Sensitive data detection method and device, electronic equipment and storage medium

Abstract

The application provides a sensitive data detection method and device, electronic equipment and storage medium, and belongs to the technical field of artificial intelligence. The method comprises the following steps: inputting communication data into an acceleration preprocessing layer to obtain a preliminary risk score; determining a subsequent processing path based on a judgment result of the preliminary risk score; if the subsequent processing path is a first path, directly determining a final classification label; and if the subsequent processing path is a second path, inputting the communication data into an enhanced research and judgment layer to determine a final classification label. The application adopts a double-layer model architecture design and a data flow control method, uses a lightweight acceleration preprocessing layer to perform large-scale and high-speed preliminary screening on a large amount of data, and then performs accurate type division on the screened suspicious data through the enhanced research and judgment layer, so that the accuracy close to the heavy model is obtained at the speed close to the lightweight model, the balance between efficiency and accuracy is realized, and the production level requirement is met.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to a sensitive data detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of digital communication technology, the amount of information transmitted through channels such as telecommunications networks and the Internet has increased exponentially. In this context, how to quickly, accurately and efficiently automatically identify and dispose of sensitive content such as violations or other types contained in it to maintain network environment security and user interests has become a key technical requirement that needs to be addressed.

[0003] To meet the above requirements, the existing technology usually uses rule engines, machine learning or deep learning model-based technical solutions to detect communication data. For example, based on pre-set keywords, call frequency, transfer amount, etc. Static rules are matched; algorithms such as Logistic Regression (LR), Random Forest (RF), etc. are used to train classification models through historical data to identify sensitive features; or models such as Long Short-Term Memory (LSTM), Transformer, etc. are used to analyze text semantics.

[0004] However, the above-mentioned existing technical solutions still have significant defects and deficiencies in practical application. The rule engine-based approach relies too much on manually set rules and cannot cover all sensitive content patterns, resulting in high false positive rates. The detection method based on traditional machine learning has weak processing capability for unstructured data (such as voice, text), and frequent manual parameter tuning is required. The detection method based on deep learning model has poor real-time performance and is difficult to meet the detection needs of the telecommunications network with massive data responding in seconds. SUMMARY

[0005] The present application provides a sensitive data detection method, device, electronic equipment and storage medium to solve the problem that the existing technology cannot balance between real-time and accuracy, and is difficult to cope with the rapid iteration of sensitive data presentation methods.

[0006] The present application provides a sensitive data detection method, comprising the following steps:

[0007] inputting the communication data to be detected into an acceleration preprocessing layer, and obtaining a preliminary risk score output by the acceleration preprocessing layer;

[0008] determining the subsequent processing path of the communication data based on the determination result of the preliminary risk score;

[0009] if the subsequent processing path is the first path, determining a final classification label based on the preliminary risk score;

[0010] if the subsequent processing path is the second path, inputting the communication data into an enhanced judgment layer to determine a final classification label according to an output of the enhanced judgment layer;

[0011] the preliminary risk score represents a probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier representing a sensitivity category to which the communication data belongs.

[0012] According to the sensitive data detection method provided by the application, the communication data includes structured data and unstructured communication content.

[0013] The communication data to be detected is input into the accelerated preprocessing layer, comprising:

[0014] extracting text features from the unstructured communication content;

[0015] The structured data and the text features are input into the accelerated preprocessing layer together.

[0016] According to the sensitive data detection method provided by the application, the text features are a set of weight values representing the importance of each keyword in the unstructured communication content.

[0017] The weight value corresponding to each keyword is determined based on the term frequency of the keyword and the inverse document frequency of the keyword;

[0018] The term frequency is the frequency of the keyword appearing in the unstructured communication content, and the inverse document frequency is a measurement value of the rarity of the keyword in the historical communication content sample library, and the measurement value is inversely proportional to the number of documents containing the keyword in the historical communication content sample library. The historical communication content sample library includes a plurality of historical communication content samples labeled as containing sensitive content and a plurality of historical communication content samples labeled as not containing sensitive content.

[0019] According to the sensitive data detection method provided by the application, the accelerated preprocessing layer includes a plurality of parallel sub-models, and each sub-model is trained to identify a specific type of sensitive data.

[0020] The communication data to be detected is input into the accelerated preprocessing layer, and the preliminary risk score output by the accelerated preprocessing layer is obtained, comprising:

[0021] The communication data is input into each sub-model respectively to obtain individual score results output by each sub-model;

[0022] output the highest score among all the individual score results as the preliminary risk score;

[0023] The individual score result output by any sub-model represents the probability that the communication data identified by the sub-model contains the specific type of sensitive data corresponding to the sub-model.

[0024] According to the sensitive data detection method provided by the application, the determination condition of the determination result of the preliminary risk score is dynamically adjusted; wherein the determination condition is dynamically determined based on the following steps:

[0025] Obtain the trigger frequency of each specific type of sensitive data within a preset time window, to determine the current characteristic variation of each specific type of sensitive data based on the trigger frequency;

[0026] For the target sub-model trained to identify each specific type of sensitive data, according to the current characteristic variation of the specific type of sensitive data and the preset basic discrimination threshold, the historical discrimination threshold of the target sub-model in the last detection period is corrected to obtain the current sensitive discrimination threshold in the current detection period;

[0027] Determine the current sensitive discrimination threshold of the sub-model outputting the highest score among all the individual score results in the current detection period, to determine the sensitive discrimination interval in the current detection period;

[0028] Based on the relationship between the preliminary risk score and the sensitive discrimination interval, determine the determination condition in the current detection period.

[0029] According to the sensitive data detection method provided by the application, the determination condition is specifically:

[0030] When the preliminary risk score is greater than the maximum value of the sensitive discrimination interval, it is determined that the subsequent processing path of the communication data is the first path, and the final classification label is determined to be abnormal;

[0031] When the preliminary risk score is less than the minimum value of the sensitive discrimination interval, it is determined that the subsequent processing path of the communication data is the first path, and the final classification label is determined to be normal;

[0032] When the preliminary risk score is within the sensitive discrimination interval, it is determined that the subsequent processing path of the communication data is the second path.

[0033] According to the sensitive data detection method provided by the application, the method further comprises:

[0034] Receive the model configuration instruction sent by the model rule configuration background;

[0035] In response to the model configuration instruction, modifying the text feature or the structured data processing rule associated with any of the sub-models in the acceleration preprocessing layer;

[0036] The model configuration instruction is generated based on a user-operable rule management interface, which is a front-end interface of a background of the model rule configuration.

[0037] According to the sensitive data detection method provided by the application, after the pre-training language model receives the communication data, the pre-training language model further comprises:

[0038] Performing dynamic proportion word token masking on the unstructured communication content in the input communication data;

[0039] And / or the pre-training language model compresses the high-dimensional semantic vector to a pre-set low-dimensional semantic vector through feature distillation.

[0040] According to the sensitive data detection method provided by the application, before the communication data to be detected is input into the acceleration preprocessing layer, the method comprises:

[0041] Obtaining a voice data stream;

[0042] Transcribing the voice data stream to obtain the unstructured communication content;

[0043] After obtaining the voice data stream, the method further comprises:

[0044] Extracting a voiceprint feature from the voice data stream;

[0045] Inputting the voiceprint feature into a voiceprint judgment module to obtain a voice identity analysis result output by the voiceprint judgment module;

[0046] The voice identity analysis result is used as reference information for determining the final classification label.

[0047] According to the sensitive data detection method provided by the application, the voiceprint feature is input into a voiceprint judgment module to obtain a voice identity analysis result output by the voiceprint judgment module, and at least one of the following implementation manners is adopted:

[0048] The voiceprint judgment module is used to compare the voiceprint feature with a blacklist voiceprint library to generate the voice identity analysis result;

[0049] The voiceprint judgment module is used to perform clustering analysis on a plurality of voiceprint features derived from different communication data, so as to determine the voice identity analysis result according to the association relationship between all the voiceprint features obtained through clustering analysis;

[0050] The voiceprint judgment module is used to detect matching degrees between the voiceprint features associated with a single communication number and other voiceprint features associated with the single communication number collected within a preset time length, so as to generate the voice identity analysis result according to the matching degrees.

[0051] The application further provides a sensitive data detection device, comprising:

[0052] A risk preliminary evaluation unit is configured to input the communication data to be detected into an acceleration preprocessing layer and acquire a preliminary risk score output by the acceleration preprocessing layer.

[0053] A data detection shunt unit is configured to determine a subsequent processing path of the communication data based on a judgment result of the preliminary risk score.

[0054] If the subsequent processing path is a first path, a final classification label is determined based on the preliminary risk score.

[0055] If the subsequent processing path is a second path, the communication data is input into a data enhancement judgment unit.

[0056] The data enhancement judgment unit determines a final classification label according to the communication data.

[0057] The preliminary risk score represents a probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to represent a sensitivity category to which the communication data belongs.

[0058] The application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the sensitive data detection method according to any one of the above-mentioned methods when executing the program.

[0059] The application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program is executable on a processor to implement the sensitive data detection method according to any one of the above-mentioned methods.

[0060] The sensitive data detection method, device, electronic device, and storage medium provided by the application adopt a double-layer model architecture design and a data flow control method, use a lightweight acceleration preprocessing layer to perform large-scale and high-speed preliminary screening on a large amount of incoming data, and then use an enhancement judgment layer to accurately classify the suspicious data, so that the accuracy of a heavy model is obtained at a speed close to a lightweight model, a balance between efficiency and accuracy is achieved, and production-level requirements are met. BRIEF DESCRIPTION OF DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0062] Figure 1 is a flowchart of the sensitive data detection method provided by the present application.

[0063] Figure 2 is a flowchart of updating the determination condition of the preliminary risk score provided by the present application.

[0064] Figure 3 is a system architecture diagram of the sensitive data detection method provided by the present application.

[0065] Figure 4 is a structure diagram of the sensitive data detection device provided by the present application.

[0066] Figure 5 is a structure diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0067] In order to make the objectives, technical solutions and advantages of the present application clearer, the following will combine the drawings in the present application to clearly and completely describe the technical solutions in the present application. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort fall within the protection scope of the present application.

[0068] It should be noted that in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "comprises a" does not exclude the presence of another identical element in the process, method, article or device comprising the element. The above terms in the present application can be understood according to the specific meaning of the specific circumstances by those skilled in the art.

[0069] The sensitive data detection method, device, electronic equipment and storage medium provided by the present application are particularly related to a sensitive data real-time early warning method based on the fusion of deep learning and natural language processing technology, which can be applied to intelligent research and judgment of massive sensitive data in financial, customer service, express delivery and other scenarios. The technical solutions in the embodiments of the present application are described clearly and completely. It should be noted that the described embodiments are part of the embodiments of the present application, not all embodiments. Figures 1-5 The technical solutions in the embodiments of the present application are described clearly and completely. It should be noted that the described embodiments are part of the embodiments of the present application, not all embodiments.

[0070] Figure 1 The flowchart of the sensitive data detection method provided by the present application is shown in FIG. 1, and a sensitive data detection method provided by the present application is shown in FIG. 2. Figure 1 The execution subject of the sensitive data detection method provided by the present application can be a logical sensitive data detection system or an electronic device (such as a server) physically carrying the system, and is designed to solve the technical problem that the prior art is difficult to balance the detection accuracy and processing efficiency when processing massive real-time data. The method can be applied to scenarios such as telecommunication network security and Internet content review, and specifically can include the following steps:

[0071] First, the communication data to be detected is input into the acceleration preprocessing layer to obtain a preliminary risk score output by the acceleration preprocessing layer.

[0072] In the present embodiment, the communication data to be detected refers to communication information in digital form that needs to be analyzed for content security. The specific form can include but is not limited to a voice data stream, a text message, an email or a network post. The communication data can be received in real time or read in batches.

[0073] The acceleration preprocessing layer is the first level processing unit in the double-layer architecture proposed by the present application, which is used for rapid preliminary analysis of all received communication data to be detected.

[0074] In a specific implementation, the acceleration preprocessing layer can be composed of one or more computing models or rule sets, which are designed with low computational complexity and high processing speed as the main features to meet the real-time requirements of large-scale data streams. When the communication data to be detected is input into the acceleration preprocessing layer, the acceleration preprocessing layer analyzes the communication data and outputs a preliminary risk score.

[0075] The preliminary risk score is a numerical value output by the acceleration preprocessing layer to represent the probability of containing sensitive data in the communication data. In the present application, the sensitive data can refer to different types of content according to different application scenarios, such as telecommunications fraud information, network violation content or abnormal transaction data in financial risk control, etc.

[0076] In an optional embodiment, the preliminary risk score can be normalized to the interval [0, 1]. By obtaining the preliminary risk score, a quantitative basis for subsequent decision steps is provided.

[0077] Secondly, based on the determination result of the preliminary risk score, a subsequent processing path for the communication data is determined.

[0078] After obtaining the preliminary risk score, the system will make a determination thereon, aiming to evaluate the definiteness of the preliminary risk score, i.e., whether it is sufficient for making a final classification decision. Based on the determination result, the system will determine a subsequent processing path for the communication data. The subsequent processing path is a pre-defined logical flow for differentiating the processing of data with different risk levels. The present application defines at least two subsequent processing paths to achieve the optimal allocation of computing resources.

[0079] Specifically, if the subsequent processing path is a first path, a final classification label is determined based on the preliminary risk score. The first path is a processing flow set for communication data whose determination result of the preliminary risk score is considered to be definite. When the system judges that no more complex analysis is needed, this path will be selected. Under the first path, the system will directly determine the final classification of the communication data based on the value of the obtained preliminary risk score. For example, a determination rule can be pre-set: when the preliminary risk score is higher than a pre-set high threshold, the final classification label is determined to be “high risk” or “abnormal”; when the score is lower than a pre-set low threshold, it is determined to be “normal”.

[0080] Correspondingly, if the subsequent processing path is a second path, the communication data is input to an enhanced judgment layer to determine a final classification label according to the output of the enhanced judgment layer.

[0081] The second path is a processing flow set for communication data whose determination result of the preliminary risk score is considered to be indefinite or suspicious.

[0082] The enhanced judgment layer is a second-level processing unit in the two-layer architecture of the present application, which is designed to have high analysis accuracy as the main target, and can be internally composed of one or more deep network models with complex structures. These deep network models have the ability to perform deep semantic understanding of the communication content, and can mine deep features that the acceleration preprocessing layer fails to identify. When the communication data is input to the enhanced judgment layer, it performs deep analysis on the trusted data and outputs the corresponding analysis result. The system will determine the final classification label of the communication data according to the output result of the enhanced judgment layer.

[0083] The final classification label is the final output of the processing flow of the method, which is a qualitative identifier for representing the sensitivity category to which the communication data belongs. As a qualitative identifier, it can be a discrete category name rather than a continuous numerical value. For example, the qualitative identifier can be "high risk", "low risk", "normal", or more specific sensitive content subtypes such as "fake customer service class", "illegal advertising class", etc. The final classification label can be directly used by downstream business systems.

[0084] The sensitive data detection method provided by the application adopts a double-layer model architecture design and a data flow control method, uses a lightweight acceleration preprocessing layer to perform large-scale and high-speed preliminary screening on a large amount of incoming data, and then performs accurate type division on the screened suspicious data through an enhanced research and judgment layer, so that the accuracy of the heavy model is obtained at a speed close to the lightweight model, the balance between efficiency and accuracy is realized, and the production level requirement is met.

[0085] As an optional embodiment, the communication data includes structured data and unstructured communication content.

[0086] The communication data to be detected is input into the acceleration preprocessing layer, including:

[0087] Text features are extracted from the unstructured communication content.

[0088] The structured data and the text features are input into the acceleration preprocessing layer together.

[0089] The communication data to be detected provided by the application is composed of two different types of data, and the acceleration preprocessing layer performs fusion processing on the two different types of data.

[0090] In a specific application scenario, when the system receives an original telephone call data stream, the information contained in the data stream can be divided into two main parts:

[0091] One part is unstructured communication content, mainly referring to natural language information without fixed format and free flow. In this embodiment, the most typical unstructured communication content is the call script text converted from the original call recording through voice transcription technology. For example, the text content is "Hello, we are XX customer service, your personal loan account is abnormal, and needs to cooperate with us to check the funds..."

[0092] The other part is structured data, which refers to data with clear fields and fixed format. In this embodiment, the structured data can include but is not limited to communication signaling information, system configured list information and other associated data.

[0093] The communication signaling information can include a calling number, a called number, a number home location, whether it is an overseas call, a call duration, a call frequency, and other information reflecting the behavior characteristics of the communication.

[0094] The list information configured by the system can be a pre-maintained blacklist of known fraud numbers, or a protected whitelist that is less likely to be misjudged.

[0095] In some embodiments, the other associated data can include a structured numerical representation such as a speaker voiceprint feature vector extracted from the call voice.

[0096] Considering that the calculation model inside the acceleration preprocessing layer may not be able to directly process the original text string, before inputting these communication data into the acceleration preprocessing layer, a key preprocessing can be performed on the unstructured communication content in advance, that is, to extract the computable and quantifiable text features from the unstructured communication content. In an optional embodiment, this step can be completed by calculating the weight of key words in the text, such as the words "credit limit", "account verification", "security authentication code", etc., thereby converting a piece of conversational text into a feature vector composed of key words and their importance scores.

[0097] After completing the text feature extraction, the embodiment can perform a step of fusing the input, that is, inputting the structured data and the text features into the acceleration preprocessing layer together. In other words, when the acceleration preprocessing layer analyzes, the input it receives is a feature set that fuses two different types of data.

[0098] For example, when the acceleration preprocessing layer analyzes the call voice, the following feature set is obtained:

[0099] (1) Text features extracted from the text, such as the appearance of the keyword "credit limit" with a weight of 0.8, and the appearance of the keyword "account verification" with a weight of 0.9.

[0100] (2) Directly obtained structured data, such as the feature "whether it is an overseas call" = yes; the feature "calling number hits the blacklist" = yes; the feature "call duration" = 350 seconds.

[0101] The calculation model inside the acceleration preprocessing layer will consider all these feature sets to calculate the final preliminary risk score, for example, the probability model inside it will calculate P (sensitive | appearance of "credit limit" AND yes overseas call AND hit blacklist...).

[0102] The sensitive data detection method provided by the application realizes the feature layer fusion of structured data and unstructured communication content at the acceleration preprocessing layer, so that the generation of the preliminary risk score no longer depends on only the single call content or single call behavior, the content features and behavior features of the communication can be comprehensively analyzed, a more comprehensive and reliable preliminary judgment than single data source analysis can be made, and therefore the recognition accuracy of the entire detection method is greatly improved.

[0103] Based on the content of the above embodiment, as an optional embodiment, how the application generates a set of quantifiable text features capable of representing the importance of the content from the unstructured communication content will be described in detail.

[0104] The application can extract text features from unstructured communication content (such as call text), and the text features are a set of weight values representing the importance of each keyword in the unstructured communication content. It can be understood that the text features are not a single numerical value, but a set of weight values, which together form a numerical vector for representing the core semantics of the communication content. Specifically, each value in the set of weight values corresponds to a keyword in the communication content and is used to measure the importance of the keyword for judging whether the content is sensitive.

[0105] In order to obtain the weight value corresponding to each keyword, the embodiment discloses a specific determination method, which is determined based on the term frequency (TF) of the keyword and the inverse document frequency (IDF) of the keyword.

[0106] The term frequency refers to the frequency of the keyword appearing in the unstructured communication content, which can be determined by counting the importance of each keyword in the single communication content. For example, in an unstructured communication content, if the keyword "account verification" appears multiple times, it has a high term frequency.

[0107] The inverse document frequency is a measure value for evaluating the rarity of the keyword in the historical communication content sample library. This index aims to enhance the importance of keywords with high discriminability that only appear in specific types of communication content, while suppressing the importance of general words that exist in various types of communication content. The size of the inverse document frequency is inversely proportional to the number of documents containing the keyword in the historical communication content sample library. Specifically, the more rare a keyword is in the historical communication content sample library (i.e. the fewer documents containing the keyword), the higher the measure value of its inverse document frequency; on the contrary, if a keyword appears in most documents (such as general words), the measure value of its inverse document frequency will tend to zero.

[0108] The historical communication content sample library is a pre-constructed corpus directly related to the application field of the present application, which specifically includes: a plurality of historical communication content samples marked as containing sensitive content, and a plurality of historical communication content samples marked as not containing sensitive content.

[0109] In a preferred embodiment, to adapt to the continuous evolution of sensitive content-related jargon, the present embodiment introduces a weight dynamic adjustment mechanism, which is mainly realized by real-time and dynamic updating of the inverse document frequency metric value, and the updating process can include but is not limited to the following steps:

[0110] (1) Before deployment, the system can calculate and store an initial inverse document frequency dictionary based on a large-scale historical communication content sample library offline.

[0111] (2) During actual detection operation, the newly received communication data is regarded as a streaming data set. A sliding window or small batch processing method can be used, for example, once a preset number (such as ten thousand) of new communication data is processed, an update calculation is triggered. On the current window or batch of data, the system will re-count the document frequency of each keyword, and re-calculate and update the above-mentioned inverse document frequency dictionary in combination with historical statistical information.

[0112] The weight dynamic adjustment mechanism can make the determination of keyword weight dynamically follow the changes in the language environment. For example, when a new sensitive content term (such as "digital wallet freezing") appears and increases, it will obtain a higher inverse document frequency metric value in the new data batch because its overall document number is still small, and its weight is thus dynamically improved. Conversely, if an old sensitive term is widely known and frequently appears in normal communication, its document frequency will increase, resulting in a dynamic decrease in its inverse document frequency metric value, and its weight will also decrease.

[0113] Finally, the weight value corresponding to each keyword can be obtained by combining and calculating (for example, multiplying) the term frequency of the keyword and the inverse document frequency metric value of the keyword. By performing this calculation on all identified keywords, a complete set of weight values as text features can be generated.

[0114] The present application provides an efficient and dynamically adaptive text feature extraction method, which combines term frequency and inverse document frequency based on a professional field sample library, and introduces a weight dynamic adjustment mechanism. The generated text features can accurately represent the core semantics and sensitivity of the communication content, thereby providing high-quality input for the acceleration preprocessing layer to perform reliable preliminary risk scoring, and improving the performance of the entire detection method.

[0115] As an optional embodiment, the acceleration pre-processing layer comprises a plurality of parallel sub-models, each of which is trained to identify a specific type of sensitive data; the step of inputting the communication data to be detected into the acceleration pre-processing layer and obtaining the preliminary risk score output by the acceleration pre-processing layer comprises: inputting the communication data into each of the sub-models respectively to obtain individual score results output by each of the sub-models; and outputting the highest score value among all the individual score results as the preliminary risk score; the individual score result output by any sub-model represents the probability that the communication data identified by the any sub-model contains the specific type of sensitive data corresponding to the any sub-model.

[0116] The embodiment will elaborate the internal architecture of the acceleration pre-processing layer and the specific generation process of the preliminary risk score.

[0117] In one specific implementation, the acceleration pre-processing layer is not a single, macroscopic computing model, but comprises a plurality of parallel sub-models, each of which is a lightweight classifier or rule set. This architecture design aims to achieve fine-grained and specialized identification of different types of sensitive content.

[0118] It should be noted that in order to make each sub-model have specialized identification capability, each sub-model is trained to identify a specific type of sensitive data. For example, in a telecommunications anti-fraud application scenario, independent sub-models can be trained for different types of fraud, such as a sub-model specifically for identifying "fake financial customer service" type content, another sub-model specifically for identifying "brushing rebate" type content, and other sub-models corresponding to different sensitive content scenarios.

[0119] The embodiment further specifies the specific implementation of the step of inputting the communication data to be detected into the acceleration pre-processing layer and obtaining the preliminary risk score output by the acceleration pre-processing layer. The process comprises the following sub-steps:

[0120] First, input the communication data into each sub-model respectively to obtain individual score results output by each sub-model. In one specific implementation, when a communication data to be detected (assuming it contains structured data and text features) enters the acceleration pre-processing layer, it is distributed to all parallel sub-models in the acceleration pre-processing layer as a unified feature vector. Each sub-model independently analyzes the feature vector and outputs a corresponding individual score result.

[0121] Here, the individual score result output by any sub-model represents the probability that the communication data contains the specific type of sensitive data corresponding to the sub-model. For example, the individual score result output by the "fake financial customer service" sub-model is 0.82, indicating that the sub-model considers that the current communication data has an 82% probability of belonging to the "fake financial customer service" type.

[0122] Then, after obtaining all the individual score results output by the sub-models, the system performs a decision step, that is, outputs the highest score value among all the individual score results as the preliminary risk score. For example, if the "fake financial customer service" sub-model outputs 0.82, the "single return" sub-model outputs 0.15, and the values output by other sub-models are all less than this, the system will select the highest score value of 0.82 as the preliminary risk score representing the judgment result of the entire acceleration preprocessing layer. At the same time, the system will also record which sub-model produces this highest score, which helps to preliminarily determine the specific type of sensitive content in the subsequent steps.

[0123] The present application adopts the architecture of multiple parallel sub-models, realizes fine-grained identification and rapid screening of different types of sensitive content, and compared with the scheme using a single general model, this specialized and parallel processing method not only improves the accuracy of preliminary judgment, but also provides a basis for subsequent implementation of dynamic threshold adjustment and rule configuration for specific sensitive content types, greatly enhancing the flexibility and precision strike capability of the entire detection method.

[0124] In the sensitive data detection method provided by the present application, the discrimination condition for determining the judgment result of the preliminary risk score is dynamically adjusted. That is, the present application introduces a dynamic adjustment mechanism that can adapt to changes in the situation of sensitive content.

[0125] The present application determines the subsequent processing path of the communication data based on the judgment result of the preliminary risk score, and this judgment process relies on a preset discrimination condition. For example, in a threshold-based implementation, the discrimination condition can be one or more pairs of high and low thresholds. However, in actual application, the frequency of occurrence and the speech pattern of various types of sensitive content are constantly changing. If a fixed, static discrimination condition is used, when a certain type of sensitive content suddenly breaks out, it may lead to a large number of false negatives due to the discrimination condition being too strict; on the contrary, when a certain type of sensitive content decreases, a too lenient discrimination condition may lead to an increase in the false positive rate.

[0126] To solve this technical problem, the embodiment clearly points out that the discriminant condition for determining the judgment result of the preliminary risk score is dynamically adjusted. In a specific implementation, this means that the discriminant condition is not fixed once set, but can be automatically and periodically updated and optimized according to real-time detection environment and data feedback. This dynamic adjustment mechanism is the key to realizing high adaptability of the application, enabling the sensitive data detection method provided by the application to flexibly adjust its vigilance according to the main risk type currently faced, like an experienced analyst.

[0127] For example, when it is found through internal monitoring that the frequency of sensitive content related to the specific type of "fake financial customer service" has significantly increased in recent times, the dynamic adjustment mechanism will be triggered, for example, the discriminant condition associated with the "fake financial customer service" sub-model will be automatically optimized, such as the threshold for judging high risk can be moderately reduced. In this way, even if the subsequent preliminary risk score of the "fake financial customer service" type communication content is not very high, it is more likely to be accurately captured, thereby effectively improving the recall rate of high-frequency type sensitive content. Conversely, when a certain type of sensitive content disappears or the false positive rate is consistently high, the discriminant condition can be adjusted in the opposite direction to improve the accuracy of detection.

[0128] By introducing the dynamic adjustment mechanism of the discriminant condition, the sensitive data detection method provided by the application effectively gets rid of the limitations of traditional static rules or fixed threshold schemes, enabling the entire detection method to have self-adaptability to the changing sensitive content situation, intelligently balancing the accuracy and recall rate of detection while ensuring system stability, thereby maintaining high efficiency and precision in detection performance in complex and variable practical application environments.

[0129] Figure 2 is a flowchart of the process of updating the discriminant condition of the preliminary risk score provided by the application, as shown in Figure 2 , specifically including but not limited to the following steps:

[0130] Step 1, obtaining the trigger frequency of each specific type of sensitive data within a preset time window, to determine the current feature variation of each specific type of sensitive data based on the trigger frequency.

[0131] A preset time window (for example, every 5 minutes or every data batch processed) can be used to monitor the trigger frequency of each specific type of sensitive data in real time. In an optional implementation, the trigger frequency of a certain specific type of sensitive data can be defined as the ratio of the number of times its corresponding sub-model is identified as a sensitive event to the total number of monitored events within the current time window: t ​​

[0132] .

[0133] After obtaining the trigger frequency of the current time window , the current feature change amount of each specific type of sensitive data can be further determined , the feature change amount reflects the change amplitude and direction of the current frequency relative to the historical baseline, and is the core driving force for adjusting the discrimination condition, which can be calculated by . Wherein, wherein is the baseline frequency of the specific type of sensitive data triggered based on historical data of multiple time windows, for example, the sliding average of the past several time windows.

[0134] In another embodiment, the content of feature monitoring can also be extended to other dimensions, such as: the change of the recent keyword weight distribution, or the recent model performance indicators such as accuracy and recall rate obtained by feedback with the downstream business system. These additional monitoring dimensions can be used together to determine a more comprehensive feature change amount.

[0135] Step 2, for the target sub-model trained to identify each specific type of sensitive data, according to the current feature change amount of the specific type of sensitive data and the preset basic discrimination threshold, the historical discrimination threshold of the target sub-model in the last detection period is corrected to obtain the current sensitive discrimination threshold in the current detection period.

[0136] It should be noted that the threshold correction method based on exponential weighted moving average provided in step 2 is independently performed for the target sub-model trained to identify each specific type of sensitive data, that is, the present invention will correct the discrimination threshold of each target sub-model according to its corresponding current feature change amount . Specifically, the historical discrimination threshold of the target sub-model in the last detection period is corrected to obtain the current sensitive discrimination threshold in the current detection period. This correction can be realized by an exponential weighted recursive method, which not only considers the current data performance, but also smoothly takes into account the influence of historical threshold, thereby avoiding the sharp fluctuation of threshold caused by data mutation.

[0137] In a specific implementation, the correction process can be expressed by the following correction formula:

[0138] .

[0139] Wherein, is the calculated current sensitive discrimination threshold; the historical discrimination threshold, that is, the threshold value of the target sub-model in the last detection period; It is a preset basic discrimination threshold set for this target sub-model; It is a historical weight decay factor, whose value is usually between 0.7 and 0.9, used to control the decay rate of historical information; It is a change sensitivity coefficient used to adjust the response magnitude of the discrimination threshold to changes in features.

[0140] Based on the above modified formula, when the triggering frequency of a specific type of sensitive content increases (i.e.) >0), can be achieved by setting a sensitivity coefficient. (Taking a negative value) makes the calculated current sensitivity threshold... This reduces the false positive rate, thereby increasing the recall rate for that high-incidence content type. Conversely, when an increase in the false positive rate is detected (e.g., inferred from feedback accuracy metrics), adjustments can be made. Value is positive or adjusted The calculation method increases the threshold to improve accuracy.

[0141] Step 3: Determine the current sensitivity threshold of the sub-model with the highest score among all the individual scores in the current detection period, so as to determine the sensitivity interval of the current detection period.

[0142] When new communication data is processed by the accelerated preprocessing layer, it is determined which sub-model output the highest individual score result, and then the sub-model with the highest score among all individual score results is determined at the current sensitivity threshold in the current detection period.

[0143] The current sensitivity threshold is dynamically changed based on this sub-model that outputs the highest score. This allows for the rapid determination of the sensitive discrimination interval for the current detection period. For example, this sensitive discrimination interval can be determined by a pair of high and low thresholds. , Composed of, among which and All by Derived or direct, these are different dynamic thresholds, such as the core threshold. Add or subtract a fixed offset, such as 0.1, to both sides.

[0144] Step 4: Based on the relationship between the preliminary risk score and the sensitive discrimination interval, determine the discrimination conditions for the current detection cycle, and then determine the subsequent processing path of the communication data.

[0145] In an optional embodiment, the dynamic adjustment process can also introduce a boundary protection mechanism. That is, an upper limit and a lower limit of the allowed fluctuation are set for each dynamic discrimination threshold (for example, within ±20% of the base threshold) to prevent extreme data from causing the threshold to drift too much, ensuring the stability of the entire detection method.

[0146] The sensitive data detection method provided by the application provides a complete, closed-loop and highly targeted dynamic determination method of discrimination conditions. By using the recursive correction method of exponential weighted moving average, the current sensitive discrimination threshold can be dynamically adjusted in real time, avoiding high resource consumption, and balancing real-time performance and lightweight characteristics. The method can intelligently and differently respond to the situation changes of different types of sensitive content, dynamically balance the recall rate and the accuracy rate, and greatly improve the robustness and intelligent level of the entire detection system in complex and variable environments.

[0147] Notably, the dynamic determination method disclosed in the embodiment based on the idea of exponential weighted moving average has extremely high computational efficiency and extremely low resource consumption, with time complexity and space complexity of O(1), i.e., constant level.

[0148] Specifically, the time complexity of O(1) is reflected in that, in each detection period, the process of calculating the current sensitive discrimination threshold for a single target sub-model only needs to perform a certain number of fixed arithmetic operations (such as multiplication, addition, etc.), and the number of calculation steps is constant and does not depend on the total amount of historical communication data processed or the size of data to be processed in the future. For example, when calculating by the above correction formula, only the historical discrimination threshold of the last period and the feature change amount of the current period are needed, without traversing or processing any earlier historical data.

[0149] The space complexity of O(1) is reflected in that, in order to complete the calculation of the next detection period, only one historical discrimination threshold (i.e., the discrimination threshold calculated in the current period ) needs to be maintained in the memory for each target sub-model, and the corresponding storage overhead is fixed and will not increase with the increase of running time or the accumulation of the amount of data processed, i.e., there is no need to store the discrimination threshold sequence of all historical time points.

[0150] Due to the O(1) computational and storage overhead characteristics, the discrimination condition dynamic adjustment mechanism introduced by the application has the characteristics of high efficiency and lightweight, and can achieve powerful dynamic adaptation function with almost negligible computational and storage resource consumption, which has a key technical advantage in meeting the stringent requirements of low latency and lightweight in the massive and real-time data stream processing scenario.

[0151] The sensitive discrimination interval in the embodiment , is jointly defined by a maximum value and a minimum value , which is a discrimination basis for triage of the preliminary risk score.

[0152] In a specific embodiment, the specific application logic of the discrimination condition is as follows:

[0153] The high-risk direct-out path determines that the subsequent processing path of the communication data is the first path when the preliminary risk score is greater than the maximum value of the sensitive discrimination interval.

[0154] When the preliminary risk score of a communication data exceeds the currently dynamically set high threshold (i.e., the maximum value ), it can be considered to have a high suspicion of sensitive content, and no more complex analysis is needed. At this time, the first path (i.e., the fast channel) is selected for it, and the final classification label is directly determined as abnormal. The "abnormal" here is a qualitative identification, which can also be "high risk", "sensitive" or a specific sensitive content type according to the specific business scenario.

[0155] The low-risk direct-out path determines that the subsequent processing path of the communication data is the first path when the preliminary risk score is less than the minimum value of the sensitive discrimination interval.

[0156] When the preliminary risk score is lower than the currently dynamically set low threshold (i.e., the minimum value ), it can be considered to be basically confirmed as normal content. At this time, the first path is also selected for it, and the final classification label is directly determined as normal.

[0157] The suspicious data deep analysis path determines that the subsequent processing path of the communication data is the second path when the preliminary risk score is within the sensitive discrimination interval.

[0158] This means that when the preliminary risk score falls within the ambiguous interval defined by the maximum value and the minimum value , the acceleration preprocessing layer cannot make a clear judgment. At this time, it can be considered that the communication data has a certain suspiciousness and needs to be analyzed more deeply, so the second path (i.e., the fine analysis channel) is selected for it, and it is handed over to the subsequent enhanced analysis layer for processing.

[0159] This invention provides a clear and efficient three-way traffic splitting and discrimination logic. By using a sensitive discrimination interval dynamically defined by maximum and minimum values, it can intelligently classify all communication data into three categories: "abnormal," "normal," and "suspicious." This ensures that only a small number of truly difficult-to-judge data are sent to the computationally expensive enhanced judgment layer, while the vast majority of clear data can be quickly processed through the first path. This not only greatly optimizes the allocation of system resources but also perfectly balances the real-time performance and accuracy of the entire detection method when processing massive amounts of data.

[0160] Based on the above embodiments, as an optional embodiment, the sensitive data detection method provided by the present invention also introduces a configurable mechanism for model rules, which aims to provide an expert intervention channel to cope with the rapid emergence of new sensitive content patterns, help improve the problem of insufficient automatic identification ability in specific scenarios, and make up for the lag that may exist in the pure automatic learning mechanism.

[0161] In one specific implementation, the configurability mechanism relies on a model rule configuration backend consisting of a front-end interface and back-end services. This backend allows authorized personnel (e.g., anti-fraud experts or system administrators) to manually and instantly adjust the rules of any sub-model in the accelerated preprocessing layer. The specific workflow may include the following steps:

[0162] First, the model configuration instructions are defined and generated based on the user-configurable rule management interface, which is the front-end interface of the model rule configuration backend.

[0163] The model rule configuration backend provides a visual rule management interface, where operators can see a list of all parallel sub-models. For example, there might be a sub-model for identifying "impersonating financial customer service" and another for identifying "brushing orders for rebates." Operators can select and access the dedicated configuration page for any of these sub-models.

[0164] On this dedicated configuration page, operators can define or modify rules related to the sub-model through a series of input boxes, checkboxes, drop-down menus, or a rule editor. When the operator completes the configuration and submits it (for example, by clicking the "Save" or "Publish" button), the front-end interface will convert the operation into structured model configuration instructions.

[0165] Then, the system will receive model configuration instructions sent by the model rule configuration backend in real time. After receiving the model configuration instructions generated by the front-end interface, it will send them to the detection system that is running online.

[0166] Finally, the detection system will respond to the model configuration instruction to modify the text feature or structured data processing rule associated with any sub-model in the acceleration preprocessing layer.

[0167] After receiving the response model configuration instruction, the detection system will immediately parse and execute the corresponding modification operation, such as dynamically adding, deleting, or adjusting.

[0168] The specific configurable rule content corresponding to the response model configuration instruction includes but is not limited to text feature-related rules and structured data processing rules.

[0169] Text feature-related rules can include positive keywords and negative keywords. Operators can add new keywords for the target sub-model, and the appearance of these keywords will increase the probability of the communication content being judged as sensitive content of the corresponding type. For example, for a new type of "fake medical insurance" sensitive content, operators can manually add keywords such as "medical insurance card fraud", "suspected insurance fraud", "fund check", etc. Operators can also set an initial base weight for these newly added keywords.

[0170] Operators can also add keywords for false positive exclusion, for example, if a normal social security notification call is mistakenly judged due to the inclusion of "medical insurance card", "medical insurance reimbursement", "annual settlement", etc. can be added as negative keywords to reduce its sensitive score in normal scenarios.

[0171] Structured data processing rules mainly include communication signaling rules, black / white list rules, etc. For communication signaling rules, operators can configure communication behavior characteristics highly related to specific sensitive types. For example, a rule can be set for a sub-model: "the caller ID must be an overseas number" or "the first call duration must be greater than a preset number of seconds".

[0172] For black / white lists, operators can maintain exclusive blacklists and / or whitelists for specific sub-models. For example, newly confirmed phone numbers used to implement specific type sensitive behavior can be manually added to the blacklist of the corresponding sub-model, or frequently misreported official numbers can be added to the whitelist.

[0173] After the system responds to the instruction and completes the modification, it will immediately load the new rules into the corresponding sub-model running instance in the acceleration preprocessing layer, making it take effect immediately.

[0174] The present application provides an efficient operation and maintenance mode that combines automated models with human expert experience, providing visual, configurable, and immediate rule management functions, enabling quick response and precise adaptation when faced with a growing number of new sensitive content, greatly improving the flexibility, robustness, and continuous effectiveness of the system in complex adversarial environments.

[0175] As an optional embodiment, the enhanced judgment layer is constructed based on a pre-training language model of a Transformer architecture.

[0176] In the architecture with only the acceleration preprocessing layer, the sensitive data detection method provided by the application can achieve efficient preliminary screening, but still has certain limitations. Specifically, the probability statistical model relied on by the acceleration preprocessing layer mainly focuses on surface features such as the appearance frequency of keywords when analyzing text, and lacks the ability to understand the deep and coherent context semantics of the communication content. This may lead to the fact that its recognition effect does not meet the requirements of a production-level system (for example, both the accuracy and the recall rate need to be more than 95%) when facing some sensitive content that uses new rhetoric and ambiguous wording.

[0177] In order to make up for this deficiency and achieve higher detection accuracy, the enhanced judgment layer used in this embodiment is constructed based on a pre-training language model of a Transformer architecture, for example, a BERT model (Bidirectional Encoder Representations from Transformers). The BERT model takes its powerful self-attention mechanism (Self-Attention) as the core, which can capture the long-distance dependency relationship between any two words in the text sequence, thereby achieving a deep understanding of the context semantics.

[0178] In a specific embodiment, when a communication data to be judged is sent to the enhanced judgment layer, the pre-training language model of this layer will analyze it. In order to better apply it to the sensitive data detection scenario of the application and balance the accuracy and efficiency, one or more optimization strategies can be used, for example:

[0179] (1) Parallel attention mechanism is used. In the Transformer encoder inside the enhanced judgment layer, a typical multi-head self-attention mechanism (for example, an 8-head or 12-head parallel computing architecture) can be used. Each head independently focuses on different semantic subspaces and accelerates feature capture through parallel computing. This mechanism expands the model's expressive power, allowing it to better distinguish subtle semantic differences in sensitive rhetoric.

[0180] (2) Dynamically manage the secondary judgment threshold. A configurable discrimination threshold can be set for the output of the enhanced judgment layer. This discrimination threshold is used to make a final ruling on the deep risk score output by the pre-training language model. By manually or automatically dynamically managing this discrimination threshold, the judgment result of the acceleration preprocessing layer can be linked, and the data size entering the enhanced judgment layer can be flexibly controlled, thereby achieving a fine balance between efficiency and effectiveness.

[0181] The present application greatly enhances the recognition ability of complex, new, and contextually related sensitive content by introducing a pre-trained language model based on the Transformer architecture as an enhanced research and judgment layer. It compensates for the shortcomings of the acceleration preprocessing layer in deep semantic understanding, enabling the entire two-layer architecture to maintain high processing efficiency while improving the final detection accuracy and recall rate to meet the requirements of production-level systems, achieving high-precision and intelligent research and judgment of sensitive data.

[0182] As another optional embodiment, the pre-trained language model, after receiving the communication data, further comprises:

[0183] performing dynamic proportion token masking on the unstructured communication content in the input communication data;

[0184] and / or the pre-trained language model compresses high-dimensional semantic vectors to pre-set low-dimensional semantic vectors through feature distillation.

[0185] The pre-trained language model used by the enhanced research and judgment layer can also use the following two optimization strategies to improve model robustness and running efficiency when analyzing:

[0186] The first optimization strategy is to perform dynamic proportion token masking on the unstructured communication content in the input communication data to enhance the generalization ability and tolerance of the pre-trained language model to variant rhetoric.

[0187] Specifically, before sending the unstructured communication content (such as call text) into the core computing unit of the pre-trained language model, the Token Sequence of the unstructured communication content will be processed, including randomly selecting a part of the Token Sequence and replacing or masking it with a special mask marker.

[0188] Dynamic proportion means that the proportion of masked tokens is not a fixed value, but is dynamically adjusted within a pre-set interval (for example, 15% to 25%). In an optional embodiment, the specific proportion can be adaptively adjusted according to the progress of training or the complexity of the current processing data batch. This dynamic mask proportion strategy allows the pre-trained language model to be exposed to a wider variety of context missing patterns during training and inference, thereby improving its generalization ability to different contexts: it helps to reduce the model's overfitting to specific sentence structures, and also enables the model to maintain good semantic understanding and recognition ability when facing sensitive rhetoric transformed by synonym replacement, word order reversal, etc.

[0189] Another optimization strategy is to compress the high-dimensional semantic vector to a pre-set low-dimensional semantic vector through feature distillation, so as to reduce the model calculation complexity and resource occupation, and improve the overall real-time performance of the system.

[0190] The pre-trained language model (after deep encoding of the input text, a high-dimensional semantic vector (for example, 768 dimensions) is usually generated for each text. Although the high-dimensional semantic vector contains rich semantic information, its high dimension also brings a large calculation and storage load to the subsequent processing (such as full connection layer classification).

[0191] To solve this problem, the present embodiment introduces a feature distillation technology by adding a feature distillation module after the output end of the pre-trained language model. The feature distillation module can adopt a lightweight neural network or a linear dimension reduction method, and its core function is to compress and map the high-dimensional semantic vector to a pre-set low-dimensional semantic vector (for example, 192 dimensions). In the compression process, the key core information for classification and discrimination can be ensured to be retained through adversarial learning or minimizing reconstruction error, etc.

[0192] This optimization strategy significantly reduces the dimension of the feature vector, thereby saving the calculation resources and memory occupation when deploying the model. At the same time, it effectively reduces the delay of subsequent calculation, and is particularly suitable for deployment in an environment with limited computing resources. To some extent, compressing the features can filter out part of the noise interference in the high-dimensional space, which helps to improve the generalization ability of the pre-trained language model.

[0193] Figure 3 is the system architecture diagram of the sensitive data detection method provided by the present application, in combination with Figure 3 As shown, before processing the communication data to be detected, the original voice signal is first preprocessed. The preprocessing process can be uniformly managed and started by a scheduling service module, which specifically includes:

[0194] First, the voice data stream is obtained. The voice data stream is the original telephone call recording or real-time voice signal that needs to be detected.

[0195] After obtaining the voice data stream, as shown in Figure 3 The scheduling service module calls the voice transcription capability of the system. The voice transcription capability can be realized based on automatic speech recognition (ASR) technology, which functions to process the voice data stream and convert it from an analog acoustic signal to a digital text sequence, that is, the unstructured communication content can be obtained. The unstructured communication content is usually a text string, which will be one of the main inputs for subsequent accelerated preprocessing layer content analysis.

[0196] By introducing the speech transcription step, the original unstructured speech signal can be converted into machine-readable and analyzable text data, i.e., the unstructured communication content, thereby laying a foundation for subsequent content-based deep semantic analysis and risk assessment, and greatly expanding the applicable scenarios of the present application.

[0197] As shown in Figure 3 After obtaining the speech data stream, the dispatch service module will also call the voiceprint extraction capability of the system in parallel to extract voiceprint features from the speech data stream. The voiceprint feature is a numerical vector that can represent the biological characteristics of the speaker's identity, which is directly input as an identity analysis path.

[0198] After the voiceprint features are extracted, the voiceprint features can be input to a separate voiceprint judgment module. The voiceprint judgment module is designed to analyze the identity of the speaker, and the analysis result is the voice identity analysis result output by the voiceprint judgment module.

[0199] The voice identity analysis result is not directly used for final decision-making, but is used as reference information for determining the final classification label. As shown in the comprehensive judgment process in Figure 3 The output result of the voiceprint judgment module is sent to the subsequent processing link.

[0200] In an optional embodiment, the voice identity analysis result (for example, a Boolean value indicating whether it hits the blacklist, or a risk score indicating identity abnormalities) can be regarded as a structured data, which is used together with the text features from the unstructured communication content to calculate the preliminary risk score by the acceleration preprocessing layer.

[0201] By introducing a parallel identity analysis path, i.e., by combining content-based analysis (implemented by speech transcription) and identity-based analysis (implemented by voiceprint judgment), the present application can comprehensively analyze the communication data from two dimensions, greatly improving the accuracy and robustness of detection, especially for identifying known multiple or gang cases, which has a key technical advantage.

[0202] Voiceprint features are a biometric technology that analyzes the identity characteristics of speech rather than the content of speech. Specifically, a unique and quantifiable feature vector that represents the physical characteristics of the speaker's vocal organs is extracted from the speech signal as the identification object.

[0203] As an optional embodiment, the present application inputs the voiceprint features to the voiceprint judgment module, and obtains the voice identity analysis result output by the voiceprint judgment module, which can be implemented in at least one of the following ways:

[0204] The first implementation: using the voiceprint judgment module to compare the voiceprint features with a blacklist voiceprint library to generate the voice identity analysis result.

[0205] A blacklist voiceprint library can be established in advance, which stores voiceprint features of known risk personnel (e.g., historically confirmed fraudsters). When the voiceprint judgment module receives the voiceprint features of the current caller, it will compare them with all the voiceprints in the blacklist voiceprint library in a one-to-many manner. If the calculated similarity exceeds a preset threshold, a voice identity analysis result indicating "hit blacklist" can be directly generated, which can achieve accurate and efficient identification of habitual offenders.

[0206] The second implementation: using the voiceprint judgment module to perform clustering analysis on multiple voiceprint features derived from different communication data to determine the voice identity analysis result according to the association relationship between all the voiceprint features obtained by clustering analysis.

[0207] The voiceprint judgment module can periodically collect and process multiple voiceprint features derived from different times and different communication numbers, and perform clustering analysis on them. If there are multiple seemingly isolated sensitive events behind which the same or highly similar voiceprint features appear (i.e., they are clustered into one class), it can be determined that there is an association relationship between these events. Based on this association relationship, a voice identity analysis result indicating "suspected gang crime" can be generated, providing important clues to crack down on gang crimes from the source.

[0208] The third implementation: using the voiceprint judgment module to detect the matching degree between the voiceprint features associated with a single communication number and other voiceprint features associated with the single communication number collected within a preset time period to generate the voice identity analysis result according to the matching degree.

[0209] The voiceprint judgment module can monitor the changes of voiceprint features associated with a single communication number over time. Specifically, the voiceprint features of the current call can be matched with other voiceprint features of the same single communication number collected within a preset time period (e.g., the past 24 hours). If it is found that the matching degree is consistently low, i.e., a number has multiple distinct voiceprint features in a short period of time, it may indicate that the number is a "public number" or "virtual number" used for bulk phone calls. Based on this detected low matching degree, a voice identity analysis result indicating "one number multiple voices" anomaly can be generated as strong evidence for judging sensitive risks.

[0210] The application provides a variety of specific and effective voiceprint analysis methods, including one or more ways such as blacklist comparison, cluster analysis or abnormal identity detection, which can conduct in-depth security analysis on communication data from the dimension of speaker identity, generate multi-dimensional voice identity analysis results as important reference information for subsequent comprehensive analysis, greatly enrich the detection means of the system, and improve the recognition ability of specific risk scenarios (such as habitual offenders, gangs and false numbers).

[0211] Figure 4 is a structural schematic diagram of the sensitive data detection device provided by the application, as Figure 4 shown, mainly includes but is not limited to:

[0212] The risk preliminary evaluation unit 11 is used for inputting the communication data to be detected into an acceleration preprocessing layer, and obtaining a preliminary risk score output by the acceleration preprocessing layer;

[0213] The data detection shunt unit 12 is used for determining a subsequent processing path of the communication data based on a judgment result of the preliminary risk score;

[0214] If the subsequent processing path is a first path, a final classification label is determined based on the preliminary risk score;

[0215] If the subsequent processing path is a second path, the communication data is input into the data enhancement analysis unit 13;

[0216] The data enhancement analysis unit 13 determines a final classification label according to the communication data;

[0217] The preliminary risk score represents the probability that the communication data contains sensitive data, and the final classification label is a qualitative identification representing the sensitivity category to which the communication data belongs.

[0218] Optionally, the risk preliminary evaluation unit 11 has the acceleration preprocessing layer mentioned in the above embodiments built therein, is responsible for receiving the communication data to be detected, and calling a plurality of parallel sub-models in the acceleration preprocessing layer to analyze the communication data, so as to obtain the preliminary risk score.

[0219] The data enhancement analysis unit 13 has the enhancement analysis layer mentioned in the above embodiments built therein, and is responsible for conducting in-depth and context-aware analysis on the communication data with high suspiciousness sent by the shunt unit.

[0220] In an optional embodiment, the data enhancement and judgment unit 13 will first generate a deep risk score by its built-in enhancement and judgment layer (for example, a pre-trained language model based on a Transformer architecture) before outputting the final classification label, and then compare the deep risk score with a preset higher discrimination threshold (for example, 0.85) to finally determine the final classification result of the communication data.

[0221] Next, the cooperative working process of each unit of the device will be described through a specific implementation case.

[0222] Suppose the sensitive data detection device receives a piece of communication content "Your credit account is abnormal, and you need to download security software to clear the risk" as the communication data to be detected.

[0223] The risk preliminary assessment unit 11 starts working, and its built-in acceleration preprocessing layer analyzes the communication data. Suppose the sub-model trained to identify "fake credit investigation" outputs the highest individual score result, which is 0.71. Therefore, the preliminary risk score output by the risk preliminary assessment unit 11 is 0.71.

[0224] After receiving the preliminary risk score of 0.71, the data detection and shunting unit 12 assumes that the dynamic sensitive discrimination interval from the "fake credit investigation" sub-model is [0.65, 0.75]. Since 0.71 is within the dynamic sensitive discrimination interval, the data detection and shunting unit 12 determines that the subsequent processing path of the data is the second path, and sends it to the data enhancement and judgment unit 13.

[0225] After receiving the communication data, the enhancement and judgment layer built in the data enhancement and judgment unit 13 performs deep semantic analysis on the text content and identifies the typical risk inducing behavior pattern of "account abnormality" followed by "software download". The enhancement and judgment layer outputs a deep risk score, for example, 0.92.

[0226] The decision logic inside the data enhancement and judgment unit 13 compares 0.92 with the preset discrimination threshold 0.85. Since 0.92 is greater than 0.85, the data enhancement and judgment unit 13 finally determines that the final classification label of the communication data is "abnormal" or "fake credit investigation type sensitive content".

[0227] The sensitive data detection device provided by the present application adopts the architecture design and data flow control method of a double-layer model, uses a lightweight acceleration preprocessing layer to perform large-scale and high-speed preliminary screening on a large amount of incoming data, and then uses an enhancement and judgment layer to accurately classify the suspicious data, so as to obtain an accuracy close to that of a heavy model at a speed close to that of a lightweight model, balance between efficiency and accuracy, and meet the production requirements.

[0228] It should be noted that the sensitive data detection device provided by the present application can execute the sensitive data detection method described in any of the above embodiments during specific operation, and this embodiment will not be described here.

[0229] Figure 5 is a structural schematic diagram of an electronic device provided by the present application, as Figure 5 shown, the electronic device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 complete mutual communication through the communications bus 540. The processor 510 can call the logic instructions in the memory 530 to execute the sensitive data detection method, which includes: inputting the communication data to be detected into an accelerated preprocessing layer, and obtaining a preliminary risk score output by the accelerated preprocessing layer; determining a subsequent processing path of the communication data based on a judgment result of the preliminary risk score; if the subsequent processing path is a first path, determining a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, inputting the communication data into an enhanced research and judgment layer to determine a final classification label according to the output of the enhanced research and judgment layer; the preliminary risk score represents the probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier used to represent the sensitivity category to which the communication data belongs.

[0230] In addition, the logic instructions in the memory 530 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in the various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0231] In another aspect, the present application also provides a computer program product, which comprises a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions which, when executed by a computer, enable the computer to perform the sensitive data detection method provided by any of the above embodiments, the method comprising: inputting communication data to be detected into an accelerated preprocessing layer, and obtaining a preliminary risk score output by the accelerated preprocessing layer; determining a subsequent processing path of the communication data based on a determination result of the preliminary risk score; if the subsequent processing path is a first path, determining a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, inputting the communication data into an enhanced research and judgment layer to determine a final classification label according to an output of the enhanced research and judgment layer; the preliminary risk score represents a probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier representing a sensitivity category to which the communication data belongs.

[0232] In another aspect, the present application also provides a non-transitory computer-readable storage medium, which stores a computer program, the computer program being executed by a processor to implement a sensitive data detection method provided by any of the above embodiments, the method comprising: inputting communication data to be detected into an accelerated preprocessing layer, and obtaining a preliminary risk score output by the accelerated preprocessing layer; determining a subsequent processing path of the communication data based on a determination result of the preliminary risk score; if the subsequent processing path is a first path, determining a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, inputting the communication data into an enhanced research and judgment layer to determine a final classification label according to an output of the enhanced research and judgment layer; the preliminary risk score represents a probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier representing a sensitivity category to which the communication data belongs.

[0233] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0234] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0235] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of sensitive data detection, the method comprising: The method comprises: inputting the communication data to be detected into an acceleration preprocessing layer, and obtaining a preliminary risk score output by the acceleration preprocessing layer; determining a subsequent processing path of the communication data based on a determination result of the preliminary risk score; if the subsequent processing path is a first path, determining a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, inputting the communication data into an enhanced judgment layer to determine a final classification label according to an output of the enhanced judgment layer; the preliminary risk score represents a probability that the communication data contains sensitive data, and the final classification label is a qualitative identifier representing a sensitivity category to which the communication data belongs; wherein the acceleration preprocessing layer comprises a plurality of parallel sub-models, each of which is trained to identify a specific type of sensitive data; the method of inputting the communication data to be detected into the acceleration preprocessing layer and obtaining the preliminary risk score output by the acceleration preprocessing layer comprises: inputting the communication data into each of the sub-models to obtain an individual score result output by each of the sub-models; outputting the highest score value among all the individual score results as the preliminary risk score; the individual score result output by any sub-model represents a probability that the communication data contains the specific type of sensitive data corresponding to the sub-model.

2. The sensitive data detection method of claim 1, wherein, The communication data comprises structured data and unstructured communication content. The method of inputting the communication data to be detected into the acceleration preprocessing layer comprises: extracting text features from the unstructured communication content; inputting the structured data and the text features into the acceleration preprocessing layer.

3. The sensitive data detection method of claim 2, wherein, The text features are a set of weight values representing the importance of each keyword in the unstructured communication content; The weight value corresponding to each keyword is determined based on the term frequency of the keyword and the inverse document frequency of the keyword; The term frequency is the frequency of the keyword appearing in the unstructured communication content, and the inverse document frequency is a measurement value of the rarity of the keyword in a historical communication content sample library, which is inversely proportional to the number of documents containing the keyword in the historical communication content sample library, and the historical communication content sample library comprises a plurality of historical communication content samples labeled as containing sensitive content and a plurality of historical communication content samples labeled as not containing sensitive content.

4. The method of claim 1, wherein, The discriminant condition for determining the determination result of the preliminary risk score is dynamically adjusted; The discriminant condition is dynamically determined based on the following steps: obtaining the trigger frequency of each specific type of sensitive data within a preset time window to determine the current feature variation of each specific type of sensitive data based on the trigger frequency; for a target sub-model trained to identify each specific type of sensitive data, according to the current feature variation of the specific type of sensitive data and a preset basic discriminant threshold, the historical discriminant threshold of the target sub-model in the last detection period is corrected to obtain a current sensitive discriminant threshold in the current detection period; determining a current sensitive discrimination threshold of the current detection cycle by determining a highest score value of all the individual score results in the current detection cycle, to determine a sensitive discrimination interval of the current detection cycle; determining the discrimination condition of the current detection cycle based on a relationship between the preliminary risk score and the sensitive discrimination interval.

5. The sensitive data detection method of claim 4, wherein, The discrimination condition is specifically: when the preliminary risk score is greater than the maximum value of the sensitive discrimination interval, determining that the subsequent processing path of the communication data is the first path, and determining that the final classification label is abnormal; when the preliminary risk score is less than the minimum value of the sensitive discrimination interval, determining that the subsequent processing path of the communication data is the first path, and determining that the final classification label is normal; when the preliminary risk score is within the sensitive discrimination interval, determining that the subsequent processing path of the communication data is the second path.

6. The method of claim 1, wherein, Further comprising: receiving a model configuration instruction sent by a model rule configuration background; in response to the model configuration instruction, modifying the text feature or structured data processing rule associated with any of the sub-models in the acceleration preprocessing layer; The model configuration instruction is generated based on a user-operable rule management interface of the model rule configuration background.

7. The sensitive data detection method of claim 2, wherein, The enhanced research and judgment layer is established based on a pre-trained language model; After receiving the communication data, the pre-trained language model further comprises: performing dynamic proportion word and character masking on the unstructured communication content in the input communication data; and / or the pre-trained language model compresses high-dimensional semantic vectors to pre-set low-dimensional semantic vectors through feature distillation.

8. The method of claim 2, wherein, Before inputting the communication data to be detected into the acceleration preprocessing layer, comprising: acquiring a voice data stream; transcribing the voice data stream to obtain the unstructured communication content; After acquiring the voice data stream, further comprising: extracting a voiceprint feature from the voice data stream; inputting the voiceprint feature into a voiceprint research and judgment module to obtain a voice identity analysis result output by the voiceprint research and judgment module; The voice identity analysis result is used as reference information for determining the final classification label.

9. The sensitive data detection method of claim 8, wherein, The inputting of the voiceprint feature into the voiceprint research and judgment module to obtain the voice identity analysis result output by the voiceprint research and judgment module adopts at least one of the following implementation modes: using the voiceprint research and judgment module to compare the voiceprint feature with a blacklist voiceprint library to generate the voice identity analysis result; using the voiceprint research and judgment module to perform clustering analysis on a plurality of voiceprint features derived from different communication data, to determine the voice identity analysis result according to the association relationship between all the voiceprint features obtained through clustering analysis; using the voiceprint research and judgment module to detect the matching degree between the voiceprint feature associated with a single communication number and other voiceprint features associated with the single communication number collected within a preset time period, to generate the voice identity analysis result according to the matching degree.

10. A sensitive data detection apparatus, characterized by, Comprising: a risk preliminary assessment unit, configured to input the communication data to be detected into an acceleration preprocessing layer, and obtain a preliminary risk score output by the acceleration preprocessing layer; a data detection shunt unit, configured to determine a subsequent processing path of the communication data based on a determination result of the preliminary risk score; if the subsequent processing path is a first path, determine a final classification label based on the preliminary risk score; if the subsequent processing path is a second path, input the communication data into a data enhancement judgment unit; the data enhancement judgment unit is configured to determine a final classification label according to the communication data; the preliminary risk score represents a probability that the communication data contains sensitive data, and the final classification label is a qualitative identification representing a sensitivity category to which the communication data belongs; wherein the device is further configured to: the inputting of the communication data to be detected into the acceleration preprocessing layer and the obtaining of the preliminary risk score output by the acceleration preprocessing layer include: inputting the communication data into each sub-model respectively to obtain an individual score result output by each sub-model; outputting a highest score value in all the individual score results as the preliminary risk score; the individual score result output by any sub-model represents a probability that the communication data identified by the any sub-model contains a specific type of sensitive data corresponding to the any sub-model.

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the sensitive data detection method according to any one of claims 1 to 9. 12.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the sensitive data detection method according to any one of claims 1 to 9.

Images