the success rate of adversarial attack, P risk is the target risk probability value.

8. The communication risk identification method based on multimodal behavior fusion according to claim 7 is characterized in that: The user sensitivity is determined according to the occupation and position of the user of the target terminal; and the determining of the preset dynamic defense threshold according to the adjusted defense threshold, the network load impact value, and the user sensitivity includes: T final (t)=T(t)×(1+α×NL-β×UC) Among them, T final (t) is the preset dynamic defense threshold, T(t) is the adjusted defense threshold, α is the network load impact factor, β is the user sensitivity coefficient, NL is the network load impact value, and UC is the user sensitivity.

9. The communication risk identification method based on multimodal behavior fusion according to claim 1 is characterized in that: Generating a target defense instruction according to the target risk probability value and a preset dynamic defense threshold includes: When the target risk probability value is greater than or equal to the first risk threshold and less than the preset dynamic defense threshold, generating a first defense instruction, wherein the first defense instruction is used to instruct to send a risk SMS to the target terminal; If the target risk probability value is greater than or equal to the preset dynamic defense threshold and less than a second risk threshold, a second defense instruction is generated, wherein the second defense instruction is used to restrict the network access rights of the APP with the transfer function, and / or perform a graphic verification code verification, and / or trigger a device fingerprint review; When the target risk probability value is greater than or equal to the second risk threshold, facial recognition and voiceprint matching are triggered, and / or the execution time of the transfer operation is delayed.

10. A communication risk identification system based on multimodal behavior fusion, characterized in that: include: a fusion unit, configured to fuse a network environment vector, a permission feature vector, a multimedia vector, and a social behavior vector of a target terminal during a communication process within a preset time period to obtain a multi-dimensional feature vector, wherein the network environment vector is determined based on the WiFi type, VPN status, and frequency of abnormal port detection events; the permission feature vector is determined based on the APP permission deviation index and the sensitive permission combination risk index; the multimedia vector is determined based on the image risk index and the voiceprint risk index; and the social behavior vector is determined based on the social circle mutation rate and the density of emergency-induced keywords; A first input unit, the first input unit is used to input the multi-dimensional feature vector into a preset causal graph model to obtain a fusion vector output by the preset causal graph model; A second input unit, the second input unit is used to input the fusion vector into the TCN-Transformer hybrid model to obtain a target risk probability value output by the TCN-Transformer hybrid model; A generating unit is used to generate a target defense instruction according to the target risk probability value and a preset dynamic defense threshold, and the target defense instruction is used to instruct the target terminal to start a target defense strategy.

Images