A short message anti-fraud method and system based on sending trajectory and content identification

Abstract

The application discloses a short message anti-fraud method and system based on sending track and content identification, relates to the field of communication security and anti-fraud technology, and extracts multi-dimensional sending track features and content structure element sequences of a short message at an edge node; constructs a disturbance mode based on the track features, judges the time sequence coupling relationship with a content variation section, and generates a track-content collaborative feature vector; uses a lightweight scoring model to preliminarily judge the collaborative feature vector, obtains a classification label and a credibility score; constructs a user track graph for a short message with a score in a fuzzy interval, and identifies a potential cross-hop evolution mode therein; if there is an evolution sign, a central side graph alignment and evolution path discrimination model is called, a final judgment anti-fraud result is output, a path camouflage and structure disturbance collaborative attack that is difficult to capture by a traditional detection method is identified, and the application is suitable for a real-time fraud detection system on an edge intelligent device.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication security and anti-fraud technology, in particular to a short message anti-fraud method and system based on sending trajectory and content recognition. BACKGROUND

[0002] With the complication of network environment and diversification of communication means, short messages as a common notification and verification carrier are facing increasingly complex fraud attack risks. Traditional short message anti-fraud methods are mostly based on fixed keyword matching, blacklist rules, URL analysis or communication statistics features, which have certain effects in conventional scenarios, but their recognition ability is limited in the face of advanced persistent (APT) attacks, cross-hop transformed links, template disturbance and structural reorganization, especially in the following two typical problems:

[0003] 1. Path camouflage problem: attackers hide the real sending source by using non-typical network forwarding paths, such as relay hopping or VPN proxy, which causes discontinuity in the geographical distribution between base stations or abnormal forwarding delay, making it difficult to map the path features to normal behavior patterns.

[0004] 2. Structural perturbation problem: attackers slightly disturb the original short message template field order, position and content details, such as moving the "payment code" field position forward or inserting meaningless fields, to evade static rules and form "evolutionary version" disguised short messages, which maintain the fraud function in semantics while avoiding traditional rule libraries.

[0005] Currently, there is still a lack of fraud recognition methods that combine trajectory behavior and content structure joint analysis. If only one dimension of path or content is judged independently, it is often difficult to identify cross-path evolution fraud behavior. However, if a correlation mechanism between "path disturbance" and "content variation" is established, a collaborative detection framework can be formed, which is expected to greatly improve the recognition ability of path manipulation + content evolution type short message fraud.

[0006] In view of this, the present application provides a short message anti-fraud method and system based on sending trajectory and content recognition to solve the above problems. SUMMARY

[0007] The purpose of the present application is to provide a short message anti-fraud method and system based on sending trajectory and content recognition, which can quickly make a preliminary judgment and build a trajectory map at the edge, and finally complete deep detection combined with structural evolution path, to improve the detection accuracy and adaptability of the overall anti-fraud system.

[0008] In order to achieve the above purpose, the present application provides the following technical solutions:

[0009] In a first aspect, the present application provides a short message anti-fraud method based on sending trajectory and content identification, which is used for initial judgment and deep detection of short messages, and includes the following steps:

[0010] Step S101: In the edge node, multi-dimensional sending trajectory features and content structure element sequences of the short message are extracted, the multi-dimensional sending trajectory features include hop count, routing path delay, and geographical coordinate sequence, and the content structure element sequences include short message structure position and field order;

[0011] Step S102: A trajectory disturbance mode is constructed based on the multi-dimensional sending trajectory features, and whether the trajectory disturbance node and the variation section of the content structure element sequence have relevance is judged, and a collaborative feature vector of trajectory-content association is generated based on the judgment result;

[0012] Step S103: The collaborative feature vector is input into an edge lightweight scoring model to obtain a short message initial judgment result and a credibility score thereof; short messages with a credibility score in a preset fuzzy interval are merged with their cross-session historical sending trajectory records and historical content fingerprint sequences to construct a user trajectory graph;

[0013] Step S104: Based on the user trajectory graph, whether the short message has a cross-hop evolution mode is identified; if the cross-hop evolution mode is identified, a central side deep content evolution detection model is triggered to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and an end judgment label is output as an anti-fraud identification result.

[0014] As a preferred technical solution of the first aspect of the present application, the generation logic of the collaborative feature vector includes:

[0015] The inter-hop distance of the geographical coordinate sequence is calculated, the trajectory disturbance nodes with irregular distance offset are screened out, and a trajectory disturbance node set is obtained;

[0016] The position offset of the field order of the short message is analyzed, the section in which the field order changes is identified, and a structure variation section set is obtained;

[0017] Based on the timestamp distribution of the disturbance node set and the structure variation section set, the relative time sequence offset of the two in the sending sequence is calculated;

[0018] If there is a disturbance node-structure section pair with an offset time interval less than a set threshold, the pair is paired as a trajectory-content candidate combination;

[0019] The weighted fusion value of the trajectory disturbance strength and the structure position offset amplitude of all candidate combinations is calculated, a collaborative feature vector is constructed and output, and is used for subsequent scoring.

[0020] As a preferred technical solution of the first aspect of the application, the structured coding logic of the collaborative feature vector is:

[0021] The inter-hop distance change value and the forwarding delay value of each trajectory perturbation node are encoded into a two-dimensional perturbation matrix;

[0022] The position offset value and the field content difference value of each structure variation segment are encoded into a position variation vector;

[0023] The perturbation matrix and the position variation vector are spliced into a joint feature unit, and feature fusion is performed thereon through a position matching network;

[0024] A sparse attention mechanism is used to screen out a joint feature unit set with a higher interaction weight;

[0025] The joint feature unit set is subjected to average pooling to obtain a trajectory-content collaborative feature vector and output, which is used for subsequent model input.

[0026] As a preferred technical solution of the first aspect of the application, the construction logic of the edge lightweight scoring model is:

[0027] The collaborative feature vector is input into a double-branch scoring network with a trajectory channel and a content channel to extract trajectory-related features and content-related features, respectively;

[0028] The extracted feature vectors are subjected to feature fusion and input into a fully connected layer to be mapped to a scoring space;

[0029] Probability conversion is performed on the output of the scoring space to generate a binary classification output value representing a preliminary judgment result;

[0030] A confidence distribution value is calculated for the internal response gradient of the fused feature vector as a credibility score;

[0031] The preliminary judgment classification label and the credibility score value of the short message are output, and the short message with a credibility score value in a preset fuzzy interval is used to trigger the construction of a subsequent user trajectory graph.

[0032] As a preferred technical solution of the first aspect of the application, the construction logic of the user trajectory graph is:

[0033] Short messages with a credibility score in a preset fuzzy interval are identified, and their session identifiers and sending times are extracted;

[0034] The sending trajectory sequence and the content structure element fingerprint sequence corresponding to the session identifier are retrieved from the historical records;

[0035] A basic trajectory graph is constructed with sending trajectory nodes as graph nodes and the time sequence relationship between nodes as graph edges;

[0036] Embedding the corresponding content structure fingerprint as a node attribute into the trajectory graph to form a structure-enhanced trajectory graph;

[0037] Outputting the structure-enhanced user trajectory graph for identifying the cross-hop evolution pattern.

[0038] As a preferred technical solution of the first aspect of the application, the identification logic of the cross-hop evolution pattern in the user trajectory graph is:

[0039] According to the geographical span and time interval between nodes in the user historical trajectory, a trajectory sub-path with spatial jump or time anomaly is identified;

[0040] Performing edit distance calculation on the structure element fingerprint sequence in each trajectory sub-path to identify content offset nodes appearing in multiple paths;

[0041] Constructing a high-frequency content jump sub-graph for content offset nodes with an appearance frequency exceeding a set threshold to form a candidate jump pattern set;

[0042] Matching the graph structure in the jump pattern set with the historical trajectory graph to label potential cross-hop path segments;

[0043] Outputting a user trajectory graph that integrates high-frequency jump structure and cross-path segment relationships to support evolution identification.

[0044] As a preferred technical solution of the first aspect of the application, the construction logic of the user trajectory graph for supporting evolution identification is:

[0045] Mapping each path in the trajectory graph to a fixed-dimensional vector representation using a graph embedding algorithm;

[0046] Calculating the structural similarity scores between paths using a graph similarity measure function;

[0047] Selecting path pairs with similarity scores in a specified high-similarity interval to form a candidate evolution path group;

[0048] Time-sorting the internal nodes of each path group and forming an ordered content transformation sequence;

[0049] Outputting the content transformation path group with structural similarity and time sequence orderability as a potential evolution path input to the next graph alignment module.

[0050] As a preferred technical solution of the first aspect of the application, the identification logic of the cross-hop evolution pattern is:

[0051] Constructing the content structure element sequence of the current short message as a graph structure representation, where the nodes represent field positions and the edges represent structure order;

[0052] extracting a historical content structure graph with the same starting field category from a user trajectory graph as a candidate evolution reference;

[0053] performing a graph structure alignment operation on the current structure graph and the candidate reference graph, calculating node coverage and edge matching rate;

[0054] if the matching rate is higher than the set threshold, and the transformed nodes are concentrated in a specific position segment, it is judged that there is a cross-hop evolution mode;

[0055] output the identification result of the cross-hop evolution mode, and trigger the center side model call.

[0056] As a preferred technical solution of the first aspect of the application, the processing flow of the center side deep content evolution detection model includes:

[0057] input the current content structure element sequence into the evolution path discrimination module constructed based on the graph neural network;

[0058] input the potential evolution path group identified from the user trajectory graph as a reference path;

[0059] perform path-level similarity aggregation and node mutation point mining in the graph neural network;

[0060] jointly score the structural consistency and content disturbance trend between the current sequence and the reference path group;

[0061] output the final judgment label as the anti-fraud detection result of the short message.

[0062] Secondly, the application provides a short message anti-fraud system based on sending trajectory and content identification, which is based on the implementation of the first aspect and includes an edge processing unit arranged at the edge side and a center processing unit arranged at the center side, which are connected through a communication interface.

[0063] The edge processing unit is arranged at the edge side and is used for performing preliminary feature extraction and discrimination of the short message, and the edge processing unit includes:

[0064] The feature extraction module is used for extracting multi-dimensional sending trajectory features and content structure element sequences of the target short message.

[0065] The trajectory association construction module is used for constructing a trajectory disturbance mode based on the multi-dimensional sending trajectory features and generating a trajectory-content associated collaborative feature vector.

[0066] The edge scoring module is used for receiving the collaborative feature vector and inputting it into the edge lightweight scoring model, outputting the short message preliminary judgment result and the credibility score, and triggering the merging of cross-session historical trajectories and content fingerprints to construct a user trajectory graph when the score is in a preset fuzzy interval.

[0067] a central processing unit arranged at the center side and configured to perform deep detection on the short message in the fuzzy interval, the central processing unit comprising:

[0068] a deep detection module configured to identify whether the short message has a cross-hop evolution mode based on the user trajectory graph, and if so, perform a deep content evolution detection model to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and output a final judgment label as a fraud identification result.

[0069] In the above technical solution, the present application provides technical effects and advantages:

[0070] The present application realizes high-precision modeling and layered detection of short message anti-fraud behavior by fusing the feature recognition mechanism of sending trajectory and content structure element. Among them, by extracting multi-dimensional sending trajectory features such as base station hopping and path delay, and combining with content structure difference information such as field order and position change, a collaborative feature vector with time sequence coupling relationship is constructed, which can effectively perceive the linkage mode between sending path disturbance and content camouflage, so as to identify the fraud short message with cross-hop evolution characteristics. Further, through the credibility scoring mechanism, the uncertain samples are introduced into the graph construction stage, combined with the user historical trajectory and content evolution sequence, the potential evolution attack path is identified, and through the graph structure alignment and graph neural network discrimination model, the final judgment identification of the evolution type attack short message is realized. The above technical path effectively solves the problem that the traditional method cannot cope with the composite attack problem of path camouflage and content fine-tuning coexisting, and significantly improves the recognition accuracy and behavior trend modeling ability of the anti-fraud system. BRIEF DESCRIPTION OF DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0072] Figure 1 The short message anti-fraud system framework based on sending trajectory and content recognition of the present application.

[0073] Figure 2 The short message anti-fraud method flowchart based on sending trajectory and content recognition of the present application. DETAILED DESCRIPTION

[0074] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art. The drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0075] Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more exemplary embodiments. Numerous specific details are provided in the following description to give a full understanding of exemplary embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure may be practiced with one or more specific details omitted, or methods, components, steps, etc. In other instances, well-known structures, methods, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0076] Example 1

[0077] like Figure 2 As shown, this invention provides a method for SMS anti-fraud based on sending trajectory and content recognition. The edge node refers to a real-time detection module deployed at the access layer of the SMS service platform or at a geographical area gateway. This edge node has the ability to instantly access the sending trajectory and part of the SMS content, and possesses low latency response and basic computing resources; the method includes the following steps:

[0078] Step S101: In the edge node, extract the multidimensional sending trajectory features and content structure element sequence of the SMS message. The multidimensional sending trajectory features include hop count, routing path delay, and geographic coordinate sequence. The content structure element sequence includes SMS message structure location and field order.

[0079] Specifically, when the edge node receives the target SMS message, extracting the multi-dimensional sending trajectory features and content structure element sequence of the SMS message can be achieved by performing the following processing steps:

[0080] Obtain multi-hop forwarding records related to the SMS sending path, parse the route ID and corresponding timestamp of each hop, and construct a trajectory record sequence containing the number of route hops, the delay of each hop, and the geographical location of the hop point;

[0081] Extract the total number of hops, the average delay of the routing path, and the sequence of geographical coordinate changes for each hop from the trajectory recording sequence to form a multi-dimensional transmission trajectory feature set, which is used for subsequent disturbance detection;

[0082] The short message content is field position coded to extract the field start position, end position, field length and original arrangement order to form a content structure element sequence;

[0083] The sending trajectory features and the content structure element sequence are cached in the edge node temporary feature queue as input feature sets for subsequent trajectory disturbance modeling and content association analysis.

[0084] The structured sending trajectory feature set and the content structure element sequence are output for S102 step calling.

[0085] Step S102: Based on the multi-dimensional sending trajectory features, a trajectory disturbance pattern is constructed, and it is judged whether the variation segment of the trajectory disturbance node and the content structure element sequence has relevance, and a trajectory-content association collaborative feature vector is generated based on the judgment result;

[0086] It should be noted that: the abnormal disturbance nodes in the trajectory need to be identified, the variation segment of the content structure needs to be located, and the trajectory-content collaborative feature vector for the edge lightweight scoring model is output through time sequence pairing and feature fusion. The collaborative feature vector encodes the behavior disturbance information and the content structure change information at the same time, enhances the sensitivity and discriminability to the cross-hop and cross-session evolution fraud style.

[0087] Specifically, the generation logic of the collaborative feature vector is:

[0088] The inter-hop distance of the geographic coordinate sequence is calculated, and the trajectory disturbance nodes with irregular distance offset are selected to obtain a trajectory disturbance node set;

[0089] That is, the straight-line distance of the geographic coordinate sequence is calculated hop by hop to obtain an inter-hop distance sequence; the historical inter-hop distance statistics of the same region are compared, and if the deviation degree of a certain inter-hop distance exceeds the deviation threshold set during deployment, the hop point is marked as a trajectory disturbance node, thereby outputting a trajectory disturbance node set containing node ID, timestamp, inter-hop distance deviation value, and corresponding routing segment identifier. By taking the spatial offset as a disturbance indicator, cross-region mutation transfer behavior can be captured; the advantage is that this method relies on intuitive geographic information, has low calculation cost and is easy to run in real time on edge devices, thereby quickly screening out suspicious sending path nodes and reducing subsequent processing amount.

[0090] The field order of the short message is analyzed for position offset to identify the segment where the field order changes to obtain a structure variation segment set;

[0091] It should be noted that the content structure element sequence is indexed according to the field position; the index sequence is compared with the standard template of the service or the index sequence of the historical similar message, and the field position offset vector is calculated; if the position of a field or field group changes beyond the displacement threshold determined during deployment, the corresponding section is marked as a structure variation section, and the variation section start and end fields, variation type (substitution / insertion / deletion) and timestamp are recorded.

[0092] Among them, the field sequence offset reflects the traces of the content template being rewritten or slightly disturbed; this step can be completed at the edge, and the advantage is that it can detect the local rearrangement or insertion behavior made by the attacker to evade content detection from the content structure level, and does not depend on full-text semantic analysis, and the calculation burden is small.

[0093] Based on the timestamp distribution of the disturbance node set and the structure variation segment set, the relative time sequence offset of the two in the sending sequence is calculated;

[0094] It should be noted that the timestamp of each element in the disturbance node set and the structure variation segment set is read; a time sequence offset matrix of disturbance node x variation segment is constructed, and the corresponding routing segment index and message session identifier are recorded, and the relative time sequence offset of the two in the sending sequence is represented through the time sequence offset matrix; each cell in the time sequence offset matrix is:

[0095] ;

[0096] Among them: represents the relative time offset between the disturbance node and the structure variation segment, which is used to represent the time difference between the two in the SMS sending sequence; represents the timestamp of the corresponding disturbance node, and represents the sending time of the hop or routing position (for example, the time when a proxy forwarding node receives the SMS), represents the timestamp of the corresponding structure variation segment, which represents the time when the field structure change is recorded or the content is generated (usually the processing time of the SMS before content editing or sending is completed).

[0097] Based on the time sequence offset matrix, a quantitative basis for measuring whether the trajectory event and the content event occur closely in the same sending window is provided; the advantage is that the concurrency of behavior and content can be proved according to the time sequence, which is an important basis for subsequent pairing determination, thereby reducing the false judgment of pure coincidence.

[0098] If there is a disturbance node-structure segment pair with an offset time interval less than a set threshold, pair it as a trajectory-content candidate combination;

[0099] It should be noted that: for each pair in the time sequence offset matrix, when the offset value does not exceed the pairing window threshold set during deployment, the disturbance node and the variation segment form a candidate pairing entry; for each candidate entry, its route segment similarity index and intra-session occurrence frequency are attached as auxiliary attributes. Therefore, the candidate pairing screening combines time sequence and routing information to screen out combinations that are not related in time or routing; the advantage of this step is to reduce the scale of subsequent fusion calculation through multi-dimensional screening, ensuring the efficiency and feasibility of edge processing.

[0100] The weighted fusion value of the trajectory disturbance intensity and the structural position offset amplitude of all candidate combinations is calculated, a collaborative feature vector is constructed and output, which is used for subsequent scoring.

[0101] It should be noted that: for each candidate pairing, the trajectory disturbance intensity index (such as inter-hop distance deviation, single-hop delay change) and the content offset index (such as field displacement amplitude, field replacement level) are extracted respectively; the two types of indexes are weighted and combined according to the preset fusion weight to form the joint sub-vector of each pair; all joint sub-vectors in the sequence are spliced or aggregated in sequence according to the defined order to obtain the primary collaborative feature vector. The fusion weight and the aggregation strategy are determined by experiments based on historical samples during deployment. Thus, the primary trajectory-content collaborative feature vector output for the edge lightweight scoring model unifies the trajectory and content metrics into a vector space, forming a representation that can express both behavior and structural changes; the advantage is that it can be directly used for lightweight scoring at the edge, reducing false positives and maintaining real-time performance.

[0102] Further description, the construction method of the collaborative feature vector includes:

[0103] The inter-hop distance change value and the forwarding delay value of each trajectory disturbance node are encoded into a two-dimensional disturbance matrix;

[0104] It should be noted that: the trajectory disturbance node in the candidate pairing is constructed into a two-dimensional disturbance matrix, each row of the two-dimensional disturbance matrix corresponds to a disturbance node, column 1 is the inter-hop distance deviation normalized value, column 2 is the single-hop delay change value, and column 3 is the number of hops change identification within the routing segment; save the matrix and the corresponding timestamp mapping. Matrix expression makes multi-dimensional trajectory features structured in subsequent fusion, which is convenient for accurate alignment with content vectors; the advantage is that the data structure is clear and convenient for efficient processing in lightweight neural modules.

[0105] The position offset value and the field content difference value of each structural variation segment are encoded into a position variation vector;

[0106] It should be noted that each structural variation segment is formed into a position variation vector, which includes field start and end index offset, field replacement level encoding (exemplarily, synonymous replacement / similar replacement / new field three types of encoding), and the number of occurrences of the variation segment in the session. The structural variation is encoded as a discrete vector, which facilitates numerical comparison and alignment of trajectory features; the advantage is that the type information of the variation can be retained, which helps to distinguish between malicious disturbance and normal template variants.

[0107] The disturbance matrix and the position variation vector are spliced into a joint feature unit, and feature fusion is performed thereon through a position matching network.

[0108] It should be noted that for each candidate pair, the rows of the corresponding two-dimensional disturbance matrix and the position variation vector are spliced into a joint feature unit in chronological order; and a plurality of continuous joint units are input into the position matching network in a time window. The position matching network is a small feedforward network or a lightweight convolutional network, and the input thereof retains time and position index information to support position alignment. The joint feature unit retains the paired information of the trajectory and the structure, and the position matching network can learn the interactive features aligned in time and position; the advantage is that heterogeneous features are effectively fused at low computational cost, which facilitates edge deployment.

[0109] Specifically, the joint feature unit is denoted as:

[0110]

[0111] Among them: represents the geographical jump distance change between the trajectory node and the previous node, which measures whether the path has an abnormal jump (such as a sudden jump over a long distance); represents the forwarding delay offset of the node, which is the difference between the actual delay and the historical or average delay, reflecting whether there is suspicious forwarding behavior (such as detour, hijacking, etc.); represents the hop position of the node in the entire path, which is used to provide its context position in the network forwarding sequence (such as the number of hops); represents the structural position offset of the variation field, which is calculated as the difference between the expected position of the field in the template and the actual occurrence position, reflecting the structural adjustment behavior (such as disturbance of field order); represents the content change degree of the field, which is usually represented by the edit distance (Levenshtein Distance), that is, the minimum modification step number between the content of the field and the historical content, reflecting the semantic variation behavior; represents the context length feature of the field, which measures the context complexity of its position in the short text, reflecting the nesting depth of the content in the structure and the variation influence range.

[0112] ​The joint feature unit set with higher interaction weight is screened out using a sparse attention mechanism;

[0113] It should be noted that the interaction weight between the position matching network output representation calculation unit is calculated, and the sparse selection strategy is used to retain the top-ranked subset of weights and remove units with low weights and small contributions. The screening threshold is determined by experiments during deployment. Sparse screening reduces noise and redundant features, concentrates representation on high-interaction units, thereby improving the discriminant ability of subsequent aggregation; the advantage is to significantly reduce the computational overhead and improve the discriminant accuracy.

[0114] The joint feature unit set is subjected to average pooling to obtain a trajectory-content collaborative feature vector and output, which is used for subsequent model input.

[0115] It should be noted that the effective joint unit set is subjected to average or weighted pooling (the pooling method is determined by the deployment strategy) by column to obtain a fixed-length vector; a simple linear transformation or projection is performed on the vector to match the input dimension of the edge lightweight scoring model; the final trajectory-content collaborative feature vector is output. Pooling integration compresses high-value interactions within a time series into a robust representation, and projection ensures compatibility with subsequent model structures; the advantage is to form a low-dimensional, information-concentrated and quickly computable input representation, which is beneficial to deployment in edge resource-constrained environments.

[0116] Step S103: inputting the collaborative feature vector into the edge lightweight scoring model to obtain a short message preliminary judgment result and a credibility score; merging the short message with a preset fuzzy interval credibility score, constructing a user trajectory graph by merging the cross-session historical sending trajectory record and the historical content fingerprint sequence;

[0117] It should be noted that the edge lightweight scoring model is responsible for fast and distributed processing of clear samples, so only samples with uncertain scores (fuzzy interval) are uploaded to the center node for resource-intensive deep analysis, thereby improving the processing efficiency and resource utilization of the entire system. The trajectory-content collaborative feature vector output in the previous process is input into the edge scoring model to complete the preliminary judgment of whether the short message is suspected of fraud, and a credibility score is output. For short messages with uncertain judgment results (i.e., scores in the fuzzy interval), further analysis of their potential evolution attack features is performed through trajectory graph construction.

[0118] Specifically, the construction logic of the edge lightweight scoring model is as follows:

[0119] The collaborative feature vector is input into a double-branch scoring network with a trajectory channel and a content channel to extract trajectory-related features and content-related features, respectively;

[0120] It should be noted that the edge lightweight scoring model includes two parallel branch channels, the branch channels include a trajectory branch and a content branch, a lightweight convolutional layer or a feedforward network is adopted, the calculation cost is controllable, and the edge deployment is suitable; wherein:

[0121] The trajectory branch extracts spatial behavior features of the encoded skip distance change and time delay offset in the collaborative feature vector;

[0122] The content branch extracts structural variation features of the field position offset and semantic disturbance in the collaborative feature vector;

[0123] The double-channel structure design can decouple and extract trajectory information and content information, so that the model has higher sensitivity when processing different attack types, and the calculation cost is controllable due to the adoption of a lightweight convolutional layer or a feedforward network, and the edge deployment is suitable.

[0124] Feature fusion is performed on the extracted feature vectors, and a full connection layer is input to map to a scoring space;

[0125] It should be noted that the features extracted from the two branches are combined into a unified fusion feature representation, and then mapped to a scoring space through a full connection layer to obtain a scoring vector. Each dimension in the scoring vector represents the model's judgment tendency that the short message belongs to a certain category (normal or suspicious). The trajectory and content information from two sources are integrated into a unified discriminant feature, so that only a vector space needs to be classified subsequently, reducing calculation redundancy.

[0126] Probability conversion is performed on the output of the scoring space to generate a binary classification output value representing the preliminary judgment result;

[0127] It should be noted that after feature fusion, the output numerical vector is essentially the original score of the network. In order to make the model output "suspicious / normal" two labels, the score needs to be converted to a probability value in the 0-1 interval through a probability function (such as Sigmoid), and then a binary classification label ("suspicious short message" or "normal short message") is obtained through threshold judgment. Ensure that the model output can be directly used for real-time discrimination, and the preliminary judgment result can be quickly obtained at the edge node.

[0128] The internal response gradient of the fusion feature vector is calculated to obtain a confidence distribution value as a credibility score;

[0129] It should be noted that in addition to the classification result, the present embodiment also requires the model to output a "credibility score". By calculating the response gradient or entropy value of the fusion feature at each layer in the network, a confidence distribution value of a short message under the discrimination of the model can be obtained. The model's grasp degree of the preliminary judgment conclusion is quantified. When the credibility is very low, the short message can be handed over to the deep detection module on the center side for processing, realizing layered scheduling and saving computing power.

[0130] The preliminary judgment classification label and the credibility score value of the short message are output, and the short message with the credibility score value in the preset fuzzy interval is used to trigger the construction of the subsequent user trajectory graph. As the final comprehensive output stage, the edge lightweight scoring model outputs the preliminary judgment classification label (suspicious / normal) and the credibility score value at the edge: only the short message with the credibility falling in the preset fuzzy interval enters the deeper graph analysis. In this way, both edge real-time response and reasonable allocation of central computing power are ensured.

[0131] Further, the construction logic of the user trajectory graph is as follows:

[0132] The short message with the credibility score in the preset fuzzy interval is identified, and the session identifier and the sending time thereof are extracted;

[0133] That is, the short message with the score in the fuzzy interval (such as between 0.4-0.6) is screened from the output of the edge lightweight scoring model. Such short message cannot be directly judged as normal, nor constitutes direct suspicion, and therefore needs more in-depth analysis. The session identifier (such as Session-ID) and the timestamp thereof are extracted and used as the index key for subsequent query and graph construction.

[0134] The sending trajectory sequence and the content structure element fingerprint sequence corresponding to the session identifier are called from the historical record;

[0135] That is, through the above index information, the entire sending path (base station jump sequence) and the short message content structure (such as field order, length distribution, etc.) of the user or session in the past window period are called out from the local cache or the central database. These information serve as the basic data source for subsequent trajectory graph construction.

[0136] The basic trajectory graph is constructed with the sending trajectory node as the graph node and the time sequence relationship between the nodes as the graph edge;

[0137] That is, the relay base station node or the jump point involved in each sending process is taken as the node of the graph, and the directed edge is established between the nodes in time sequence. The structure of the graph truly restores the spatial path of the short message flow of the user in a time window, providing a graph computing structure basis for subsequent identification of abnormal path.

[0138] The corresponding content structure fingerprint is embedded into the trajectory graph as the node attribute, forming a structure-enhanced trajectory graph;

[0139] That is, the short message content structure information (such as field offset, template position, keyword nesting, etc.) corresponding to each trajectory node is embedded into the graph node attribute in the form of a vector, so that the trajectory graph not only can represent geographical / time sequence information, but also has content semantic expression ability, making it possible to identify the composite attack of "trajectory jump + content evolution" subsequently.

[0140] outputting the structure-enhanced user trajectory graph for identifying the cross-hop evolution pattern.

[0141] That is, the graph structure built after completion integrates the geographic node, forwarding order and content variation information as the input of subsequent "cross-hop evolution pattern recognition". The user trajectory graph supports various algorithm operations such as graph traversal, clustering and matching, and is a key bridge between edge detection and center depth recognition in the application.

[0142] Further, the identification logic of the cross-hop evolution pattern in the user trajectory graph is as follows:

[0143] According to the geographical span and time interval between nodes in the user historical trajectory, the trajectory sub-path with spatial jump or time anomaly is identified;

[0144] It should be noted that the physical geographical distance and time interval of the adjacent node pair (i.e. the short message flow path segment) in the graph are calculated: if the geographical span exceeds the set threshold but the time interval is very short, it means that there is an irregular path jump; if the time interval is too long and the geographical distance is very short, it may mean that there is an implicit transfer or content waiting buffer, and such trajectory segment is marked as "abnormal sub-path" as the key detection object.

[0145] The edit distance of the structure element fingerprint sequence in each trajectory sub-path is calculated to identify the content offset node appearing in multiple paths;

[0146] It should be noted that the "edit distance" calculation (such as Levenshtein) is performed on the short message content structure sequence carried in each sub-path to measure the difference in content structure with the normal path. The node with similar structure but key field position replaced is marked as "content offset node". It helps to capture the "detour - change word - disguise" type of evolution fraud behavior.

[0147] The high-frequency content jump sub-graph of the content offset node appearing with a frequency exceeding a set threshold is constructed to form a candidate jump pattern set;

[0148] It should be noted that the frequency of the content offset node appearing in different trajectories is counted, and the high-frequency jump pattern (such as placing the "verification code" in the first field position in advance) is selected to construct a jump sub-graph. The jump sub-graph is considered as a candidate structure of potential evolution attack path, which will be used for matching later.

[0149] The graph structure in the jump pattern set is matched with the historical trajectory graph to mark the potential cross-hop path segment; the graph matching or sub-graph isomorphism algorithm is used to find the candidate jump sub-graph in the overall trajectory graph Figure 1Structures that are found are considered potential evolutionary path segments and are labeled in the graph for subsequent deep detection calls;

[0150] The user trajectory graph that fuses high-frequency jump structures and cross-path segment relationships is output to support evolution recognition. The final output user trajectory graph is a composite knowledge graph that is labeled with spatial jump trajectory segments, high-frequency content offset nodes, and potential evolutionary path segments. It is the main input for the subsequent "content evolution detection" module and is the key support for detecting "multiple cross-node, cross-content evolutionary attacks."

[0151] Specifically, the construction logic of the user trajectory graph for supporting evolution recognition is as follows:

[0152] Each path in the trajectory graph is mapped to a fixed-dimensional vector representation using a graph embedding algorithm. Each "trajectory path" (i.e., a jump trajectory from the start point to the end point of a message) in the trajectory graph structure is vectorized to enable the input of complex graph structures into subsequent similarity measurement and learning models in the form of fixed-length vectors. The graph embedding method includes but is not limited to:

[0153] Node2Vec: generates path sequences based on node random walk and trains embeddings using word vector models;

[0154] GraphSAGE or GAT: uses graph neural networks to aggregate information based on neighbor structure;

[0155] Or use a custom method to encode the node sequence in the path and its embedded attributes (such as geographic location, timestamp, content summary) into a unified vector.

[0156] Each path embedding results in a fixed-dimensional vector (such as 128 dimensions or 256 dimensions) as a compressed representation of the path.

[0157] The structural similarity score between paths is calculated using a graph similarity measurement function. The structural similarity between two different trajectory paths is measured to determine whether there is a potential "evolution" association. That is, the same fraud attack strategy in different times and different disguises; the similarity calculation is based on:

[0158] Vector distance (such as cosine similarity, Euclidean distance inverse);

[0159] If graph structure encoding is used, the structural similarity can be calculated based on graph isomorphism matching degree or subgraph kernel function;

[0160] The difference in content structure (such as field sequence) can be considered to be integrated into the composite similarity score.

[0161] The score range is generally normalized to [0, 1], and the closer the value is to 1, the more similar it is.

[0162] Filter out path pairs with similarity scores in a specified high similarity interval to form a candidate evolution path group; filter out those highly similar path pairs from all path pairs as potential evolution path candidates to facilitate further focus of the subsequent evolution detection module; set a similarity interval threshold (such as 0.8-1.0), and any path pair with a score falling within this interval will be combined into an evolution group, assuming:

[0163] The first path (original path),

[0164] The second path (fake path),

[0165] If they are structurally consistent or only have small field offsets or node replacements, they form a group, which reduces the amount of comparison and improves the efficiency of evolution identification.

[0166] Time sort the nodes in each path group and form an ordered content transformation sequence; to capture how content evolves over time, each node in the path group needs to be sorted by time and its content structure fingerprint evolution process needs to be tracked; each node originally carries a timestamp (short message forwarding time) and a structure fingerprint (such as field sequence), which is arranged in ascending order by time, forming a content transformation trajectory sequence, exemplarily,

[0167] Path group A:

[0168] Node 1 (10:01): [header, paycode, auth]

[0169] Node 2 (10:03): [paycode, header, auth]

[0170] Node 3 (10:06): [paycode, auth]

[0171] As can be seen, the "paycode" field is moved from the middle to the front and eventually remains as the main field, showing an "evolution simplification" trend.

[0172] Output the content transformation path group with similar structure and time-ordered sequence as the potential evolution path input to the next graph alignment module; the path group with similar structure and time-ordered sequence in the above path group is used as an evolution path candidate set for subsequent modules (such as a graph alignment identifier) for detailed comparison and attack behavior identification; each path group is an input unit that enters the next stage (such as a deep graph alignment model, a GRU sequence comparison module, etc.) for higher-dimensional semantic alignment and strategy identification.

[0173] Step S104: Based on the user trajectory graph, it is identified whether there is a cross-hop evolution pattern in the short message; if it is identified that there is a cross-hop evolution pattern, a central side deep content evolution detection model is triggered to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and an end judgment label is output as a fraud identification result.

[0174] It should be noted that: through graph structure analysis of the user trajectory graph, it is identified whether there is a cross-hop evolution feature; if there is, the abnormal short message is handed over to the central side high complexity content evolution detection model for final judgment, which has multiple key meanings such as fraud closed-loop identification, center-edge cooperation, and hierarchical resource control.

[0175] Specifically, the identification logic of the cross-hop evolution pattern is as follows:

[0176] The content structure element sequence of the current short message is constructed as a graph structure representation, wherein the node represents the field position, and the edge represents the structure order.

[0177] The short message content structure is mapped from a linear sequence (such as [field1, field2, field3]) to a graph structure, which is convenient for subsequent structure comparison and variation identification. Each short message field is a node of the graph (such as “payee”, “payment code”, “timestamp”, etc.); directed edges are established between nodes according to the original order to reflect the content structure flow; node attributes can include field position, field semantic label, fingerprint feature, etc.; the current short message structure is represented as a directed attribute graph.

[0178] The historical content structure graph with the same starting field category is extracted from the user trajectory graph as a candidate evolution reference; those historical structures consistent with the starting field of the current short message are selected as comparable objects to avoid irrelevant comparison. The starting field type (such as the first field being “verification code”, “payee”, “payment code”, etc.) is determined; the historical short message structure graph with the same starting field category is filtered in the trajectory graph; and the structure graph is extracted as a reference set.

[0179] The graph structure alignment operation is performed on the current structure graph and the candidate reference graph, and the node coverage rate and the edge matching rate are calculated; the structure level similarity is evaluated to identify the matching relationship between the current structure and the historical evolution path. The node coverage rate is the number of nodes in the current structure graph that appear in the reference graph (or the field semantics are consistent); the edge matching rate is the proportion of the structure order of the edges in the current graph that is the same as the reference graph; and the graph matching algorithm (such as maximum subgraph isomorphism, structure alignment scoring) is used for scoring calculation.

[0180] If the matching rate is higher than the set threshold, and the transformation node is concentrated in a specific location segment, it is determined that there is a cross-hop evolution mode; it is determined whether the current short message is a structural variant (cross-hop evolution) of the historical attack path. A structural matching threshold (such as node coverage rate > 0.8 and edge matching rate > 0.7) is set; at the same time, it is judged whether the mutation field is concentrated in the sensitive area such as the initial segment or the end segment (for example, the "payment code" is advanced); if the above two conditions are met, it is considered that there is a persistent evolution of the evolution camouflage strategy.

[0181] The identification result of the cross-hop evolution mode is output, and the central side model is called to submit the potential evolution short message judged by the edge to the central side high complexity model for final classification decision, to ensure the balance between resource efficiency and detection accuracy.

[0182] Further, the processing flow of the central side deep content evolution detection model includes:

[0183] The current content structure element sequence is input into an evolution path discrimination module constructed based on a graph neural network; the content structure element sequence of the target short message is converted into a structured short message graph, and is input into an evolution path discrimination module constructed based on a graph neural network. The graph neural network is used to model the deep semantics of the short message structure and its variation mode, to provide feature representation for complex graph alignment calculation.

[0184] In specific implementation, a graph attention network (GAT) or a graph convolution network (GCN) can be used to represent and extract nodes in the structure graph, to obtain a structure encoding vector reflecting the features of the nodes and their neighborhoods. The structure encoding is used as the basis for subsequent alignment and similarity comparison.

[0185] The potential evolution path group identified from the user trajectory graph is input as a reference path; a set of potential historical evolution paths is extracted from the user trajectory graph, which is input into the model as a reference path. Each reference path is represented in the form of a structure graph and its path sequence, and is vectorized and modeled through the same graph neural network coding module as the current short message structure, to obtain the structure representation of multiple reference paths.

[0186] Path-level similarity aggregation and node mutation point mining are performed in the graph neural network; the model further performs path-level similarity aggregation and node mutation point mining in the graph neural network, to compare the similarities and differences between the current path and the historical path at the structure level and the semantic level. In this process, key mutation nodes can be identified, including field insertion, deletion, and order adjustment; at the same time, the concentration degree of the mutation nodes and the change of the sensitive fields are evaluated, to obtain the comprehensive similarity score under multiple reference paths.

[0187] Joint scoring of structural consistency and content disturbance trend between current sequence and reference path set; after alignment and variation identification are completed, the model jointly scores the structural consistency and content disturbance trend between the current short message sequence and the reference path set. This score combines the structural alignment score (involving node and edge similarity) and the field disturbance strength to obtain a floating-point value reflecting the suspiciousness.

[0188] According to the comparison between the floating-point value and the preset threshold, it is determined whether the short message belongs to the extension of the attack evolution track. If the score result exceeds the threshold, a "high risk" label is output; if it does not exceed the threshold, it is labeled as "non-evolution type short message".

[0189] Output the final judgment label as the anti-fraud detection result of the short message. The output final judgment label is used as the anti-fraud detection result of the short message, which clearly identifies whether the current short message belongs to an instance of cross-hop evolution attack. At the same time, the model retains the key judgment process in the process of generating the label, so as to facilitate subsequent traceability analysis and audit tracking.

[0190] Embodiment 2

[0191] This embodiment is based on embodiment 1, and is used to further illustrate the effectiveness of the short message anti-fraud method based on sending track and content identification of the present application. The following will be described in detail in combination with a typical fraudulent short message scenario in actual application.

[0192] In a certain operator network environment, a user receives a suspicious short message A, which contains the content "payment code: please complete payment within 5 minutes". The short message does not pass through the traditional central cluster in the sending process, but is delivered by base station X → transfer node Z → base station Y, and the sending time interval is extremely short. The short message has normal surface content, but in fact it has been processed by structural manipulation and path avoidance, and belongs to a typical cross-hop evolution attack short message.

[0193] S101: Sending track and content structure extraction

[0194] The edge node first performs initial analysis on the short message A to extract its sending track and content structure information:

[0195] The sending track features include:

[0196] Geographic coordinate sequence: ;

[0197] Number of hops = 2;

[0198] Route path delay sequence: .

[0199] The content structure element sequence is parsed as:

[0200] Field Order = [Time Hint Field → Payment Code Field → Description Field];

[0201] Where the "Payment Code" field is inserted in advance in the front, disrupting the original semantic flow.

[0202] S102: Trajectory-Content Collaborative Identification Process:

[0203] Trajectory disturbance identification, inter-jump distance calculation on geographic coordinate sequence, finding that Dist(X, Y) exceeds the regular physical jump threshold, marked as a disturbance node.

[0204] Structural variation identification, position comparison on field position sequence, finding that the "Payment Code" field is moved from the original middle to the front, forming a structural offset segment.

[0205] Time sequence pairing analysis, obtaining the timestamps of the disturbance node and the structural variation segment, calculating the time sequence offset , whose value is less than the preset pairing window , meeting the linkage condition.

[0206] Candidate combination generation, forming a trajectory-content candidate combination with the trajectory disturbance node and the variation field that meet the pairing condition, marked as <Node_Y, Payment Code>.

[0207] Collaborative vector construction, extracting the following six quantitative features to construct the collaborative vector : Where: Dist(X, Y) represents the jump offset amplitude (such as Dist(X, Y) / regular mean); Δt_ZY represents the node routing delay anomaly (such as Δt_ZY exceeding the variance); Pos represents the number of hops (the hop is at the end of the path); Pos represents the "Payment Code" field position offset (such as Pos=2→Pos=1); Semantic difference value (such as semantic fingerprint cosine distance) with historical version; Context nesting variation degree (such as context span change before and after position variation).

[0208] S103: Edge scoring and fuzzy triggering mechanism, the constructed collaborative vector U is input into the edge lightweight scoring model: the model output preliminary judgment result: suspicious; credibility score: 0.53, located in the fuzzy interval [0.4, 0.6]. Since the score is not high enough to confirm fraud, nor is it low enough to pass directly, triggering the subsequent trajectory graph construction and center side evolution detection process.

[0209] Cross-hop evolution detection and final output, trajectory graph construction, extracting the short message conversation trajectory from the user's historical records, constructing the graph:

[0210] Node: base station geographical location;

[0211] Edge: time-oriented edge;

[0212] Node attribute: content structure fingerprint (field order, field semantics).

[0213] The graph shows that the user has a jump record from base station A → B → X → Y in the past two hours, and the field "payment code" appears in advance multiple times, forming a high-frequency structure deviation subgraph.

[0214] Cross-hop evolution recognition, using graph structure alignment and node matching algorithm, identifies that the current short message structure graph is highly consistent with the above historical path graph, and judges that there is a cross-hop evolution feature.

[0215] Deep model final judgment, the center side evolution judgment model based on graph neural network receives input, and the evaluation result is: the content structure evolution degree is high; the path graph and the current node alignment accuracy is high; the output label: evolution type attack short message.

[0216] Embodiment 2

[0217] As Figure 1 shown, the embodiments not described in detail are shown in embodiment 1, and the present application provides a short message anti-fraud system based on sending trajectory and content recognition, including an edge processing unit arranged on the edge side and a center processing unit arranged on the center side, which are connected through a communication interface;

[0218] The edge processing unit is arranged on the edge side and is used for performing preliminary feature extraction and discrimination of the short message, and the edge processing unit comprises:

[0219] The feature extraction module is used for extracting multi-dimensional sending trajectory features and content structure element sequences of the target short message.

[0220] The trajectory correlation construction module is used for constructing a trajectory disturbance mode based on the multi-dimensional sending trajectory features, and generating a trajectory-content correlation collaborative feature vector.

[0221] The edge scoring module is used for receiving the collaborative feature vector and inputting it into the edge lightweight scoring model, outputting the short message preliminary judgment result and the credibility score, and triggering the merging of cross-session historical trajectory and content fingerprint when the score is in the preset fuzzy interval, and constructing a user trajectory graph.

[0222] The center processing unit is arranged on the center side and is used for deep detection of the short message in the fuzzy interval, and the center processing unit comprises:

[0223] A deep detection module is configured to identify whether there is a cross-hop evolution mode in the short message based on the user trajectory graph, and if so, execute a deep content evolution detection model to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and output a final judgment label as a fraud identification result.

[0224] The generation logic of the collaborative feature vector of the short message anti-fraud based on the sending trajectory and content identification is as follows:

[0225] The inter-hop distance of the geographic coordinate sequence is calculated, the trajectory disturbance nodes with irregular distance offset are screened out, and a trajectory disturbance node set is obtained.

[0226] The position offset of the field sequence of the short message is analyzed, the section where the field sequence changes is identified, and a structure variation section set is obtained.

[0227] Based on the timestamp distribution of the disturbance node set and the structure variation section set, the relative time sequence offset of the two in the sending sequence is calculated.

[0228] If there is a disturbance node-structure section pair with an offset time interval less than a set threshold, the pair is matched as a trajectory-content candidate combination.

[0229] The weighted fusion value of the trajectory disturbance strength and the structure position offset amplitude of all candidate combinations is calculated, the collaborative feature vector is constructed and output, and is used for subsequent scoring.

[0230] The structured coding logic of the collaborative feature vector of the short message anti-fraud based on the sending trajectory and content identification is as follows:

[0231] The inter-hop distance change value and the forwarding delay value of each trajectory disturbance node are encoded into a two-dimensional disturbance matrix.

[0232] The position offset value and the field content difference value of each structure variation section are encoded into a position variation vector.

[0233] The disturbance matrix and the position variation vector are spliced into a joint feature unit, and feature fusion is performed thereon through a position matching network.

[0234] The joint feature unit set with a higher interaction weight is screened out using a sparse attention mechanism.

[0235] The joint feature unit set is averaged and pooled to obtain a trajectory-content collaborative feature vector and output, which is used for subsequent model input.

[0236] As a preferred technical solution of the first aspect of the application, the construction logic of the edge lightweight scoring model is as follows:

[0237] The collaborative feature vector is input into a double-branch scoring network with a trajectory channel and a content channel to extract trajectory-related features and content-related features respectively;

[0238] Feature fusion is performed on the extracted feature vectors, and a fully connected layer is input to map to a scoring space;

[0239] Probability conversion is performed on the output of the scoring space to generate a binary classification output value representing the preliminary judgment result;

[0240] The confidence distribution value is calculated as the confidence score based on the internal response gradient of the fused feature vector;

[0241] The preliminary judgment classification label and the confidence score value of the short message are output, and the short message with a confidence score value in a preset fuzzy interval is used to trigger the construction of the subsequent user trajectory graph.

[0242] The construction logic of the user trajectory graph based on the short message anti-fraud of sending trajectory and content identification is as follows:

[0243] The short message with a confidence score in a preset fuzzy interval is identified, and its session identifier and sending time are extracted;

[0244] The sending trajectory sequence and the content structure element fingerprint sequence corresponding to the session identifier are retrieved from the historical records;

[0245] The sending trajectory node is taken as the graph node, and the time sequence relationship between nodes is taken as the graph edge to construct the basic trajectory graph;

[0246] The corresponding content structure fingerprint is embedded into the trajectory graph as a node attribute to form a structure-enhanced trajectory graph;

[0247] The structure-enhanced user trajectory graph is output for identifying the cross-hop evolution mode.

[0248] The identification logic of the cross-hop evolution mode in the user trajectory graph based on the short message anti-fraud of sending trajectory and content identification is as follows:

[0249] According to the geographical span and time interval between nodes in the user historical trajectory, a trajectory sub-path with spatial jump or time anomaly is identified;

[0250] The edit distance calculation is performed on the structure element fingerprint sequence in each trajectory sub-path to identify the content offset nodes appearing in multiple paths;

[0251] The high-frequency content jump sub-graph is constructed for the content offset nodes with an appearance frequency exceeding a set threshold to form a candidate jump mode set;

[0252] The graph structure in the jump mode set is matched with the historical trajectory graph to mark the potential cross-hop path segment;

[0253] Output the user trajectory graph that fuses high-frequency jump structure and cross-path segment relationship to support evolution recognition.

[0254] The construction logic of the user trajectory graph that supports evolution recognition for the short message anti-fraud based on sending trajectory and content recognition is as follows:

[0255] Each path in the trajectory graph is mapped to a fixed-dimensional vector representation using a graph embedding algorithm.

[0256] The structural similarity scores between paths are calculated using a graph similarity measure function.

[0257] Path pairs with similarity scores in a specified high-similarity interval are screened out to form candidate evolution path groups.

[0258] The internal nodes of each path group are time-ordered, and an ordered content transformation sequence is formed.

[0259] The structural similarity and time sequence sortable content transformation path group is output as a potential evolution path input to the next graph alignment module.

[0260] The identification logic of the cross-hop evolution pattern for the short message anti-fraud based on sending trajectory and content recognition is as follows:

[0261] The content structure element sequence of the current short message is constructed as a graph structure representation, where the nodes represent field positions and the edges represent structure order.

[0262] Extract historical content structure graphs with the same starting field category from the user trajectory graph as candidate evolution references.

[0263] Perform graph structure alignment operations on the current structure graph and the candidate reference graph to calculate node coverage and edge matching rate.

[0264] If the matching rate is higher than the set threshold and the transformed nodes are concentrated in a specific position segment, it is determined that there is a cross-hop evolution pattern.

[0265] Output the identification result of the cross-hop evolution pattern and trigger the center-side model call.

[0266] The processing flow of the center-side deep content evolution detection model for the short message anti-fraud based on sending trajectory and content recognition includes:

[0267] Input the current content structure element sequence into the evolution path discrimination module based on graph neural network.

[0268] Input the potential evolution path group identified from the user trajectory graph as a reference path.

[0269] Perform path-level similarity aggregation and node anomaly point mining in the graph neural network.

[0270] jointly score the structural consistency and content disturbance tendency between the current sequence and the reference path set;

[0271] output the final judgment label as the anti-fraud detection result of the short message.

[0272] Embodiment 3

[0273] The embodiment also provides a computer readable storage medium storing a computer program, and the computer program is executed by a processor to implement the steps of the method in the embodiment 1.

[0274] The above-described embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the above-described embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the flow or function described in the embodiments of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired network or a wireless network. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. containing one or more available medium collections. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid state disk.

[0275] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed in the present application can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0276] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0277] In several embodiments provided by the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. For example, the division of the units is merely a logical function division. For example, there can be multiple partitions for one unit or multiple units for one partition according to actual conditions. For example, a plurality of units or components can be combined or integrated into another system, and some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0278] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0279] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can be physically present separately, or two or more units can be integrated into one unit.

[0280] The above only describes some exemplary embodiments of the present application by way of illustration. It is self-evident that those skilled in the art can modify the described embodiments in various manners without departing from the spirit and scope of the present application. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present application.

Claims

1. A short message anti-fraud method based on sending trajectory and content identification, used for preliminary judgment and deep detection of short messages, characterized in that, Comprise the following steps: Step S101: In the edge node, extract the multi-dimensional sending trajectory features and content structure element sequence of the short message, the multi-dimensional sending trajectory features include hop count, routing path delay, geographical coordinate sequence, and the content structure element sequence includes short message structure position and field order; Step S102: Based on the multi-dimensional sending trajectory features, construct a trajectory disturbance mode, and determine whether the trajectory disturbance node and the variation segment of the content structure element sequence have relevance, and generate a collaborative feature vector based on the determination result; Step S103: Input the collaborative feature vector into the edge lightweight scoring model to obtain the short message preliminary judgment result and its credibility score; merge the cross-session historical sending trajectory records and historical content fingerprint sequence of the short message with the credibility score in the preset fuzzy interval, and construct a user trajectory graph; Step S104: Based on the user trajectory graph, identify whether the short message has a cross-hop evolution mode; If the cross-hop evolution mode is identified, trigger the central side deep content evolution detection model to perform graph alignment calculation on the current content structure element sequence and the historical evolution path, and output the final judgment label as the anti-fraud identification result; The identification logic of the cross-hop evolution mode is: The content structure element sequence of the current short message is constructed as a graph structure representation, where the node represents the field position and the edge represents the structure order; Extract the historical content structure graph with the same starting field category from the user trajectory graph as a candidate evolution reference; Perform graph structure alignment operation on the current structure graph and the candidate reference graph, and calculate the node coverage rate and edge matching rate; If the matching rate is higher than the set threshold, and the transformation nodes are concentrated in the sensitive area, the sensitive area includes the starting segment or the tail segment, it is judged that there is a cross-hop evolution mode; Output the identification result of the cross-hop evolution mode and trigger the central side model call. 2.The method of claim 1, wherein, The generation logic of the collaborative feature vector is: Calculate the inter-hop distance of the geographical coordinate sequence, filter out the trajectory disturbance nodes with irregular distance offset, and obtain the trajectory disturbance node set; Perform position offset analysis on the field order of the short message, identify the segment where the field order changes, and obtain the structure variation segment set; Based on the timestamp distribution of the disturbance node set and the structure variation segment set, calculate the relative time sequence offset of both in the sending sequence; If there is a disturbance node-structure segment pair with an offset time interval less than a set threshold, pair it as a trajectory-content candidate combination; Calculate the weighted fusion value of the trajectory disturbance intensity and the structure position offset amplitude of all candidate combinations, construct a collaborative feature vector and output it for subsequent scoring. 3.The method of claim 2, wherein, The structured coding logic of the collaborative feature vector is: Encode the inter-hop distance change value and the forwarding delay value of each trajectory disturbance node into a two-dimensional disturbance matrix; Encode the position offset value and the field content difference value of each structure variation segment into a position variation vector; Concatenate the disturbance matrix and the position variation vector into a joint feature unit, and perform feature fusion through a position matching network; Use the sparse attention mechanism to filter out a joint feature unit set with a higher interaction weight; The trajectory-content collaborative feature vectors are obtained by performing average pooling on the joint feature unit set and outputted for subsequent model input. 4.The method for SMS anti-fraud based on sending trajectory and content identification according to claim 1, characterized in that, The construction logic of the edge lightweight scoring model is as follows: The collaborative feature vectors are inputted into a double-branch scoring network with trajectory channel and content channel to extract trajectory-related features and content-related features respectively; The extracted feature vectors are subjected to feature fusion and inputted into a fully connected layer to be mapped to a scoring space; The output of the scoring space is subjected to probability conversion to generate a binary classification output value representing the preliminary judgment result; The internal response gradient of the fused feature vector is calculated to obtain a confidence distribution value as a credibility score; The preliminary judgment classification label and the credibility score of the short message are outputted, and the short message with the credibility score in the preset fuzzy interval is used to trigger the construction of the subsequent user trajectory graph. 5.The method for SMS anti-fraud based on sending trajectory and content identification according to claim 4, characterized in that, The construction logic of the user trajectory graph is as follows: The short message with the credibility score in the preset fuzzy interval is identified, and the session identifier and sending time thereof are extracted; The sending trajectory sequence and the content structure element fingerprint sequence corresponding to the session identifier are retrieved from the historical records; A basic trajectory graph is constructed with the sending trajectory nodes as graph nodes and the time sequence relationship between the nodes as graph edges; The corresponding content structure fingerprint is embedded into the trajectory graph as a node attribute to form a structure-enhanced trajectory graph; The structure-enhanced user trajectory graph is outputted for identifying the cross-hop evolution mode.

6. The method for SMS anti-fraud based on sending trajectory and content identification according to claim 5, characterized in that, The identification logic of the cross-hop evolution mode in the user trajectory graph is as follows: According to the geographical span and time interval between the nodes in the user historical trajectory, a trajectory sub-path with spatial jump or time anomaly is identified; The structure element fingerprint sequence in each trajectory sub-path is subjected to edit distance calculation to identify content offset nodes appearing in multiple paths; A high-frequency content jump sub-graph is constructed for the content offset nodes with an appearance frequency exceeding a set threshold to form a candidate jump mode set; The graph structure in the jump mode set is matched with the historical trajectory graph to label potential cross-hop path segments; The user trajectory graph fused with the high-frequency jump structure and the cross-path segment relationship is outputted to support evolution identification.

7. The method of claim 6, wherein the method further comprises: The construction logic of the user trajectory graph for supporting evolution identification is as follows: Each path in the trajectory graph is mapped to a fixed-dimensional vector representation by using a graph embedding algorithm; The structural similarity scores between the paths are calculated by using a graph similarity measure function; Path pairs with similarity scores in a specified high-similarity interval are selected to form a candidate evolution path group; The nodes in each path group are time-ordered to form an ordered content transformation sequence; The content transformation path group with structural similarity and time-ordered sequence is outputted as a potential evolution path to be inputted into a subsequent graph alignment module. 8.The method for SMS anti-fraud based on sending trajectory and content identification according to claim 1, wherein, The processing flow of the center-side deep content evolution detection model includes: The current content structure element sequence is inputted into an evolution path discrimination module constructed based on a graph neural network; The potential evolution path group identified from the user trajectory graph is inputted as a reference path; Similarity aggregation at the path level and node mutation point mining are performed in the graph neural network; The structural consistency and content disturbance trend between the current sequence and the reference path group are jointly scored; The final judgment label is outputted as the anti-fraud detection result of the short message.

9. A short message anti-fraud system based on sending trajectory and content identification, for implementing the short message anti-fraud method based on sending trajectory and content identification according to any one of claims 1-8, characterized in that, The edge processing unit is arranged at the edge side and is used for performing preliminary feature extraction and discrimination of the short message, and the edge processing unit comprises: The edge processing unit is arranged at the edge side and is used for performing preliminary feature extraction and discrimination of the short message, and the edge processing unit comprises: The feature extraction module is used for extracting multi-dimensional sending track features and content structure element sequences of the target short message; The track correlation construction module is used for constructing a track disturbance mode based on the multi-dimensional sending track features and generating a track-content correlation collaborative feature vector; The edge scoring module is used for receiving the collaborative feature vector and inputting the collaborative feature vector into an edge lightweight scoring model, outputting a short message preliminary judgment result and a credibility score, and triggering merging of cross-session historical track and content fingerprints to construct a user track graph when the score is in a preset fuzzy interval; The center processing unit is arranged at the center side and is used for performing deep detection on the short message in the fuzzy interval, and the center processing unit comprises: The deep detection module is used for identifying whether the short message has a cross-hop evolution mode based on the user track graph; if yes, performing a deep content evolution detection model, performing graph alignment calculation on the current content structure element sequence and the historical evolution path, and outputting a final judgment label as an anti-fraud recognition result.

Images