Sensitive data detection method and device, electronic equipment and storage medium

Abstract

The invention provides a sensitive data detection method and device, electronic equipment and a storage medium, and belongs to the technical field of artificial intelligence, and the method comprises the steps: inputting communication data to an acceleration preprocessing layer, and obtaining a preliminary risk score; determining a subsequent processing path based on a judgment result of the preliminary risk score; if the subsequent processing path is the first path, directly determining a final classification label; and if the subsequent processing path is the second path, inputting the communication data to an enhanced study and judgment layer to determine a final classification label. According to the invention, a double-layer model architecture design and a data flow control method are adopted, a lightweight acceleration preprocessing layer is used for carrying out large-scale and high-speed preliminary screening on mass inrush data, and then an enhanced study and judgment layer is used for carrying out accurate type division on screened suspicious data, so that the data flow control method is realized at a speed close to that of a lightweight model on the whole. Accuracy close to a heavy weight model is obtained, balance between efficiency and precision is achieved, and production-level requirements are met.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a sensitive data detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid development of digital communication technologies, the amount of information disseminated through telecommunications networks, the internet, and other channels has exploded. Against this backdrop, how to quickly, accurately, and efficiently identify and handle illegal or other sensitive content to maintain network security and protect user interests has become a critical technological need that urgently requires resolution.

[0003] To meet these needs, existing technologies typically employ rule engines and machine learning or deep learning models to detect communication data. For example, matching is performed based on static rules such as preset keywords, call frequency, and transfer amounts; algorithms like Logistic Regression (LR) and Random Forest (RF) are used to train classification models on historical data to identify sensitive features; or models such as Long Short-Term Memory (LSTM) and Transformer are used to analyze text semantics.

[0004] However, the aforementioned existing technical solutions still have significant defects and shortcomings in practical applications. Rule-based engines rely too heavily on manually set rules, failing to cover all occurrence patterns of sensitive content and resulting in a high false positive rate. Traditional machine learning-based detection methods are weak in processing unstructured data (such as speech and text) and require frequent manual parameter tuning. Deep learning model-based detection methods suffer from poor real-time performance, making it difficult to meet the second-level response requirements of massive data in telecommunications networks. Summary of the Invention

[0005] This invention provides a sensitive data detection method, apparatus, electronic device, and storage medium to solve the problem that existing technologies cannot achieve a balance between real-time performance and accuracy, and are unable to cope with the rapid iteration of sensitive data presentation methods.

[0006] This invention provides a method for detecting sensitive data, comprising the following steps: The communication data to be detected is input into the accelerated preprocessing layer to obtain a preliminary risk score output by the accelerated preprocessing layer; Based on the preliminary risk score, the subsequent processing path for the communication data is determined. If the subsequent processing path is the first path, then a final classification label is determined based on the preliminary risk score; If the subsequent processing path is the second path, the communication data is input to the enhanced judgment layer to determine a final classification label based on the output of the enhanced judgment layer. The preliminary risk score represents the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to represent the sensitivity category to which the communication data belongs.

[0007] According to a sensitive data detection method provided by the present invention, the communication data includes structured data and unstructured communication content; The step of inputting the communication data to be detected into the accelerated preprocessing layer includes: Extract text features from the unstructured communication content; The structured data and the text features are input together into the accelerated preprocessing layer.

[0008] According to a sensitive data detection method provided by the present invention, the text feature is a set of weight values ​​characterizing the importance of each keyword in the unstructured communication content; The weight value corresponding to each keyword is determined based on the keyword's term frequency and the keyword's inverse document frequency; The term frequency is the frequency at which the keyword appears in the unstructured communication content, and the inverse document frequency is a measure of the rarity of the keyword in the historical communication content sample library. The measure is inversely proportional to the number of documents containing the keyword in the historical communication content sample library. The historical communication content sample library includes multiple historical communication content samples marked as containing sensitive content and multiple historical communication content samples marked as not containing sensitive content.

[0009] According to a sensitive data detection method provided by the present invention, the accelerated preprocessing layer includes multiple parallel sub-models, each of which is trained to identify a specific type of sensitive data; The step of inputting the communication data to be detected into the accelerated preprocessing layer and obtaining the preliminary risk score output by the accelerated preprocessing layer includes: The communication data is input into each of the sub-models to obtain the individual rating results output by each sub-model; Output the highest score among all the individual ratings as the preliminary risk score; The individual score output by any sub-model represents the probability that the communication data identified by any sub-model contains sensitive data of a specific type.

[0010] According to a sensitive data detection method provided by the present invention, the discrimination conditions for determining the preliminary risk score are dynamically adjusted; wherein the discrimination conditions are dynamically determined based on the following steps: The trigger frequency of each specific type of sensitive data within a preset time window is obtained, and the current characteristic change of each specific type of sensitive data is determined based on the trigger frequency; For a target sub-model trained to identify each specific type of sensitive data, the historical discrimination threshold of the target sub-model in the previous detection period is corrected based on the current feature change amount of the specific type of sensitive data and the preset basic discrimination threshold, so as to obtain the current sensitive discrimination threshold of the current detection period. Determine the current sensitivity threshold of the sub-model with the highest score among all the individual scores in the current detection period, so as to determine the sensitivity interval of the current detection period; Based on the relationship between the preliminary risk score and the sensitive discrimination interval, the discrimination conditions for the current detection cycle are determined.

[0011] According to the sensitive data detection method provided by the present invention, the discrimination condition is specifically as follows: When the initial risk score is greater than the maximum value of the sensitivity discrimination interval, the subsequent processing path for the communication data is determined to be the first path, and the final classification label is determined to be abnormal. When the initial risk score is less than the minimum value of the sensitivity discrimination interval, the subsequent processing path for the communication data is determined to be the first path, and the final classification label is determined to be normal. When the preliminary risk score is within the sensitive discrimination interval, the subsequent processing path for the communication data is determined to be the second path.

[0012] A sensitive data detection method provided by the present invention further includes: Receive model configuration instructions sent from the model rule configuration backend; In response to the model configuration command, the text features or structured data processing rules associated with any of the sub-models in the accelerated preprocessing layer are modified; The model configuration instructions are generated based on a user-configurable rule management interface, which is the front-end interface of the model rule configuration backend.

[0013] According to a sensitive data detection method provided by the present invention, after receiving the communication data, the pre-trained language model further includes: Dynamic proportional word masking is performed on the unstructured communication content in the input communication data; And / or the pre-trained language model compresses high-dimensional semantic vectors into preset low-dimensional semantic vectors through feature distillation.

[0014] According to a sensitive data detection method provided by the present invention, before inputting the communication data to be detected into the acceleration preprocessing layer, the method includes: Acquire the voice data stream; The voice data stream is transcribed to obtain the unstructured communication content; After acquiring the voice data stream, the process also includes: Extract voiceprint features from the speech data stream; The voiceprint features are input into the voiceprint analysis module to obtain the voice identity analysis results output by the voiceprint analysis module; The voice identity analysis results are used as reference information to determine the final classification label.

[0015] According to a sensitive data detection method provided by the present invention, the step of inputting the voiceprint features into a voiceprint analysis module and obtaining the voice identity analysis result output by the voiceprint analysis module adopts at least one of the following implementation methods: The voiceprint analysis module is used to compare the voiceprint features with the blacklist voiceprint database to generate the voice identity analysis result. The voiceprint analysis module is used to perform cluster analysis on multiple voiceprint features from different communication data, so as to determine the voice identity analysis result based on the correlation between all the voiceprint features obtained by the cluster analysis. The voiceprint analysis module is used to detect the matching degree between the voiceprint features associated with a single communication number and other voiceprint features associated with the single communication number collected within a preset time period, so as to generate the voice identity analysis result based on the matching degree.

[0016] The present invention also provides a sensitive data detection device, comprising: The preliminary risk assessment unit is used to input the communication data to be detected into the accelerated preprocessing layer and obtain a preliminary risk score output by the accelerated preprocessing layer. The data detection and diversion unit is used to determine the subsequent processing path of the communication data based on the judgment result of the preliminary risk score. If the subsequent processing path is the first path, then a final classification label is determined based on the preliminary risk score; If the subsequent processing path is the second path, then the communication data is input to the data enhancement and analysis unit; The data augmentation and analysis unit determines a final classification label based on the communication data; The preliminary risk score represents the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to represent the sensitivity category to which the communication data belongs.

[0017] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the sensitive data detection method as described above.

[0018] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the sensitive data detection method as described above.

[0019] The sensitive data detection method, device, electronic device, and storage medium provided by this invention adopt a two-layer model architecture design and data flow control method. It uses a lightweight accelerated preprocessing layer to perform large-scale and high-speed preliminary screening of massive influx of data, and then uses an enhanced judgment layer to accurately classify the screened suspicious data. Thus, it achieves an accuracy close to that of a heavyweight model at a speed close to that of a lightweight model, achieving a balance between efficiency and accuracy and meeting production-grade requirements. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the sensitive data detection method provided by the present invention.

[0022] Figure 2 This is a schematic diagram of the process for updating the judgment criteria of the preliminary risk score provided by the present invention.

[0023] Figure 3 This is a schematic diagram of the system architecture of the sensitive data detection method provided by the present invention.

[0024] Figure 4 This is a schematic diagram of the sensitive data detection device provided by the present invention.

[0025] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. Those skilled in the art will understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0028] The sensitive data detection method, apparatus, electronic device, and storage medium provided by this invention specifically relate to a real-time early warning method for sensitive data based on the fusion of deep learning and natural language processing technologies. This method is applicable to the intelligent analysis of massive amounts of sensitive data in scenarios such as finance, customer service, and express delivery. The following is a detailed explanation... Figures 1-5 The technical solutions in the embodiments of the present invention will be clearly and completely described. It should be noted that the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0029] Figure 1 This is a flowchart illustrating the sensitive data detection method provided by the present invention, as shown below. Figure 1 As shown in the figure, this embodiment provides a sensitive data detection method, the execution subject of which can be a logical sensitive data detection system or an electronic device (such as a server) that physically carries the system. It aims to solve the technical problem of balancing detection accuracy and processing efficiency when processing massive amounts of real-time data, and can be applied to scenarios such as telecommunications network security and internet content moderation. The method specifically includes the following steps: First, the communication data to be detected is input into the accelerated preprocessing layer to obtain a preliminary risk score output by the accelerated preprocessing layer.

[0030] In this embodiment, the communication data to be detected refers to communication information in digital form that requires content security analysis. Its specific form may include, but is not limited to, a voice data stream, a text message, an email, or a web post. The communication data can be acquired in real-time or in batches.

[0031] The accelerated preprocessing layer is the first-level processing unit in the two-layer architecture proposed in this invention, used to perform rapid preliminary analysis on all received communication data to be detected.

[0032] In a specific implementation, the accelerated preprocessing layer can consist of one or more computational models or rule sets, designed primarily for low computational complexity and high processing speed to meet the real-time requirements of large-scale data streams. When the communication data to be detected is input into the accelerated preprocessing layer, it analyzes the data and outputs a preliminary risk score.

[0033] The preliminary risk score is a numerical value output by the accelerated preprocessing layer, used to characterize the probability that the communication data contains sensitive data. In this invention, "sensitive data" can refer to different types of content depending on the application scenario, such as telecommunications fraud information, illegal online content, or abnormal transaction data in financial risk control.

[0034] In one optional implementation, the initial risk score can be normalized to the [0, 1] interval. Obtaining this initial risk score provides a quantitative basis for subsequent decision-making steps.

[0035] Secondly, based on the preliminary risk score, the subsequent processing path for the communication data is determined.

[0036] After obtaining a preliminary risk score, the system will assess its clarification, determining whether it is sufficient for making a final classification decision. Based on this assessment, the system will determine a subsequent processing path for the communication data. The subsequent processing path is a predefined logical flow for differentiated processing of data with different risk levels. This invention defines at least two subsequent processing paths to optimize the allocation of computing resources.

[0037] Specifically, if the subsequent processing path is the first path, a final classification label is determined based on the preliminary risk score. The first path is a processing flow designed for communication data whose preliminary risk score determination results are considered clear. This path is selected when the system determines that no more complex analysis is needed. Under the first path, the system directly determines the final classification based on the obtained preliminary risk score value. For example, a preset judgment rule can be used: when the preliminary risk score is higher than a preset high threshold, the final classification label is determined to be "high risk" or "abnormal"; when the score is lower than a preset low threshold, it is determined to be "normal".

[0038] Accordingly, if the subsequent processing path is the second path, the communication data is input to the enhanced analysis layer to determine a final classification label based on the output of the enhanced analysis layer.

[0039] The second path is a processing procedure designed for communication data whose initial risk score is deemed ambiguous or questionable.

[0040] The enhanced analysis layer is the second-level processing unit in the two-layer architecture of this invention. Its design prioritizes high analytical accuracy and can be composed of one or more complex deep network models. These deep network models possess the ability to perform deep semantic understanding of communication content, uncovering deep features that the preprocessing layer failed to identify. When communication data is input to the enhanced analysis layer, it performs deep analysis on the reliable data and outputs corresponding analysis results. The system determines the final classification label of the communication data based on the output of the enhanced analysis layer.

[0041] The final classification label is the final output of this method's processing flow. It is a qualitative identifier used to characterize the sensitivity category to which the communication data belongs. As a qualitative identifier, it can be a discrete category name rather than a continuous numerical value. For example, the qualitative identifier can be "high risk," "low risk," "normal," or a more specific sensitive content subtype, such as "impersonating customer service" or "illegal advertising." This final classification label can be directly used by downstream business systems.

[0042] The sensitive data detection method provided by this invention adopts a two-layer model architecture design and data flow control method. It uses a lightweight accelerated preprocessing layer to perform large-scale and high-speed preliminary screening of massive influx of data, and then uses an enhanced judgment layer to accurately classify the screened suspicious data. Thus, it achieves an accuracy close to that of a heavyweight model at a speed close to that of a lightweight model, achieving a balance between efficiency and accuracy and meeting production-level requirements.

[0043] As an optional embodiment, the communication data includes structured data and unstructured communication content; The step of inputting the communication data to be detected into the accelerated preprocessing layer includes: Extract text features from the unstructured communication content; The structured data and the text features are input together into the accelerated preprocessing layer.

[0044] The communication data to be detected provided by this invention is composed of two different types of data, and the accelerated preprocessing layer will fuse these two different types of data.

[0045] In a specific application scenario, when the system receives a raw telephone call data stream, the information contained in the data stream can be decomposed into two main parts: One part is unstructured communication content, mainly referring to free-flowing natural language information without a fixed format. In this embodiment, the most typical unstructured communication content is the text of the conversation obtained by converting the original call recording using speech-to-text technology. For example, the text content might be: "Hello, this is XX customer service. Your personal loan account has an anomaly and you need to cooperate with us to investigate your funds..."

[0046] The other part is structured data, which refers to data with clearly defined fields and fixed formats. In this embodiment, structured data may include, but is not limited to: communication signaling information, system configuration list information, and other related data.

[0047] The communication signaling information may include information reflecting the behavioral characteristics of communication, such as the calling number, the called number, the location of the number, whether it is an overseas call, the call duration, and the call frequency.

[0048] The list information configured in the system can be a pre-maintained blacklist of known fraudulent numbers, or a protected whitelist that is not easily misjudged.

[0049] In some implementations, other associated data may include structured numerical representations such as speaker voiceprint feature vectors extracted from the call audio.

[0050] Considering that the computational model within the accelerated preprocessing layer may not be able to directly process the raw text strings, a crucial preprocessing step can be performed on the unstructured communication content before inputting it into the accelerated preprocessing layer. This involves extracting computable and quantifiable text features from the unstructured communication content. In an optional implementation, this step can be accomplished by calculating the weights of keywords in the text, such as "credit limit," "account verification," and "security authentication code," thereby transforming a piece of spoken text into a feature vector composed of keywords and their importance scores.

[0051] After text feature extraction is completed, this embodiment can perform an input fusion step, that is, input the structured data and text features together into the accelerated preprocessing layer. In other words, when the accelerated preprocessing layer performs analysis, the input it receives is a feature set that combines two different types of data.

[0052] For example, when the accelerated preprocessing layer analyzes call speech, it obtains the following set of features: (1) Text features extracted from the text, such as the keyword "credit limit" appearing, have a weight of 0.8; the keyword "account verification" appears, with a weight of 0.9.

[0053] (2) Directly obtained structured data, such as the feature "whether it is an overseas call" = yes; the feature "caller number is on the blacklist" = yes; the feature "call duration" = 350 seconds.

[0054] The computational model inside the accelerated preprocessing layer takes into account all these feature sets to calculate the final preliminary risk score. For example, its internal probability model calculates P(sensitive | "credit limit" appears AND is an overseas call AND hits the blacklist...).

[0055] The sensitive data detection method provided by this invention achieves feature fusion of structured data and unstructured communication content at the accelerated preprocessing layer. This makes the generation of preliminary risk scores no longer solely dependent on a single call content or a single call behavior. Instead, it integrates the content and behavioral features of the communication to make a more comprehensive and reliable preliminary judgment than analysis of a single data source, thereby greatly improving the recognition accuracy of the entire detection method.

[0056] Based on the above embodiments, as an optional embodiment, this invention will be described in detail how it generates a set of quantifiable text features that characterize the importance of the content from unstructured communication content.

[0057] This invention can extract text features from unstructured communication content (such as call scripts). Each text feature is a set of weighted values ​​representing the importance of keywords within the unstructured communication content. It can be understood that a text feature is not a single numerical value, but rather a set of weighted values ​​that together form a numerical vector representing the core semantics of the communication content. Specifically, each value in this set of weighted values ​​corresponds to a keyword in the communication content and is used to measure the importance of that keyword in determining the sensitivity of the content.

[0058] To obtain the weight value corresponding to each keyword, this embodiment discloses a specific determination method, which is based on two dimensions: the term frequency (TF) of the keyword and the inverse document frequency (IDF) of the keyword.

[0059] Term frequency (TF) refers to the frequency with which keywords appear in unstructured communication content. It can be determined by statistically analyzing the importance of each keyword within a single communication. For example, if the keyword "account verification" appears multiple times in an unstructured communication, it has a high TF.

[0060] Inverse document frequency (IVF) is a metric used to assess the rarity of keywords in a historical communication content sample. This metric aims to increase the importance of highly distinctive keywords that appear only in specific types of communication content, while suppressing the importance of generic terms that are prevalent across various communication content types. The magnitude of IVF is inversely proportional to the number of documents in the historical communication content sample containing the keyword. Specifically, the rarer a keyword is in the historical communication content sample (i.e., the fewer documents containing it), the higher its IVF value; conversely, if a keyword appears in the vast majority of documents (such as generic terms), its IVF value will approach zero.

[0061] The historical communication content sample library is a pre-built corpus collection directly related to the application field of this invention. Specifically, it includes: multiple historical communication content samples that have been marked as containing sensitive content, and multiple historical communication content samples that have been marked as not containing sensitive content.

[0062] In a preferred embodiment, to adapt to the continuous evolution of language related to sensitive content, this embodiment introduces a dynamic weight adjustment mechanism, which is mainly achieved by updating the inverse document frequency metric in real time and dynamically. The update process may include, but is not limited to, the following steps: (1) Before deployment, the system can calculate and store an initial inverse document frequency dictionary offline based on a large-scale historical communication content sample library.

[0063] (2) In the actual detection process, the newly received communication data is regarded as a streaming dataset. A sliding window or small batch processing method can be used. For example, an update calculation is triggered every time a preset number (such as 10,000) of new communication data is processed. On the data in the current window or batch, the system will re-count the document frequency of each keyword and, in combination with historical statistical information, recalculate and update the above inverse document frequency dictionary.

[0064] This dynamic weighting mechanism allows keyword weights to be determined in a way that keeps pace with changes in the linguistic environment. For example, when a new sensitive term (such as "frozen digital wallets") emerges and increases in frequency, it will receive a higher inverse document frequency (IVF) metric in new data batches because its overall number of occurrences is still relatively small, and its weight will be dynamically increased. Conversely, if an old sensitive term becomes widely known and frequently appears in normal communication, its document frequency will increase, causing its IVF metric to dynamically decrease, and its weight to drop accordingly.

[0065] Ultimately, the weight value for each keyword can be obtained by combining (e.g., multiplying) the keyword's term frequency with its inverse document frequency metric. By performing this calculation on all identified keywords, a complete set of weight values ​​as text features can be generated.

[0066] This invention provides an efficient and dynamically adaptable text feature extraction method. By combining word frequency with inverse document frequency calculated based on a professional domain sample library and introducing a dynamic weight adjustment mechanism, the generated text features can accurately characterize the core semantics and sensitivity of the communication content. This provides high-quality input for accelerating the preprocessing layer to perform reliable preliminary risk scoring and improves the performance of the entire detection method.

[0067] Based on the above embodiments, as an optional embodiment, the accelerated preprocessing layer includes multiple parallel sub-models, each of which is trained to identify a specific type of sensitive data; the step of inputting the communication data to be detected into the accelerated preprocessing layer to obtain a preliminary risk score output by the accelerated preprocessing layer includes: inputting the communication data into each of the sub-models respectively to obtain an individual score result output by each sub-model; outputting the highest score among all the individual score results as the preliminary risk score; the individual score result output by any sub-model represents the probability that the communication data identified by any sub-model contains its corresponding specific type of sensitive data.

[0068] This embodiment will describe in detail the internal architecture of the accelerated preprocessing layer and the specific process of generating the preliminary risk score.

[0069] In one specific implementation, the accelerated preprocessing layer is not a single, macroscopic computational model, but rather includes multiple parallel sub-models, each of which is a lightweight classifier or rule set. This architecture is designed to achieve fine-grained, specialized identification of different types of sensitive content.

[0070] It should be noted that, in order to ensure that each sub-model has specialized recognition capabilities, each sub-model is trained to identify a specific type of sensitive data. For example, in a telecommunications anti-fraud application scenario, separate sub-models can be trained for different types of fraud, such as a sub-model specifically for identifying "impersonating financial customer service" content, another sub-model specifically for identifying "brushing rebates" content, and several other sub-models corresponding to different sensitive content scenarios.

[0071] This embodiment further clarifies the specific implementation method of the step of inputting the communication data to be detected into the accelerated preprocessing layer and obtaining the preliminary risk score output by the accelerated preprocessing layer. This process includes the following sub-steps: First, the communication data is input into each sub-model to obtain the individual score results output by each sub-model. In a specific implementation, when a piece of communication data to be detected (assuming it already contains structured data and text features) enters the accelerated preprocessing layer, it is treated as a unified feature vector and distributed to all parallel sub-models within the accelerated preprocessing layer. Each sub-model independently analyzes this feature vector and outputs the corresponding individual score result.

[0072] Here, the individual score output by any sub-model represents the probability that the communication data identified by that sub-model contains sensitive data of a specific type. For example, the individual score output by the "impersonating financial customer service" sub-model is 0.82, which means that the sub-model believes that there is an 82% probability that the current communication data belongs to the "impersonating financial customer service" type.

[0073] Then, after obtaining the individual scores from all sub-models, the system performs a decision-making step: outputting the highest score among all individual scores as the preliminary risk score. For example, if the "impersonating financial customer service" sub-model outputs 0.82, the "brushing orders for cashback" sub-model outputs 0.15, and the values ​​output by other sub-models are all lower than these, the system will select the highest score of 0.82 as the preliminary risk score representing the final judgment result of the entire accelerated preprocessing layer. Simultaneously, the system will also record which sub-model generated this highest score, which helps in the preliminary determination of the specific type of sensitive content in subsequent steps.

[0074] This invention employs an architecture of multiple parallel sub-models to achieve fine-grained identification and rapid screening of different types of sensitive content. Compared with the solution using a single general model, this specialized and parallel processing method not only improves the accuracy of the initial judgment, but also provides a foundation for subsequent implementation of differentiated dynamic threshold adjustments and rule configurations for specific sensitive content types, greatly enhancing the flexibility and precision of the entire detection method.

[0075] In the sensitive data detection method provided by this invention, the discrimination conditions used to determine the judgment result of the preliminary risk score are dynamically adjusted. That is, this invention introduces a dynamic adjustment mechanism that can adapt to changes in the situation of sensitive content.

[0076] This invention determines the subsequent processing path of communication data based on the preliminary risk score, a process that relies on a preset discrimination condition. For example, in a threshold-based implementation, this discrimination condition could be one or more pairs of high and low thresholds. However, in practical applications, the frequency and wording patterns of various sensitive contents are constantly changing. If a fixed, static discrimination condition is used, a sudden surge in a certain type of sensitive content may lead to a large number of missed detections due to overly stringent conditions; conversely, when a decrease in a certain type of sensitive content, overly lenient conditions may lead to an increased false positive rate.

[0077] To address this technical problem, this embodiment explicitly states that the discrimination criteria used to determine the preliminary risk score are dynamically adjusted. In one specific implementation, this means that the discrimination criteria are not fixed after being set once, but can be automatically and periodically updated and optimized based on the real-time detection environment and data feedback. This dynamic adjustment mechanism is key to the high adaptability of this invention, enabling the sensitive data detection method provided by this invention to flexibly adjust its level of vigilance based on the main risk types currently faced, much like an experienced analyst.

[0078] For example, when internal monitoring reveals a significant increase in the frequency of sensitive content related to the specific type of "impersonating financial customer service," a dynamic adjustment mechanism is triggered. This might automatically optimize the discrimination criteria associated with the "impersonating financial customer service" sub-model, such as appropriately lowering the threshold used to judge high risk. In this way, even if subsequent communications related to "impersonating financial customer service" don't initially have a very high risk score, they are more likely to be accurately detected, effectively improving the recall rate for frequently occurring types of sensitive content. Conversely, when a certain type of sensitive content disappears or the false positive rate remains consistently high, the discrimination criteria can be adjusted in reverse to improve detection accuracy.

[0079] By introducing a dynamic adjustment mechanism for the discrimination conditions, the sensitive data detection method provided by this invention effectively overcomes the limitations of traditional static rules or fixed threshold schemes, enabling the entire detection method to adapt to the ever-changing situation of sensitive content. Under the premise of ensuring system stability, it can intelligently balance the accuracy and recall of detection, thereby maintaining efficient and accurate detection performance in complex and ever-changing real-world application environments.

[0080] Figure 2 This is a schematic diagram of the process for updating the judgment criteria of the preliminary risk score provided by the present invention, as shown in the figure. Figure 2 As shown, the specific steps include, but are not limited to, the following: Step 1: Obtain the trigger frequency of each specific type of sensitive data within a preset time window, and determine the current feature change amount of each specific type of sensitive data based on the trigger frequency.

[0081] A preset time window (e.g., every 5 minutes or every batch of data processed) can be used to monitor the triggering frequency of specific types of sensitive data in real time. In an optional implementation, the triggering frequency of a specific type of sensitive data... It can be defined as the current time window. t Within that window, the ratio of the number of times its corresponding sub-model is identified as a sensitive event to the total number of monitored events within that window is: .

[0082] After obtaining the trigger frequency of the current time window Then, the current feature change amount for each specific type of sensitive data can be further determined. Characteristic change It reflects the magnitude and direction of the current frequency change relative to the historical baseline, and is the core driving force behind the adjustment of the discrimination criteria. This can be achieved through... The calculation yields the following result: [The result is missing here, likely due to an incomplete sentence or a formatting error.] It is a baseline frequency for triggering specific types of sensitive data, calculated based on historical data from multiple time windows, such as the moving average of several past time windows.

[0083] In another embodiment, feature monitoring can be extended to other dimensions, such as recent changes in keyword weight distribution, or recent model performance metrics, such as accuracy and recall, obtained through feedback from downstream business systems. These additional monitoring dimensions can be used together to determine a more comprehensive measure of feature change.

[0084] Step 2: For the target sub-model trained to identify each specific type of sensitive data, the historical discrimination threshold of the target sub-model in the previous detection period is corrected based on the current feature change amount of the specific type of sensitive data and the preset basic discrimination threshold, so as to obtain the current sensitive discrimination threshold of the current detection period.

[0085] It should be noted that the threshold correction method based on exponentially weighted moving average provided in step 2 is performed independently for each target sub-model trained to identify each specific type of sensitive data. That is, this invention will adjust the threshold for each target sub-model based on its corresponding current feature change. This is done to correct the discrimination threshold. Specifically, the historical discrimination threshold of the target sub-model in the previous detection period is corrected to obtain the current sensitivity discrimination threshold for the current detection period. This correction can be achieved through an exponentially weighted recursive method, which not only considers the current data performance but also smoothly incorporates the influence of historical thresholds, thereby avoiding drastic fluctuations in the threshold caused by data mutations.

[0086] In a specific implementation, this correction process can be expressed by the following correction formula: .

[0087] in, It is the calculated current sensitivity threshold; The historical discrimination threshold is the threshold of the target sub-model in the previous detection period; It is a preset basic discrimination threshold set for this target sub-model; It is a historical weight decay factor, whose value is usually between 0.7 and 0.9, used to control the decay rate of historical information; It is a change sensitivity coefficient used to adjust the response magnitude of the discrimination threshold to changes in features.

[0088] Based on the above modified formula, when the triggering frequency of a specific type of sensitive content increases (i.e.) >0), can be achieved by setting a sensitivity coefficient. (Taking a negative value) makes the calculated current sensitivity threshold... This reduces the false positive rate, thereby increasing the recall rate for that high-incidence content type. Conversely, when an increase in the false positive rate is detected (e.g., inferred from feedback accuracy metrics), adjustments can be made. Value is positive or adjusted The calculation method increases the threshold to improve accuracy.

[0089] Step 3: Determine the current sensitivity threshold of the sub-model with the highest score among all the individual scores in the current detection period, so as to determine the sensitivity interval of the current detection period.

[0090] When new communication data is processed by the accelerated preprocessing layer, it is determined which sub-model output the highest individual score result, and then the sub-model with the highest score among all individual score results is determined at the current sensitivity threshold in the current detection period.

[0091] The current sensitivity threshold is dynamically changed based on this sub-model that outputs the highest score. This allows for the rapid determination of the sensitive discrimination interval for the current detection period. For example, this sensitive discrimination interval can be determined by a pair of high and low thresholds. , Composed of, among which and All by Derived or direct, these are different dynamic thresholds, such as the core threshold. Add or subtract a fixed offset, such as 0.1, to both sides.

[0092] Step 4: Based on the relationship between the preliminary risk score and the sensitive discrimination interval, determine the discrimination conditions for the current detection cycle, and then determine the subsequent processing path of the communication data.

[0093] In an optional implementation, the dynamic adjustment process can also incorporate a boundary protection mechanism. This involves setting an upper and lower limit for permissible fluctuations (e.g., within ±20% of the base threshold) for each dynamic discrimination threshold to prevent excessive threshold drift caused by extreme data, thus ensuring the stability of the entire detection method.

[0094] The sensitive data detection method provided by this invention offers a complete, closed-loop, and highly targeted dynamic determination method for discrimination conditions. By employing an exponentially weighted moving average recursive correction method, the current sensitive discrimination threshold can be dynamically adjusted in real time, avoiding high resource overhead and balancing real-time performance with lightweight characteristics. This allows the method to intelligently and differentiatedly respond to changes in the situation of different types of sensitive content, achieving a dynamic balance between recall and precision, and greatly improving the robustness and intelligence of the entire detection system in complex and ever-changing environments.

[0095] It is worth noting that the dynamic determination method based on the idea of ​​exponential weighted moving average disclosed in this embodiment has extremely high computational efficiency and extremely low resource overhead. Its time complexity and space complexity are both O(1), that is, constant level.

[0096] Specifically, its time complexity of O(1) is reflected in the fact that, within each detection cycle, the process of calculating the current sensitivity threshold for a single target sub-model only requires performing a few fixed arithmetic operations (e.g., multiplication, addition, etc.). The number of calculation steps is constant and does not depend on the total amount of communication data processed historically or the scale of data to be processed in the future. For example, when calculating using the above-mentioned modified formula, it is only necessary to call the historical threshold of the previous cycle. and the characteristic change of the current cycle This is sufficient, without needing to traverse or process any earlier historical data.

[0097] Its space complexity is O(1), which means that in order to complete the calculation for the next detection cycle, it is only necessary to maintain a historical discrimination threshold (i.e., the one calculated in the current cycle) in memory for each target sub-model. The corresponding storage overhead is fixed and will not increase with the growth of runtime or the accumulation of processed data, meaning there is no need to store the discrimination threshold sequence for all historical moments.

[0098] Due to this O(1) computation and storage overhead, the dynamic adjustment mechanism for the discrimination condition introduced in this invention exhibits high efficiency and lightweight characteristics. It can achieve powerful dynamic adaptation with almost negligible computation and storage resource consumption. This has key technical advantages for meeting the stringent requirements of low latency and lightweight in massive, real-time data stream processing scenarios.

[0099] The sensitive discrimination interval in this embodiment [ , ] is determined by a maximum value and a minimum value The criteria for jointly defining and using the three-way triage of the preliminary risk score.

[0100] In one specific implementation, the application logic of this discrimination condition is as follows: In the high-risk direct output path, when the preliminary risk score is greater than the maximum value of the sensitivity discrimination interval, the subsequent processing path for the communication data is determined to be the first path.

[0101] When the initial risk score of a communication data exceeds the currently dynamically set high threshold (i.e., the maximum value) If an element is identified as highly sensitive, it can be considered to have extremely high suspicion of being sensitive content, and no further complex analysis is needed. In this case, the first path (i.e., the fast track) will be selected, and the final classification label will be directly determined as "abnormal." Here, "abnormal" is a qualitative label, which, depending on the specific business scenario, can also be "high-risk," "sensitive," or a specific type of sensitive content.

[0102] In the low-risk direct output path, when the preliminary risk score is less than the minimum value of the sensitivity discrimination interval, the subsequent processing path for the communication data is determined to be the first path.

[0103] When the initial risk score is lower than the currently dynamically set low threshold (i.e., the minimum value) If the content is within the normal range, it can be considered as such. In this case, the first path will be selected, and the final category label will be determined as normal.

[0104] The suspicious data in-depth analysis path determines the second path as the subsequent processing path for the communication data when the preliminary risk score is within the sensitive discrimination interval.

[0105] This means that when the initial risk score falls within the range of the maximum value... and minimum value When the defined range is ambiguous, the accelerated preprocessing layer cannot make a clear judgment. At this point, the communication data can be considered somewhat suspicious and requires more in-depth analysis. Therefore, a second path (i.e., a fine analysis channel) will be selected for it, and it will be handed over to the subsequent enhanced analysis layer for processing.

[0106] This invention provides a clear and efficient three-way traffic splitting and discrimination logic. By using a sensitive discrimination interval dynamically defined by maximum and minimum values, it can intelligently classify all communication data into three categories: "abnormal," "normal," and "suspicious." This ensures that only a small number of truly difficult-to-judge data are sent to the computationally expensive enhanced judgment layer, while the vast majority of clear data can be quickly processed through the first path. This not only greatly optimizes the allocation of system resources but also perfectly balances the real-time performance and accuracy of the entire detection method when processing massive amounts of data.

[0107] Based on the above embodiments, as an optional embodiment, the sensitive data detection method provided by the present invention also introduces a configurable mechanism for model rules, which aims to provide an expert intervention channel to cope with the rapid emergence of new sensitive content patterns, help improve the problem of insufficient automatic identification ability in specific scenarios, and make up for the lag that may exist in the pure automatic learning mechanism.

[0108] In one specific implementation, the configurable mechanism relies on a model rule configuration backend consisting of a front-end interface and back-end services. This backend allows authorized personnel (e.g., anti-fraud experts or system administrators) to manually and instantly adjust the rules of any sub-model in the accelerated preprocessing layer. The specific workflow may include the following steps: First, the model configuration instructions are defined and generated based on the user-configurable rule management interface, which is the front-end interface of the model rule configuration backend.

[0109] The model rule configuration backend provides a visual rule management interface, where operators can see a list of all parallel sub-models. For example, there might be a sub-model for identifying "impersonating financial customer service" and another for identifying "brushing orders for rebates." Operators can select and access the dedicated configuration page for any of these sub-models.

[0110] On this dedicated configuration page, operators can define or modify rules related to the sub-model through a series of input boxes, checkboxes, drop-down menus, or a rule editor. When the operator completes the configuration and submits it (for example, by clicking the "Save" or "Publish" button), the front-end interface will convert the operation into structured model configuration instructions.

[0111] Then, the system will receive model configuration instructions sent by the model rule configuration backend in real time. After receiving the model configuration instructions generated by the front-end interface, it will send them to the detection system that is running online.

[0112] Finally, the detection system responds to the model configuration instructions and modifies the text features or structured data processing rules associated with any of the sub-models in the accelerated preprocessing layer.

[0113] Upon receiving the response model configuration instruction, the detection system will immediately parse and execute the corresponding modification operations, such as dynamically adding, deleting, or adjusting.

[0114] The specific configurable rules corresponding to the response model configuration instructions include, but are not limited to, rules related to text features and structured data processing rules. Rules related to text features can include positive keywords and negative keywords. Operators can add new keywords to the target sub-model; the appearance of these words increases the probability that the communication content will be identified as sensitive content of the corresponding type. For example, for a new type of sensitive content such as "fake medical insurance," operators can manually add keywords such as "medical insurance card fraud," "suspected insurance fraud," and "funds investigation." Operators can also assign an initial base weight to these newly added keywords.

[0115] Operators can also add keywords to eliminate false alarms. For example, if a legitimate social security notification call is found to be misjudged because it contains "medical insurance card", "medical insurance reimbursement" or "annual settlement" can be added as reverse keywords to reduce its sensitivity score in normal scenarios.

[0116] Structured data processing rules mainly include communication signaling rules, blacklists / whitelists, and other rules. For communication signaling rules, operators can configure communication behavior characteristics highly correlated with specific sensitive types. For example, rules can be set for a sub-model such as "the incoming call number must be an overseas number" or "the first call duration must be greater than a preset number of seconds."

[0117] Regarding blacklists and whitelists, operators can maintain their own dedicated blacklists and / or whitelists for specific sub-models. For example, newly confirmed phone numbers used to carry out specific types of sensitive activities can be manually added to the blacklist of the corresponding sub-model, or official numbers that are frequently falsely reported can be added to the whitelist.

[0118] After the system completes the modification in response to the instruction, it will immediately load the new rule into the corresponding sub-model running instance in the accelerated preprocessing layer, so that it takes effect immediately.

[0119] This invention provides an efficient operation and maintenance model that combines automated models with human expert experience. By providing visualized, configurable, and instantly effective rule management functions, it enables rapid response and accurate adaptation when facing a constant stream of new sensitive content, greatly improving the system's flexibility, robustness, and continuous effectiveness in complex adversarial environments.

[0120] As an optional embodiment, the enhanced judgment layer is constructed based on a pre-trained language model of the Transformer architecture.

[0121] While the sensitive data detection method provided by this invention can achieve efficient preliminary screening in an architecture with only an accelerated preprocessing layer, it still has certain limitations. Specifically, the probabilistic statistical model relied upon by the accelerated preprocessing layer mainly focuses on surface features such as the frequency of keyword occurrences when analyzing text, lacking the ability to deeply and coherently understand the contextual semantics of the communication content. This may result in its recognition performance not meeting the requirements of production-grade systems (e.g., accuracy and recall both need to reach above 95%) when facing sensitive content using new phrasing or obscure wording.

[0122] To compensate for this deficiency and achieve higher detection accuracy, the enhanced judgment layer used in this embodiment is built based on a pre-trained language model of the Transformer architecture, such as the BERT model (Bidirectional Encoder Representations from Transformers). The BERT model, with its powerful self-attention mechanism at its core, can capture the long-distance dependency between any two words in a text sequence, thereby achieving a deep understanding of the contextual semantics.

[0123] In one specific implementation, when communication data to be analyzed is fed into the enhanced analysis layer, the pre-trained language model at that layer analyzes it. To better apply it to the sensitive data detection scenario of this invention and to balance accuracy and efficiency, one or more optimization strategies can be adopted, such as: (1) A parallel attention mechanism is adopted. In the Transformer encoder inside the enhancement judgment layer, a typical multi-head self-attention mechanism (e.g., an 8-head or 12-head parallel computing architecture) can be used. Each head independently focuses on a different semantic subspace and accelerates feature capture through parallel computing. This mechanism expands the expressive power of the model, enabling it to better distinguish subtle semantic differences in sensitive utterances.

[0124] (2) Dynamic management of the secondary judgment threshold allows for setting a configurable judgment threshold for the output of the enhanced judgment layer. This judgment threshold is used to make the final determination on the deep risk score output by the pre-trained language model. By dynamically managing this judgment threshold manually or automatically, it is possible to link it with the judgment results of the accelerated preprocessing layer, flexibly control the scale of data entering the enhanced judgment layer, and thus achieve a fine balance between efficiency and effectiveness.

[0125] This invention significantly enhances the ability to identify complex, novel, and context-sensitive content by introducing a pre-trained language model based on the Transformer architecture as an enhanced judgment layer. It compensates for the shortcomings of the accelerated preprocessing layer in deep semantic understanding, enabling the entire two-layer architecture to maintain high processing efficiency while raising the final detection accuracy and recall to levels meeting production-grade system requirements, thus achieving high-precision and intelligent judgment of sensitive data.

[0126] As another optional embodiment, after receiving the communication data, the pre-trained language model further includes: Dynamic proportional word masking is performed on the unstructured communication content in the input communication data; And / or the pre-trained language model compresses high-dimensional semantic vectors into preset low-dimensional semantic vectors through feature distillation.

[0127] When enhancing the analysis of the pre-trained language model used in the judgment layer, the following two optimization strategies can be employed to improve the model's robustness and operational efficiency: The first optimization strategy is to perform dynamic proportional lexical masking on the unstructured communication content in the input communication data to enhance the generalization ability and tolerance to variant utterances of the pre-trained language model.

[0128] Specifically, before feeding unstructured communication content (such as call text) into the core computing unit of the pre-trained language model, its token sequence is processed, including randomly selecting a portion of tokens in the sequence and replacing or masking them with a special mask marker.

[0129] Dynamic proportion refers to the fact that the proportion of masked words is not a fixed value, but is dynamically adjusted within a preset range (e.g., 15% to 25%). In an optional embodiment, this specific proportion can be adaptively adjusted based on the progress of training or the complexity of the current batch of data being processed. This strategy based on dynamic masking proportion allows the pre-trained language model to be exposed to more diverse context-deficit patterns during training and inference, thereby improving its generalization ability to different contexts. It helps reduce overfitting of the model to specific sentence structures, and also enables the model to maintain good semantic understanding and recognition capabilities when faced with sensitive utterances that have undergone synonym substitution, word order inversion, etc.

[0130] Another optimization strategy is to compress high-dimensional semantic vectors into preset low-dimensional semantic vectors through feature distillation, so as to reduce the computational complexity and resource consumption of the model and improve the overall real-time performance of the system.

[0131] Pre-trained language models typically generate a high-dimensional semantic vector (e.g., 768-dimensional) for each text after deep encoding of the input text. While this high-dimensional semantic vector contains rich semantic information, its high dimensionality also brings a large computational and storage load to subsequent processing (such as fully connected layer classification).

[0132] To address this issue, this embodiment introduces feature distillation, which involves adding a feature distillation module after the output of the pre-trained language model. This module can employ a lightweight neural network or a linear dimensionality reduction method. Its core function is to compress and map high-dimensional semantic vectors to a predefined low-dimensional semantic vector (e.g., 192-dimensional). During compression, key information for classification can be preserved through adversarial learning or minimizing reconstruction errors.

[0133] This optimization strategy significantly reduces the dimensionality of feature vectors, thereby saving computational resources and memory usage during model deployment. Simultaneously, it effectively reduces latency in subsequent computations, making it particularly suitable for deployment in environments with limited computational resources. To a certain extent, compressed features can filter out some noise interference in high-dimensional space, helping to improve the generalization ability of pre-trained language models.

[0134] Figure 3 This is a schematic diagram of the system architecture of the sensitive data detection method provided by the present invention, combined with... Figure 3 As shown, before processing the communication data to be detected, the raw voice signal is first preprocessed. This preprocessing process can be uniformly managed and initiated by a scheduling service module, and specifically includes: First, acquire the voice data stream. The voice data stream is the original telephone call recording or real-time voice signal that needs to be detected.

[0135] After obtaining the voice data stream, as Figure 3 As shown, the scheduling service module invokes the system's speech transcription capability. This speech transcription capability is based on Automatic Speech Recognition (ASR) technology, which processes the speech data stream, converting it from analog acoustic signals into a digitized text sequence, thus obtaining unstructured communication content. This unstructured communication content is typically a text string, which serves as one of the main inputs for subsequent content analysis in the accelerated preprocessing layer.

[0136] By introducing a speech-to-text step, this invention can transform raw, unstructured speech signals into machine-readable and analyzable text data, i.e., the unstructured communication content, thereby laying the foundation for subsequent content-based deep semantic analysis and risk assessment, and greatly expanding the applicable scenarios of this invention.

[0137] like Figure 3 As shown, after acquiring the voice data stream, the scheduling service module also invokes the system's voiceprint extraction capability in parallel to extract voiceprint features from the voice data stream. These voiceprint features are numerical vectors that characterize the speaker's biological identity, serving as direct input to the identity analysis path.

[0138] After the voiceprint features are extracted, they can be input into a separate voiceprint analysis module. This module is designed to perform a secure analysis of the speaker's identity, and the analysis result is the voice identity analysis result output by the voiceprint analysis module.

[0139] The results of voice identity analysis are not directly used for the final decision, but rather as reference information to determine the final classification label. For example... Figure 3 As shown in the comprehensive analysis process, the output of the voiceprint analysis module will be sent to the subsequent processing stage.

[0140] In an alternative implementation, the voice identity analysis result (e.g., a Boolean value indicating whether a blacklist has been hit, or a risk score indicating an identity anomaly) can be treated as structured data, which, together with text features from unstructured communication content, is used by an accelerated preprocessing layer to calculate an initial risk score.

[0141] This invention introduces a parallel identity analysis path, which combines content-based analysis (achieved through speech transcription) and identity-based analysis (achieved through voiceprint analysis). This allows for comprehensive analysis of communication data from two dimensions, greatly improving the accuracy and robustness of detection. It has key technical advantages, especially for identifying known multiple or gang-related crimes.

[0142] Voiceprint recognition is a biometric technology that does not analyze the content of speech, but rather analyzes the identity characteristics of speech. Specifically, it uses a unique, quantifiable feature vector extracted from the speech signal that represents the physical characteristics of the speaker's vocal organs as the identification object.

[0143] As an optional embodiment, the implementation step of inputting the voiceprint features into the voiceprint analysis module to obtain the voice identity analysis result output by the voiceprint analysis module can be carried out by at least one of the following implementation methods: The first implementation method is to use the voiceprint analysis module to compare the voiceprint features with the blacklist voiceprint database to generate the voice identity analysis result.

[0144] A blacklist voiceprint database can be pre-established, storing the voiceprint features of multiple individuals known to be at risk (e.g., historically confirmed fraudsters). When the voiceprint analysis module receives the voiceprint features of the current caller, it performs a one-to-many comparison with all voiceprints in the blacklist database. If the calculated similarity exceeds a preset threshold, a voice identity analysis result indicating "hit the blacklist" can be directly generated. This method enables accurate and efficient identification of repeat offenders.

[0145] The second implementation method is to use the voiceprint analysis module to perform cluster analysis on multiple voiceprint features from different communication data, and determine the voice identity analysis result based on the correlation between all the voiceprint features obtained from the cluster analysis.

[0146] The voiceprint analysis module can periodically collect and process multiple voiceprint features from different times and different communication numbers, and perform cluster analysis on them. If multiple seemingly isolated sensitive events show the same or highly similar voiceprint features (i.e., they are clustered into one category), then a correlation between these events can be determined. Based on this correlation, a voice identity analysis result indicating "suspected gang activity" can be generated, providing important clues for combating gang activities at their source.

[0147] The third implementation method is to use the voiceprint analysis module to detect the matching degree between the voiceprint features associated with a single communication number and other voiceprint features associated with the single communication number collected within a preset time period, so as to generate the voice identity analysis result based on the matching degree.

[0148] The voiceprint analysis module can monitor changes in voiceprint features associated with a single communication number over a period of time. Specifically, it can perform a match test by comparing the voiceprint features of the current call with other voiceprint features belonging to the same communication number collected within a preset time period (e.g., the past 24 hours). If the match rate is consistently low, meaning that a number has multiple distinct voiceprint features within a short period, this may indicate that the number is a "public number" or "virtual number" used for bulk calls. Based on this detected low match rate, a voice identity analysis result indicating "one number, multiple voices" anomalies can be generated, serving as strong evidence for assessing sensitive risks.

[0149] This invention provides a variety of specific and effective voiceprint analysis methods, including one or more methods such as blacklist comparison, cluster analysis, or abnormal identity detection. These methods can perform in-depth security analysis of communication data from the perspective of speaker identity, and generate multi-dimensional voice identity analysis results as important reference information for subsequent comprehensive analysis. This can greatly enrich the system's detection methods and improve the ability to identify specific risk scenarios (such as habitual offenders, gangs, and fake numbers).

[0150] Figure 4 This is a schematic diagram of the sensitive data detection device provided by the present invention, as shown below. Figure 4 As shown, it mainly includes, but is not limited to: The preliminary risk assessment unit 11 is used to input the communication data to be detected into the accelerated preprocessing layer and obtain the preliminary risk score output by the accelerated preprocessing layer. The data detection and diversion unit 12 is used to determine the subsequent processing path of the communication data based on the judgment result of the preliminary risk score. If the subsequent processing path is the first path, then a final classification label is determined based on the preliminary risk score; If the subsequent processing path is the second path, then the communication data is input to the data enhancement and judgment unit 13; The data augmentation and analysis unit 13 determines a final classification label based on the communication data; The preliminary risk score represents the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to represent the sensitivity category to which the communication data belongs.

[0151] Optionally, the preliminary risk assessment unit 11 has a built-in accelerated preprocessing layer mentioned in the above embodiments, which is responsible for receiving the communication data to be detected and calling multiple parallel sub-models in the accelerated preprocessing layer to analyze it in order to obtain the preliminary risk score.

[0152] The data enhancement analysis unit 13 has a built-in enhancement analysis layer mentioned in the above embodiments, which is responsible for performing in-depth, context-aware analysis on communication data with high suspicion sent by the diversion unit.

[0153] In an optional implementation, before outputting the final classification label, the data augmentation and judgment unit 13 first generates a deep risk score by its built-in augmentation and judgment layer (e.g., a pre-trained language model based on the Transformer architecture), and then compares the deep risk score with a preset, high discrimination threshold (e.g., 0.85) to finally determine the final classification result of the communication data.

[0154] The following is a specific implementation case to illustrate the collaborative workflow of the various units of this device: Suppose that the sensitive data detection device receives a communication message that reads, "Your credit account has an anomaly; you need to download security software to remove the risk."

[0155] The preliminary risk assessment unit 11 starts working, and its built-in accelerated preprocessing layer analyzes the communication data. It is assumed that the sub-model trained to identify "fake credit reports" outputs the highest individual score result, 0.71. Therefore, the preliminary risk score output by the preliminary risk assessment unit 11 is 0.71.

[0156] After receiving the preliminary risk score of 0.71, the data detection and diversion unit 12 assumes that the dynamic sensitive discrimination interval from the "fake credit report" sub-model is [0.65, 0.75]. Since 0.71 is within this dynamic sensitive discrimination interval, the data detection and diversion unit 12 determines that the subsequent processing path of the data is the second path and sends it to the data augmentation and analysis unit 13.

[0157] After receiving the communication data, the data enhancement and judgment unit 13 performs deep semantic analysis on the text content through its built-in enhancement and judgment layer. It identifies the typical risk-inducing behavior pattern of "account abnormality" followed by "downloading software". The enhancement and judgment layer outputs a deep risk score, such as 0.92.

[0158] The decision logic within the data augmentation and analysis unit 13 compares 0.92 with a preset discrimination threshold of 0.85. Since 0.92 is greater than 0.85, the data augmentation and analysis unit 13 ultimately determines the final classification label of the communication data as "abnormal" or "sensitive content related to false credit reporting".

[0159] The sensitive data detection device provided by this invention adopts a two-layer model architecture design and data flow control method. It uses a lightweight accelerated preprocessing layer to perform large-scale and high-speed preliminary screening of massive influx of data, and then uses an enhanced judgment layer to accurately classify the suspicious data. Thus, it achieves an accuracy close to that of a heavyweight model at a speed close to that of a lightweight model, achieving a balance between efficiency and accuracy and meeting production-level requirements.

[0160] It should be noted that the sensitive data detection device provided by the present invention can execute the sensitive data detection method described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0161] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 5 As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can invoke logical instructions in the memory 530 to execute a sensitive data detection method. This method includes: inputting the communication data to be detected to an accelerated preprocessing layer to obtain a preliminary risk score output by the accelerated preprocessing layer; determining a subsequent processing path for the communication data based on the judgment result of the preliminary risk score; if the subsequent processing path is a first path, determining a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, inputting the communication data to an enhanced judgment layer to determine a final classification label based on the output of the enhanced judgment layer; the preliminary risk score characterizes the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to characterize the sensitivity category to which the communication data belongs.

[0162] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0163] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, when the program instructions are executed by a computer, the computer is able to execute the sensitive data detection method provided in the above embodiments, the method including: inputting communication data to be detected to an accelerated preprocessing layer to obtain a preliminary risk score output by the accelerated preprocessing layer; determining a subsequent processing path for the communication data based on the judgment result of the preliminary risk score; if the subsequent processing path is a first path, determining a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, inputting the communication data to an enhanced judgment layer to determine a final classification label according to the output of the enhanced judgment layer; the preliminary risk score characterizes the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to characterize the sensitivity category to which the communication data belongs.

[0164] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the sensitive data detection method provided in the above embodiments. The method includes: inputting communication data to be detected into an accelerated preprocessing layer to obtain a preliminary risk score output by the accelerated preprocessing layer; determining a subsequent processing path for the communication data based on the judgment result of the preliminary risk score; if the subsequent processing path is a first path, determining a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, inputting the communication data into an enhanced judgment layer to determine a final classification label based on the output of the enhanced judgment layer; wherein the preliminary risk score characterizes the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to characterize the sensitivity category to which the communication data belongs.

[0165] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0166] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting sensitive data, characterized in that, include: The communication data to be detected is input into the accelerated preprocessing layer to obtain a preliminary risk score output by the accelerated preprocessing layer; Based on the preliminary risk score, the subsequent processing path for the communication data is determined. If the subsequent processing path is the first path, then a final classification label is determined based on the preliminary risk score; If the subsequent processing path is the second path, the communication data is input to the enhanced judgment layer to determine a final classification label based on the output of the enhanced judgment layer. The preliminary risk score represents the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to represent the sensitivity category to which the communication data belongs.

2. The sensitive data detection method according to claim 1, characterized in that, The communication data includes structured data and unstructured communication content; The step of inputting the communication data to be detected into the accelerated preprocessing layer includes: Extract text features from the unstructured communication content; The structured data and the text features are input together into the accelerated preprocessing layer.

3. The sensitive data detection method according to claim 2, characterized in that, The text features are a set of weight values ​​that characterize the importance of each keyword in the unstructured communication content; The weight value corresponding to each keyword is determined based on the keyword's term frequency and the keyword's inverse document frequency; The term frequency is the frequency at which the keyword appears in the unstructured communication content, and the inverse document frequency is a measure of the rarity of the keyword in the historical communication content sample library. The measure is inversely proportional to the number of documents containing the keyword in the historical communication content sample library. The historical communication content sample library includes multiple historical communication content samples marked as containing sensitive content and multiple historical communication content samples marked as not containing sensitive content.

4. The sensitive data detection method according to any one of claims 1-3, characterized in that, The accelerated preprocessing layer includes multiple parallel sub-models, each of which is trained to identify a specific type of sensitive data; The step of inputting the communication data to be detected into the accelerated preprocessing layer and obtaining the preliminary risk score output by the accelerated preprocessing layer includes: The communication data is input into each of the sub-models to obtain the individual rating results output by each sub-model; Output the highest score among all the individual ratings as the preliminary risk score; The individual score output by any sub-model represents the probability that the communication data identified by any sub-model contains sensitive data of a specific type.

5. The sensitive data detection method according to claim 4, characterized in that, The criteria used to determine the outcome of the preliminary risk score are dynamically adjusted. The discrimination criteria are dynamically determined based on the following steps: The trigger frequency of each specific type of sensitive data within a preset time window is obtained, and the current characteristic change of each specific type of sensitive data is determined based on the trigger frequency; For a target sub-model trained to identify each specific type of sensitive data, the historical discrimination threshold of the target sub-model in the previous detection period is corrected based on the current feature change amount of the specific type of sensitive data and the preset basic discrimination threshold, so as to obtain the current sensitive discrimination threshold of the current detection period. Determine the current sensitivity threshold of the sub-model with the highest score among all the individual scores in the current detection period, so as to determine the sensitivity interval of the current detection period; Based on the relationship between the preliminary risk score and the sensitive discrimination interval, the discrimination conditions for the current detection cycle are determined.

6. The sensitive data detection method according to claim 5, characterized in that, The specific discrimination criteria are as follows: When the initial risk score is greater than the maximum value of the sensitivity discrimination interval, the subsequent processing path for the communication data is determined to be the first path, and the final classification label is determined to be abnormal. When the initial risk score is less than the minimum value of the sensitivity discrimination interval, the subsequent processing path for the communication data is determined to be the first path, and the final classification label is determined to be normal. When the preliminary risk score is within the sensitive discrimination interval, the subsequent processing path for the communication data is determined to be the second path.

7. The sensitive data detection method according to claim 4, characterized in that, Also includes: Receive model configuration instructions sent from the model rule configuration backend; In response to the model configuration command, the text features or structured data processing rules associated with any of the sub-models in the accelerated preprocessing layer are modified; The model configuration instructions are generated based on a user-configurable rule management interface, which is the front-end interface of the model rule configuration backend.

8. The sensitive data detection method according to claim 2, characterized in that, After receiving the communication data, the pre-trained language model also includes: Dynamic proportional word masking is performed on the unstructured communication content in the input communication data; And / or the pre-trained language model compresses high-dimensional semantic vectors into preset low-dimensional semantic vectors through feature distillation.

9. The sensitive data detection method according to claim 2, characterized in that, Before inputting the communication data to be detected into the accelerated preprocessing layer, the following steps are included: Acquire the voice data stream; The voice data stream is transcribed to obtain the unstructured communication content; After acquiring the voice data stream, the process also includes: Extract voiceprint features from the speech data stream; The voiceprint features are input into the voiceprint analysis module to obtain the voice identity analysis results output by the voiceprint analysis module; The voice identity analysis results are used as reference information to determine the final classification label.

10. The sensitive data detection method according to claim 9, characterized in that, The step of inputting the voiceprint features into the voiceprint analysis module and obtaining the voice identity analysis results output by the voiceprint analysis module can be achieved using at least one of the following implementation methods: The voiceprint analysis module is used to compare the voiceprint features with the blacklist voiceprint database to generate the voice identity analysis result. The voiceprint analysis module is used to perform cluster analysis on multiple voiceprint features from different communication data, so as to determine the voice identity analysis result based on the correlation between all the voiceprint features obtained by the cluster analysis. The voiceprint analysis module is used to detect the matching degree between the voiceprint features associated with a single communication number and other voiceprint features associated with the single communication number collected within a preset time period, so as to generate the voice identity analysis result based on the matching degree.

11. A sensitive data detection device, characterized in that, include: The preliminary risk assessment unit is used to input the communication data to be detected into the accelerated preprocessing layer and obtain a preliminary risk score output by the accelerated preprocessing layer. The data detection and diversion unit is used to determine the subsequent processing path of the communication data based on the judgment result of the preliminary risk score. If the subsequent processing path is the first path, then a final classification label is determined based on the preliminary risk score; If the subsequent processing path is the second path, then the communication data is input to the data enhancement and analysis unit; The data augmentation and analysis unit determines a final classification label based on the communication data; The preliminary risk score represents the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to represent the sensitivity category to which the communication data belongs.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the sensitive data detection method as described in any one of claims 1 to 10.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the sensitive data detection method as described in any one of claims 1 to 10.

Images