Short message anti-fraud method and system based on sending track and content identification

Abstract

The invention discloses a short message anti-fraud method and system based on sending track and content identification, and relates to the technical field of communication security and anti-fraud, and the method comprises the steps: extracting a multi-dimensional sending track feature and a content structure element sequence of a short message at an edge node; constructing a disturbance mode based on the trajectory features, judging a time sequence coupling relationship between the disturbance mode and the content variation segment, and generating a trajectory-content collaborative feature vector; performing primary judgment on the collaborative feature vector by using a lightweight scoring model to obtain a classification label and a credibility score; constructing a user track map for the short messages with the scores in the fuzzy interval, and identifying potential cross-hop evolution modes in the user track map; and if an evolution sign exists, calling a central side graph alignment and evolution path judgment model, outputting a final judgment anti-fraud result, identifying path disguise and structure disturbance collaborative attack which is difficult to capture by a traditional detection method, and being suitable for a real-time fraud detection system on edge intelligent equipment.

Description

Technical Field

[0001] This invention relates to the field of communication security and anti-fraud technology, specifically to a method and system for anti-fraud SMS based on sending trajectory and content recognition. Background Technology

[0002] With the increasing complexity of the network environment and the diversification of communication methods, SMS, as a commonly used notification and verification medium, is facing increasingly sophisticated fraud attack risks. Traditional SMS anti-fraud methods are mostly based on fixed keyword matching, blacklist rules, URL analysis, or communication statistics. While these methods are effective in conventional scenarios, their identification capabilities are limited when facing advanced persistent attacks (APTs), cross-hop link transformations, template perturbations, and structural reconfigurations. They are particularly inadequate in the following two typical problems: 1. Path spoofing problem: Attackers use atypical network forwarding paths to hide the real source of the signal through relay hopping or VPN proxy, resulting in discontinuous geographical distribution between base stations or abnormal forwarding delays, making it difficult to map path characteristics to normal behavior patterns.

[0003] 2. Structural perturbation problem: Attackers make slight perturbations to the order, position, and content details of the original SMS template fields, such as moving the "payment code" field to the front or inserting meaningless fields, to circumvent static rules and form an "evolved" fake SMS. While maintaining the fraudulent function semantically, it avoids the traditional rule base.

[0004] Currently, there is a lack of fraud detection methods that integrate trajectory behavior and content structure analysis. Judging solely based on either the path or content dimension often fails to identify cross-path evolutionary fraud. However, establishing a correlation mechanism between "path perturbation" and "content variation," forming a collaborative detection framework, could significantly improve the ability to identify SMS fraud involving path manipulation and content evolution.

[0005] In view of this, the present invention provides a method and system for anti-fraud of SMS messages based on sending trajectory and content recognition, thereby solving the above problems. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for SMS anti-fraud based on sending trajectory and content recognition. It can quickly make preliminary judgments and construct trajectory maps at the edge, and finally complete deep detection by combining structural evolution paths, thereby improving the detection accuracy and adaptability of the overall anti-fraud system.

[0007] To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, the present invention provides a method for anti-fraud SMS messages based on sending trajectory and content recognition, used for initial judgment and deep detection of SMS messages, including the following steps: Step S101: In the edge node, extract the multidimensional sending trajectory features and content structure element sequence of the SMS message. The multidimensional sending trajectory features include hop count, routing path delay, and geographic coordinate sequence. The content structure element sequence includes SMS message structure location and field order. Step S102: Construct a trajectory perturbation pattern based on the multidimensional transmission trajectory features, determine whether the trajectory perturbation nodes and the variation segments of the content structure element sequence are related, and generate a trajectory-content related collaborative feature vector based on the determination result. Step S103: Input the collaborative feature vector into the edge lightweight scoring model to obtain the initial judgment result of the SMS and its credibility score; merge the SMS messages with credibility scores in the preset fuzzy range with their cross-session historical sending trajectory records and historical content fingerprint sequences to construct a user trajectory map; Step S104: Based on the user trajectory map, identify whether the SMS message has a jump evolution pattern; if a jump evolution pattern is identified, trigger the central side deep content evolution detection model to perform graph alignment calculation on the current content structure element sequence and historical evolution path, and output the final judgment label as the anti-fraud identification result.

[0008] As a preferred embodiment of the first aspect of the present invention, the logic for generating the collaborative feature vector is as follows: The jump distance is calculated on the geographic coordinate sequence, and trajectory disturbance nodes with irregular distance offsets are screened out to obtain a set of trajectory disturbance nodes; The positional offset analysis of the field order in SMS messages is performed to identify the segments where the field order has changed, thus obtaining a set of structural variation segments; Based on the timestamp distribution of the set of perturbed nodes and the set of structural variation segments, the relative temporal offset between the two in the transmission sequence is calculated; If there are perturbation node-structure segment pairs with an offset time interval less than a set threshold, then pair them as candidate combinations of trajectory-content. For all candidate combinations, calculate the weighted fusion value of trajectory disturbance intensity and structural position offset magnitude, construct a collaborative feature vector and output it for subsequent scoring.

[0009] As a preferred embodiment of the first aspect of the present invention, the structured encoding logic of the collaborative feature vector is as follows: The hop distance change and forwarding delay value of each trajectory disturbance node are encoded into a two-dimensional disturbance matrix; Encode the positional offset value and field content difference value of each structural variation segment into a positional variation vector; The perturbation matrix and the position variation vector are concatenated into a joint feature unit, and then the features are fused through a position matching network. Use sparse attention mechanism to filter out the set of joint feature units with high interaction weights; Average pooling is performed on the joint feature unit set to obtain the trajectory-content co-feature vector, which is then output for subsequent model input.

[0010] As a preferred embodiment of the first aspect of the present invention, the construction logic of the edge lightweight scoring model is as follows: The collaborative feature vector is input into a two-branch scoring network with trajectory and content channels to extract trajectory-related features and content-related features respectively. Feature fusion is performed on the extracted feature vectors, and the resulting vectors are input into a fully connected layer and mapped to the scoring space. Perform probability transformation on the output of the scoring space to generate a binary classification output value representing the initial judgment result; The confidence distribution value of the internal response gradient of the fused feature vector is calculated and used as the confidence score. The initial classification label and credibility score of the SMS message are output. SMS messages with credibility scores within a preset fuzzy range are used to trigger the construction of subsequent user trajectory maps.

[0011] As a preferred embodiment of the first aspect of the present invention, the logic for constructing the user trajectory map is as follows: Identify SMS messages with credibility scores within a preset fuzzy range and extract their session identifiers and sending times; Retrieve the sending trajectory sequence and content structure element fingerprint sequence corresponding to the session identifier from the historical records; A basic trajectory graph is constructed using the sending trajectory nodes as graph nodes and the temporal order relationships between nodes as graph edges. The corresponding content structure fingerprint is embedded as a node attribute into the trajectory graph to form a structure-enhanced trajectory graph. The structure-enhanced user trajectory map is output to identify jump evolution patterns.

[0012] As a preferred embodiment of the first aspect of the present invention, the identification logic for the jump evolution pattern in the user trajectory map is as follows: Based on the geographical span and time interval between nodes in the user's historical trajectory, identify trajectory sub-paths with spatial jumps or temporal anomalies; Edit distance calculation is performed on the structural element fingerprint sequence in each trajectory sub-path to identify content offset nodes appearing in multiple paths; For content offset nodes whose frequency exceeds a set threshold, construct a high-frequency content jump subgraph to form a candidate jump pattern set; Match the graph structure in the jump pattern set with the historical trajectory graph to mark potential jump path segments; Output user trajectory maps that fuse high-frequency jump structures and cross-path segment relationships to support evolutionary recognition.

[0013] As a preferred embodiment of the first aspect of the present invention, the logic for constructing a user trajectory map to support evolutionary recognition is as follows: A graph embedding algorithm is used to map each path in the trajectory graph to a fixed-dimensional vector representation; Calculate the structural similarity score between each path using a graph similarity metric function; Path pairs with similarity scores in a specified high similarity range are selected to form a candidate evolutionary path group; The nodes within each path group are sorted by time to form an ordered sequence of content transformations; The output structure is similar and the time series can be sorted, and the content transformation path group is used as the input of the potential evolution path to the next step graph alignment module.

[0014] As a preferred embodiment of the first aspect of the present invention, the identification logic of the jump evolution mode is as follows: The content structure element sequence of the current SMS message is constructed as a graph structure representation, where nodes represent field positions and edges represent structural order. Extract historical content structure diagrams with the same starting field category from the user trajectory graph as candidate evolution references; Perform graph structure alignment operation on the current structure graph and the candidate reference graph, and calculate the node coverage rate and edge matching rate; If the matching rate is higher than the set threshold and the transformation nodes are concentrated in a specific position segment, it is determined that there is a jump evolution mode. Output the recognition result of the jump evolution pattern and trigger the central side model call.

[0015] As a preferred embodiment of the first aspect of the present invention, the processing flow of the center-side depth content evolution detection model includes: The current content structure element sequence is input into the evolution path discrimination module built on graph neural network; Potential evolutionary path groups identified from the user trajectory map will be used as reference path inputs; Perform path-level similarity aggregation and node mutation mining in graph neural networks; A joint score is given for the structural consistency and content perturbation trend between the current sequence and the reference path group; Output the final judgment label as the anti-fraud detection result for the SMS message.

[0016] Secondly, the present invention provides a text message anti-fraud system based on sending trajectory and content recognition. Based on the implementation of the first aspect, it includes an edge processing unit set on the edge side and a central processing unit set on the center side, which are connected through a communication interface. An edge processing unit, disposed on the edge side, is used to perform preliminary feature extraction and discrimination of SMS messages. The edge processing unit includes: The feature extraction module is used to extract multidimensional sending trajectory features and content structure element sequences of the target SMS message; The trajectory association construction module is used to construct a trajectory perturbation pattern based on the multi-dimensional transmission trajectory features and generate a collaborative feature vector of trajectory-content association; The edge scoring module is used to receive the collaborative feature vector and input it into the edge lightweight scoring model, output the initial judgment result of the SMS and the credibility score, and when the score is within a preset fuzzy range, trigger the merging of cross-session history trajectory and content fingerprint to construct a user trajectory map. A central processing unit, located at the center, is used to perform depth detection on SMS messages in the fuzzy region. The central processing unit includes: The deep detection module is used to identify whether the SMS message has a jump evolution pattern based on the user trajectory map; if it does, the deep content evolution detection model is executed to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and outputs the final judgment label as the anti-fraud identification result.

[0017] The technical effects and advantages provided by the present invention in the above technical solution are as follows: This invention achieves high-precision modeling and hierarchical detection of SMS anti-fraud behavior by integrating a feature recognition mechanism that combines sending trajectory and content structure elements. Specifically, by extracting multi-dimensional sending trajectory features such as base station jumps and path delays, and combining them with content structure differences such as field order and positional changes, a collaborative feature vector with temporal coupling is constructed. This vector effectively perceives the linkage pattern between sending path disturbances and content spoofing, thereby identifying fraudulent SMS messages with cross-hop evolutionary characteristics. Furthermore, a credibility scoring mechanism introduces uncertain samples into the graph construction stage. By combining user historical trajectories and content evolution sequences, potential evolutionary attack paths are identified. Finally, through graph structure alignment and a graph neural network discrimination model, the final identification of evolutionary attack SMS messages is achieved. This technical approach effectively solves the problem of traditional methods struggling to cope with complex attacks involving both path spoofing and content fine-tuning, significantly improving the identification accuracy and behavioral trend modeling capabilities of anti-fraud systems. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0019] Figure 1 This is a framework diagram of the SMS anti-fraud system based on sending trajectory and content recognition according to the present invention.

[0020] Figure 2 This is a flowchart of the SMS anti-fraud method based on sending trajectory and content recognition of the present invention. Detailed Implementation

[0021] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art. The drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0022] Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more exemplary embodiments. Numerous specific details are provided in the following description to give a full understanding of exemplary embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure may be practiced with one or more specific details omitted, or methods, components, steps, etc. In other instances, well-known structures, methods, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0023] Example 1 like Figure 2 As shown, this invention provides a method for SMS anti-fraud based on sending trajectory and content recognition. The edge node refers to a real-time detection module deployed at the access layer of the SMS service platform or at a geographical area gateway. This edge node has the ability to instantly access the sending trajectory and part of the SMS content, and possesses low latency response and basic computing resources; the method includes the following steps: Step S101: In the edge node, extract the multidimensional sending trajectory features and content structure element sequence of the SMS message. The multidimensional sending trajectory features include hop count, routing path delay, and geographic coordinate sequence. The content structure element sequence includes SMS message structure location and field order. Specifically, when the edge node receives the target SMS message, extracting the multi-dimensional sending trajectory features and content structure element sequence of the SMS message can be achieved by performing the following processing steps: Obtain multi-hop forwarding records related to the SMS sending path, parse the route ID and corresponding timestamp of each hop, and construct a trajectory record sequence containing the number of route hops, the delay of each hop, and the geographical location of the hop point; Extract the total number of hops, the average delay of the routing path, and the sequence of geographical coordinate changes for each hop from the trajectory recording sequence to form a multi-dimensional transmission trajectory feature set, which is used for subsequent disturbance detection; The text message content is encoded with field positions, and the start position, end position, field length and original arrangement order of the fields are extracted to form a sequence of content structure elements. The transmission trajectory features and content structure element sequences are cached in a temporary feature queue at the edge nodes, serving as the input feature set for subsequent trajectory perturbation modeling and content association analysis.

[0024] Output a structured set of transmission trajectory features and a sequence of content structure elements for use in step S102.

[0025] Step S102: Construct a trajectory perturbation pattern based on the multidimensional transmission trajectory features, determine whether the trajectory perturbation nodes and the variation segments of the content structure element sequence are related, and generate a trajectory-content related collaborative feature vector based on the determination result. It should be noted that: it is necessary to identify abnormal perturbation nodes in the trajectory, locate variant segments of the content structure, and output a trajectory-content co-feature vector for the edge lightweight scoring model through temporal pairing and feature fusion. The co-feature vector will simultaneously encode behavioral perturbation information and content structure change information, enhancing the sensitivity and discriminability of cross-jump and cross-session evolution fraud patterns.

[0026] Specifically, the logic for generating the collaborative feature vector is as follows: The jump distance is calculated on the geographic coordinate sequence, and trajectory disturbance nodes with irregular distance offsets are screened out to obtain a set of trajectory disturbance nodes; In other words, the straight-line distance is calculated hop-by-hop for the geographic coordinate sequence to obtain the hop distance sequence. The historical hop distance statistics for the same area are compared. If the deviation of a certain hop distance exceeds the deviation threshold set during deployment, the hop point is marked as a trajectory disturbance node. This outputs a set of trajectory disturbance nodes containing node ID, timestamp, hop distance deviation value, and corresponding route segment identifier. By using spatial offset as a disturbance indicator, the relay behavior of cross-regional abrupt changes can be captured. The advantage is that this method relies on intuitive geographic information, has low computational cost, and is easy to run in real time on edge devices, thereby quickly screening out suspicious transmission path nodes and reducing the amount of subsequent processing.

[0027] The positional offset analysis of the field order in SMS messages is performed to identify the segments where the field order has changed, thus obtaining a set of structural variation segments; It should be noted that: an index sequence is created for the content structure element sequence based on field position; the index sequence is compared with the standard template or historical similar message index sequence of the service to calculate the field position offset vector; if the position change of a certain field or field group exceeds the displacement threshold determined at the time of deployment, the corresponding segment is marked as a structural variation segment, and the start and end fields of the variation segment, the variation type (replacement / insertion / deletion) and timestamp are recorded.

[0028] Among them, the field sequence offset reflects traces of content template being rewritten or slightly disturbed; this step can be completed at the edge, and its advantage is that it can detect the local rearrangement or insertion behavior made by attackers to evade content detection from the content structure level, and does not rely on full-text semantic parsing, thus having a small computational burden.

[0029] Based on the timestamp distribution of the set of perturbed nodes and the set of structural variation segments, the relative temporal offset between the two in the transmission sequence is calculated; It should be noted that: for each element in the set of perturbed nodes and the set of structural variant segments, the timestamp is read; a time-series offset matrix of perturbed nodes × variant segments is constructed, and the corresponding routing segment index and message session identifier are recorded simultaneously. The time-series offset matrix represents the relative time-series offset of the two in the transmission sequence; each element in the time-series offset matrix is: ; in: This represents the relative time offset between the perturbation node and the structural variation segment, used to indicate the time difference between the two in the SMS sending sequence; The timestamp of the corresponding disturbance node indicates the sending time of the hop count or routing location (e.g., the time when a proxy forwarding node receives an SMS message). The timestamp represents the corresponding structural variation segment, indicating the time when the structural change of this field was recorded or the content was generated (usually the processing time of the SMS message when the content was edited or before it was sent).

[0030] The temporal offset matrix provides a quantitative basis for measuring whether trajectory events and content events occur closely within the same transmission window. Its advantage is that it can prove the concurrency of behavior and content based on the temporal sequence, which serves as an important basis for subsequent pairing judgment, thereby reducing misjudgments of purely accidental parallel events.

[0031] If there are perturbation node-structure segment pairs with an offset time interval less than a set threshold, then pair them as candidate combinations of trajectory-content. It should be noted that for each pair in the temporal offset matrix, when the offset value does not exceed the pairing window threshold set during deployment, the perturbed node and the mutated segment constitute a candidate pairing entry; each candidate entry is further supplemented with its route segment similarity index and frequency of occurrence within the session as auxiliary attributes. Therefore, the candidate pairing screening combines temporal and routing information to eliminate combinations that are not temporally or route-related. The advantage of this step is that it reduces the scale of subsequent fusion calculations through multi-dimensional screening, ensuring the efficiency and feasibility of edge-side processing.

[0032] For all candidate combinations, calculate the weighted fusion value of trajectory disturbance intensity and structural position offset magnitude, construct a collaborative feature vector and output it for subsequent scoring.

[0033] It should be noted that for each candidate pair, trajectory perturbation intensity indicators (such as inter-hop distance deviation and single-hop delay changes) and content offset indicators (such as field displacement amplitude and field replacement level) are extracted separately. These two types of indicators are weighted and merged according to preset fusion weights to form a joint sub-vector for each pair. All joint sub-vectors in the sequence are concatenated or aggregated sequentially according to the defined order to obtain a primary collaborative feature vector. The fusion weights and aggregation strategy are determined by experiments based on historical samples during deployment. This outputs a primary trajectory-content collaborative feature vector for use by a lightweight edge scoring model, unifying trajectory and content measurements into a single vector space, forming a representation that can simultaneously express behavioral and structural changes. Its advantage is that it can be directly used for lightweight scoring at the edge, reducing false positives and maintaining real-time performance.

[0034] To further explain, the collaborative feature vector is constructed in the following ways: The hop distance change and forwarding delay value of each trajectory disturbance node are encoded into a two-dimensional disturbance matrix; It should be noted that: a two-dimensional perturbation matrix is ​​constructed for the trajectory perturbation nodes in the candidate pairings. Each row of the two-dimensional perturbation matrix corresponds to a perturbation node. Column 1 is the normalized value of the inter-hop distance deviation, column 2 is the single-hop delay change, and column 3 is the hop count change identifier within the route segment. The matrix and the corresponding timestamp mapping are saved. The matrix representation keeps the multi-dimensional trajectory features structured in subsequent fusion, which is convenient for precise alignment with the content vector. The advantages are clear data structure and efficient processing in lightweight neural modules.

[0035] Encode the positional offset value and field content difference value of each structural variation segment into a positional variation vector; It should be noted that each structural variation segment is converted into a positional variation vector. This vector includes the field start and end index offsets, the field replacement level encoding (exemplarily, three types of encoding: synonym replacement, similar replacement, and newly added field), and the number of times the variation segment appears within the session. Encoding structural variations as discrete vectors facilitates numerical comparison and alignment with trajectory features; its advantage is that it preserves the type information of the variation, helping to distinguish between malicious perturbations and normal template variants.

[0036] The perturbation matrix and the position variation vector are concatenated into a joint feature unit, and then the features are fused through a position matching network. It should be noted that for each candidate pairing, the rows of the corresponding two-dimensional perturbation matrix and the position variation vector are concatenated into a joint feature unit in chronological order. Several consecutive joint units are then input into the position matching network according to a time window. The position matching network is a small feedforward network or a lightweight convolutional network, whose input retains temporal and position index information to support position alignment. The joint feature unit retains paired information of trajectory and structure, and the position matching network can learn the interactive features of temporal and positional alignment. Its advantage is that it can effectively fuse heterogeneous features with low computational cost, making it easy to deploy at the edge.

[0037] Specifically, the joint feature unit is denoted as: ; in: It indicates the change in geographical jump distance between the trajectory node and the previous node, and measures whether there are abnormal jumps in the path (such as sudden jumps over long distances). This indicates the forwarding delay offset of the node, that is, the difference between the actual delay and the historical or average delay, reflecting whether there is any suspicious forwarding behavior (such as taking a detour, being hijacked, etc.). This indicates the hop number of the node in the entire path, used to provide its contextual position (such as the hop number) in the network forwarding sequence. This represents the structural position offset of the mutated field. It is calculated as the difference between the expected position of the field in the template and the actual position, reflecting structural adjustment behavior (such as the field order being disturbed). The degree of change in the content of this field is usually expressed as the Levenshtein Distance, which is the minimum number of modification steps between the content of this field and its historical content, reflecting semantic variation behavior; This indicates the context length feature of the field, which measures the context complexity of its position in the SMS text and reflects the nesting depth and variation range of the content in the structure.

[0038] Use sparse attention mechanism to filter out the set of joint feature units with high interaction weights; It should be noted that the output of the location matching network represents the interaction weights between computational units, and a sparse selection strategy is used to retain the subset with the highest weight ranking, while removing units with low weight and small contribution. This selection threshold was determined experimentally during deployment. Sparse selection reduces noise and redundant features, concentrating the representation on highly interactive units, thereby improving the discriminative ability of subsequent aggregation; its advantages are significantly reduced computational overhead and improved discrimination accuracy.

[0039] Average pooling is performed on the joint feature unit set to obtain the trajectory-content co-feature vector, which is then output for subsequent model input.

[0040] It should be noted that: Average or weighted pooling is performed column-wise on the effective set of joint units (the pooling method is determined by the deployment strategy) to obtain a fixed-length vector; a simple linear transformation or projection is performed on the vector to match the input dimension of the lightweight edge scoring model; the final trajectory – content-coordinated feature vector – is then output. Pooling integration compresses high-value interactions within the time series into a robust representation, while projection ensures compatibility with subsequent model structures; its advantage is the formation of a low-dimensional, information-condensed, and rapidly computable input representation, which is beneficial for deployment in resource-constrained edge environments.

[0041] Step S103: Input the collaborative feature vector into the edge lightweight scoring model to obtain the initial judgment result of the SMS and its credibility score; merge the SMS messages with credibility scores in the preset fuzzy range with their cross-session historical sending trajectory records and historical content fingerprint sequences to construct a user trajectory map; It should be noted that the lightweight edge scoring model is responsible for the rapid, distributed processing of clear samples. Therefore, only samples with uncertain scores (fuzzy ranges) are uploaded to the central node for resource-intensive deep analysis, thereby improving the overall system's processing efficiency and resource utilization. The trajectory-content co-feature vector output from the previous process is input into the edge-side scoring model to make a preliminary judgment on whether the SMS message is suspected of fraud and output a credibility score. For SMS messages with uncertain judgment results (i.e., scores in fuzzy ranges), further analysis of their potential evolutionary attack characteristics will be conducted through trajectory mapping.

[0042] Specifically, the construction logic of the edge lightweight scoring model is as follows: The collaborative feature vector is input into a two-branch scoring network with trajectory and content channels to extract trajectory-related features and content-related features respectively. It should be noted that the lightweight edge scoring model includes two parallel branch channels, namely a trajectory branch and a content branch. It employs lightweight convolutional layers or feedforward networks, resulting in controllable computational costs and suitability for edge deployment. Trajectory branching: Extracting spatial behavior features of hop distance variation and time delay offset encoded in the collaborative feature vector; Content branch: Extract structural variation features of field position offset and semantic perturbation from the collaborative feature vector; The dual-channel structure design can decouple and extract trajectory information and content information, making the model more sensitive to different attack types. At the same time, due to the use of lightweight convolutional layers or feedforward networks, the computational cost is controllable and it is suitable for edge deployment.

[0043] Feature fusion is performed on the extracted feature vectors, and the resulting vectors are input into a fully connected layer and mapped to the scoring space. It should be noted that the features extracted from the two branches are combined into a unified fusion feature representation, which is then mapped to the scoring space through a fully connected layer to obtain a scoring vector. Each dimension in the scoring vector represents the model's tendency to judge whether the SMS belongs to a certain category (normal or suspicious). By integrating information from both the trajectory and content sources into a unified discriminative feature, subsequent classification only needs to be performed in a single vector space, reducing computational redundancy.

[0044] Perform probability transformation on the output of the scoring space to generate a binary classification output value representing the initial judgment result; It's important to note that after feature fusion, the output numerical vector is essentially the network's original score. To enable the model to output both "suspicious" and "normal" labels, the scores need to be converted into probability values ​​in the 0–1 range using a probability function (such as the sigmoid function), and then a threshold is applied to obtain the binary classification label ("suspicious SMS" or "normal SMS"). This ensures that the model output can be directly used for real-time discrimination, allowing for rapid initial judgments at edge nodes.

[0045] The confidence distribution value of the internal response gradient of the fused feature vector is calculated and used as the confidence score. It should be noted that, in addition to the classification results, this embodiment also requires the model to output a "confidence score". By calculating the response gradient or entropy value of the fused features in each layer of the network, the confidence distribution value of a text message under the model's judgment can be obtained. This quantifies the model's confidence in its initial judgment. When the confidence score is very low, the text message can be handed over to the deep detection module on the central side for processing, achieving hierarchical scheduling and saving computing power.

[0046] The system outputs the initial classification label and credibility score of the SMS messages. SMS messages with credibility scores within a preset fuzzy range are used to trigger the construction of subsequent user trajectory maps. As the final comprehensive output stage, the lightweight edge scoring model simultaneously outputs the initial classification label (suspicious / normal) and credibility score at the edge: only SMS messages with credibility scores falling within the preset fuzzy range proceed to deeper map analysis. This ensures real-time edge response while rationally allocating central computing power.

[0047] To further explain, the construction logic of the user trajectory map is as follows: Identify SMS messages with credibility scores within a preset fuzzy range and extract their session identifiers and sending times; In other words, SMS messages with scores falling within a fuzzy range (e.g., 0.4–0.6) are filtered from the output of the lightweight edge scoring model. These messages cannot be directly classified as normal, nor do they constitute direct suspicion, thus requiring further analysis. Their session identifiers (e.g., Session-ID) and timestamps are extracted and used as index keys for subsequent queries and graph construction.

[0048] Retrieve the sending trajectory sequence and content structure element fingerprint sequence corresponding to the session identifier from the historical records; In other words, using the aforementioned index information, the system retrieves all sending paths (base station hop order) and SMS content structures (such as field order and length distribution) for the user or session within a certain past window period from the local cache or central database. This information serves as the basic data source for subsequent trajectory mapping.

[0049] A basic trajectory graph is constructed using the sending trajectory nodes as graph nodes and the temporal order relationships between nodes as graph edges. In other words, the relay base station nodes or hop points involved in each transmission process are used as nodes in the graph, and directed edges are established between the nodes in chronological order. The graph structure realistically recreates the spatial path of SMS messages flowing through a user within a time window, providing a graph computational structure foundation for subsequent identification of abnormal paths.

[0050] The corresponding content structure fingerprint is embedded as a node attribute into the trajectory graph to form a structure-enhanced trajectory graph. In other words, the SMS content structure information (such as field offset, template position, keyword nesting, etc.) corresponding to each trajectory node is embedded into the graph node attributes in vector form, so that the trajectory graph can not only represent geographical / temporal information, but also has the ability to express content semantics, making it possible to identify the composite attack of "trajectory jump + content evolution" in the future.

[0051] The structure-enhanced user trajectory map is output to identify jump evolution patterns.

[0052] In other words, the completed graph structure integrates geographical nodes, forwarding order, and content variation information, serving as the input for subsequent "jump evolution pattern recognition." The user trajectory graph supports various algorithm operations such as graph traversal, clustering, and matching, and is a key bridge between edge detection and center depth recognition in this invention.

[0053] To further explain, the identification logic for the jump evolution pattern in the user trajectory map is as follows: Based on the geographical span and time interval between nodes in the user's historical trajectory, identify trajectory sub-paths with spatial jumps or temporal anomalies; It should be noted that: for adjacent node pairs in the graph (i.e. SMS transfer path segments), the physical geographical distance and time interval are calculated. If the geographical span exceeds the set threshold but the time interval is extremely short, it indicates that there is an unconventional path jump. If the time interval is too long but the geographical distance is very close, it may indicate that there is an implicit transfer or content waiting buffer. Such trajectory segments are marked as "abnormal sub-paths" and are the focus of detection.

[0054] Edit distance calculation is performed on the structural element fingerprint sequence in each trajectory sub-path to identify content offset nodes appearing in multiple paths; It should be noted that an "edit distance" calculation (such as Levenshtein) is performed on the text message content structure sequence carried in each sub-path to measure its difference from the content structure in the normal path. Nodes with similar structures but with key field positions replaced are marked as "content offset nodes." This helps to detect evolutionary fraudulent behavior such as "detour-word change-disguise."

[0055] For content offset nodes whose frequency exceeds a set threshold, construct a high-frequency content jump subgraph to form a candidate jump pattern set; It should be noted that the frequency of content offset nodes appearing in different trajectories is statistically analyzed, and high-frequency jump patterns (such as repeatedly placing "CAPTCHA" in the first field) are selected and constructed as jump subgraphs. Jump subgraphs are considered candidate structures for potential evolutionary attack paths and will be used for matching later.

[0056] The graph structure in the jump pattern set is matched with the historical trajectory graph to identify potential jump path segments; graph matching or subgraph isomorphism algorithms are used to search for candidate jump subgraphs in the overall trajectory graph. Figure 1 If a consistent structure is found, it is considered a potential evolutionary path segment and labeled in the graph for use in subsequent depth detection. The output is a user trajectory graph that integrates high-frequency jump structures and cross-path segment relationships to support evolutionary identification. The final output user trajectory graph is a composite knowledge graph simultaneously labeled with: spatial jump trajectory segments, high-frequency content offset nodes, and potential evolutionary path segments. It serves as the main input for the subsequent "content evolution detection" module and is a key support for this invention to detect "multiple cross-node, cross-content evolutionary attacks".

[0057] Specifically, the logic for constructing the user trajectory map to support evolutionary recognition is as follows: A graph embedding algorithm is used to map each path in the trajectory graph to a fixed-dimensional vector representation. This vectorizes each "trajectory path" (i.e., the jump trajectory from the SMS start point to the end point) in the trajectory graph structure, enabling the complex graph structure to be input as a fixed-length vector into subsequent similarity measurement and learning models. Graph embedding methods include, but are not limited to: Node2Vec: Generates path sequences based on random walks of nodes, and then trains embeddings using a word vector model; GraphSAGE or GAT: Aggregates information based on the neighbor structure using graph neural networks; Alternatively, a custom method can be used to encode the sequence of nodes in the path and their embedded attributes (such as geographic location, timestamp, and content summary) into a unified vector.

[0058] Each path, after embedding, yields a fixed-dimensional vector (such as 128-dimensional or 256-dimensional), which serves as a compressed representation of that path.

[0059] The structural similarity score between paths is calculated using a graph similarity metric function; the structural similarity between two different trajectory paths is measured to determine whether there is a potential "evolutionary" association; that is, variations of the same fraudulent attack strategy under different times and different disguises; the similarity calculation is based on: Vector distance (such as cosine similarity, reciprocal of Euclidean distance); If graph structure encoding is used, structural similarity can be calculated based on graph isomorphism matching degree or subgraph kernel function; Consider incorporating differences in content structure (such as field sequences) into a composite similarity score.

[0060] The score range is generally normalized to [0, 1], and the closer the value is to 1, the more similar the score is.

[0061] Path pairs with similarity scores falling within a specified high similarity range are selected to form candidate evolutionary path groups. From all path pairs, highly similar path pairs are selected as potential evolutionary path candidate groups to facilitate further focusing by the subsequent evolutionary detection module. A similarity range threshold is set (e.g., 0.8–1.0), and path pairs whose scores fall within this range are grouped into evolutionary paths. Assume: The first path (original path). The second path (the disguised path) If they have the same structure or only have small field offsets or node replacements, they form a group, which can reduce the amount of comparison and improve the efficiency of evolutionary recognition.

[0062] The nodes within each path group are sorted by time to form an ordered sequence of content changes. To capture how content evolves over time, the nodes in the path group are sorted by time, and the evolution of their content structure fingerprints is tracked. Each node originally carries a timestamp (SMS forwarding time) and a structure fingerprint (such as a field sequence). After being arranged in ascending order by time, a sequence of content changes is formed. For example, Path group A: Node 1 (10:01): [header, paycode, auth] Node 2 (10:03): [paycode, header, auth] Node 3 (10:06): [paycode, auth] As can be seen, the "paycode" field moved from the middle to the front and was eventually retained as the main field, showing an "evolutionary simplification" trend.

[0063] The output structure is similar and the time series can be sorted. The content transformation path group is used as the potential evolution path input to the next graph alignment module. The path group with similar structure and time order is used as the evolution path candidate set for subsequent modules (such as the graph alignment recognizer) to perform detailed comparison and attack behavior identification. Each path group is used as an input unit to enter the next stage (such as the depth graph alignment model, GRU sequence comparison module, etc.) for higher-dimensional semantic alignment and policy recognition.

[0064] Step S104: Based on the user trajectory map, identify whether the SMS message has a jump evolution pattern; if a jump evolution pattern is identified, trigger the central side deep content evolution detection model to perform graph alignment calculation on the current content structure element sequence and historical evolution path, and output the final judgment label as the anti-fraud identification result.

[0065] It should be noted that by analyzing the graph structure of the user trajectory map, the presence of jump evolution characteristics can be identified. If such characteristics are found, the abnormal SMS message is handed over to the high-complexity content evolution detection model on the central side for final judgment. This has multiple key implications, including fraud closed-loop identification, central-edge collaboration, and hierarchical resource control.

[0066] Specifically, the identification logic for the jump evolution pattern is as follows: The content structure element sequence of the current SMS message is constructed as a graph structure representation, where nodes represent field positions and edges represent structural order. The SMS content structure is mapped from a linear sequence (e.g., [field 1, field 2, field 3]) to a graph structure, facilitating subsequent structural comparison and mutation identification. Each SMS field serves as a node in the graph (e.g., "recipient", "payment code", "timestamp"). Directed edges are established between nodes in their original order to reflect the flow of the content structure. Node attributes can include field position, field semantic labels, fingerprint features, etc. The current SMS structure is represented as a directed attribute graph.

[0067] Extract historical content structure diagrams with the same starting field category from the user trajectory graph as candidate evolution references; select historical structures that are consistent with the current SMS message in the starting field as comparable objects to avoid irrelevant comparisons. Determine the starting field type (e.g., the first field is "verification code", "recipient", "payment code", etc.); filter historical SMS message structure diagrams with the same starting field category in the trajectory graph; extract their structure diagrams as a reference set.

[0068] Perform graph structure alignment operations on the current structural graph and candidate reference graphs, and calculate node coverage and edge matching rates; conduct structural level similarity assessment to identify the matching relationship between the current structure and historical evolution paths. Node coverage is the percentage of nodes in the current structural graph that appear in the reference graph (or have consistent field semantics); edge matching is the proportion of edges in the current graph with the same structural order as those in the reference graph; use graph matching algorithms (such as maximum subgraph isomorphism, structural alignment scoring) to calculate the scores.

[0069] If the matching rate is higher than a set threshold and the transformed nodes are concentrated in a specific segment, it is determined that a cross-jump evolution pattern exists; it is then determined whether the current SMS is a structural variant of a historical attack path (cross-jump evolution). A structural matching threshold is set (e.g., node coverage > 0.8 and edge matching rate > 0.7); at the same time, it is determined whether the mutated fields are concentrated in sensitive areas such as the start or end segments (e.g., "payment code" is placed earlier); if both of the above conditions are met, it is considered that there is a continuous evolution of the evolutionary camouflage strategy.

[0070] The recognition result of the jump evolution pattern is output, and the central side model is called to submit the potential evolution SMS of edge judgment to the central side high complexity model for final classification decision, so as to ensure the balance between resource efficiency and detection accuracy.

[0071] To further explain, the processing flow of the center-side deep content evolution detection model includes: The current content structure element sequence is input into an evolutionary path discrimination module built on a graph neural network; the content structure element sequence of the target SMS message is converted into a structured SMS graph and input into the evolutionary path discrimination module built on a graph neural network. The graph neural network is used to model the deep semantics of the SMS message structure and its variation patterns, providing feature representations for complex graph alignment calculations.

[0072] In practical implementation, Graph Attention Networks (GAT) or Graph Convolutional Networks (GCN) can be used to extract representations of nodes in the structure graph, obtaining a structure encoding vector that reflects the features of the node and its neighborhood. This structure encoding serves as the basis for subsequent alignment and similarity comparison.

[0073] Potential evolutionary path groups identified from the user trajectory map are used as input reference paths; a set of potential historical evolutionary paths is extracted from the user trajectory map and used as input reference paths to the model. Each reference path is represented in the form of a structure graph and its path sequence, and is vectorized and modeled using the same graph neural network encoding module as the current SMS structure, thereby obtaining structural representations of multiple reference paths.

[0074] The model performs path-level similarity aggregation and node mutation mining within a graph neural network. Further path-level similarity aggregation and node mutation mining are performed within the graph neural network, comparing the current path with historical paths at both the structural and semantic levels. During this process, key mutation nodes can be identified, including field insertions, deletions, and order adjustments. Simultaneously, the concentration of mutation nodes and changes in sensitive fields are evaluated to obtain a comprehensive similarity score across multiple reference paths.

[0075] The model jointly scores the structural consistency and content perturbation trend between the current sequence and the reference path set. After completing alignment and mutation identification, the model jointly scores the structural consistency and content perturbation trend between the current SMS sequence and the reference path set. This score integrates the structural alignment score (involving the similarity of nodes and edges) and the field perturbation strength to obtain a floating-point value reflecting the degree of suspicion.

[0076] The floating-point value is compared with a preset threshold to determine whether the SMS message belongs to an extension of the attack evolution trajectory. If the score exceeds the threshold, a "high-risk" label is output; if it does not exceed the threshold, it is labeled as a "non-evolutionary SMS message".

[0077] The model outputs a final label as the anti-fraud detection result for the SMS message, clearly identifying whether the current SMS message belongs to an instance of a cross-jump evolution attack. Simultaneously, the model retains key decision-making processes during label generation for subsequent source tracing and auditing.

[0078] Example 2 Based on Example 1, this embodiment further illustrates the effectiveness of the SMS anti-fraud method based on sending trajectory and content recognition of the present invention. The following is a detailed explanation in conjunction with typical fraudulent SMS scenarios that occur in practical applications.

[0079] In a certain operator's network environment, a user receives a suspicious text message A, the content of which contains "Payment code: Please complete the payment within 5 minutes". During the sending process of the text message, it does not pass through the traditional central cluster, but is delivered by base station X → relay node Z → base station Y, and the sending time interval is extremely short. The surface content of the text message is normal, but in fact, it has undergone structural manipulation and path avoidance processing, belonging to a typical cross-hop evolution attack text message.

[0080] S101: Sending trajectory and content structure extraction The edge node first performs an initial parsing on text message A to extract its sending trajectory and content structure information: The sending trajectory features include: Geographical coordinate sequence: ; Hop count = 2; Routing path delay sequence: .

[0081] The content structure element sequence is parsed as: Field order = [Time prompt field → Payment code field → Explanation field]; Among them, the "Payment code" field is inserted in the front in advance, disrupting the original semantic flow.

[0082] S102: Trajectory-content collaborative recognition process: Trajectory perturbation recognition: Calculate the inter-hop distance of the geographical coordinate sequence, and find that Dist(X, Y) exceeds the conventional physical hop distance threshold, and mark it as a perturbed node.

[0083] Structure variation recognition: Compare the positions of the field position sequences, and find that the "Payment code" field has moved from the original middle part to the front part, forming a structure offset segment.

[0084] Timing pairing analysis: Obtain the timestamps of the perturbed node and the structure variation segment, and calculate the timing offset , and its value is less than the preset pairing window , meeting the linkage condition.

[0085] Candidate combination generation: Combine the trajectory perturbation node and the variant field that meet the pairing conditions into a set of trajectory-content candidate combinations, and mark it as <Node_Y, Payment code>.

[0086] Collaborative vector construction: Extract the following six quantitative features to construct a collaborative vector : Among them: represents the hop distance offset amplitude (such as Dist(X,Y) / conventional mean); represents the abnormal node routing delay (such as Δt_ZY exceeding the variance); represents the hop number position (this hop is at the end of the path); This indicates the offset of the "Payment Code" field (e.g., Pos=2 → Pos=1). Indicates the semantic difference values ​​of a field compared to historical versions (such as the cosine distance of a semantic fingerprint). Indicates the degree of change in the context of a field (such as the change in the context span before and after a change in position).

[0087] S103: Edge scoring and fuzzy triggering mechanism. The constructed collaborative vector U is input into the lightweight edge scoring model: the model outputs an initial judgment result: suspicious; confidence score: 0.53, located in the fuzzy interval [0.4, 0.6]. Since the score is not high enough to confirm fraud, nor low enough to pass directly, the subsequent trajectory map construction and center-side evolution detection process is triggered.

[0088] Jump evolution detection and final judgment output, trajectory map construction, extracting SMS session trajectories from user history records to construct the map: Node: Geographical location of the base station; Edge: Time-directed edge; Node attributes: Content structure fingerprint (field order, field semantics).

[0089] The graph shows that the user had a jump record from base station A → B → X → Y in the past two hours, and the field "payment code" appeared early multiple times, forming a high-frequency structure offset subgraph.

[0090] The jump evolution identification uses graph structure alignment and node matching algorithms to identify that the current SMS structure graph is highly consistent with the above historical path graph, and to determine that there are jump evolution characteristics.

[0091] The deep model makes the final judgment. The central side receives the input based on the evolutionary discrimination model of graph neural network. The evaluation results are: high degree of content structure evolution; high alignment accuracy between the path graph and the current node; output label: evolutionary attack SMS.

[0092] Example 2 like Figure 1 As shown in the figure, the parts not described in detail in this embodiment are as shown in Embodiment 1. This embodiment provides a text message anti-fraud system based on sending trajectory and content recognition, including an edge processing unit set on the edge side and a central processing unit set on the center side, which are connected through a communication interface. An edge processing unit, disposed on the edge side, is used to perform preliminary feature extraction and discrimination of SMS messages. The edge processing unit includes: The feature extraction module is used to extract multidimensional sending trajectory features and content structure element sequences of the target SMS message; The trajectory association construction module is used to construct a trajectory perturbation pattern based on the multi-dimensional transmission trajectory features and generate a collaborative feature vector of trajectory-content association; The edge scoring module is used to receive the collaborative feature vector and input it into the edge lightweight scoring model, output the initial judgment result of the SMS and the credibility score, and when the score is within a preset fuzzy range, trigger the merging of cross-session history trajectory and content fingerprint to construct a user trajectory map. A central processing unit, located at the center, is used to perform depth detection on SMS messages in the fuzzy region. The central processing unit includes: The deep detection module is used to identify whether the SMS message has a jump evolution pattern based on the user trajectory map; if it does, the deep content evolution detection model is executed to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and outputs the final judgment label as the anti-fraud identification result.

[0093] The logic for generating collaborative feature vectors in SMS anti-fraud based on sending trajectory and content recognition: The jump distance is calculated on the geographic coordinate sequence, and trajectory disturbance nodes with irregular distance offsets are screened out to obtain a set of trajectory disturbance nodes; The positional offset analysis of the field order in SMS messages is performed to identify the segments where the field order has changed, thus obtaining a set of structural variation segments; Based on the timestamp distribution of the set of perturbed nodes and the set of structural variation segments, the relative temporal offset between the two in the transmission sequence is calculated; If there are perturbation node-structure segment pairs with an offset time interval less than a set threshold, then pair them as candidate combinations of trajectory-content. For all candidate combinations, calculate the weighted fusion value of trajectory disturbance intensity and structural position offset magnitude, construct a collaborative feature vector and output it for subsequent scoring.

[0094] The structured encoding logic of the collaborative feature vector in SMS anti-fraud based on sending trajectory and content recognition is as follows: The hop distance change and forwarding delay value of each trajectory disturbance node are encoded into a two-dimensional disturbance matrix; Encode the positional offset value and field content difference value of each structural variation segment into a positional variation vector; The perturbation matrix and the position variation vector are concatenated into a joint feature unit, and then the features are fused through a position matching network. Use sparse attention mechanism to filter out the set of joint feature units with high interaction weights; Average pooling is performed on the joint feature unit set to obtain the trajectory-content co-feature vector, which is then output for subsequent model input.

[0095] As a preferred embodiment of the first aspect of the present invention, the construction logic of the edge lightweight scoring model is as follows: The collaborative feature vector is input into a two-branch scoring network with trajectory and content channels to extract trajectory-related features and content-related features respectively. Feature fusion is performed on the extracted feature vectors, and the resulting vectors are input into a fully connected layer and mapped to the scoring space. Perform probability transformation on the output of the scoring space to generate a binary classification output value representing the initial judgment result; The confidence distribution value of the internal response gradient of the fused feature vector is calculated and used as the confidence score. The initial classification label and credibility score of the SMS message are output. SMS messages with credibility scores within a preset fuzzy range are used to trigger the construction of subsequent user trajectory maps.

[0096] The logic for constructing the user trajectory map in SMS anti-fraud based on sending trajectory and content recognition is as follows: Identify SMS messages with credibility scores within a preset fuzzy range and extract their session identifiers and sending times; Retrieve the sending trajectory sequence and content structure element fingerprint sequence corresponding to the session identifier from the historical records; A basic trajectory graph is constructed using the sending trajectory nodes as graph nodes and the temporal order relationships between nodes as graph edges. The corresponding content structure fingerprint is embedded as a node attribute into the trajectory graph to form a structure-enhanced trajectory graph. The structure-enhanced user trajectory map is output to identify jump evolution patterns.

[0097] The identification logic for the jump evolution pattern in the user trajectory map of SMS anti-fraud based on sending trajectory and content recognition is as follows: Based on the geographical span and time interval between nodes in the user's historical trajectory, identify trajectory sub-paths with spatial jumps or temporal anomalies; Edit distance calculation is performed on the structural element fingerprint sequence in each trajectory sub-path to identify content offset nodes appearing in multiple paths; For content offset nodes whose frequency exceeds a set threshold, construct a high-frequency content jump subgraph to form a candidate jump pattern set; Match the graph structure in the jump pattern set with the historical trajectory graph to mark potential jump path segments; Output user trajectory maps that fuse high-frequency jump structures and cross-path segment relationships to support evolutionary recognition.

[0098] The logic for constructing user trajectory maps to support evolutionary recognition in SMS anti-fraud based on sending trajectory and content recognition is as follows: A graph embedding algorithm is used to map each path in the trajectory graph to a fixed-dimensional vector representation; Calculate the structural similarity score between each path using a graph similarity metric function; Path pairs with similarity scores in a specified high similarity range are selected to form a candidate evolutionary path group; The nodes within each path group are sorted by time to form an ordered sequence of content transformations; The output structure is similar and the time series can be sorted, and the content transformation path group is used as the input of the potential evolution path to the next step graph alignment module.

[0099] The identification logic of the jump evolution pattern in SMS anti-fraud based on sending trajectory and content recognition is as follows: The content structure element sequence of the current SMS message is constructed as a graph structure representation, where nodes represent field positions and edges represent structural order. Extract historical content structure diagrams with the same starting field category from the user trajectory graph as candidate evolution references; Perform graph structure alignment operation on the current structure graph and the candidate reference graph, and calculate the node coverage rate and edge matching rate; If the matching rate is higher than the set threshold and the transformation nodes are concentrated in a specific position segment, it is determined that there is a jump evolution mode. Output the recognition result of the jump evolution pattern and trigger the central side model call.

[0100] The processing flow of the SMS anti-fraud center-side deep content evolution detection model based on sending trajectory and content recognition includes: The current content structure element sequence is input into the evolution path discrimination module built on graph neural network; Potential evolutionary path groups identified from the user trajectory map will be used as reference path inputs; Perform path-level similarity aggregation and node mutation mining in graph neural networks; A joint score is given for the structural consistency and content perturbation trend between the current sequence and the reference path group; Output the final judgment label as the anti-fraud detection result for the SMS message.

[0101] Example 3 This embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in Embodiment 1.

[0102] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired or wireless network. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0103] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0104] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0105] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only one method, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0106] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0107] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0108] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A method for preventing SMS fraud based on sending trajectory and content recognition, used for initial judgment and deep detection of SMS messages, characterized in that, Includes the following steps: Step S101: In the edge node, extract the multidimensional sending trajectory features and content structure element sequence of the SMS message. The multidimensional sending trajectory features include hop count, routing path delay, and geographic coordinate sequence. The content structure element sequence includes SMS message structure location and field order. Step S102: Construct a trajectory perturbation pattern based on the multidimensional transmission trajectory features, determine whether the trajectory perturbation nodes and the variation segments of the content structure element sequence are related, and generate a trajectory-content related collaborative feature vector based on the determination result. Step S103: Input the collaborative feature vector into the edge lightweight scoring model to obtain the initial judgment result of the SMS and its credibility score; merge the SMS messages with credibility scores in the preset fuzzy range with their cross-session historical sending trajectory records and historical content fingerprint sequences to construct a user trajectory map; Step S104: Based on the user trajectory map, identify whether the SMS message has a jump evolution pattern; If a jump evolution pattern is identified, the central-side deep content evolution detection model is triggered to perform graph alignment calculations on the current content structure element sequence and historical evolution path, and outputs a final judgment label as the anti-fraud identification result.

2. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 1, characterized in that, The logic for generating the collaborative feature vector: The jump distance is calculated on the geographic coordinate sequence, and trajectory disturbance nodes with irregular distance offsets are screened out to obtain a set of trajectory disturbance nodes; The positional offset analysis of the field order in SMS messages is performed to identify the segments where the field order has changed, thus obtaining a set of structural variation segments; Based on the timestamp distribution of the set of perturbed nodes and the set of structural variation segments, the relative temporal offset between the two in the transmission sequence is calculated; If there are perturbation node-structure segment pairs with an offset time interval less than a set threshold, then pair them as candidate combinations of trajectory-content. For all candidate combinations, calculate the weighted fusion value of trajectory disturbance intensity and structural position offset magnitude, construct a collaborative feature vector and output it for subsequent scoring.

3. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 2, characterized in that, The structured encoding logic of the collaborative feature vector is as follows: The hop distance change and forwarding delay value of each trajectory disturbance node are encoded into a two-dimensional disturbance matrix; Encode the positional offset value and field content difference value of each structural variation segment into a positional variation vector; The perturbation matrix and the position variation vector are concatenated into a joint feature unit, and then the features are fused through a position matching network. Use sparse attention mechanism to filter out the set of joint feature units with high interaction weights; Average pooling is performed on the joint feature unit set to obtain the trajectory-content co-feature vector, which is then output for subsequent model input.

4. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 1, characterized in that, The construction logic of the edge lightweight scoring model is as follows: The collaborative feature vector is input into a two-branch scoring network with trajectory and content channels to extract trajectory-related features and content-related features respectively. Feature fusion is performed on the extracted feature vectors, and the resulting vectors are input into a fully connected layer and mapped to the scoring space. Perform probability transformation on the output of the scoring space to generate a binary classification output value representing the initial judgment result; The confidence distribution value of the internal response gradient of the fused feature vector is calculated and used as the confidence score. The initial classification label and credibility score of the SMS message are output. SMS messages with credibility scores within a preset fuzzy range are used to trigger the construction of subsequent user trajectory maps.

5. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 4, characterized in that, The logic for constructing the user trajectory map is as follows: Identify SMS messages with credibility scores within a preset fuzzy range and extract their session identifiers and sending times; Retrieve the sending trajectory sequence and content structure element fingerprint sequence corresponding to the session identifier from the historical records; A basic trajectory graph is constructed using the sending trajectory nodes as graph nodes and the temporal order relationships between nodes as graph edges. The corresponding content structure fingerprint is embedded as a node attribute into the trajectory graph to form a structure-enhanced trajectory graph. The output structure-enhanced user trajectory map is used to identify jump evolution patterns.

6. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 5, characterized in that, The identification logic for the jump evolution pattern in the user trajectory map is as follows: Based on the geographical span and time interval between nodes in the user's historical trajectory, identify trajectory sub-paths with spatial jumps or temporal anomalies; Edit distance calculation is performed on the structural element fingerprint sequence in each trajectory sub-path to identify content offset nodes appearing in multiple paths; For content offset nodes whose frequency exceeds a set threshold, construct a high-frequency content jump subgraph to form a candidate jump pattern set; Match the graph structure in the jump pattern set with the historical trajectory graph to mark potential jump path segments; Output user trajectory maps that fuse high-frequency jump structures and cross-path segment relationships to support evolutionary recognition.

7. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 6, characterized in that, The logic for constructing the user trajectory map to support evolutionary recognition is as follows: A graph embedding algorithm is used to map each path in the trajectory graph to a fixed-dimensional vector representation; Calculate the structural similarity score between each path using a graph similarity metric function; Path pairs with similarity scores in a specified high similarity range are selected to form a candidate evolutionary path group; The nodes within each path group are sorted by time to form an ordered sequence of content transformations; The output structure is similar and the time series can be sorted, and the content transformation path group is used as the input of the potential evolution path to the next step graph alignment module.

8. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 1, characterized in that, The identification logic for the leapfrog evolution pattern is as follows: The content structure element sequence of the current SMS message is constructed as a graph structure representation, where nodes represent field positions and edges represent structural order. Extract historical content structure diagrams with the same starting field category from the user trajectory graph as candidate evolution references; Perform graph structure alignment operation on the current structure graph and the candidate reference graph, and calculate the node coverage rate and edge matching rate; If the matching rate is higher than the set threshold and the transformation nodes are concentrated in a specific position segment, it is determined that there is a jump evolution mode. Output the recognition result of the jump evolution pattern and trigger the central side model call.

9. The SMS anti-fraud method based on sending trajectory and content recognition according to claim 8, characterized in that, The processing flow of the center-side deep content evolution detection model includes: The current content structure element sequence is input into the evolution path discrimination module built on graph neural network; Potential evolutionary path groups identified from the user trajectory map will be used as reference path inputs; Perform path-level similarity aggregation and node mutation mining in graph neural networks; A joint score is given for the structural consistency and content perturbation trend between the current sequence and the reference path group; Output the final judgment label as the anti-fraud detection result for the SMS message.

10. A text message anti-fraud system based on sending trajectory and content recognition, used to implement the text message anti-fraud method based on sending trajectory and content recognition as described in any one of claims 1-9, characterized in that, It includes an edge processing unit located on the edge side and a center processing unit located on the center side, which are connected through a communication interface; An edge processing unit, disposed on the edge side, is used to perform preliminary feature extraction and discrimination of SMS messages. The edge processing unit includes: The feature extraction module is used to extract multidimensional sending trajectory features and content structure element sequences of the target SMS message; The trajectory association construction module is used to construct a trajectory perturbation pattern based on the multi-dimensional transmission trajectory features and generate a collaborative feature vector of trajectory-content association; The edge scoring module is used to receive the collaborative feature vector and input it into the edge lightweight scoring model, output the initial judgment result of the SMS and the credibility score, and when the score is within a preset fuzzy range, trigger the merging of cross-session history trajectory and content fingerprint to construct a user trajectory map. A central processing unit, located at the center, is used to perform depth detection on SMS messages in the fuzzy region. The central processing unit includes: The deep detection module is used to identify whether the SMS message has a jump evolution pattern based on the user trajectory map; if it does, the deep content evolution detection model is executed to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and outputs the final judgment label as the anti-fraud identification result.

Images