Short message auditing and intercepting system based on artificial intelligence

Abstract

The invention relates to the technical field of short message auditing and intercepting, in particular to a short message auditing and intercepting system based on artificial intelligence, which performs multi-level semantic feature extraction on short message content by constructing a deep learning architecture mixed by a convolutional neural network and a recurrent neural network. And traditional keywords are effectively identified, and camouflage keywords, homophonic replacement and interference symbols which are easy to bypass are filtered. Furthermore, a short message semantic map is constructed through a multi-head self-attention mechanism, and weighted analysis and abnormal node recognition are carried out by taking sensitive words and key semantic units as map nodes and taking semantic association relationships among the nodes as edges, so that the abnormal short message recognition precision is improved. Besides, a multi-dimensional short message risk assessment mechanism is constructed by combining the historical behavior mode of the sending number, the number reputation score and the incidence relation between the numbers, and a hierarchical auditing strategy is implemented, so that the system processing efficiency and the interception accuracy are effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of short message review and interception, and in particular to a short message review and interception system based on artificial intelligence. Background Art

[0002] With the rapid adoption of smartphones and mobile internet, text messaging has become a vital tool for daily communication and information transfer. However, the resulting surge in the number of fraudulent, harassing, and various types of spam has brought significant disruption and risk to users' daily lives. Current SMS blocking systems primarily rely on keyword matching and simple rule-based filtering. While these systems can initially block some obvious harassing content, they are far less effective against carefully disguised, frequently mutated, and semantically complex fraudulent and harassing messages. These messages often circumvent traditional keyword filtering systems through methods such as homophonic substitution, special symbol interference, and contextual fuzzing. Furthermore, as fraudsters constantly update their message content and delivery strategies, traditional rule-based engines or simple machine learning models struggle to keep up with and adapt to the complex, diverse, and dynamically changing fraud landscape. Furthermore, existing technologies generally fail to fully utilize the sender's historical sending history, number reputation scores, and the social network information between numbers. This results in a lack of comprehensiveness and precision in SMS risk assessment, thereby reducing recognition accuracy. Summary of the Invention

[0003] To solve the above problems, the present invention provides an artificial intelligence-based SMS review and interception system, which distinguishes suspicious and normal SMS messages through a hybrid architecture of convolutional neural networks and recurrent neural networks, further uses semantic analysis on suspicious SMS messages and combines them with suspicious values to make comprehensive judgments, thereby achieving accuracy and comprehensiveness in SMS review.

[0004] To achieve the above object, the technical solution adopted by the present invention is:

[0005] An artificial intelligence-based SMS review and interception system, comprising: an SMS data acquisition module, a classification and judgment module, a semantic analysis module, a detection and judgment module, and an interception module;

[0006] The SMS data acquisition module is used to receive SMS and related meta-information and perform pre-processing to obtain SMS data;

[0007] The classification judgment module is used to calculate the suspicious value of the SMS data based on a hybrid architecture of a pre-trained convolutional neural network and a recurrent neural network, classify the SMS data according to the suspicious value, and obtain SMS classification results, wherein the SMS classification results include suspicious SMS and normal SMS;

[0008] The semantic analysis module is used to perform natural language processing on SMS data classified as suspicious SMS, extract text features, sensitive words, suspicious links, and semantic features of sensitive information requests, and calculate the SMS risk value based on the semantic features, combined with the sender's historical behavior, number reputation, and association relationship information;

[0009] The interception module is used to perform weighting based on the suspicious value and the SMS risk value, calculate an interception index based on the weighting, and intercept the suspicious SMS based on the interception index; the interception module is also used to execute passage for the normal SMS.

[0010] Furthermore, the receiving of the short message and related meta information and pre-processing thereof includes the following steps:

[0011] Receive original SMS content from SMS gateway;

[0012] Collect SMS sender information, including phone number, sending time, sending frequency, and sending geographic location information;

[0013] The original SMS content and SMS sender information are preprocessed, including removing special characters, word segmentation and text normalization, to generate SMS data.

[0014] Furthermore, the hybrid architecture of the convolutional neural network and the recurrent neural network is constructed by the following steps:

[0015] Convert the SMS data into word vector representations using a word embedding model to generate a vectorized matrix of the SMS data;

[0016] Using a convolutional neural network to extract local text features from the vectorized matrix of the SMS data to obtain a semantic space feature map of the SMS;

[0017] Inputting the semantic space feature map into a recurrent neural network to capture the contextual semantic relationship between words in the text of the SMS and form a SMS feature sequence;

[0018] The SMS feature sequence is subjected to dimensionality reduction processing through a fully connected layer, and a suspicious value is output.

[0019] Furthermore, the convolutional neural network is trained by the following steps:

[0020] Perform word segmentation and text normalization on the training samples marked as normal text messages and suspicious text messages to obtain the training data set;

[0021] The training dataset is converted into a vectorized matrix using a word embedding model and input into a convolutional neural network. Local features are extracted through convolutional layers and pooling layers to form a semantic space feature map.

[0022] The loss function is used to calculate the error between the SMS classification probability value output by the network and the actual classification label, and the back propagation algorithm is used to update the network weight parameters based on the error value until the error value converges to the preset threshold.

[0023] Furthermore, the hidden state vector calculation formula of the recurrent neural network is as follows:

[0024]

[0025] Among them, h t is the hidden state vector output at time t; x t is the SMS feature vector input; c t-1 is the state of the memory unit at time t-1; W xc is the input SMS feature vector x t to the weight matrix of the candidate memory state; W hc is the hidden state vector h at the previous moment t-1 to the weight matrix of the candidate memory state; b c is the bias vector; i t 、f t and o t They are the control vectors for the input gate, forget gate, and output gate respectively; is element-wise multiplication.

[0026] Furthermore, the natural language processing of the SMS data classified as suspicious SMS includes the following steps:

[0027] Perform semantic graph mapping on SMS data, converting SMS text into a graph structure with keywords as nodes and semantic relationships as edges;

[0028] Based on the pre-trained multi-head self-attention mechanism model, feature weighting is performed on the nodes and edges of the graph structure to calculate the semantic importance of each node and edge in the graph structure;

[0029] Identify possible semantically abnormal nodes or edges based on the semantic importance of nodes and edges, and obtain the semantically abnormal feature set of SMS data by calculating the node abnormality degree and edge abnormality degree;

[0030] Based on the set of semantic anomaly features, the text features, sensitive words, links and sensitive information requests in the SMS data are screened and the SMS semantic features are output.

[0031] Furthermore, the attention mechanism model is trained by the following steps:

[0032] Construct a graph-structured training dataset containing normal and suspicious text messages, using keywords in the text messages as nodes of the graph structure and semantic relationships between keywords as edges of the graph structure. Initial annotation of the nodes and edges is performed, including normal nodes, abnormal nodes, normal edges, and abnormal edges.

[0033] Use graph convolutional networks to perform initial embedding encoding on the nodes and edges in the graph structure to obtain node feature matrices and edge feature matrices;

[0034] Perform linear mapping on the node feature matrix and the edge feature matrix to generate query, key, and value feature matrices respectively. Then, calculate the attention weight between each node and its adjacent nodes or edges through the multi-head self-attention mechanism, and output the attention weight value of each node and edge.

[0035] The contribution of nodes and edges to the overall semantics of the graph structure is judged based on the attention weight value, and nodes and edges with attention weights higher than the preset threshold are identified as important nodes and key edges in the graph structure;

[0036] By comparing important nodes and key edges with the initially labeled abnormal nodes and edges, the loss function is calculated based on the difference between the predicted attention weight values and the actual annotations, and the model parameters are optimized through the backpropagation algorithm.

[0037] Furthermore, the weight value calculation formula of the multi-head self-attention mechanism is as follows:

[0038]

[0039] Among them, MultiHead is the attention weight value output; Q, K and V are the query, key and value feature matrices of nodes and edges respectively; and are the query weight matrix, key weight matrix, and value weight matrix of the i-th attention head respectively; W O is the fusion weight matrix output by the multi-head attention mechanism; d k is the dimension of the feature vector in each attention head; h is the number of attention heads; Concat is the concatenation operation of the feature vectors output by multiple attention heads.

[0040] Furthermore, the calculation of the SMS risk value includes the following steps:

[0041] Constructing SMS risk feature vectors based on SMS semantic features output by the semantic parsing module;

[0042] Using the sender's historical behavior, number reputation, and association relationship information, the behavior anomaly index, number reputation index, and association anomaly index are calculated respectively;

[0043] The SMS risk feature vector is weightedly fused with the behavior anomaly index, number reputation index and association anomaly index to calculate and output the SMS risk value.

[0044] Furthermore, intercepting suspicious text messages according to the interception index includes:

[0045] The preset interception threshold is compared with the interception index. If the interception index is greater than or equal to the interception threshold, the text message is intercepted; if the interception index is less than the interception threshold, it is determined to be a normal text message.

[0046] The beneficial effects of the present invention are as follows: the present invention first extracts multi-level semantic features of SMS content by constructing a hybrid deep learning architecture of convolutional neural networks (CNNs) and recurrent neural networks (RNNs). Through the performance advantages of convolutional neural networks in local text feature recognition and the ability of recurrent neural networks to capture serialized contextual information, a refined analysis of SMS text semantic information is achieved, which can effectively identify disguised keyword variants, homophonic replacements and interference symbols, thereby solving the problem that traditional keyword matching methods are easily bypassed. Further, based on a multi-head self-attention mechanism, an accurate SMS semantic feature network is constructed with sensitive words and key semantic units in SMS as graph nodes and semantic association relationships as graph edges. The multi-head self-attention mechanism is used to perform feature weighted calculations on graph nodes and edges, effectively quantifying and identifying abnormal nodes and abnormal relationships that have significant contributions to the overall semantic structure of SMS, thereby significantly improving the recognition accuracy of abnormal SMS semantic features. In response to the defects of the existing technology that ignores the historical behavior patterns of numbers, the credibility of numbers, and the association relationship information between numbers, this solution constructs a multi-dimensional SMS risk assessment mechanism. Through historical sending behavior and calculating the associated anomaly index based on the social relationship network of the number, the semantic risk characteristics of the SMS are adaptively weighted and fused with the above-mentioned number risk index, ultimately forming an accurate SMS risk value, which comprehensively improves the reliability and robustness of the risk assessment. Furthermore, this solution also uses a hierarchical SMS review strategy. For SMS messages that are pre-determined to be normal by the classification judgment module, the pass operation is directly executed; only for SMS messages that are determined to be suspicious by the classification module, the semantic analysis is further carried out and the interception index is further comprehensively determined in combination with the previous suspicious value. This hierarchical processing strategy effectively avoids the computational pressure and review delay caused by additional semantic analysis of normal SMS messages, significantly improves the system processing efficiency, and ensures the accurate identification and interception of suspicious SMS messages, combining efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a structural diagram of an artificial intelligence-based SMS review and interception system in the present invention.

[0048] Figure 2This is a flow chart of the steps for constructing the hybrid architecture of convolutional neural networks and recurrent neural networks in the present invention. DETAILED DESCRIPTION

[0049] See also Figure 1-Figure 2 As shown, the present invention relates to an artificial intelligence-based SMS review and interception system, comprising: an SMS data acquisition module, a classification and judgment module, a semantic analysis module, a detection and judgment module, and an interception module;

[0050] The SMS data acquisition module is used to receive SMS and related meta-information and perform pre-processing to obtain SMS data;

[0051] The classification judgment module is used to calculate the suspicious value of the SMS data based on a hybrid architecture of a pre-trained convolutional neural network and a recurrent neural network, classify the SMS data according to the suspicious value, and obtain SMS classification results, wherein the SMS classification results include suspicious SMS and normal SMS;

[0052] The semantic analysis module is used to perform natural language processing on SMS data classified as suspicious SMS, extract text features, sensitive words, suspicious links, and semantic features of sensitive information requests, and calculate the SMS risk value based on the semantic features, combined with the sender's historical behavior, number reputation, and association relationship information;

[0053] The interception module is used to perform weighting based on the suspicious value and the SMS risk value, calculate an interception index based on the weighting, and intercept the suspicious SMS based on the interception index; the interception module is also used to execute passage for the normal SMS.

[0054] Specifically, the SMS data acquisition module interacts with the operator's SMS gateway interface to receive the original SMS content and related meta-information from the user terminal, including the sender's phone number, sending timestamp, sending frequency, and geographic location. After obtaining the original SMS, the data acquisition module first performs text preprocessing, specifically removing special symbols and meaningless characters in the SMS content, then uses language processing tools to segment the SMS content into Chinese words, and performs text standardization operations on the segmentation results to form a vectorized input form of SMS data suitable for model processing. The classification judgment module performs preliminary classification of SMS data based on a pre-trained deep neural network model. This embodiment uses a hybrid network architecture that combines a convolutional neural network (CNN) with a recurrent neural network (RNN). The CNN extracts local semantic features from text messages. Specifically, the CNN scans the message vector matrix using multiple convolution kernels, capturing the local semantic structure of keywords and compressing the features using a pooling layer. The compressed features are then fed into a recurrent neural network (RNN). The RNN, based on long short-term memory (LSTM), captures the long-term semantic dependencies between words in the text. Finally, a fully connected layer performs feature dimensionality reduction and outputs the suspicious value corresponding to the text message data. Furthermore, a threshold for the suspicious value is set to perform a preliminary classification of the text messages: if the suspicious value exceeds the set threshold, the message is considered suspicious; otherwise, it is considered normal. For text messages initially classified as suspicious, the semantic parsing module further performs refined natural language processing to further explore potential risks within the text messages. Specifically, this module first creates a semantic graph of the text message content, using sensitive words and key phrases in the text message as graph nodes and semantic associations as graph edges to form a text message semantic relationship network. The multi-head self-attention mechanism model is further used to calculate the semantic importance of each node and edge in the graph. Specifically, the importance of nodes and edges is determined by calculating the attention weights of the query, key, and value matrices to accurately identify anomalous nodes and relationships in the graph. Subsequently, by calculating the node and edge anomaly degrees, a set of semantic anomaly features, such as text features, sensitive words, suspicious links, and sensitive information requests, is extracted. Simultaneously, the module combines the sender's historical SMS sending history, sending frequency, and anomalous behavior characteristics to calculate a behavioral anomaly index. Furthermore, the module calculates the reputation index of the sending number and the association anomaly index between numbers using a number reputation database and a social relationship graph.Finally, the multi-dimensional risk features are weighted and fused. Using the Gradient Boosting Decision Tree (GBDT) model, the fused risk feature vector undergoes nonlinear fitting and adaptive weight optimization to calculate the final SMS risk value. The detection and judgment module is responsible for combining the SMS risk value with the suspicious value output by the classification and judgment module to calculate the interception index. Specifically, a linear weighting approach is used to assign different weights to the SMS risk value and the suspicious value. The weight coefficients are set based on optimization results from actual system operation to calculate the SMS interception index. The SMS interception index is then compared with the SMS interception index based on a preset interception threshold in the operational environment. If the interception index exceeds the preset interception threshold, the system classifies the message as high-risk; otherwise, it is classified as low-risk or normal. Finally, the interception module performs specific processing based on the interception judgment results. Specifically, for high-risk messages, the system automatically intercepts the message content and records the interception record in real time to the backend database, simultaneously updating the number's reputation record. For low-risk or normal messages, the interception module allows the message to pass directly, ensuring real-time and convenient communication for users.

[0055] In a specific embodiment, the original SMS is received, key information is extracted and pre-processed, for example: "[XX Bank] Your credit card was used to make a 5,000 yuan purchase in a different location. If the operation was not made by you, please log in to http: / / xx-xxxxx immediately to freeze your account! Customer service phone number: xxx-xxx", text cleaning: removing redundant spaces and line breaks, unifying upper and lower case, and structuring the data to become: "text":"[XX Bank] Your credit card was used to make a 5,000 yuan purchase in a different location","link":"http: / / xx-bank-fake.com / verify","phone":"400-123-4567","sender":"106900XX","timestamp":"2023-05-2015:30:00". The CNN+RNN model is used to calculate the suspicious value of SMS messages and classify them as "suspicious" or "normal": CNN (keyword detection) detects sensitive words such as "credit card," "spend 5,000 yuan," and "freeze account." RNN (semantic analysis) identifies the threatening tone of "If this is not the operation by me, please log in immediately," and ultimately outputs a quantified suspicious value.

[0056] Suspicious text messages are analyzed through deep NLP analysis to calculate a risk score. Keyword matching: "credit card," "consumption," and "frozen account" are interpreted as semantics related to financial fraud. Link analysis: The domain name xx-xxxx.com is not on the official whitelist. Blacklist comparison: This link has recently been flagged as a phishing website. A quantitative risk score is output. The suspicion score and risk score are then combined to calculate an interception index, enabling fraudulent text messages to be intercepted.

[0057] This system uses intelligent technology to accurately identify and intercept fraudulent, phishing, and harassing text messages. The system adopts a modular design, encompassing five core modules: data acquisition, classification, semantic analysis, detection, and interception, forming a complete SMS review loop.

[0058] First, the original text messages undergo standardized preprocessing to extract key information. A CNN+RNN hybrid model then performs preliminary classification to quickly identify suspicious content. For suspicious text messages, the system further employs NLP technology for in-depth semantic analysis, combining it with a blacklist database and sender reputation assessment to comprehensively assess the risk. Ultimately, a dynamic weighting algorithm makes interception decisions, ensuring the smooth flow of legitimate text messages. Multi-model fusion technology significantly reduces the false positive rate, and the processing time for a single text message is kept to milliseconds.

[0059] This system effectively prevents common fraud schemes such as bank impersonation and fraudulent orders, providing users with secure and reliable communications. Through intelligent audit mechanisms, the system ensures security while minimizing disruption to users' normal communications, achieving a perfect balance between security and user experience.

[0060] Furthermore, the receiving of the short message and related meta information and pre-processing thereof includes the following steps:

[0061] Receive original SMS content from SMS gateway;

[0062] Collect SMS sender information, including phone number, sending time, sending frequency, and sending geographic location information;

[0063] The original SMS content and SMS sender information are preprocessed, including removing special characters, word segmentation and text normalization, to generate SMS data.

[0064] Specifically, in this embodiment, the SMS data acquisition module first establishes a data interaction interface with the operator's SMS gateway. It then receives the original SMS content sent by the user terminal from the SMS gateway in real time via a standard communication protocol. It also collects metadata related to the SMS sender, including the sender's mobile phone number, SMS sending timestamp, historical sending frequency, and geographic location information at the time of sending. The SMS sending frequency can be obtained by statistically analyzing the number of SMS messages sent from the same sending number within a specified time window, while the sending geographic location information can be accurately acquired and recorded based on the operator's base station positioning technology or Global Positioning System (GPS) technology. After successfully receiving the original SMS content and the corresponding metadata, the SMS data acquisition module further performs a rigorous data preprocessing process. First, the original SMS content undergoes a data cleaning process, removing special symbols, emoticons, meaningless characters, and other interfering symbols from the SMS text to prevent noise from interfering with subsequent semantic analysis and feature extraction. In specific implementations, regular expressions can be used for text filtering or a pre-set database of special symbols for precise removal. Subsequently, the SMS data acquisition module performs Chinese word segmentation processing on the cleaned SMS text, and uses the current mainstream and highly accurate natural language processing tools (Jieba word segmentation or Harbin Institute of Technology Language Cloud) to accurately segment the SMS text to convert the SMS content into a semantically clear and structurally standardized vocabulary sequence. In addition, the text after word segmentation needs to be standardized, including synonym merging, word form normalization and abnormal phrase correction, to ensure the standardization and consistency of the SMS data, and to facilitate the feature extraction and processing of the subsequent deep learning model. While completing the above-mentioned text preprocessing of the SMS content, this embodiment also performs structured processing on the SMS sender information, including uniformly formatting the sender's phone number, performing time standardization conversion on the sending timestamp, normalizing the sending frequency data, and uniformly converting the coordinates of the sending geographic location information, and converting the location coordinates into specific city or regional labels based on geocoding technology to form a structured sender meta-information feature vector, so that it can be effectively included in the scope of historical behavior pattern analysis and number reputation evaluation during subsequent risk assessment.

[0065] Furthermore, the hybrid architecture of the convolutional neural network and the recurrent neural network is constructed by the following steps:

[0066] Convert the SMS data into word vector representations using a word embedding model to generate a vectorized matrix of the SMS data;

[0067] Using a convolutional neural network to extract local text features from the vectorized matrix of the SMS data to obtain a semantic space feature map of the SMS;

[0068] Inputting the semantic space feature map into a recurrent neural network to capture the contextual semantic relationship between words in the text of the SMS and form a SMS feature sequence;

[0069] The SMS feature sequence is subjected to dimensionality reduction processing through a fully connected layer, and a suspicious value is output.

[0070] In some embodiments, after preprocessing, the SMS data first enters the word embedding layer for vectorization processing. Specifically, a pre-trained word embedding model (such as Word2Vec, GloVe or FastText) is used to map the word segmentation sequence in each SMS content to the corresponding real word vector representation in the high-dimensional space. Each SMS content is represented as a vectorized matrix of dimension n×d, where n is the number of words contained in the SMS, and d is the word vector dimension preset by the word embedding model, with a value ranging from 100 to 300. After completing the vectorization of the SMS data, this embodiment further uses a convolutional neural network to extract and process local text features of the SMS data vector matrix. The convolutional neural network is composed of multiple parallel convolution filters, each of which uses convolution kernels of different sizes (for example, sizes of 2, 3, and 4, respectively) to scan the word vector matrix in a sliding window manner, gradually capturing local semantic information of different scales in the SMS content. The convolution operation process specifically involves each convolution kernel performing a matrix convolution operation on each local text segment, completing feature mapping through a nonlinear activation function (such as the ReLU function). Furthermore, a max-pooling operation is performed to compress the text feature dimensions, outputting a robust and significant SMS semantic space feature map matrix. The resulting semantic space feature map matrix is then used as the input for a recurrent neural network (RNN) model. This embodiment uses a long short-term memory (LSTM) network as the specific implementation architecture. The LSTM network has a special gating mechanism, including a forget gate, an input gate, and an output gate, which effectively solves the vanishing gradient problem of traditional RNNs. The specific process is as follows: the SMS semantic space feature matrix sequentially enters the LSTM unit. The LSTM unit uses the gating mechanism to combine the current input with the historical state, automatically determining whether to retain or forget the long-term dependency information of the preceding words, thereby accurately capturing the contextual semantic relationships between words in the SMS text and ultimately outputting a stable SMS feature sequence vector. Finally, this SMS feature sequence vector is input into a fully connected layer for dimensionality reduction to integrate and refine the global semantic features of the SMS content. In practice, the fully connected layer compresses the input SMS feature sequence using a linear combination method. It then maps the features to a scalar space using an activation function and a linear regression model. The resulting output is a numerical value representing the suspiciousness of the message, known as the SMS Suspicion Value. The SMS Suspicion Value ranges from 0 to 1. Values closer to 1 indicate a more suspicious message, while values lower than 1 indicate a more likely suspicious message. This provides a clear and reliable basis for initial SMS classification.

[0071] It's worth emphasizing that CNNs are responsible for learning latent semantic fragments from local word combinations, while RNNs further understand the relationships between fragments within a global semantic structure. This combination of the two allows the model to accurately capture micro-risk signals and understand the flow of context at a macro level when faced with fraudulent text messages with complex structures or varied language expressions. This improves the model's robustness and semantic parsing accuracy in noisy text message environments, significantly outperforming traditional single neural network model architectures. Through this deep fusion mechanism, the system achieves a broader and deeper recognition capability for high-risk text messages, providing a solid foundational semantic support for subsequent risk assessment and interception strategies.

[0072] Furthermore, the convolutional neural network is trained by the following steps:

[0073] Perform word segmentation and text normalization on the training samples marked as normal text messages and suspicious text messages to obtain the training data set;

[0074] The training dataset is converted into a vectorized matrix using a word embedding model and input into a convolutional neural network. Local features are extracted through convolutional layers and pooling layers to form a semantic space feature map.

[0075] The loss function is used to calculate the error between the SMS classification probability value output by the network and the actual classification label, and the back propagation algorithm is used to update the network weight parameters based on the error value until the error value converges to the preset threshold.

[0076] Specifically, a large amount of SMS data is first collected and labeled as training samples. The labeling process adopts a combination of manual and automated auxiliary labeling, where the labeling labels are divided into two categories: normal SMS and suspicious SMS. After the labeling is completed, all training samples are uniformly segmented and text normalized using natural language processing tools, specifically including removing interference characters, symbol normalization, synonym merging and word form unification, to obtain a structured and standardized training data set. Furthermore, this embodiment uses a pre-trained word embedding model (such as Word2Vec, GloVe or FastText) to map each word in the above structured training data set to a high-dimensional real space to form a word vector representation. Specifically, each SMS is converted into a vectorized matrix with a dimension of n×d, where n represents the number of words in the SMS and d represents the word vector dimension. The vectorized matrix serves as the input for training the convolutional neural network (CNN). Subsequently, the input SMS vectorized matrix is sent to the convolution layer for local semantic feature extraction. Multiple convolution kernels are used in the convolution layer, each of which slides and scans the word vector matrix with a fixed window length, and extracts local features of different granularities through the convolution operation. Each convolution kernel generates a feature map through a nonlinear activation function (such as the ReLU function), and then passes through the pooling layer and uses the Max-Pooling method to compress the feature dimension, reduce the sensitivity of the feature matrix to local word order changes, and enhance the generalization performance of the model. Finally, the convolution layer and the pooling layer jointly generate the semantic space feature map matrix of the text message. During the network training phase, the feature map matrix is input into the fully connected layer, which compresses the high-dimensional semantic space feature map to the two-dimensional probability output layer through linear transformation, and outputs the classification probability value of the text message as a suspicious text message or a normal text message. The loss function is further defined as a cross-entropy loss function, which calculates the error value between the classification probability value output by the network and the true label of the training sample. Based on the calculated error value, this embodiment uses the stochastic gradient descent algorithm (SGD) or other optimization algorithms (such as Adam) to update the network parameters. Specifically, the error backpropagation algorithm is used to return the loss gradient layer by layer, and the gradient value of each network parameter is solved by the chain rule, thereby dynamically adjusting the weight coefficients and bias terms of each convolution kernel and fully connected layer in the network. The above training process is iterated until the error value converges to the pre-set threshold range, indicating that the convolutional neural network is fully trained and the network has strong generalization ability and classification accuracy, thus completing the training process of the SMS classification model.

[0077] Furthermore, the hidden state vector calculation formula of the recurrent neural network is as follows:

[0078]

[0079] Among them, h tis the hidden state vector output at time t; x t is the SMS feature vector input; c t-1 is the state of the memory unit at time t-1; W xc is the input SMS feature vector x t to the weight matrix of the candidate memory state; W hc is the hidden state vector h at the previous moment t-1 to the weight matrix of the candidate memory state; b c is the bias vector; i t 、f t and o t They are the control vectors for the input gate, forget gate, and output gate respectively; is element-wise multiplication.

[0080] It should be noted that, specifically, at any moment, the calculation of the hidden state vector first combines the current SMS feature vector input and the previous hidden state vector through a linear transformation to obtain a candidate memory state. The candidate memory state undergoes a nonlinear mapping using a hyperbolic tangent activation function to ensure that the state value ranges between [-1, 1], enhancing model training stability. Subsequently, the network utilizes a gating mechanism consisting of input, forget, and output gates to regulate the candidate memory state and the previous memory cell state. The input gate determines which new semantic information is added to the memory cell based on the current input features; the forget gate determines which existing semantic information is discarded or retained based on the historical hidden state, thereby dynamically updating the memory cell state. The output gate is responsible for filtering the updated memory cell state and determining which semantic information is transferred to the current hidden state vector. Finally, the network remaps the memory cell state, regulated by the input and forget gates, through a hyperbolic tangent function and performs element-wise multiplication with the output gate's control vector to form the current hidden state vector. Through gated collaboration and nonlinear computational processes, the model can effectively control and retain the flow and expression of specific semantic features in SMS text in long-term semantic relationships, significantly improving the accuracy and stability of SMS classification and risk assessment tasks. This avoids the problem of gradient vanishing or exploding in traditional recurrent neural network training, ensuring the reliability and efficiency of model training.

[0081] Furthermore, the natural language processing of the SMS data classified as suspicious SMS includes the following steps:

[0082] Perform semantic graph mapping on SMS data, converting SMS text into a graph structure with keywords as nodes and semantic relationships as edges;

[0083] Based on the pre-trained multi-head self-attention mechanism model, feature weighting is performed on the nodes and edges of the graph structure to calculate the semantic importance of each node and edge in the graph structure;

[0084] Identify possible semantically abnormal nodes or edges based on the semantic importance of nodes and edges, and obtain the semantically abnormal feature set of SMS data by calculating the node abnormality degree and edge abnormality degree;

[0085] Based on the set of semantic anomaly features, the text features, sensitive words, links and sensitive information requests in the SMS data are screened and the SMS semantic features are output.

[0086] Specifically, the SMS text is first decomposed into semantic units at the word level, with the keywords or sensitive words in the SMS content as the core nodes, and the corresponding semantic edges are constructed according to the semantic correlation between the keywords to form a semantic graph with a clear structure. In the specific operation, the dependency syntax analysis algorithm and the semantic association model (such as the word vector similarity algorithm) are used to calculate the association weights between the nodes, thereby obtaining a weighted semantic relationship network graph structure, which provides a structured basis for the subsequent abnormal semantic feature recognition. After constructing the semantic graph, this embodiment further uses a pre-trained multi-head self-attention mechanism model to perform refined feature weighting processing on the nodes and edges in the semantic graph. Specifically, the multi-head self-attention mechanism first linearly maps node and edge features to obtain three matrix representations: query, key, and value. Then, in multiple parallel attention calculation modules (i.e., attention heads), independent attention weights are calculated for the semantic feature correlations between each node and its adjacent nodes or edges, and a normalized weight score for each node and edge is obtained using the Softmax function. Finally, the calculation results of multiple attention heads are concatenated and linearly integrated to output the final semantic importance scores of the nodes and edges in the semantic graph structure. Subsequently, anomalies are identified based on the semantic importance scores of these nodes and edges. By performing a statistical distribution analysis on the node and edge weights and employing Z-score normalization or setting dynamic thresholds, nodes and edges whose semantic importance is significantly above or below the normal threshold range are clearly identified and marked as semantically abnormal nodes or edges. Furthermore, by jointly quantifying the node and edge abnormality degrees, a set of abnormal semantic features of SMS data can be obtained. The calculation method of node abnormality is usually based on the gap between the semantic weight value of the node and the statistical benchmark of the weight of similar nodes in normal samples, and the calculation of edge abnormality is determined based on the degree of deviation of the semantic connection weight between nodes. Finally, based on the set of semantic abnormality features obtained above, the specific text features, sensitive words, suspicious links and sensitive information requests in the SMS data are screened and weighted. In the specific implementation, the words and phrases corresponding to abnormal nodes and abnormal edges will be marked, and the risk level of sensitive words and links will be quantitatively evaluated through a rule engine or statistical model; at the same time, targeted analysis will be conducted in combination with the type of sensitive information request to form a unified SMS semantic feature vector. The above SMS semantic feature vector, which has undergone deep algorithm optimization and refined processing, will effectively support the subsequent risk assessment and interception judgment decision of SMS, and improve the accuracy and robustness of the overall system for abnormal SMS identification and risk control.

[0087] It should be noted that during the above process, the system parses suspicious text messages into a semantic graph structure. This semantic graph uses keywords, entity nouns, sensitive terms, and other items in the text message as graph nodes, and models the semantic, logical, or behavioral relationships between them as edges within the graph structure, such as the semantic paths formed by "account-anomaly" and "click-link." This graph representation not only preserves the explicit structural relationships between terms but also expresses semantic contextual dependencies, enabling the system to form a quantifiable structural model of the complex semantic clues in fraudulent text messages. This approach significantly differs from traditional natural language processing models that rely solely on sequence processing. Its advantage lies in its ability to represent nonlinear semantic structures and complex relationships between multiple nodes. Unlike existing techniques that use only a single attention path or fixed weights to assess node importance, the multi-head attention mechanism allows the model to analyze the semantic relevance between a node and adjacent nodes or edges in parallel across multiple subspaces, improving its ability to perceive heterogeneous semantic information. Each attention head can focus on a specific type of semantic relationship. For example, some attention heads may focus on behavioral instruction words (such as "input" and "submit"), while others may focus on logical dependencies between target objects (such as "account" and "verification code"). Based on the node and edge weights allocated by multi-head attention, the system further introduces the concepts of "node anomaly" and "edge anomaly." This component quantifies metrics such as the degree of attention activation, contextual outlier status, and activation frequency in high-risk training samples for nodes or edges in the graph. This component identifies "semantically anomaly nodes" and "semantically anomaly edges" that pose potential threats to the overall semantics of the text message, forming a "semantically anomaly feature set" for the text message. This set is further used to perform secondary screening for sensitive words, potentially misleading links, and identity verification requests within the text message. The system then reconstructs semantic weights based on the degree of anomaly, ultimately outputting text message semantic features with high semantic sensitivity.

[0088] Furthermore, the attention mechanism model is trained by the following steps:

[0089] Construct a graph-structured training dataset containing normal and suspicious text messages, using keywords in the text messages as nodes of the graph structure and semantic relationships between keywords as edges of the graph structure. Initial annotation of the nodes and edges is performed, including normal nodes, abnormal nodes, normal edges, and abnormal edges.

[0090] Use graph convolutional networks to perform initial embedding encoding on the nodes and edges in the graph structure to obtain node feature matrices and edge feature matrices;

[0091] Perform linear mapping on the node feature matrix and the edge feature matrix to generate query, key, and value feature matrices respectively. Then, calculate the attention weight between each node and its adjacent nodes or edges through the multi-head self-attention mechanism, and output the attention weight value of each node and edge.

[0092] The contribution of nodes and edges to the overall semantics of the graph structure is judged based on the attention weight value, and nodes and edges with attention weights higher than the preset threshold are identified as important nodes and key edges in the graph structure;

[0093] By comparing important nodes and key edges with the initially labeled abnormal nodes and edges, the loss function is calculated based on the difference between the predicted attention weight values and the actual annotations, and the model parameters are optimized through the backpropagation algorithm.

[0094] Specifically, a semantic graph training dataset is first constructed, consisting of a sufficient and balanced number of normal and suspicious SMS samples. During implementation, the SMS texts are subjected to keyword extraction using natural language processing tools. Each keyword is treated as an independent node in the graph structure, and the semantic relationships between keywords serve as connecting edges in the graph. To ensure the effectiveness of supervised learning, this embodiment performs initial labeling on each node and edge in the graph structure. This labeling is based on the SMS risk signature library and the abnormal keyword library in the historical sample library. This results in clearly labeled normal nodes, abnormal nodes, normal edges, and abnormal edge labels in the training set, providing supervisory signals for subsequent training. After constructing the graph dataset, the model then uses a graph convolutional network (GCN) for initial embedding encoding. The GCN aggregates information about nodes and their neighbors using the graph structure's adjacency matrix and the initial feature matrices of nodes and edges in a convolutional manner, resulting in node and edge feature matrices in the embedding space. This process effectively captures the graph structure's topological information and local semantic features, forming a tightly structured and semantically rich graph structure feature representation. Subsequently, this embodiment uses a linear mapping method to map the node feature matrix and edge feature matrix obtained by the graph convolutional network to three independent feature spaces, representing the query, key and value matrices respectively, for use in the subsequent attention mechanism calculation process. The mapping process is usually implemented by a learnable linear transformation matrix to ensure the flexibility and adaptability of model training. Next, the multi-head self-attention mechanism is used to calculate the attention weights of the query, key and value feature matrices. Specifically, the multi-head self-attention mechanism runs multiple independent attention calculation modules at the same time. Each module independently calculates and evaluates the weight of the semantic feature correlation between the node and its adjacent nodes or edges. During the calculation process, the final attention weight value of the node and edge is obtained by scaling the dot product and normalizing the Softmax function, thereby outputting the contribution of each node and edge to the overall semantics of the graph structure. Based on the obtained attention weight value, this embodiment sets a predetermined attention weight threshold. Nodes and edges with weight values exceeding this threshold will be regarded as important nodes and key edges in the graph structure to mark their importance to the overall semantics of the graph. These identified important nodes and key edges are then compared with the initial manually or semi-automatically annotated abnormal nodes and edges to quantify the difference between the model's predictions and the actual annotations. Finally, a loss function (such as cross-entropy loss or mean squared error loss) is defined to measure the degree of deviation between the model's predicted attention weights and the true annotation labels. Based on the results of this loss function, a gradient backpropagation algorithm is used to adjust and optimize the parameters of the attention mechanism model layer by layer. The training process continues with iterative optimization until the loss function converges to a predetermined threshold range, completing the training process of the multi-head attention mechanism model.Through the rigorous and in-depth algorithm process described above, this embodiment ensures the model's ability to accurately identify abnormal semantic features of text messages and has strong generalization performance.

[0095] Furthermore, the weight value calculation formula of the multi-head self-attention mechanism is as follows:

[0096]

[0097] Among them, MultiHead is the attention weight value output; Q, K and V are the query, key and value feature matrices of nodes and edges respectively; and are the query weight matrix, key weight matrix, and value weight matrix of the i-th attention head respectively; W O is the fusion weight matrix output by the multi-head attention mechanism; d k is the dimension of the feature vector in each attention head; h is the number of attention heads; Concat is the concatenation operation of the feature vectors output by multiple attention heads.

[0098] It should be noted that the multi-head self-attention mechanism is used to fine-tune the semantic relationships between nodes and edges in the SMS semantic graph. Its core concept is to use multiple attention heads to concurrently compute the semantic relevance between nodes (or edges) in the graph, extracting multi-dimensional contextual information from different representation subspaces to enhance the model's ability to identify potentially risky semantic structures. Specifically, the system first maps the embedded features of each node or edge in the graph into three independent representations: a query vector, a key vector, and a value vector. This process is accomplished using a set of learnable linear transformation matrices. The purpose of this process is to project the original node or edge features into different semantic subspaces, enabling subsequent attention calculations to be performed from different semantic perspectives. In each attention head, a similarity score is calculated between the query vector and the key vector using a dot product. This score represents the degree of attention the current node has given to its neighboring nodes. To avoid instability caused by large values in high-dimensional spaces, the dot product result is divided by a scaling factor (i.e., the square root of the vector dimension) and then normalized using a Softmax function to produce a set of standardized attention weights. These weights represent the contribution of each neighboring node (or edge) to the semantic representation of the current node. Next, the attention weight will be applied to the corresponding value vector, and the semantic information of adjacent nodes will be aggregated through weighted summation to form a context-enhanced representation of the current node under the attention head. Since an attention head can only model node relationships from a semantic perspective, in order to enhance the expressive power of the model, this embodiment uses multiple attention heads for parallel calculation. Each attention head has independent parameters and mapping directions, which can capture different types of semantic dependency structures in the SMS semantic graph. The feature vectors output by all attention heads will then be spliced together to output the attention weight values, which will be compressed or transformed through a final linear mapping layer to adapt to the input requirements of subsequent modules. In this way, the model not only retains various local semantic relationships, but also effectively identifies keywords and association paths with significant semantic importance in the SMS semantic graph through a global structural weight distribution mechanism. Overall, the multi-head self-attention mechanism realizes the automatic capture of high-risk semantic fragments in SMS through the fusion of learnable feature mapping and multi-angle attention, significantly enhancing the system's perception of complex, deformed, and potentially fraudulent SMS messages, and providing strong semantic feature support for subsequent SMS risk modeling and interception strategies.

[0099] Furthermore, the calculation of the SMS risk value includes the following steps:

[0100] Constructing SMS risk feature vectors based on SMS semantic features output by the semantic parsing module;

[0101] Using the sender's historical behavior, number reputation, and association relationship information, the behavior anomaly index, number reputation index, and association anomaly index are calculated respectively;

[0102] The SMS risk feature vector is weightedly fused with the behavior anomaly index, number reputation index and association anomaly index to calculate and output the SMS risk value.

[0103] In some embodiments, the calculation of SMS risk value is based on a multi-dimensional feature fusion mechanism, which aims to achieve a comprehensive assessment and quantification of the potential risks of SMS. First, the system constructs an SMS risk feature vector representing the potential risks of SMS content based on the SMS semantic features output by the semantic parsing module. This vector is composed of multi-dimensional features, covering dimensions such as sensitive word density, number of suspicious links, number of abnormal semantic nodes, frequency of sensitive information requests, and semantic anomaly intensity score. Each dimension of features is standardized to make it comparable and meet the requirements of subsequent weighted operations. On the basis of constructing the SMS semantic risk representation, the system further introduces historical portrait modeling of the sender's behavior dimension, and calculates the independent indexes of the following three dimensions: behavioral anomaly index, number credibility index, and association anomaly index. The behavioral anomaly index is modeled based on behavioral trajectory characteristics such as sudden changes in sending frequency, SMS content change patterns, and historical interception records. It uses anomaly detection models (such as isolation forests or Z-score-based statistical methods) to identify whether sending behavior deviates from the normal user group. The number reputation index is comprehensively evaluated by integrating static data such as historical reporting frequency, blacklist hit rate, and telecommunications operator ratings with dynamically updated indicators. The association anomaly index is based on the interactive relationship network model between numbers. It uses graph structure analysis methods to identify whether the sender is in a high-risk transmission network, such as whether there is frequent communication with multiple numbers identified as fraudulent or transmission paths with similar content. These three risk indices, together with the semantic risk feature vector of the SMS body, constitute a multidimensional risk assessment input. During the fusion stage, the system uses a learnable weighting mechanism to combine the various dimensions, where each risk index and semantic feature dimension is assigned a different weight coefficient. The weight can be learned from historical verification data or set using a heuristic strategy based on expert experience. The fused risk value is not only highly interpretable but also enhances the model's ability to identify highly disguised, infrequently sent, or text messages with hidden social structures. This results in a comprehensive risk identification capability that integrates content semantics with behavioral graphs. This technology's key advantages over existing SMS interception methods include its independence from static rules, its ability to dynamically adapt to evolving attack patterns, its end-to-end risk learning capabilities, and its ability to capture potential threat paths that are difficult for traditional models to capture. This fundamentally improves the accuracy, timeliness, and robustness of the interception system.

[0104] Furthermore, intercepting suspicious text messages according to the interception index includes:

[0105] The preset interception threshold is compared with the interception index. If the interception index is greater than or equal to the interception threshold, the text message is intercepted; if the interception index is less than the interception threshold, it is determined to be a normal text message.

[0106] It should be noted that the execution of SMS interception policies relies on a system-calculated "interception index." This index comprehensively reflects the content risk and sender behavior risk of an SMS message. It is a quantitative indicator output by the system based on the fusion of multi-dimensional features. The interception module compares this interception index with a preset interception threshold to automatically determine whether to intercept an SMS message. After semantic analysis and risk calculation, the system weights and combines the SMS suspicion score output by the classification and judgment module with the SMS risk score output by the semantic analysis module to generate a final interception index. A higher interception index indicates a greater degree of suspicion and potential harm. The system employs a set of adjustable interception thresholds to distinguish between SMS messages that require interception and those that are permitted. During operation, the interception module compares the interception index of each SMS message to the threshold. If the interception index is greater than or equal to the preset threshold, an interception action is immediately triggered, preventing the message from being delivered to the user's terminal. The relevant information may be recorded for subsequent model optimization or regulatory review. If the interception index is less than the interception threshold, the message is deemed normal and allowed to pass normally to the user. The judgment mechanism based on the interception index described in this embodiment has good scalability and robustness, can adapt to the complex and changeable characteristics of fraudulent text messages, effectively realize the precise interception of high-risk text messages, and avoid misjudgment interference with normal text messages.

[0107] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, C language, VHDL language, Verilog language, object-oriented programming language Java, and directly interpreted scripting language JavaScript, etc.

[0108] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0109] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0111] The above embodiments are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary engineering technicians in this field should fall within the scope of protection determined by the claims of the present invention.

Claims

1. An artificial intelligence-based SMS review and interception system, characterized in that: include: SMS data acquisition module, classification and judgment module, semantic analysis module, detection and judgment module and interception module; The SMS data acquisition module is used to receive SMS and related meta-information and perform pre-processing to obtain SMS data; The classification judgment module is used to calculate the suspicious value of the SMS data based on a hybrid architecture of a pre-trained convolutional neural network and a recurrent neural network, classify the SMS data according to the suspicious value, and obtain SMS classification results, wherein the SMS classification results include suspicious SMS and normal SMS; The semantic analysis module is used to perform natural language processing on SMS data classified as suspicious SMS, extract text features, sensitive words, suspicious links, and semantic features of sensitive information requests, and calculate the SMS risk value based on the semantic features, combined with the sender's historical behavior, number reputation, and association relationship information; The interception module is used to perform weighting based on the suspicious value and the SMS risk value, calculate an interception index according to the weighting, and intercept the suspicious SMS according to the interception index; The interception module is also used to execute the pass for the normal text message.

2. The artificial intelligence-based SMS review and interception system according to claim 1 is characterized in that: The receiving of the short message and related meta information and pre-processing thereof comprises the following steps: Receive original SMS content from SMS gateway; Collect SMS sender information, including phone number, sending time, sending frequency, and sending geographic location information; The original SMS content and SMS sender information are preprocessed, including removing special characters, word segmentation and text normalization, to generate SMS data.

3. The artificial intelligence-based SMS review and interception system according to claim 2 is characterized in that: The hybrid architecture of convolutional neural network and recurrent neural network is constructed by the following steps: Convert the SMS data into word vector representations using a word embedding model to generate a vectorized matrix of the SMS data; Using a convolutional neural network to extract local text features from the vectorized matrix of the SMS data to obtain a semantic space feature map of the SMS; Inputting the semantic space feature map into a recurrent neural network to capture the contextual semantic relationship between words in the text of the SMS and form a SMS feature sequence; The SMS feature sequence is subjected to dimensionality reduction processing through a fully connected layer, and a suspicious value is output.

4. The artificial intelligence-based SMS review and interception system according to claim 3 is characterized in that: The convolutional neural network is trained by the following steps: Perform word segmentation and text normalization on the training samples marked as normal text messages and suspicious text messages to obtain the training data set; The training dataset is converted into a vectorized matrix using a word embedding model and input into a convolutional neural network. Local features are extracted through convolutional layers and pooling layers to form a semantic space feature map. The loss function is used to calculate the error between the SMS classification probability value output by the network and the actual classification label, and the back propagation algorithm is used to update the network weight parameters based on the error value until the error value converges to the preset threshold.

5. The artificial intelligence-based SMS review and interception system according to claim 4 is characterized in that: The hidden state vector calculation formula of the recurrent neural network is as follows: Among them, h t is the hidden state vector output at time t; x t is the SMS feature vector input; c t-1 is the state of the memory unit at time t-1; W xc is the input SMS feature vector x t to the weight matrix of the candidate memory state; W hc is the hidden state vector h at the previous moment t-1 to the weight matrix of the candidate memory state; b c is the bias vector; i t 、f t and o t are the control vectors of the input gate, forget gate and output gate respectively; ○ is element-level multiplication.

6. The artificial intelligence-based SMS review and interception system according to claim 1 is characterized in that: The natural language processing of the SMS data classified as suspicious SMS includes the following steps: Perform semantic graph mapping on SMS data, converting SMS text into a graph structure with keywords as nodes and semantic relationships as edges; Based on the pre-trained multi-head self-attention mechanism model, feature weighting is performed on the nodes and edges of the graph structure to calculate the semantic importance of each node and edge in the graph structure; Identify possible semantically abnormal nodes or edges based on the semantic importance of nodes and edges, and obtain the semantically abnormal feature set of SMS data by calculating the node abnormality degree and edge abnormality degree; Based on the set of semantic anomaly features, the text features, sensitive words, links and sensitive information requests in the SMS data are screened and the SMS semantic features are output.

7. The artificial intelligence-based SMS review and interception system according to claim 6 is characterized in that: The attention mechanism model is trained through the following steps: Construct a graph-structured training dataset containing normal and suspicious text messages, using keywords in the text messages as nodes of the graph structure and semantic relationships between keywords as edges of the graph structure. Initial annotation of the nodes and edges is performed, including normal nodes, abnormal nodes, normal edges, and abnormal edges. Use graph convolutional networks to perform initial embedding encoding on the nodes and edges in the graph structure to obtain node feature matrices and edge feature matrices; Perform linear mapping on the node feature matrix and the edge feature matrix to generate query, key, and value feature matrices respectively. Then, calculate the attention weight between each node and its adjacent nodes or edges through the multi-head self-attention mechanism, and output the attention weight value of each node and edge. The contribution of nodes and edges to the overall semantics of the graph structure is judged based on the attention weight value, and nodes and edges with attention weights higher than the preset threshold are identified as important nodes and key edges in the graph structure; By comparing important nodes and key edges with the initially labeled abnormal nodes and edges, the loss function is calculated based on the difference between the predicted attention weight values and the actual annotations, and the model parameters are optimized through the backpropagation algorithm.

8. The artificial intelligence-based SMS review and interception system according to claim 7, characterized in that: The weight calculation formula of the multi-head self-attention mechanism is as follows: Among them, MultiHead is the attention weight value output; Q, K and V are the query, key and value feature matrices of nodes and edges respectively; and are the query weight matrix, key weight matrix, and value weight matrix of the i-th attention head respectively; W O is the fusion weight matrix output by the multi-head attention mechanism; d k is the dimension of the feature vector in each attention head; h is the number of attention heads; Concat is the concatenation operation of the feature vectors output by multiple attention heads.

9. The artificial intelligence-based SMS review and interception system according to claim 1 is characterized in that: Calculating the SMS risk value includes the following steps: Constructing SMS risk feature vectors based on SMS semantic features output by the semantic parsing module; Using the sender's historical behavior, number reputation, and association relationship information, we calculate the behavior anomaly index, number reputation index, and association anomaly index respectively; The SMS risk feature vector is weightedly fused with the behavior anomaly index, number reputation index and association anomaly index to calculate and output the SMS risk value.

10. The artificial intelligence-based SMS review and interception system according to claim 1, characterized in that: The interception of suspicious text messages according to the interception index includes: The preset interception threshold is compared with the interception index. If the interception index is greater than or equal to the interception threshold, the text message is intercepted; if the interception index is less than the interception threshold, it is determined to be a normal text message.

Images