Short message center information processing early warning method and system

Abstract

The invention discloses a short message center information processing early warning method and system, and particularly relates to the technical field of information processing, and the method comprises the steps that a short message center receives short message content of a sending user, extracts sensitive vocabularies in short messages, determines similar short messages of the short messages of the sending user by using a similarity calculation method based on the sensitive vocabularies in the short messages, and sends the short messages to the sending user; determining short message behavior data of a sending user short message, determining a relationship between the sending user short message and a short message receiver through a knowledge graph, obtaining trust relationship data of the sending user short message, determining a risk short message, and determining the risk short message according to a historical record of sending the short message by the sending user and a record of sending the short message in a current monitoring time period. According to the method, the difference between the historical behavior and the current behavior of the sending user is determined through the KL divergence, the habit information of the sending user is determined, and the short message sending behavior of the sending user in the monitoring time period is warned in time, so that malicious short messages and junk short messages can be prevented from spreading, and the security of the platform is improved.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and more particularly to a short message center information processing early warning method and system. Background Art

[0002] With the popularization of mobile Internet and the widespread use of SMS services, the number of spam SMS, fraud SMS and malicious SMS has gradually increased, becoming a major problem faced by major communication platforms and users. Such SMS not only interferes with users' normal communications, but may also lead to personal privacy leakage, property loss, and even endanger social security. Existing spam SMS identification systems mainly rely on keyword matching, rule setting and blacklisting. It is not easy to comprehensively analyze SMS content, sending behavior, user relationships and other multi-dimensional data to accurately identify potential risk SMS, and it is not easy to accurately identify risky users who may potentially send SMS.

[0003] In order to solve the above-mentioned defects, a technical solution is now provided. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present invention provide a short message center information processing warning method and system to solve the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A short message center information processing early warning method specifically comprises the following steps:

[0007] S1: The short message center receives the text message content of the sending user, extracts sensitive words in the text message, uses a similarity calculation method based on the sensitive words in the text message to determine similar text messages to the sending user's text message, and determines the text message behavior data of the sending user's text message;

[0008] S2: Determine the relationship between the sender and receiver of SMS messages through the knowledge graph, obtain the trust relationship data of the sender's SMS messages, and build an SMS assessment model based on the trust relationship data and SMS behavior data to identify risky SMS messages;

[0009] S3: Based on the historical SMS sending history of the sending user and the SMS sending history during the current monitoring period, the difference between the sending user's historical behavior and current behavior is determined through KL divergence to determine the sending user's habit information;

[0010] S4: Calculate each SMS message sent by the user during the monitoring period using the SMS assessment model to determine the risk information of the sending user;

[0011] S5: By sending the user's habit information and risk information during the monitoring period, a comprehensive analysis of the risks existing in the monitoring period is conducted, and timely warnings are issued to the sending user's behavior of sending text messages during the monitoring period.

[0012] In a preferred embodiment, determining SMS behavior data of sending user SMS messages includes:

[0013] SMS behavior data is represented by SMS behavior anomaly coefficient;

[0014] The logic for obtaining the SMS behavior abnormality coefficient is as follows: obtaining the sensitive words used to send the user SMS, and representing the sensitive words used to send the user SMS through a set as: FS, FS = [FS1, FS2, FS3, ..., FS n ], n = 1, 2, 3, ..., N, N is a positive integer, n is the number of the sensitive word in the text message sent to the user;

[0015] The sensitive words of each SMS in the SMS database are expressed as: SJK ij , SJK ij =[SJK i1 ,SJK i2 ,SJK i3 ,......,SJK iJ ]; where i = 1, 2, 3, ..., I, where I is a positive integer and is the number of each SMS in the SMS database; j = 1, 2, 3, ..., J, where J is a positive integer and is the number of the sensitive word in each SMS in the SMS database;

[0016] The similarity coefficient is calculated by Jaccard similarity to determine the similar text messages sent to the user. The calculation formula is: Among them, XS is the similarity coefficient between the sending user’s SMS and similar SMS;

[0017] Based on the behavioral feedback of similar text messages, the number of times similar text messages have been blacklisted and the number of times similar text messages have been marked as spam are determined, and the text message behavior anomaly coefficient is calculated using the following formula: Among them, YC is the SMS behavior abnormality coefficient, CS lh is the number of times similar text messages were blocked, CS bj is the number of times similar text messages are marked as spam, CS fs The total number of times similar text messages were sent.

[0018] In a preferred embodiment, obtaining the trust relationship data of the user sending the text message includes:

[0019] The trust relationship data is represented by the trust degree coefficient;

[0020] The logic for obtaining the trust coefficient is as follows: based on the SMS history of the sending user and the receiving user, the contacts of the sending user and the receiving user are determined, and the contacts of the sending user and the receiving user are used as entities in the knowledge graph, the behavior of sending and receiving SMS messages is used as the edge between the entities, and the number of SMS messages sent and received between the entities is used as the weight of the edge;

[0021] Construct the knowledge graph of the sending user and the knowledge graph of the receiving user, determine the overlapping entities between the knowledge graph of the sending user and the knowledge graph of the receiving user, and obtain the time interval length of the sending user's last contact with the overlapping entity;

[0022] Calculate the trust coefficient, the calculation formula is: Among them, XR is the trust coefficient, T m is the time interval between the last contact of the sending user with the mth overlapping entity, QZ m is the weight of sending users to overlapping entities, T k is the time interval length from the last time the user contacted the kth overlapping entity, QZ k is the weight of receiving users to overlapping entities, T zj QZ is the time interval between the sending user’s last contact with the receiving user. js is the weight from the sending user to the receiving user. If there is no overlapping entity between the knowledge graph of the sending user and the knowledge graph of the receiving user, then T m =T k =QZ k =QZ m =1.

[0023] In a preferred embodiment, constructing a text message evaluation model includes:

[0024] The SMS behavior abnormality coefficient and the trust degree coefficient are used to establish an SMS evaluation model to generate the SMS evaluation coefficient. The calculation formula of the SMS evaluation coefficient is: Among them, η is the SMS evaluation coefficient, α1 and α2 are the proportional coefficients of the SMS behavior abnormality coefficient and the trust degree coefficient, respectively, and α1 and α2 are both greater than 0.

[0025] In a preferred embodiment, determining risky text messages includes:

[0026] Set the SMS evaluation coefficient threshold, and mark the SMS evaluation coefficient threshold as: η yz ,If the SMS evaluation coefficient is greater than the SMS evaluation coefficient threshold, the SMS sent by the sending user will be marked as a risky SMS. If the SMS evaluation coefficient is less than the SMS evaluation coefficient threshold, it will not be marked.

[0027] In a preferred embodiment, determining the habit information of the sending user includes:

[0028] The habit information of the sending user during the monitoring period is represented by the habit distribution difference coefficient;

[0029] The logic for obtaining the habit distribution difference coefficient is as follows: set a monitoring time period, calculate the probability density of the number of text messages sent by the sending user in each monitoring time period in the historical records through kernel density estimation, and mark the probability density of the number of text messages sent by the sending user in each monitoring time period in the historical records as: P(slt) g , where g = 1, 2, 3, ..., G, G is a positive integer, g is the number of the monitoring time period in the historical records, t = 1, 2, 3, ..., T, T is a positive integer, t is the number of the time point in the monitoring time period;

[0030] The probability density of the number of text messages sent by the sending user during the current monitoring period is calculated by kernel density estimation, and the probability density of the number of text messages sent by the sending user during the current monitoring period is marked as: Q(sl t );

[0031] The relative entropy coefficient of the number of text messages sent in the historical records and the current monitoring period is calculated by KL divergence. The calculation formula is: Among them, XD g The relative entropy coefficient of the number of text messages sent during the g-th monitoring period in the historical records and the current monitoring period;

[0032] Calculate the habit distribution difference coefficient, the calculation formula is: FB cy =argmin(XD g ); Among them, FB cy is the coefficient of variation of the habit distribution.

[0033] In a preferred embodiment, determining the risk information of the sending user includes:

[0034] The risk information of the user sent during the monitoring period is expressed by the risk concealment coefficient;

[0035] The logic for obtaining the risk concealment coefficient is as follows: obtain the SMS evaluation coefficient of each SMS sent by the user during the monitoring period, and mark the SMS evaluation coefficient of each SMS sent by the user during the monitoring period as: η r , where r = 1, 2, 3, ..., R, R is a positive integer, and r is the number of each SMS message in the monitoring period;

[0036] Compare the SMS evaluation coefficient of each SMS message within the monitoring period with the SMS evaluation coefficient threshold, obtain the SMS messages within the monitoring period that are greater than the SMS evaluation coefficient threshold, and re-mark the SMS evaluation coefficients of the SMS messages within the monitoring period that are greater than the SMS evaluation coefficient threshold as: η w, where w = 1, 2, 3, ..., W, W is a positive integer, and w is the number of the SMS message that is greater than the SMS evaluation coefficient threshold during the monitoring period;

[0037] Calculate the risk concealment coefficient, the calculation formula is: Among them, FX yn is the risk concealment coefficient.

[0038] In a preferred embodiment, by sending the user's habit information and risk information during the monitoring period, a comprehensive analysis of the risks existing in the monitoring period is performed, including:

[0039] By comprehensively analyzing the habit information and risk information of users during the monitoring period, the habit distribution difference coefficient and the risk concealment coefficient are weighted and calculated to build an early warning assessment model and generate an early warning assessment coefficient. The calculation formula of the early warning assessment coefficient is: Among them, PG is the early warning assessment coefficient, β1 and β2 are the proportional coefficients of the habit distribution difference coefficient and the risk concealment coefficient, respectively, and β1 and β2 are both greater than 0.

[0040] In a preferred embodiment, timely warning is provided to the user for sending text messages during the monitoring period, including:

[0041] Set a warning evaluation coefficient threshold. If the warning evaluation coefficient of the sending user is greater than the warning evaluation coefficient threshold, a warning signal is generated. If the warning evaluation coefficient of the sending user is less than the warning evaluation coefficient threshold, no warning signal is generated.

[0042] In a preferred embodiment, a short message center information processing and warning system includes a text message content analysis module, a graph analysis module, a text message evaluation module, a warning evaluation module, and a signal generation module, and the modules are signal-connected;

[0043] The SMS content analysis module is used to receive and analyze the SMS content of the sending user, extract sensitive words from it, and determine SMS behavior data by identifying and classifying sensitive words;

[0044] Graph analysis module, used to build a knowledge graph of the sending and receiving users, analyze the relationship between the sending and receiving users, and determine the trust relationship data;

[0045] SMS evaluation module: users comprehensively analyze SMS behavior data and trust relationship data, build SMS evaluation models, and generate SMS evaluation coefficients for each SMS;

[0046] The early warning assessment module is used to obtain the habit information and risk information of the sending user during the monitoring period, conduct a comprehensive analysis of the habit information and risk information of the sending user during the monitoring period, build an early warning assessment model, and generate an early warning assessment coefficient;

[0047] The signal generation module is used to compare the early warning evaluation coefficient with the set early warning evaluation coefficient threshold to determine whether to generate an early warning signal.

[0048] The technical effects and advantages of the present invention are as follows:

[0049] The present invention is based on the analysis of SMS content, identifying and preventing potential spam SMS and malicious behavior. By extracting sensitive words and performing similarity analysis on the SMS content of the sending user, the system can identify the similarity between the SMS and historical records, thereby understanding the user's behavior pattern. At the same time, based on the knowledge graph, the system analyzes the relationship between the sending user and the receiving user, evaluates the degree of trust, and quantifies the risk of SMS. By evaluating the risk level of each SMS in real time and analyzing the behavioral habits of the sending user, the potential risk of the sending user's behavior is evaluated. The present invention helps to prevent the spread of malicious SMS and spam SMS and improve the security of the platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0051] Figure 1 A flowchart of a short message center information processing and early warning method according to the present invention;

[0052] Figure 2 The present invention is a schematic structural diagram of a short message center information processing early warning system. DETAILED DESCRIPTION

[0053] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0054] Example 1

[0055] Figure 1 The present invention is a flowchart of a short message center information processing early warning method, which specifically includes the following steps:

[0056] S1: The short message center receives the text message content of the sending user, extracts sensitive words in the text message, uses a similarity calculation method based on the sensitive words in the text message to determine similar text messages to the sending user's text message, and determines the text message behavior data of the sending user's text message;

[0057] S2: Determine the relationship between the sender and receiver of SMS messages through the knowledge graph, obtain the trust relationship data of the sender's SMS, and build an SMS evaluation model based on the trust relationship data and SMS behavior data;

[0058] S3: Based on the historical SMS sending history of the sending user and the SMS sending history during the current monitoring period, the difference between the sending user's historical behavior and current behavior is determined through KL divergence to determine the sending user's habit information;

[0059] S4: Calculate each SMS message sent by the user during the monitoring period using the SMS assessment model to determine the risk information of the sending user;

[0060] S5: By sending the user's habit information and risk information during the monitoring period, a comprehensive analysis of the risks existing in the monitoring period is conducted, and timely warnings are issued to the sending user's behavior of sending text messages during the monitoring period.

[0061] In step 1, the short message center receives the text message from the sending user, extracts sensitive words from the text message, and builds a text message database based on the sensitive words, specifically including:

[0062] To set sensitive words, you can use some public sensitive word libraries (such as words related to violence, political sensitivity, personal privacy, etc.) or create your own word library to meet specific needs;

[0063] Pre-process the SMS content to identify all sensitive words in the SMS content, including using string matching (such as regular expressions) or word matching to find out whether the SMS content contains these sensitive words. Use natural language processing (NLP) technology to identify sensitive words in the SMS.

[0064] Based on the SMS messages sent by users, SMS behavior data is determined through similarity analysis and user behavior analysis. SMS behavior data is represented by the SMS behavior anomaly coefficient. The advantages of the SMS behavior anomaly coefficient are:

[0065] By combining SMS similarity (based on sensitive words or semantic similarity) with behavioral feedback (such as the number of blacklisting, deletion, and marking), the system can accurately identify abnormal SMS behavior.

[0066] The SMS behavior anomaly coefficient allows for dynamic monitoring and assessment of SMS content. As user behavior changes, SMS content diversifies, and sensitive topics continue to update, the system can adjust its SMS risk assessment in real time and respond promptly to new risk patterns.

[0067] The SMS behavior anomaly coefficient can better reflect the user's actual reaction to SMS based on the user behavior feedback method, which can make the risk assessment more in line with the actual situation.

[0068] The logic for obtaining the SMS behavior abnormality coefficient is as follows: obtaining the sensitive words used to send the user SMS, and representing the sensitive words used to send the user SMS through a set as: FS, FS = [FS1, FS2, FS3, ..., FS n ], n = 1, 2, 3, ..., N, N is a positive integer, n is the number of the sensitive word in the text message sent to the user;

[0069] The sensitive words of each SMS in the SMS database are expressed as: SJK ij , SJK ij =[SJK i1 ,SJK i2 ,SJK i3 ,......,SJK iJ ]; where i = 1, 2, 3, ..., I, where I is a positive integer and is the number of each SMS in the SMS database; j = 1, 2, 3, ..., J, where J is a positive integer and is the number of the sensitive word in each SMS in the SMS database;

[0070] The similarity coefficient is calculated by Jaccard similarity to determine the similar text messages sent to the user. The calculation formula is: Among them, XS is the similarity coefficient between the sending user’s SMS and similar SMS;

[0071] Based on the behavioral feedback of similar text messages, the number of times similar text messages have been blacklisted and the number of times similar text messages have been marked as spam are determined, and the text message behavior anomaly coefficient is calculated using the following formula: Among them, YC is the SMS behavior abnormality coefficient, CS lh is the number of times similar text messages were blocked, CS bj is the number of times similar text messages are marked as spam, CS fs The total number of times similar text messages were sent.

[0072] As can be seen from the formula, the larger the SMS behavior anomaly coefficient is, the greater the risk of the SMS sent by the sending user. This is because SMS messages similar to the sending user's SMS messages may be abnormal SMS messages, and other users' reactions to similar SMS messages are negative. Therefore, the SMS messages sent by the sending user are more likely to be abnormal SMS messages.

[0073] In step 2, the relationship between the sender and receiver is determined through the knowledge graph, and the trust relationship data of the sender is obtained. The trust relationship data is represented by the trust degree coefficient. The advantages of the trust degree coefficient are:

[0074] The trust coefficient can be used to quantify the trust relationship between users into a calculable value (usually between 0 and 1), making trust assessment more intuitive and objective. Compared with traditional manual judgment or rule-based judgment, the trust coefficient obtained through graph analysis can eliminate human bias and ensure the consistency of the assessment. The trust coefficient can provide a more consistent and objective evaluation standard.

[0075] User behavior may change over time, so the trust coefficient is dynamic and can be updated in real time based on new behavior and feedback;

[0076] Through graph analysis, the system can more accurately understand the interaction patterns between senders and receivers, and help build more accurate user profiles based on multi-dimensional behavioral data such as interaction frequency and content similarity;

[0077] Graph analysis not only focuses on individual behavior, but also reveals social network effects. By analyzing the relationships between users, the system can discover group behavior patterns and infer the spread trends of certain behaviors in the entire network.

[0078] The logic for obtaining the trust coefficient is as follows: based on the SMS history of the sending user and the receiving user, the contacts of the sending user and the receiving user are determined, and the contacts of the sending user and the receiving user are used as entities in the knowledge graph, the behavior of sending and receiving SMS messages is used as the edge between the entities, and the number of SMS messages sent and received between the entities is used as the weight of the edge;

[0079] Construct the knowledge graph of the sending user and the knowledge graph of the receiving user, determine the overlapping entities between the knowledge graph of the sending user and the knowledge graph of the receiving user, and obtain the time interval length of the sending user's last contact with the overlapping entity;

[0080] It should be noted that the overlapping entities of the knowledge graph of the sending user and the knowledge graph of the receiving user represent the common contacts of the sending user and the receiving user.

[0081] Calculate the trust coefficient, the calculation formula is: Among them, XR is the trust coefficient, T m is the time interval between the last contact of the sending user with the mth overlapping entity, QZ m is the weight of sending users to overlapping entities, T k is the time interval length from the last time the user contacted the kth overlapping entity, QZ k is the weight of receiving users to overlapping entities, T zj QZ is the time interval between the sending user’s last contact with the receiving user. jsis the weight from the sending user to the receiving user. If there is no overlapping entity between the knowledge graph of the sending user and the knowledge graph of the receiving user, then T m =T k =QZ k =QZ m =1.

[0082] It can be seen from the formula that the larger the trust coefficient, the closer the relationship between the knowledge graph of the sending user and the knowledge graph of the receiving user, which indicates that there is a certain connection between the sending user and the receiving user. If there are common entities in the knowledge graph of the sending user and the knowledge graph of the receiving user, it means that the sending user and the receiving user may be acquaintances, so the behavior of sending text messages to each other may be more normal. And if the sending user has recently contacted the receiving user, the higher the trust in the current sending user's behavior of sending text messages, indicating that the interaction between the sending user and the receiving user is regular and belongs to normal social or communication behavior.

[0083] The SMS behavior abnormality coefficient and the trust degree coefficient are used to establish an SMS evaluation model to generate the SMS evaluation coefficient. The calculation formula of the SMS evaluation coefficient is: Among them, η is the SMS evaluation coefficient, α1 and α2 are the proportional coefficients of the SMS behavior abnormality coefficient and the trust degree coefficient, respectively, and α1 and α2 are both greater than 0.

[0084] Set the SMS evaluation coefficient threshold, and mark the SMS evaluation coefficient threshold as: η yz If the SMS evaluation coefficient is greater than the SMS evaluation coefficient threshold, the SMS sent by the sending user will be marked as a risky SMS, indicating that the SMS sent by the sending user may be a spam SMS and there may be certain risks, and the sending user's behavior is abnormal. If the SMS evaluation coefficient is less than the SMS evaluation coefficient threshold, it will not be marked, indicating that the SMS sent by the sending user may not be a spam SMS and the risk is low.

[0085] The short message center monitors the sending and receiving of SMS messages in real time, conducts instant evaluation of each SMS message, analyzes the risk level of the sending user, helps the system identify potentially dangerous behaviors, such as malicious marketing and harassing SMS messages, and issues timely warnings.

[0086] In step 3, the SMS center monitors the SMS sending patterns of each user over a period of time to provide early warnings, helping to detect abnormal behavior in a timely manner and reduce the risk of fraud and abuse. The advantages of this are:

[0087] If a user's account is compromised, a malicious attacker may send text messages to a large number of users without authorization. This behavior often has characteristics that differ from normal user behavior. By analyzing the user's behavior over a period of time (such as sending frequency, time interval, and content), these abnormal patterns can be identified. If the behavior in a certain period is significantly different from the user's historical behavior, it may mean that the account has been compromised.

[0088] Prevent the sending user from being a robot. The behavior patterns of robots are usually different from those of normal users, especially in terms of sending frequency, content, and recipients. By analyzing the user's SMS sending behavior over a period of time, behaviors similar to the characteristics of robots can be identified and thus recognized.

[0089] Based on the sending user's SMS sending history, the sending user's habit information during the monitoring period is determined and represented by the habit distribution difference coefficient. The habit distribution difference coefficient has the following advantages:

[0090] The habit distribution difference coefficient can automatically identify abnormal behaviors by calculating the difference between the user's historical behavior and current behavior data distribution;

[0091] It can adaptively adjust to new data without requiring extensive human intervention. The system continuously updates its behavior patterns over time, making it adaptable to long-term changes in user behavior and new behavior patterns.

[0092] The customary distribution difference coefficient simplifies the processing of complex data by calculating the differences in probability distributions. It does not rely on complex rules and thresholds set manually, but instead determines whether there are anomalies through the patterns and statistical information of the data itself.

[0093] The logic for obtaining the habit distribution difference coefficient is as follows: set a monitoring time period, calculate the probability density of the number of text messages sent by the sending user in each monitoring time period in the historical records by kernel density estimation, and mark the probability density of the number of text messages sent by the sending user in each monitoring time period in the historical records as: P(sl t ) g , where g = 1, 2, 3, ..., G, G is a positive integer, g is the number of the monitoring time period in the historical records, t = 1, 2, 3, ..., T, T is a positive integer, t is the number of the time point in the monitoring time period;

[0094] It should be noted that the historical record is a longer time period, and the monitoring time period is a smaller time period. The historical record can usually be one month or one quarter, etc., which is determined based on the actual records of text messages sent by users. The monitoring time can usually be one hour or one day, etc., which is determined by professional staff based on actual computing power and actual conditions. The time point is a shorter time period, and each time point has the same length of time. A monitoring time period contains a fixed number of time points, and the historical record contains multiple monitoring time periods.

[0095] The probability density of the number of text messages sent by the sending user during the current monitoring period is calculated by kernel density estimation, and the probability density of the number of text messages sent by the sending user during the current monitoring period is marked as: Q(sl t );

[0096] The relative entropy coefficient of the number of text messages sent in the historical records and the current monitoring period is calculated by KL divergence. The calculation formula is: Among them, XD g The relative entropy coefficient of the number of text messages sent during the g-th monitoring period in the historical records and the current monitoring period;

[0097] Calculate the habit distribution difference coefficient, the calculation formula is: FB cy =argmin(XD g ); Among them, FB cy is the coefficient of variation of the habit distribution.

[0098] As can be seen from the formula, the larger the habit distribution difference coefficient, the more different the historical SMS sending habits of the sending user are from the current ones, indicating that the user's behavior has changed significantly, and the user's account may have been stolen.

[0099] In step 4, based on the sending behavior of the sending user during the monitoring period and the SMS evaluation coefficient of each SMS of the sending user during the monitoring period, the risk information of the sending user during the monitoring period is determined, and the risk information of the sending user during the monitoring period is represented by the risk concealment coefficient.

[0100] The logic for obtaining the risk concealment coefficient is as follows: obtain the SMS evaluation coefficient of each SMS sent by the user during the monitoring period, and mark the SMS evaluation coefficient of each SMS sent by the user during the monitoring period as: η r , where r = 1, 2, 3, ..., R, R is a positive integer, and r is the number of each SMS message in the monitoring period;

[0101] Compare the SMS evaluation coefficient of each SMS message within the monitoring period with the SMS evaluation coefficient threshold, obtain the SMS messages within the monitoring period that are greater than the SMS evaluation coefficient threshold, and re-mark the SMS evaluation coefficients of the SMS messages within the monitoring period that are greater than the SMS evaluation coefficient threshold as: η w , where w = 1, 2, 3, ..., W, W is a positive integer, and w is the number of the SMS message that is greater than the SMS evaluation coefficient threshold during the monitoring period;

[0102] Calculate the risk concealment coefficient, the calculation formula is: Among them, FX yn is the risk concealment coefficient.

[0103] It can be seen from the formula that the larger the risk concealment coefficient, the more risky text messages the user may send during the monitoring period, and the higher the risk level of the user may be. The larger the risk concealment coefficient, the more spam text messages, fraudulent text messages, malicious marketing text messages or other forms of malicious content sent by the user, which means that the user has a large abnormality.

[0104] In step 5, by performing a comprehensive analysis of the user's habit information and risk information during the monitoring period, the habit distribution difference coefficient and the risk concealment coefficient are weighted and calculated to construct an early warning assessment model and generate an early warning assessment coefficient. The calculation formula for the early warning assessment coefficient is: Among them, PG is the early warning assessment coefficient, β1 and β2 are the proportional coefficients of the habit distribution difference coefficient and the risk concealment coefficient, respectively, and β1 and β2 are both greater than 0.

[0105] It can be seen from the formula that the larger the habit distribution difference coefficient and the risk concealment coefficient, the larger the early warning assessment coefficient, which means that the sending user's behavior of sending text messages during the monitoring period is at greater risk, and the short message center should activate the early warning mechanism. Conversely, the smaller the habit distribution difference coefficient and the risk concealment coefficient, the smaller the early warning assessment coefficient, which means that the sending user's behavior of sending text messages during the monitoring period is better.

[0106] Set a warning assessment coefficient threshold. If the warning assessment coefficient of the sending user is greater than the warning assessment coefficient threshold, a warning signal is generated. The short message center automatically sends an alert to the administrator or relevant personnel, prompting that the user has abnormal behavior. The user's SMS sending permission can be temporarily banned to prevent the spread of more risky SMS messages. If the warning assessment coefficient of the sending user is less than the warning assessment coefficient threshold, no warning signal is generated.

[0107] It should be noted that when the short message center generates an early warning signal, the system can conduct further review, such as detecting the user's login behavior, device information, etc., to check whether there is any account theft, robot control, etc.

[0108] The present invention is based on the analysis of SMS content, identifying and preventing potential spam SMS and malicious behavior. By extracting sensitive words and performing similarity analysis on the SMS content of the sending user, the system can identify the similarity between the SMS and historical records, thereby understanding the user's behavior pattern. At the same time, based on the knowledge graph, the system analyzes the relationship between the sending user and the receiving user, evaluates the degree of trust, and quantifies the risk of SMS. By evaluating the risk level of each SMS in real time and analyzing the behavioral habits of the sending user, the potential risk of the sending user's behavior is evaluated. The present invention helps to prevent the spread of malicious SMS and spam SMS and improve the security of the platform.

[0109] Example 2

[0110] Figure 2 This is a structural diagram of a short message center information processing and early warning system of the present invention, which specifically includes a text message content analysis module, a graph analysis module, a text message evaluation module, an early warning evaluation module, and a signal generation module, with signal connections between the modules;

[0111] The SMS content analysis module is used to receive and analyze the SMS content of the sending user, extract sensitive words from it, and determine SMS behavior data by identifying and classifying sensitive words;

[0112] Graph analysis module, used to build a knowledge graph of the sending and receiving users, analyze the relationship between the sending and receiving users, and determine the trust relationship data;

[0113] SMS evaluation module: users comprehensively analyze SMS behavior data and trust relationship data, build SMS evaluation models, and generate SMS evaluation coefficients for each SMS;

[0114] The early warning assessment module is used to obtain the habit information and risk information of the sending user during the monitoring period, conduct a comprehensive analysis of the habit information and risk information of the sending user during the monitoring period, build an early warning assessment model, and generate an early warning assessment coefficient;

[0115] The signal generation module is used to compare the early warning evaluation coefficient with the set early warning evaluation coefficient threshold to determine whether to generate an early warning signal.

[0116] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0117] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0118] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0119] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0120] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0121] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0122] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0123] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A short message center information processing warning method, characterized in that: The specific steps include: S1: The short message center receives the text message content of the sending user, extracts sensitive words in the text message, uses a similarity calculation method based on the sensitive words in the text message to determine similar text messages to the sending user's text message, and determines the text message behavior data of the sending user's text message; S2: Determine the relationship between the sender and receiver of SMS messages through the knowledge graph, obtain the trust relationship data of the sender's SMS messages, and build an SMS assessment model based on the trust relationship data and SMS behavior data to identify risky SMS messages; S3: Based on the historical SMS sending history of the sending user and the SMS sending history during the current monitoring period, the difference between the sending user's historical behavior and current behavior is determined through KL divergence to determine the sending user's habit information; S4: Calculate each SMS message sent by the user during the monitoring period using the SMS assessment model to determine the risk information of the sending user; S5: By sending the user's habit information and risk information during the monitoring period, a comprehensive analysis of the risks existing in the monitoring period is conducted, and timely warnings are issued to the sending user's behavior of sending text messages during the monitoring period.

2. A short message center information processing and early warning method according to claim 1, characterized in that: Determine SMS behavior data for sending user SMS messages, including: SMS behavior data is represented by SMS behavior anomaly coefficient; The logic for obtaining the SMS behavior abnormality coefficient is as follows: obtaining the sensitive words used to send the user SMS, and representing the sensitive words used to send the user SMS through a set as: FS, FS = [FS1, FS2, FS3, ..., FS n ], n = 1, 2, 3, ..., N, N is a positive integer, n is the number of the sensitive word in the text message sent to the user; The sensitive words of each SMS in the SMS database are expressed as: SJK ij , SJK ij =[SJK i1 ,SJK i2 ,SJK i3 ,......,SJK iJ ]; where i = 1, 2, 3, ..., I, where I is a positive integer and is the number of each SMS in the SMS database; j = 1, 2, 3, ..., J, where J is a positive integer and is the number of the sensitive word in each SMS in the SMS database; The similarity coefficient is calculated by Jaccard similarity to determine the similar text messages sent to the user. The calculation formula is: Among them, XS is the similarity coefficient between the sending user’s SMS and similar SMS; Based on the behavioral feedback of similar text messages, the number of times similar text messages have been blacklisted and the number of times similar text messages have been marked as spam are determined, and the text message behavior anomaly coefficient is calculated using the following formula: Among them, YC is the SMS behavior abnormality coefficient, CS lh is the number of times similar text messages were blocked, CS bj is the number of times similar text messages are marked as spam, CS fs The total number of times similar text messages were sent.

3. A short message center information processing and early warning method according to claim 2, characterized in that: Obtain trust relationship data for sending user text messages, including: The trust relationship data is represented by the trust degree coefficient; The logic for obtaining the trust coefficient is as follows: based on the SMS history of the sending user and the receiving user, the contacts of the sending user and the receiving user are determined, and the contacts of the sending user and the receiving user are used as entities in the knowledge graph, the behavior of sending and receiving SMS messages is used as the edge between the entities, and the number of SMS messages sent and received between the entities is used as the weight of the edge; Construct the knowledge graph of the sending user and the knowledge graph of the receiving user, determine the overlapping entities between the knowledge graph of the sending user and the knowledge graph of the receiving user, and obtain the time interval length of the sending user's last contact with the overlapping entity; Calculate the trust coefficient, the calculation formula is: Among them, XR is the trust coefficient, T m is the time interval between the last contact of the sending user with the mth overlapping entity, QZ m is the weight of sending users to overlapping entities, T k is the time interval length from the last time the user contacted the kth overlapping entity, QZ k is the weight of receiving users to overlapping entities, T zj QZ is the time interval between the sending user’s last contact with the receiving user. js is the weight from the sending user to the receiving user. If there is no overlapping entity between the knowledge graph of the sending user and the knowledge graph of the receiving user, then T m =T k =QZ k =QZ m =1.

4. A short message center information processing and early warning method according to claim 3, characterized in that: Build a SMS evaluation model, including: The SMS behavior abnormality coefficient and trust degree coefficient are used to establish the SMS evaluation model to generate the SMS evaluation Coefficient, the calculation formula of SMS evaluation coefficient is: Among them, η is the SMS evaluation coefficient, α1 and α2 are the proportional coefficients of the SMS behavior abnormality coefficient and the trust degree coefficient, respectively, and α1 and α2 are both greater than 0.

5. A short message center information processing and early warning method according to claim 4, characterized in that: Identify risky text messages, including: Set the SMS evaluation coefficient threshold, and mark the SMS evaluation coefficient threshold as: η yz ,If the SMS evaluation coefficient is greater than the SMS evaluation coefficient threshold, the SMS sent by the sending user will be marked as a risky SMS. If the SMS evaluation coefficient is less than the SMS evaluation coefficient threshold, it will not be marked.

6. A short message center information processing and warning method according to claim 5, characterized in that: Determine the user's habit information, including: The habit information of the sending user during the monitoring period is represented by the habit distribution difference coefficient; The logic for obtaining the habit distribution difference coefficient is as follows: set a monitoring time period, calculate the probability density of the number of text messages sent by the sending user in each monitoring time period in the historical records by kernel density estimation, and mark the probability density of the number of text messages sent by the sending user in each monitoring time period in the historical records as: P(sl t ) g , where g = 1, 2, 3, ..., G, G is a positive integer, g is the number of the monitoring time period in the historical records, t = 1, 2, 3, ..., T, T is a positive integer, t is the number of the time point in the monitoring time period; The probability density of the number of text messages sent by the sending user during the current monitoring period is calculated by kernel density estimation, and the probability density of the number of text messages sent by the sending user during the current monitoring period is marked as: Q(sl t ); The relative entropy coefficient of the number of text messages sent in the historical records and the current monitoring period is calculated by KL divergence. The calculation formula is: Among them, XD g The relative entropy coefficient of the number of text messages sent during the g-th monitoring period in the historical records and the current monitoring period; Calculate the habit distribution difference coefficient, the calculation formula is: FB cy =argmin(XD g ); Among them, FB cy is the coefficient of variation of the habit distribution.

7. A short message center information processing and early warning method according to claim 6, characterized in that: Determine the risk information sent to the user, including: The risk information of the user sent during the monitoring period is expressed by the risk concealment coefficient; The logic for obtaining the risk concealment coefficient is as follows: obtain the SMS evaluation coefficient of each SMS sent by the user during the monitoring period, and mark the SMS evaluation coefficient of each SMS sent by the user during the monitoring period as: η r , where r = 1, 2, 3, ..., R, R is a positive integer, and r is the number of each SMS message in the monitoring period; Compare the SMS evaluation coefficient of each SMS message within the monitoring period with the SMS evaluation coefficient threshold, obtain the SMS messages within the monitoring period that are greater than the SMS evaluation coefficient threshold, and re-mark the SMS evaluation coefficients of the SMS messages within the monitoring period that are greater than the SMS evaluation coefficient threshold as: η w , where w = 1, 2, 3, ..., W, W is a positive integer, and w is the number of the SMS message that is greater than the SMS evaluation coefficient threshold during the monitoring period; Calculate the risk concealment coefficient, the calculation formula is: Among them, FX yn is the risk concealment coefficient.

8. A short message center information processing and early warning method according to claim 7, characterized in that: By sending users’ habit information and risk information during the monitoring period, a comprehensive analysis of the risks that exist during the monitoring period is conducted, including: By comprehensively analyzing the habit information and risk information of users during the monitoring period, the habit distribution difference coefficient and the risk concealment coefficient are weighted and calculated to build an early warning assessment model and generate an early warning assessment coefficient. The calculation formula of the early warning assessment coefficient is: Among them, PG is the early warning assessment coefficient, β1 and β2 are the proportional coefficients of the habit distribution difference coefficient and the risk concealment coefficient, respectively, and β1 and β2 are both greater than 0.

9. A short message center information processing and early warning method according to claim 8, characterized in that: Provide timely warnings for users sending text messages during the monitoring period, including: Set a warning evaluation coefficient threshold. If the warning evaluation coefficient of the sending user is greater than the warning evaluation coefficient threshold, a warning signal is generated. If the warning evaluation coefficient of the sending user is less than the warning evaluation coefficient threshold, no warning signal is generated.

10. A short message center information processing warning system, used to implement the short message center information processing warning method according to any one of claims 1 to 9, characterized in that: It includes SMS content analysis module, graph analysis module, SMS evaluation module, warning evaluation module and signal generation module, and the signal connections between the modules; The SMS content analysis module is used to receive and analyze the SMS content of the sending user, extract sensitive words from it, and determine SMS behavior data by identifying and classifying sensitive words; Graph analysis module, used to build a knowledge graph of the sending and receiving users, analyze the relationship between the sending and receiving users, and determine the trust relationship data; SMS evaluation module: users comprehensively analyze SMS behavior data and trust relationship data, build SMS evaluation models, and generate SMS evaluation coefficients for each SMS; The early warning assessment module is used to obtain the habit information and risk information of the sending user during the monitoring period, conduct a comprehensive analysis of the habit information and risk information of the sending user during the monitoring period, build an early warning assessment model, and generate an early warning assessment coefficient; The signal generation module is used to compare the early warning evaluation coefficient with the set early warning evaluation coefficient threshold to determine whether to generate an early warning signal.

Images