Phishing email detection method and device based on strategy game and large language model, equipment and medium

Abstract

The application discloses a phishing email detection method and device based on strategy game and large language model, equipment and medium, relates to the technical field of network security, and the method comprises the steps that a target detection email is acquired; the target detection email is input into a target phishing email detection model for detection to obtain a phishing email detection result, wherein the target phishing email detection model is obtained by joint training of statistical characteristics and semantic characteristics, the statistical characteristics are obtained by strategy game, and the semantic characteristics are obtained by extraction of a large language model. The application accurately locates the key risk points of the phishing email through the statistical characteristics extracted based on the strategy game, comprehensively captures the complex characteristics of the phishing email in combination with the semantic characteristics extracted by the large language model, thereby avoiding the limitations of traditional single-dimensional feature detection, and improving the detection precision.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and medium for detecting phishing emails based on strategy game theory and large language models. Background Technology

[0002] With the rapid development of information technology, the openness of email has made it a primary target of cyberattacks, with phishing emails attracting particular attention due to their widespread impact and serious harm. Phishing email attackers impersonate legitimate sources to trick users into disclosing sensitive information, posing significant security risks to individuals and businesses.

[0003] Traditional phishing email detection methods rely on single-dimensional feature analysis, which makes it difficult to cope with complex and ever-changing phishing email attack methods. At the same time, they have significant shortcomings in semantic feature extraction and cannot effectively identify carefully disguised phishing email content. These problems result in existing detection systems having insufficient identification capabilities when facing new types of phishing emails, and failing to provide reliable protection for enterprises and users. Summary of the Invention

[0004] The main purpose of this application is to provide a phishing email detection method, device, equipment, and medium based on strategy game theory and large language model, which aims to accurately identify phishing emails while avoiding the limitations of traditional single-dimensional feature detection and improving detection accuracy.

[0005] To achieve the above objectives, this application proposes a phishing email detection method based on strategy game theory and large language models, the method comprising:

[0006] Retrieve target detection emails;

[0007] The target email is input into the target phishing email detection model for detection, and the phishing email detection result is obtained. The target phishing email detection model is jointly trained by statistical features and semantic features. The statistical features are obtained through strategy game and the semantic features are extracted through a large language model.

[0008] In one possible implementation, the training process of the targeted phishing email detection model includes:

[0009] Several phishing email samples are obtained. After parsing and cleaning each phishing email sample, feature fields are extracted and sample labels are added to obtain the model training set and the model test set.

[0010] Based on the model training set, strategy game analysis is performed to obtain the statistical feature set corresponding to the model training set, and semantic feature extraction is performed based on the model training set to obtain the semantic feature set corresponding to the model training set.

[0011] The statistical feature set and the semantic feature set are associated and combined to construct a dual-feature association vector set;

[0012] The dual-feature association vector set is input into the initial phishing email detection model for iterative training to obtain the undetermined phishing email detection model.

[0013] The model to be tested is performed on the model test set and the sample tag set corresponding to the model test set to obtain the target phishing email detection model.

[0014] In one possible implementation, the step of performing strategy game analysis based on the model training set to obtain the statistical feature set corresponding to the model training set includes:

[0015] For any phishing email sample in the model training set, construct a non-cooperative game model between the phishing attacker and the defender in the phishing email sample;

[0016] Solve for the Nash equilibrium of the non-cooperative game model to determine the defender's defense strategy;

[0017] Based on the defender's defense strategy, the statistical features of the phishing email samples are extracted to obtain the statistical feature set corresponding to the model training set.

[0018] In one possible implementation, the step of extracting semantic features based on the model training set to obtain a semantic feature set corresponding to the model training set includes:

[0019] For any phishing email sample in the model training set, the phishing email sample and preset prompt words are input into the first semantic feature extraction model to obtain the dialogue corpus information corresponding to the phishing email sample output by the first semantic feature extraction model, so as to obtain the dialogue corpus information database corresponding to the model training set.

[0020] The dialogue corpus information database is input into the second semantic feature extraction model for model fine-tuning;

[0021] The model training set is input into the second semantic feature extraction model after the model fine-tuning is completed to extract semantic features, thereby obtaining the semantic feature set corresponding to the model training set.

[0022] In one possible implementation, the initial phishing email detection model includes an input layer, a feature fusion layer, and a classifier;

[0023] The step of inputting the dual-feature association vector set into the initial phishing email detection model for iterative training to obtain the undetermined phishing email detection model includes:

[0024] The dual-feature association vector set is received through the input layer;

[0025] For any dual-feature association vector in the set of dual-feature association vectors, the dual-feature association vector is input to the feature fusion layer for local spatial feature extraction and feature fusion, and a dual-feature fusion vector is output to obtain a set of dual-feature fusion vectors;

[0026] The classifier outputs the probability value corresponding to the dual-feature fusion vector set, and compares the probability value with a preset threshold to determine the pending phishing email detection model.

[0027] In one possible implementation, the feature fusion layer includes a convolutional layer, a pooling layer, and a fully connected layer;

[0028] The step of inputting the dual-feature correlation vector into the feature fusion layer for local spatial feature extraction and feature fusion, and outputting a dual-feature fusion vector, includes:

[0029] The convolutional layer is deployed by setting the number of filters, the kernel size, and the activation function, and local features are extracted from the dual-feature correlation vector through the convolutional layer to obtain the first local feature.

[0030] The pooling layer is deployed by setting the pooling window size to reduce the dimensionality of the first local feature and retain key information, thereby obtaining the second local feature;

[0031] The fully connected layer is deployed by setting the output dimension and activation function to map the second local features into a dual-feature fusion vector.

[0032] In one possible implementation, the step of testing the undetermined phishing email detection model based on the model test set and the sample tag set corresponding to the model test set to obtain the target phishing email detection model includes:

[0033] For any phishing email sample in the model test set, the phishing email sample is input into the undetermined phishing email detection model for detection, and the sample detection result output by the undetermined phishing email detection model is obtained, so as to obtain the sample detection result set corresponding to the model test set;

[0034] The sample detection result set is compared and analyzed with the sample label set to obtain model test analysis data;

[0035] The model test analysis data is compared with the preset threshold to obtain the target phishing email detection model.

[0036] Furthermore, to achieve the above objectives, this application also proposes a phishing email detection device based on strategy game theory and a large language model, wherein the phishing email detection device based on strategy game theory and a large language model includes:

[0037] The acquisition module is used to acquire target detection emails;

[0038] The detection module is used to input the target email into the target phishing email detection model for detection and obtain the phishing email detection result. The target phishing email detection model is jointly trained by statistical features and semantic features. The statistical features are obtained through strategy game and the semantic features are extracted through a large language model.

[0039] Furthermore, to achieve the above objectives, this application also proposes a phishing email detection device based on strategy game theory and large language model. The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. The computer program is configured to implement the steps of the phishing email detection method based on strategy game theory and large language model as described above.

[0040] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the phishing email detection method based on strategy game theory and large language model as described above.

[0041] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the phishing email detection method based on strategy game theory and large language model as described above.

[0042] This application provides a phishing email detection method, apparatus, device, and medium based on strategy game theory and a large language model. The method acquires target emails for detection and then inputs them into a target phishing email detection model for detection to obtain phishing email detection results. The target phishing email detection model is jointly trained using statistical features and semantic features. The statistical features are obtained through strategy game theory, and the semantic features are extracted through a large language model. Therefore, the statistical features extracted based on strategy game theory (such as the number of URLs and images) can accurately locate the key risk points of phishing emails, and the semantic features extracted by the large language model (such as the persuasiveness of the email text) can comprehensively capture the complex characteristics of phishing emails, thereby avoiding the limitations of traditional single-dimensional feature detection and improving detection accuracy. Attached Figure Description

[0043] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 A flowchart illustrating the phishing email detection method based on strategy game theory and large language model provided in this application;

[0046] Figure 2 A simplified flowchart illustrating the overall process of the phishing email detection method based on strategy game theory and large language model provided in this application;

[0047] Figure 3 A flowchart illustrating the training set processing for the phishing email detection method based on strategy game theory and large language model provided in this application;

[0048] Figure 4 This is a schematic diagram of the module structure of the phishing email detection device based on strategy game theory and large language model according to an embodiment of this application.

[0049] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the phishing email detection method based on strategy game theory and large language model in the embodiments of this application.

[0050] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0051] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0052] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0053] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone; or an electronic device, big data service platform, or phishing email detection system based on strategy game theory and large language models capable of realizing the above functions. The following description uses a phishing email detection system based on strategy game theory and large language models as an example to illustrate this embodiment and the subsequent embodiments.

[0054] Based on this, embodiments of this application provide a phishing email detection method based on strategy game theory and large language models, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the phishing email detection method based on strategy game theory and large language model in this application.

[0055] In this embodiment, the phishing email detection method based on strategy game theory and large language model includes steps S11-S12:

[0056] Step S11: Obtain the target detection email;

[0057] It should be noted that targeted emails refer to email data to be determined as phishing emails, including work emails received by company employees, marketing emails from external sources, and unknown emails sent by strangers. Parsing and cleaning refers to the process of structurally disassembling targeted emails and removing invalid / interference data. "Parsing" involves extracting core email fields, while "cleaning" involves correcting or removing abnormal data to transform unstructured raw email data into standardized, usable structured data. This avoids the model's detection accuracy being affected by redundant information (such as garbled characters or duplicate fields) or formatting errors (such as missing fields or incorrect formats) in the original email. In one possible implementation, the parsing and cleaning process can support batch processing, while simultaneously performing integrity checks on the processed email data. If key fields (such as sender address or email body) are missing, they are automatically marked as "to be supplemented for verification," and manual review is prompted to ensure data usability.

[0058] It should be further noted that the specific operations involved in parsing and cleaning need to cover all dimensions of email information: the core fields to be extracted in the parsing stage include sender information (sender email address, sender name, sending server IP), recipient information (recipient email address, receipt time), email content information (email subject, email body, attachment name and type, embedded links), and email header information (email ID, transmission protocol, routing information); the issues to be addressed in the cleaning stage include: removing redundant content such as HTML tags and special characters (such as "\t") from the email body, correcting format errors in the sender's email address (such as correcting "user@com" to "user@xxx.com"), removing unrecognizable garbled characters, and ensuring that the final output parsed and cleaned data fields are complete, formatted uniformly, and free of interference information.

[0059] Specifically, the system first obtains target emails for detection through an email receiving interface. This interface supports integration with enterprise email servers (such as Exchange and Postfix) to retrieve emails for detection in real time or receive email files manually uploaded by users (supporting .eml and .msg formats). Then, the parsing module is started to extract core fields such as sender information, recipient information, email content information, and email header information according to preset email parsing rules, storing them as a structured data table. Next, the cleaning module is started to process each extracted field individually.

[0060] For the email body, regular expressions are used to remove HTML tags and special characters, retaining only plain text content. For the sender's email address, format errors are identified and attempted to be corrected using email format validation rules (such as the presence of "@" followed by a domain name suffix). If the format cannot be corrected, it is marked as an "abnormal sender". For attachments, the attachment format is validated and high-risk formats are filtered out. The names and sizes of valid attachments are recorded. Finally, the cleaned fields are checked for completeness to ensure that no critical fields are missing, generating a dataset of "parsed and cleaned target detection emails".

[0061] Step S12: Input the target email into the target phishing email detection model for detection to obtain the phishing email detection result. The target phishing email detection model is jointly trained by statistical features and semantic features. The statistical features are obtained through strategy game and the semantic features are extracted through a large language model.

[0062] It should be noted that the targeted phishing email detection model refers to a machine learning model capable of identifying phishing emails. Its core characteristic is that it integrates two features for training, rather than a single feature. Strategy game theory refers to an analytical method that constructs a non-cooperative game model between phishing attackers and defenders, solves the Nash equilibrium to determine the defense strategy, and then extracts statistical features of the emails. Statistical features refer to quantitative indicators extracted based on the results of strategy game theory, reflecting the patterns in email data. These features are used to distinguish between emails with rich content and those with simple content, reflecting multimedia complexity, HTML structure complexity, hyperlink patterns, visual presentation complexity, and attachments. Features such as whether the sender is a registered user of the email provider, the number of emails sent by the sender in a day, the number of emails sent by the sender in 15 minutes, the number of emails sent by the sender's IP in a day, the number of emails sent by the sender's IP in 15 minutes, the time the sender sent the email, whether the sender's from field matches the sender address, whether the sender's email address contains abnormal characters, the number of URLs in the email, the number of images, the number of times image fingerprints appear, whether the email is configured with SPF, the number of attachments in the email, and whether the attachments in the email contain images, etc., are not restricted here.

[0063] It should be further clarified that "large language model" refers to a pre-trained language model (such as the GPT series and BERT series models) with semantic understanding and feature extraction capabilities, used to extract deep semantic information from email text; semantic features refer to feature vectors extracted by the large language model that reflect the email's subject intent, text sentiment, and content rationality, such as the urgency score of the "urgent salary confirmation" topic and the semantic vector of persuasive statements in the body of the text; joint training refers to associating statistical features and semantic features into a dual-feature association vector, inputting it into the model for training, so that the model can learn to discriminate between the two types of features simultaneously. Pattern; Phishing email detection results refer to the model's output judgment on the target email, which usually includes two categories: "phishing email" and "normal email". In some scenarios, a confidence level is also included (e.g., "phishing email, confidence level 98%)". By using a model that integrates two features, it can determine whether an email is a phishing email from two dimensions: "data pattern" (statistical features) and "semantic intent" (semantic features). This solves the problem of low accuracy of traditional single-feature models (such as relying solely on statistical features) in detecting new types of phishing emails (with strong semantic inducement and hidden statistical patterns), and improves detection coverage and reliability.

[0064] In one possible implementation, the targeted phishing email detection model can support feature importance output, with the detection results including "key judgment features" (such as "the embedded link is a malicious domain, the semantic features show that it is a click inducement, and it is judged to be a phishing email"), which facilitates manual review and result tracing.

[0065] Specifically, the system first receives and cleans the target detection emails, then extracts their statistical and semantic features according to preset rules. In the statistical feature extraction stage, the strategy game analysis module is invoked. Based on the enterprise's preset "attacker-defender non-cooperative game model" (e.g., the defense strategy is "intercepting emails with links from unknown domains"), the system calculates statistical features such as the sender's email address matching the enterprise's whitelist (e.g., "hr_company@xxx.com" is not on the whitelist, matching degree 0%) and the overlap between embedded links and the malicious domain database (e.g., "http: / / fake-hr.com / confirm" is in the malicious database, overlap degree 100%), forming a statistical feature vector.

[0066] In the semantic feature extraction stage, the parsed and cleaned email body and subject are input into a finely tuned second semantic feature extraction model (such as the BERT model). The model outputs semantic feature vectors reflecting the persuasiveness of the text and the rationality of the subject (e.g., a semantic score of 0.95 for "inducing clicks on links" and a matching degree of 0.1 between the subject "salary confirmation" and the sender's identity). Then, the statistical feature vector and the semantic feature vector are associated to form a dual-feature association vector, which is input into the target phishing email detection model. The model's input layer receives this vector, and the feature fusion layer extracts local features (e.g., the association features between link risk and persuasive semantics) through convolutional layers, reduces dimensionality to retain key information through pooling layers, and maps to a dual-feature fusion vector through fully connected layers. The classifier processes the fusion vector and outputs a "phishing email" probability value (e.g., 0.98), which is compared with a preset threshold of 0.8 to determine if it is a "phishing email." Finally, a "phishing email detection result" is generated, including the judgment conclusion, confidence level, and key features (e.g., "embedded malicious link, semantically inducing clicks"). The overall process can be found in the reference. Figure 2 .

[0067] This embodiment acquires target emails for detection and then inputs them into a phishing email detection model for detection, obtaining phishing email detection results. The target phishing email detection model is jointly trained using statistical features and semantic features. The statistical features are obtained through strategy game theory, and the semantic features are extracted through a large language model. Therefore, the statistical features extracted based on strategy game theory (such as the number of URLs and images) can accurately locate the key risk points of phishing emails. Combined with the semantic features extracted by the large language model (such as the persuasiveness of the email text), the complex characteristics of phishing emails can be comprehensively captured, thereby avoiding the limitations of traditional single-dimensional feature detection and improving detection accuracy.

[0068] In one feasible implementation, the training process of the targeted phishing email detection model includes:

[0069] Step S21: Obtain several phishing email samples, parse and clean each phishing email sample, extract feature fields and add sample labels to obtain the model training set and the model test set.

[0070] It should be noted that phishing email samples refer to historical email data that has been clearly identified as phishing emails. Sources include enterprise email system interception records, publicly available phishing email databases (such as PhishTank), and phishing email sample libraries shared by security organizations. Samples must cover different phishing types (such as emails masquerading as official emails, emails tricking users into clicking malicious links, and emails with malicious code in attachments). Feature fields refer to key information fields that reflect the attributes of phishing emails, including sender information fields (sender email address, sending server IP), email content fields (subject, body, embedded links, attachment type), and email header fields (email ID, transmission protocol). Sample tags refer to category identifiers added to the feature fields of each phishing email sample.

[0071] It should be further clarified that the model training set refers to the sample set used to train the initial phishing email detection model, accounting for 70%-80% of the total sample size; the model test set refers to the sample set used to verify the model performance, accounting for 20%-30% of the total sample size. This set must not overlap with the training set and must have a consistent distribution. This ensures the construction of high-quality, standardized model training and testing data, providing a reliable foundation for subsequent feature extraction, model training, and testing. It avoids model training bias or distorted test results due to chaotic sample data (such as missing fields or incorrect formats), solving the problems of "low data quality and non-standard labels" in traditional sample processing. In one possible implementation, stratified sampling can be used to divide the training and test sets, ensuring that the proportion of different phishing email types in both sets is consistent, avoiding the impact of uneven sample distribution on the model's generalization ability.

[0072] Specifically, firstly, several phishing email samples are obtained through multiple channels, supporting the import of .eml and .msg format email files or batch sample retrieval from a database. Then, the parsing module is started to extract feature fields such as sender email address, sending server IP, email subject, body, embedded links, attachment type, and email ID for each sample according to preset rules, and store them as a structured data table. Next, the cleaning module is started to process abnormal data in the fields: removing HTML tags and garbled characters from the body text, correcting incorrectly formatted sender email addresses (such as supplementing missing domain suffixes), filtering invalid embedded links (such as inaccessible links), and marking high-risk attachment types (such as .exe and .bat). After cleaning, sample labels are added to each sample. Finally, the dataset is divided using stratified sampling at a 7:3 ratio, with 70% of the labeled samples used as the model training set and 30% as the model test set. The sample distribution information of the two sets is recorded (such as the number and proportion of samples of each phishing type) to ensure the effectiveness of subsequent training and testing. (See reference for details.) Figure 3 .

[0073] Step S22: Perform strategy game analysis based on the model training set to obtain the statistical feature set corresponding to the model training set, and extract semantic features based on the model training set to obtain the semantic feature set corresponding to the model training set.

[0074] It should be noted that strategic game analysis refers to an analytical method that constructs a non-cooperative game model between phishing attackers and defenders, solves for Nash equilibrium to determine defense strategies, and then extracts statistical features from the samples. The statistical feature set refers to a set of quantitative features extracted based on the results of strategic game analysis that reflects the patterns in phishing email data. Each sample corresponds to a statistical feature vector, and the features include the sender's email address matching the enterprise's whitelist, the overlap between embedded links and malicious domain databases, the proportion of high-risk attachment types, and the degree to which the email sending time deviates from normal working hours. Semantic feature extraction refers to the process of mining deep semantic information from email text using large language models (such as BERT and GPT series pre-trained models). The semantic feature set refers to a set of features extracted through large language models that reflect the semantic attributes of email text. Each sample corresponds to a semantic feature vector, and the features include the urgency score of the email subject, the semantic vector of persuasive statements in the body, and the matching degree between the text content and normal business scenarios. The core objective of this step is to extract features needed for model training from two dimensions: "data patterns" (statistical features) and "semantic intent" (semantic features). Compared to traditional single-feature extraction, this approach can more comprehensively capture the discriminative attributes of phishing emails, addressing the problem of insufficient detection of novel phishing emails (which are semantically persuasive but have hidden statistical patterns) by single features. In one possible implementation, preset prompts (such as setting seven questions related to phishing emails) can be introduced during semantic feature extraction to guide the large language model to extract persuasive semantic features more accurately.

[0075] Specifically, for any phishing email sample in the model training set, a non-cooperative game model between the phishing attacker and the defender in the phishing email sample is constructed, and then the Nash equilibrium of the non-cooperative game model is solved to determine the defender's defense strategy. Based on the defender's defense strategy, the statistical features of the phishing email sample are extracted to obtain the statistical feature set corresponding to the model training set.

[0076] Furthermore, for any phishing email sample in the model training set, the phishing email sample and preset prompt words are input into the first semantic feature extraction model to obtain the dialogue corpus information corresponding to the phishing email sample output by the first semantic feature extraction model, so as to obtain the dialogue corpus information database corresponding to the model training set. Then, the dialogue corpus information database is input into the second semantic feature extraction model for model fine-tuning, so that the model training set is input into the second semantic feature extraction model after model fine-tuning for semantic feature extraction, and the semantic feature set corresponding to the model training set is obtained.

[0077] Step S23: Associate and combine the statistical feature set and the semantic feature set to construct a dual-feature association vector set;

[0078] It should be noted that the association combination refers to concatenating the statistical feature vector and semantic feature vector corresponding to the same phishing email sample according to a preset rule to form a unified vector containing both types of features; the dual-feature association vector set refers to the set composed of dual-feature association vectors of all samples. Each vector contains information of both statistical features and semantic features, thereby establishing a close association between statistical features and semantic features. This allows subsequent model training to learn the intrinsic relationship between the two types of features simultaneously (e.g., the combination of "unknown email address + highly persuasive semantics" is more likely to be identified as a phishing email). Compared with using a single feature independently, dual-feature association vectors can more comprehensively and accurately reflect the discrimination rules of phishing emails and improve the model's adaptability to complex phishing scenarios.

[0079] In one possible implementation, the statistical feature vector and the semantic feature vector can be standardized before association (e.g., the feature values ​​can be mapped to the 0-1 range) to avoid the model training being biased towards a certain type of feature due to the difference in the numerical range of the two types of features (e.g., the statistical feature "matching degree" is 0% to 100%, while the semantic feature "vector value" is -1 to -1).

[0080] Specifically, sample matching is performed on the statistical feature set and the semantic feature set to ensure that the order of samples in the two sets is consistent (i.e., the i-th vector in the statistical feature set and the i-th vector in the semantic feature set correspond to the same phishing email sample). Then, the statistical feature vector and semantic feature vector of each sample are standardized: using the Min-Max standardization method, the percentage feature values ​​such as "whitelist matching degree" and "link overlap degree" in the statistical feature vector are kept in the 0-1 range, and the scores such as "urgency" and "persuasiveness" in the semantic feature vector are also uniformly mapped to 0-1. The interval is used to eliminate differences in numerical ranges. The two types of vectors of the same sample are concatenated in the order of "statistical feature vector first, semantic feature vector second". For example, if the statistical feature vector of a sample is [0,1,0] (whitelist matching degree 0, link overlap degree 1, attachment ratio 0) and the semantic feature vector is [0.88,0.93,0.08] (urgency degree 0.88, inducibility degree 0.93, matching degree 0.08), the concatenation will form a double feature association vector [0,1,0,0.88,0.93,0.08]. This process is repeated to concatenate the two types of vectors of all samples in the model training set into double feature association vectors. All vectors are finally combined to form a double feature association vector set, which is stored in a matrix format that the model can read for subsequent model training.

[0081] Step S24: Input the dual-feature association vector set into the initial phishing email detection model for iterative training to obtain the undetermined phishing email detection model;

[0082] It should be noted that the initial phishing email detection model refers to an untrained machine learning model with dual-feature processing capabilities. Its structure includes an input layer, a feature fusion layer (including convolutional layers, pooling layers, and fully connected layers), and a classifier. Iterative training refers to the process of repeatedly inputting the dual-feature association vector set into the initial model and adjusting the model parameters (such as convolutional layer weights and classifier thresholds) through backpropagation to gradually reduce the model's prediction error. The pending phishing email detection model refers to a model that has acquired basic phishing email detection capabilities after iterative training, but has not yet passed testing and verification.

[0083] In one possible implementation, cross-validation (such as 5-fold cross-validation) can be used during iterative training. The set of dual-feature association vectors is divided into 5 subsets, and 4 subsets are used for training and 1 subset is used for validation in turn. The learning rate is dynamically adjusted (e.g., the initial learning rate is 0.001, and it is reduced to 0.0001 when the validation error increases) to improve the generalization ability of the model.

[0084] Specifically, the input layer receives the set of dual-feature association vectors, and then for any dual-feature association vector in the set, the dual-feature association vector is input to the feature fusion layer for local spatial feature extraction and feature fusion, and outputs a dual-feature fusion vector to obtain a set of dual-feature fusion vectors. The classifier then outputs the probability value corresponding to the set of dual-feature fusion vectors, and compares the probability value with a preset threshold to determine the pending phishing email detection model.

[0085] Step S25: Based on the model test set and the sample tag set corresponding to the model test set, perform model testing on the undetermined phishing email detection model to obtain the target phishing email detection model.

[0086] It should be noted that the sample label set corresponding to the model test set refers to the set of labels of all samples in the model test set; model testing refers to the process of inputting the model test set into the model to be determined, comparing the model output results with the sample label set, and evaluating the model performance; the target phishing email detection model refers to the final usable model that has been tested and verified and whose performance meets the standards (such as accuracy and recall meeting preset thresholds). The core purpose of this step is to verify the actual detection capability of the model to be determined through rigorous testing, select the model that meets the performance standards as the final usable model, avoid misjudgment (identifying normal emails as phishing emails) or missed judgment problems caused by using unverified models, and ensure the reliability and practicality of the model detection results. In one possible implementation, in addition to evaluating accuracy, recall, F1 score and other indicators can also be calculated during model testing (if normal email samples are introduced later, precision needs to be evaluated), and preset multi-dimensional achievement thresholds (such as accuracy ≥ 95%, recall ≥ 94%, F1 score ≥ 94.5%). Only when all indicators meet the standards is it determined as the target model.

[0087] Specifically, for any phishing email sample in the model test set, the phishing email sample is input into the pending phishing email detection model for detection, and the sample detection result output by the pending phishing email detection model is obtained to obtain the sample detection result set corresponding to the model test set. Then, the sample detection result set is compared and analyzed with the sample tag set to obtain model test analysis data. The model test analysis data is then compared with a preset threshold to obtain the target phishing email detection model.

[0088] This embodiment first parses and cleans phishing email samples before extracting feature fields and adding tags, removing redundant / abnormal data (such as garbled characters and incorrectly formatted fields) to ensure the data standardization of the model training and test sets and guarantee data quality. At the same time, it combines statistical features obtained from strategic game theory (such as sender reputation and link risk) with semantic features extracted from a large language model (such as text persuasiveness and topic rationality), covering both "data patterns" and "semantic intent." This avoids the problem of insufficient detection of new types of phishing emails (with strong semantic persuasiveness and hidden statistical patterns) by single features. The statistical feature set and the semantic feature set are associated and combined into a dual-feature association vector set, enabling the model to learn the inherent relationship between the two types of features (such as the combined feature of "malicious link + persuasive semantics"). Compared with using features independently, this more accurately captures the comprehensive discrimination rules of phishing emails and improves the model's discriminative ability.

[0089] In one feasible implementation, the step of performing strategy game analysis based on the model training set to obtain the statistical feature set corresponding to the model training set includes:

[0090] Step S31: For any phishing email sample in the model training set, construct a non-cooperative game model between the phishing attacker and the defender in the phishing email sample.

[0091] It should be noted that phishing attackers refer to the entities that launch phishing attacks, whose core objective is to induce target users to perform dangerous actions (such as clicking malicious links or downloading malicious attachments) through emails. Their strategies are designed around "faking credibility" and "inducement effectiveness." Defenders refer to phishing email detection systems or security protection entities, whose core objective is to accurately identify and block phishing emails. Their strategies are designed around "risk feature identification" and "abnormal behavior judgment." Non-cooperative game theory models refer to mathematical models based on game theory used to simulate the strategic confrontation between phishing attackers and defenders. In these models, the interests of the two parties are opposed (attackers want emails to bypass detection, while defenders want to identify and block them), and they do not cooperate strategically. Thus, the abstract phishing attack and defense process is transformed into a quantifiable strategic confrontation relationship through game theory models, avoiding the problem of "relying solely on experience and lacking attack and defense logic support" in traditional feature extraction, making statistical features more closely reflect actual confrontation scenarios.

[0092] In one possible implementation, the non-cooperative game model can adjust the attacker's strategy dimension based on the type of phishing email (such as disguised official emails or phishing emails with attachments). For example, for phishing emails with attachments, the attacker's strategy can add the option of "disguising the attachment as a common format (such as .pdf)" to improve the model's adaptability to different phishing scenarios.

[0093] Specifically, in one embodiment, for any phishing email sample in the model training set, a non-cooperative game model is constructed based on three elements: "participants - strategy set - payoff function." First, the participants are identified as "phishing attackers" and "defenders." Then, the strategy sets for both parties are defined: the attacker's strategy set is determined based on the actual attributes of the sample, including specific strategies such as "impersonating the sender (e.g., impersonating a company HR email address)," "using misleading subjects (e.g., 'urgent salary confirmation')," and "embedding malicious links / attachments." Each strategy corresponds to an observable feature in the sample (e.g., if the sample sender impersonates an HR person, the attacker chooses "impersonating the sender"). The defense strategy set is designed around risk identification, including strategies such as "checking the sender whitelist," "detecting malicious links," "analyzing the misleading nature of the subject line," and "verifying the security of attachments." Finally, a payoff function is constructed, quantifying the strategy's effectiveness with a "0-1" payoff value: if the attacker's strategy successfully bypasses the defender's strategy (e.g., the attacker's disguised sender is not detected by the whitelist), the attacker's payoff is 1, and the defender's payoff is 0; if the defender's strategy successfully identifies the attacker's strategy (e.g., malicious links are detected), the defender's payoff is 1, and the attacker's payoff is 0. Through these three elements, a non-cooperative game model is formed for this phishing email sample, ensuring that the model accurately maps the corresponding offensive and defensive strategy adversarial relationship.

[0094] Step S32: Solve for the Nash equilibrium of the non-cooperative game model to determine the defender's defense strategy;

[0095] It's important to note that Nash equilibrium refers to a stable strategy combination in game theory. Under this combination, if the attacker doesn't change their strategy, the defender's strategy changes without improving their own payoff, and vice versa; that is, neither side has an incentive to change their strategy independently. The defender's defensive strategy refers to the strategy combination that maximizes the defender's payoff (i.e., optimal identification effect) under the Nash equilibrium state. This is the core basis for subsequent statistical feature extraction. By solving the Nash equilibrium, the optimal defender strategy is selected from the offensive and defensive strategy confrontation, ensuring that the statistical features extracted based on this strategy accurately hit the core risk points of phishing emails, avoiding invalid or redundant features interfering with model training, and simultaneously giving the defensive strategy theoretical stability, improving the scientific rigor and targeting of feature extraction. In one possible implementation, "strategy weights" can be introduced when solving the Nash equilibrium, weighting the payoff values ​​of different strategies (e.g., the "detecting malicious links" strategy has a higher weight in link phishing scenarios), making the final determined defensive strategy more closely match the actual risk type of the sample.

[0096] Specifically, in one embodiment, the "payoff matrix method" is used to solve the Nash equilibrium of the non-cooperative game model: First, based on the strategy sets of both sides, an attack and defense strategy payoff matrix is ​​constructed, where the rows of the matrix represent the attacker's strategy and the columns represent the defender's strategy, and the matrix elements are (attacker's payoff, defender's payoff); then, all strategy combinations are traversed to determine whether the Nash equilibrium condition is satisfied: for a certain strategy combination (attacker's strategy A, defender's strategy B), if when the attacker chooses A, the defender's payoff for switching to other strategies (such as strategies C and D) is no higher than the payoff for choosing B, and when the defender chooses B, the attacker's payoff for switching to other strategies is no higher than the payoff for choosing A. If the combined return is the highest, then the combination is a Nash equilibrium point. If there are multiple Nash equilibria, the "comprehensive return" of the defender at each equilibrium point is further calculated (the sum of the returns of each strategy of the defender at that equilibrium point). The equilibrium point with the highest comprehensive return is selected as the final stable strategy combination. Finally, the strategy combination of the defender is extracted from this equilibrium point and determined as the defender's defense strategy. At the same time, the "key adversarial logic" corresponding to this strategy is recorded (e.g., "the defender's 'detect malicious links' strategy and the attacker's 'embed malicious links' strategy form an equilibrium, indicating that link detection is the core defense point of this sample").

[0097] For example, for the game model constructed in step S31, a payoff matrix is ​​constructed: when the attacker chooses "embed malicious links" and the defender chooses "detect link malice", the payoff is (0, 1); when the attacker chooses "impersonate sender" and the defender chooses "check whitelist", the payoff is (0, 1); it is found that the strategy combination (attacker: embed malicious links + impersonate sender, defender: detect link malice + check whitelist) satisfies the Nash equilibrium condition, and the defender's overall payoff is the highest (2); finally, the defender's defense strategy is determined to be {check whether the sender is in the enterprise whitelist, detect whether the embedded link in the email is in the malicious domain database}.

[0098] In another embodiment, a non-cooperative game model G = (N, S, U) is constructed between phishing attacker A and defender D, where: the set of participants: N = {A, D}, the policy space: SA = {s1: rich content emails, s2: simple content emails}, SD = {d1: treat all equally, d2: be wary of rich content emails}, and the payoff function: UA(s i , d j ) and UD(s i ,d j ).

[0099] Attacker's profit function UA(s) i , d j ):

[0100] UA(s1, d1) =α1-β1×P(detection); UA(s1, d2) =α2-β2×P(detection)

[0101] UA(s2, d1) =α3-β3×P(detection); UA(s2, d2) =α4-β4×P(detection)

[0102] Defender's profit function UD(s) i , d j ):

[0103] UD(s1, d1) =γ1×P(detection) -δ1; UD(s1, d2) =γ2×P(detection) -δ2

[0104] UD(s2, d1) =γ3×P(detection) -δ3; UD(s2, d2)=γ4×P(detection) -δ4

[0105] Where α, β, γ, and δ are game parameters, and P(detection) is the detection probability.

[0106] By solving the optimal response functions BR_A(d) = argmax UA(s, d) and BR_D(s) = argmax UD(s,d), the pure policy Nash equilibrium (s1, d2) is obtained. The solution of this Nash equilibrium is the attack or defense strategy that the attacker and defender will adopt.

[0107] Step S33: Based on the defender's defense strategy, extract the statistical features of the phishing email samples to obtain the statistical feature set corresponding to the model training set.

[0108] It should be noted that the statistical features of phishing email samples refer to quantifiable risk indicators extracted from the samples based on defense strategies. Each defense strategy corresponds to at least one statistical feature, and the feature value must be able to reflect the degree of risk under the strategy. This transforms abstract defense strategies into specific and calculable statistical features, ensuring that feature extraction revolves around the "optimal defense direction" and avoiding the redundant feature problem of "casting a wide net" in traditional feature extraction. At the same time, it deeply binds statistical features with attack and defense logic, improving the feature's ability to identify phishing emails.

[0109] Specifically, for each phishing email sample in the model training set, the defender's defense strategy determined in step S32 is first analyzed, and the feature extraction dimensions corresponding to each strategy are clarified (e.g., "checking the sender's whitelist" corresponds to the feature of "matching degree between sender's email and enterprise whitelist", "detecting malicious links"). Corresponding to the feature "overlap of embedded links and malicious domain database"); then, based on the sample attributes, calculate the value of each feature: for "sender whitelist matching degree", query the enterprise whitelist database. If the sample sender's email address is completely in the whitelist, the matching degree is 1; partial matching (such as consistent domain name, username spoofing) is 0.5; and not in the whitelist at all is 0. For "overlap of embedded links and malicious domain database", count the total number of embedded links in the sample and the number of links in the public malicious domain database (such as PhishTank). Overlap degree = number of malicious links / total number of links (0 if there are no links). If the defense strategy includes "verifying attachment security", then extract the feature "percentage of high-risk attachment types" (number of high-risk attachments / total number of attachments). All statistical features of each sample are arranged in a preset order (such as "whitelist matching degree - ...). The "link overlap - high-risk percentage of attachments" combination is used to form a statistical feature vector; the above operation is repeated for all samples in the model training set, and finally a statistical feature set corresponding to the model training set is formed by the statistical feature vectors of all samples, which is stored in a structured data format (such as CSV, JSON) for subsequent use.

[0110] This embodiment utilizes a non-cooperative game theory model based on phishing attackers and defenders, focusing on the core of their strategic confrontation (e.g., attackers use unfamiliar email addresses + malicious links, while defenders prioritize blocking such combinations). The extracted statistical features (e.g., unfamiliar email address matching degree, malicious link overlap degree) directly correspond to key defense dimensions, avoiding interference from irrelevant features and enhancing the value of feature discrimination. Simultaneously, the non-cooperative game theory model simulates the real phishing attack and defense process, and the solved Nash equilibrium reflects the stable state of the attack and defense strategies. The defense strategy determined accordingly is more consistent with actual adversarial logic. Furthermore, the extracted statistical features can accurately capture the typical patterns of real phishing emails, improving the model's adaptability to real-world scenarios. Therefore, the defense strategy selected through game theory logic has clear targeting (e.g., prioritizing the verification of high-risk combination features). Based on this, the extracted statistical features can focus on the core risk points of phishing emails, reducing interference from similar features in normal emails (e.g., occasional unfamiliar email addresses) and lowering the probability of model misjudgment.

[0111] In one feasible implementation, the step of extracting semantic features based on the model training set to obtain a semantic feature set corresponding to the model training set includes:

[0112] Step S41: For any phishing email sample in the model training set, input the phishing email sample and preset prompt words into the first semantic feature extraction model to obtain the dialogue corpus information corresponding to the phishing email sample output by the first semantic feature extraction model, so as to obtain the dialogue corpus information database corresponding to the model training set.

[0113] It should be noted that the preset prompts refer to pre-designed question-type texts used to guide the first semantic feature extraction model to output effective information for phishing email detection. These are typically designed around whether the email's semantics exhibit phishing characteristics. The first semantic feature extraction model refers to a large-parameter language model used to generate dialogue corpus information, such as the Deepseek-R1 model. Due to its large parameter scale, this model possesses powerful general semantic understanding capabilities and can accurately determine whether the email's semantics match phishing characteristics and output a response based on the input email sample and the preset prompts. The dialogue corpus information refers to text pairs consisting of "preset prompts + the first semantic feature extraction model's response to those prompts."

[0114] It should be further clarified that the dialogue corpus refers to the collection formed by summarizing the dialogue corpus information corresponding to all phishing email samples in the model training set. This collection provides vertical corpus data in line with the email security field for the subsequent fine-tuning of the second semantic feature extraction model. It should also be noted that in this embodiment, when inputting phishing email samples into the first semantic feature extraction model, the complete original email data is not input. Instead, the core text fields after parsing and cleaning are input, including the email subject and email body text. If the email contains attachment text (such as the text content in document attachments), it is also input to avoid irrelevant fields (such as temporary email transmission identifiers and redundant format codes) interfering with the model's semantic judgment. Simultaneously, the design of the preset prompt words needs to undergo multiple rounds of verification to ensure that each prompt word corresponds to a clear phishing semantic judgment dimension, and that the prompt words are clearly and unambiguously expressed, avoiding inaccurate responses from the first semantic feature extraction model due to ambiguous prompt words, which would affect the quality of the dialogue corpus information.

[0115] Specifically, in one embodiment, the preset prompts include the following seven items: 1. Does the email subject contain misleading or risk-related words such as "urgent," "important," "verification," "security," or "abnormal"? 2. Does the email body contain descriptions that guide users to click on URL links (such as "Click here," "Access link," or "Click to verify")? 3. Does the email body mention false risk information requiring urgent handling, such as frozen user accounts, deduction of funds, or expired identity? 4. Does the email request users to provide sensitive personal information such as account passwords, ID card numbers, or bank card numbers? 5. Does the email body contain identifiers or statements that impersonate official institutions (such as banks or platform customer service)? 6. Does the email contain grammatical errors, numerous typos, or logically inconsistent statements (common in irregular phishing emails)? 7. Does the email body contain words that create a sense of urgency, such as "limited time offer" or "expired"?

[0116] Furthermore, the subject line of a phishing email sample from the model training set, "Urgent Notice: Your account has been frozen. Click to verify and unfreeze immediately," and the body line, "Dear user, your account has been frozen due to abnormal operation. Click http: / / fake-bank.com to verify your identity to unfreeze. Failure to do so within 24 hours will result in permanent account suspension," are input into the first semantic feature extraction model (deepseek-R1). Simultaneously, the above seven preset prompts are input. The model outputs the following responses in sequence: 1. Yes; 2. Yes; 3. Yes; 4. No; 5. Yes (the body line is a fake bank statement); 6. No; 7. Yes. This forms the seven dialogue corpus information corresponding to this phishing email sample. By summarizing the dialogue corpus information of all phishing email samples in the model training set, the dialogue corpus information database is obtained.

[0117] Step S42: Input the dialogue corpus information database into the second semantic feature extraction model for model fine-tuning;

[0118] It should be noted that the second semantic feature extraction model refers to the small-parameter language model used for subsequent extraction of email semantic features, specifically the Qwen2.5-7B model. This model has a smaller parameter scale than the first semantic feature extraction model (deepseek-R1), resulting in lower hardware deployment costs. However, in its initial state, it lacks semantic understanding capabilities specific to the email security domain and requires fine-tuning for optimization. Model fine-tuning refers to adjusting some parameters of the pre-trained second semantic feature extraction model using domain-specific corpora, enabling the model to learn domain-specific semantic rules and thus possess accurate processing capabilities for domain-specific tasks. The purpose of this step is to fine-tune the second semantic feature extraction model using a dialogue corpus, allowing the small-parameter model, which originally only possessed general semantic understanding capabilities, to master the semantic judgment logic in phishing email detection scenarios (such as identifying misleading statements and false risk information). This retains the advantages of the small model's low hardware requirements and fast running speed while compensating for its lack of domain-specific semantic understanding.

[0119] Additionally, it should be noted that in this embodiment, the model fine-tuning process must follow a specific training strategy to ensure the fine-tuning effect. First, the dialogue corpus information database needs to be divided into a fine-tuning training set and a fine-tuning validation set according to a preset ratio (e.g., 9:1). The fine-tuning training set is used to adjust the model parameters, and the fine-tuning validation set is used to monitor the performance of the model during training to avoid overfitting. Second, a Mini-batch Gradient Descent (Mini-batch SGD) optimizer is used during fine-tuning, with a small learning rate (e.g., 1e-5) to avoid model parameter oscillations due to an excessively large learning rate, preventing convergence to the optimal state. Finally, the cross-entropy loss function is used for fine-tuning, with "preset prompt words + email text" as input and "the answer from the first semantic feature extraction model" as the label, allowing the model to learn the mapping relationship of "input prompt words + email text → output corresponding answer," ensuring that the model can accurately reproduce the phishing semantic judgment logic after fine-tuning.

[0120] In one possible implementation, the specific process of model fine-tuning is as follows: 1. Data preprocessing: Convert each "prompt-answer" text pair in the dialogue corpus into an input format recognizable by the second semantic feature extraction model (Qwen2.5-7B), i.e., tokenize the prompts and corresponding email texts, mapping "yes" and "no" answers to labels 1 and 0 respectively; 2. Dataset splitting: Split the preprocessed dialogue corpus into a fine-tuning training set (approximately 189,000 entries) and a fine-tuning validation set (approximately 21,000 entries) at a ratio of 9:1; 3. Model configuration: Load the pre-trained Qwen2.5-7B model, freeze most of the underlying parameters of the model (only unfreeze the top 2-3 Transformer parameters) to reduce computation; set the optimizer to AdamW, the learning rate to 1e-5, the batch size to 32, and the training epochs to 5; 4. Training monitoring: Monitor training progress every 1 training session. For each epoch, the accuracy of the model (the proportion of predicted answers that match the labels) is evaluated using a fine-tuned validation set. If the accuracy of the validation set does not improve for two consecutive epochs, an early stopping mechanism is triggered to avoid model overfitting. 5. Model saving: When training ends or early stopping is triggered, the fine-tuned model parameters are saved to obtain a second semantic feature extraction model with the ability to judge the semantics of phishing emails.

[0121] Step S43: Input the model training set into the second semantic feature extraction model after the model fine-tuning is completed to extract semantic features and obtain the semantic feature set corresponding to the model training set.

[0122] It should be noted that semantic feature extraction refers to inputting the core text fields (email subject and email body) of each email sample in the model training set into a fine-tuned second semantic feature extraction model. The model performs semantic judgment on each sample based on preset prompts and outputs corresponding responses. The vector formed by combining these responses in a preset order is the semantic feature of that email sample. The semantic feature set refers to the collection formed by summarizing the semantic features of all email samples in the model training set. Each semantic feature in this set is associated with a corresponding email sample. It can be combined with statistical features to construct a dual-feature association vector for training the targeted phishing email detection model.

[0123] Additionally, it should be noted that in this embodiment, the semantic feature extraction process must ensure consistency with the dimensions of the preset prompt words in step S41. That is, the semantic features of each email sample are fixed-length vectors (e.g., 7-dimensional, corresponding to 7 preset prompt words), with each element in the vector being either "1" or "0" (corresponding to the model's answer of "yes" or "no," respectively). This standardized format facilitates subsequent concatenation with statistical features (e.g., 32-dimensional statistical features) to form a fixed-dimensional dual-feature association vector. Simultaneously, during the extraction process, consistency verification of the model's output is required. If a semantic feature of an email sample contains logical contradictions (e.g., "yes" for "contains a link that induces clicks," but "no" for "mentions a URL link"), it needs to be re-entered into the model for judgment, or the email text needs to be manually checked to ensure the accuracy of the semantic features and avoid erroneous features affecting the subsequent model training effect.

[0124] Specifically, in one embodiment, the semantic feature extraction process is as follows: 1. Data preparation: Extract the email subject and body text from each email sample in the model training set, remove HTML tags, special symbols, and other interfering content from the text to obtain clean text data; 2. Model input construction: Combine each clean text data with the 7 preset prompt words in step S41 one by one to form 7 sets of "clean text + prompt words" input sequences; 3. Semantic judgment: Input the 7 sets of input sequences one by one into the fine-tuned second semantic feature extraction model (Qwen2.5-7B). Based on the semantic judgment logic learned through fine-tuning, the model outputs a "yes" or "no" answer for each set of inputs; 4. Feature vector generation: Map the 7 answers to "1" or "0" according to the preset prompt word order (such as the arrangement order of the 7 prompt words in step S41), and combine them to form a 7-dimensional vector, which is the semantic feature of the email sample; 5. Feature set summary: Summarize the semantic features of all email samples according to "sample ID - semantic feature vector". The data is stored in a specific format and associated with the corresponding sample labels and statistical features in the model training set to form a semantic feature set.

[0125] Because the first semantic feature extraction model (such as the deepseek-R1 large-parameter model) has strong semantic understanding capabilities, combined with preset prompts (such as whether the email contains misleading descriptions or involves account verification), this embodiment can generate dialogue data that fits the phishing email detection scenario, avoiding the disconnect between general corpora and detection needs, and providing high-quality vertical domain data for subsequent fine-tuning. Meanwhile, the second semantic feature extraction model (such as the Qwen2.5-7B small-parameter model), after fine-tuning with the dialogue data database, can possess semantic understanding capabilities in the email domain. This eliminates the need for enterprises to invest heavily in deploying large-parameter models, achieving accurate semantic feature extraction and balancing detection performance with hardware costs. Therefore, by generating dialogue data based on the same model training set and fine-tuning the second semantic feature extraction model, and then using this model to extract semantic features from the training set, the accuracy of semantic feature extraction can be ensured. By ensuring that the logic, judgment criteria, and semantic logic of the training data are consistent, feature bias caused by model differences is reduced, and the stability of subsequent model training is improved. Compared with traditional keyword matching, the second semantic feature extraction model, which is fine-tuned by generating corpora from large models, can capture complex semantic relationships in email text (such as the hidden inducement statements in AI-generated phishing emails). It breaks through the limitation of shallow semantic understanding of traditional methods, improves the accuracy of extracting semantic features of new and complex phishing emails, and guides the first semantic feature extraction model to output structured dialogue corpora (such as explicit "yes / no" answers) through preset prompt words. The fine-tuned second semantic feature extraction model will also output standardized semantic features (such as fixed-dimensional binary feature vectors), realizing the standardization of semantic features. This facilitates the construction of dual-feature association vectors by concatenating with statistical features, providing a unified format input for subsequent feature fusion and model training.

[0126] In one feasible implementation, the initial phishing email detection model includes an input layer, a feature fusion layer, and a classifier; the step of inputting the dual-feature association vector set into the initial phishing email detection model for iterative training to obtain the pending phishing email detection model includes:

[0127] Step S51: Receive the dual-feature association vector set through the input layer;

[0128] It should be noted that the input layer refers to the first module of the initial phishing email detection model. Its core function is to receive external input data and pass it to subsequent modules of the model. This input layer is the starting part of the CNN-XG Boost hybrid detection architecture, and it is only responsible for data reception and format verification, without performing feature processing. The dual-feature association vector set refers to the vector set formed by associating and combining the statistical feature set and semantic feature set corresponding to the model training set. Here, association and combination means concatenating the statistical feature vector and semantic feature vector of each email sample by channel to form a single vector (i.e., dual-feature association vector), and then summing up the vectors of all samples to obtain the set.

[0129] It should also be noted that in this embodiment, the input layer performs data normalization (X) operations simultaneously when receiving the dual-feature association vector set. norm =Norm (X input This involves performing feature-by-feature standardization on each dimension of the features in each vector within the dual-feature association vector set, ensuring that the mean of each feature dimension is 0 and the variance is 1. The core function of this operation is to eliminate the scale bias caused by the difference in units between statistical and semantic features (e.g., "urlNum" in statistical features is count data, while semantic features are binary data of 0 / 1), placing the two types of features on the same comparable scale. This facilitates the sharing of weights and stable training in subsequent feature fusion layers (such as CNN modules), preventing one type of feature from dominating the model learning process due to an excessively large numerical range.

[0130] In one possible implementation, after receiving the vector set, the input layer first marks and removes invalid data; then, it performs a standardization operation on the valid vector set. Taking the statistical feature "urlNum" (number of URLs, ranging from 1 to 20) and the semantic feature "whether it contains clickbait descriptions" (0 / 1) as examples, it uses formula X... norm =(X-μ) / σ (where μ is the mean of the feature dimension and σ is the standard deviation), which maps the numerical range of "urlNum" to around [-1,1], and also standardizes the 0 / 1 values ​​of "whether it contains induced click descriptions" to the corresponding scale; after standardization, the input layer passes the processed vector set to the feature fusion layer to ensure that the subsequent modules receive standardized and comparable dual-feature data.

[0131] Step S52: For any dual-feature association vector in the dual-feature association vector set, input the dual-feature association vector into the feature fusion layer for local spatial feature extraction and feature fusion, and output the dual-feature fusion vector to obtain the dual-feature fusion vector set;

[0132] It should be noted that the dual-feature association vector refers to a single vector in the dual-feature association vector set, containing quantitative statistical information of the email (such as the number of URLs and images) and semantic judgment information (such as whether it contains misleading descriptions). The feature fusion layer refers to the core module in the initial phishing email detection model used to fuse statistical and semantic features. This layer is specifically a convolutional neural network (CNN) module, containing convolutional layers, pooling layers, and fully connected layers. Its core function is to perform local spatial feature extraction and deep fusion on the input dual-feature association vector, rather than simple concatenation. Local spatial feature extraction refers to using the convolutional layers of the CNN module to slide the convolutional kernel along the sequence dimension of the dual-feature association vector to capture the association information at local locations in the feature vector (such as local feature combinations like "many URLs + misleading click descriptions"). Feature fusion refers to integrating the local association information of statistical and semantic features into a unified fused feature through layer-by-layer processing of convolution, pooling, and fully connected layers, eliminating the independence of the two types of features and forming a feature representation that can comprehensively reflect the risk of the email.

[0133] It should be further noted that the dual-feature fusion vector refers to the vector output after a single dual-feature association vector is processed by the feature fusion layer, and its dimension can be 128. The dual-feature fusion vector set refers to the 128-dimensional vector set formed after all dual-feature association vectors are processed, and this set provides high-quality fusion feature input for subsequent classifiers.

[0134] Specifically, the convolutional layer is deployed by setting the number of filters, the kernel size, and the activation function. The convolutional layer is used to extract local features from the dual-feature correlation vector to obtain the first local feature. Then, the pooling layer is deployed by setting the pooling window size to reduce the dimensionality of the first local feature and retain key information to obtain the second local feature. Finally, the fully connected layer is deployed by setting the output dimension and the activation function to map the second local feature into a dual-feature fusion vector.

[0135] Step S53: The classifier outputs the probability value corresponding to the dual-feature fusion vector set, and compares the probability value with a preset threshold to determine the pending phishing email detection model.

[0136] It should be noted that the classifier refers to the module responsible for the final classification judgment in the initial phishing email detection model. Specifically, this classifier is the XGBoost classifier, whose core function is to output a probability value for each sample as a phishing email based on a dual-feature fusion vector set, and to classify the email by comparing the probability value with a preset threshold. The probability value refers to the numerical value output by the XGBoost classifier for each dual-feature fusion vector, representing the likelihood that the sample is a phishing email, with a value ranging from [0,1]. It is obtained by mapping the raw score output by the classifier through the sigmoid function.

[0137] It should be further clarified that the preset threshold refers to a pre-set probability threshold used to determine whether an email is phishing. This threshold can be adjusted according to actual needs; for example, it can be set to 0.3 to achieve a low false negative rate and 0.7 to achieve a low false positive rate. The pending phishing email detection model refers to a model that has been trained with a dual-feature fusion vector set and has the ability to output phishing email probabilities and classify them, but has not yet been tested and validated. Its core parameters (such as the tree structure and number of trees in XGBoost) have been optimized through training.

[0138] Specifically, the XGBoost classifier uses an additive tree model structure. It constructs multiple regression trees (T trees) to predict each dual-feature fusion vector (128 dimensions), and sums the outputs of each tree to obtain the original score.

[0139]

[0140] Where f k For the output of the k-th tree, F fused,i This is the final feature carrier after deep fusion of statistical and semantic features corresponding to the i-th sample; subsequently, the original score is mapped to a probability value in the interval [0,1] using the sigmoid function:

[0141]

[0142] A probability value closer to 1 indicates a higher likelihood that the sample is a phishing email, while a value closer to 0 indicates a lower likelihood. During training, the classifier uses binary cross-entropy (L0) to calculate the probability. BCE =-y i logp i -(1-y i log (1-p) i ), y i The sample labels (1 for phishing emails, 0 for legitimate emails) are used as the loss function. Combined with a structure regularization term (to control the complexity of the tree and avoid overfitting), the tree structure and weights are iteratively optimized to minimize the total loss.

[0143]

[0144] Wherein, Ω is the “structural regularization term” used to control the complexity during model training; when the training reaches the preset number of rounds or the loss function converges, training stops and the probability value corresponding to the dual feature fusion vector set is output. If the matching degree between the probability value and the sample label meets the training requirements (such as the training set accuracy reaching more than 95%), then the current model is determined to be a pending phishing email detection model.

[0145] This embodiment uses a feature fusion layer (including a CNN module) to extract local spatial features from dual-feature correlation vectors (statistical features + semantic features). Compared to simple concatenation, it can capture the local correlation and interaction patterns between the two types of features. The output dual-feature fusion vector can more comprehensively reflect the email risk and improve feature effectiveness. The local feature extraction capability of the CNN module can handle complex combinations of statistical and semantic features (such as phishing emails with multiple URLs and hidden misleading text), breaking through the limitations of traditional single features or simple fusion, allowing the model to handle more complex phishing email detection needs. The classifier outputs probability values ​​based on the fused dual-feature fusion vector. The fused features integrate the quantitative advantages of statistical features (such as the number of URLs) and the semantic understanding advantages of semantic features (such as misleading statements), making the probability values ​​more consistent with the real risk of the email. Combined with preset threshold judgment, it reduces false positives and false negatives.

[0146] In one feasible implementation, the feature fusion layer includes a convolutional layer, a pooling layer, and a fully connected layer; the step of inputting the dual-feature correlation vector into the feature fusion layer for local spatial feature extraction and feature fusion, and outputting a dual-feature fusion vector, includes:

[0147] Step S61: Deploy the convolutional layer by setting the number of filters, the kernel size, and the activation function, and extract local features from the dual-feature correlation vector through the convolutional layer to obtain the first local feature;

[0148] It should be noted that the number of filters refers to the total number of convolutional kernels in the convolutional layer used to extract different local features, which can be specifically set to 64. Each filter corresponds to an independent convolutional kernel, which can capture different types of local feature patterns in the two-feature correlation vector. The kernel size refers to the length of the sliding window of the convolutional kernel on the feature vector sequence, which can be set to 3, that is, each sliding covers 3 consecutive feature dimensions in the two-feature correlation vector, used to capture the local correlation between these 3-dimensional features. The activation function refers to the function used to introduce non-linear transformation to the output of the convolutional layer, which can be the "ReLU" function (Rectified Linear Unit), which can filter negative numerical features and enhance the model's ability to express non-linear features.

[0149] It should be further explained that the convolutional layer refers to the first submodule of the feature fusion layer. Based on the above parameter deployment, its core function is to extract local features from the input dual-feature association vector. Local feature extraction refers to the convolutional layer sliding the convolutional kernel across the dual-feature association vector sequence, calculating the inner product of the feature and the kernel weight within each sliding window, and then processing it through an activation function to obtain an output reflecting the local feature association. The first local feature refers to the feature map output by the convolutional layer, whose dimension is "vector length × number of filters". The purpose of this step is to accurately capture the interaction relationship of local continuous features in the dual-feature association vector by parameterizing the deployment of the convolutional layer, transforming the original statistical and semantic features into more discriminative local association features, and overcoming the limitation of simple feature concatenation in failing to uncover the intrinsic relationship between features.

[0150] Specifically, based on 64 filters and a kernel size of 3, 64 3D convolutional kernel weight matrices are initialized (each kernel weight is randomly initialized and subsequently optimized through model training iterations). Next, a dual-feature association vector (e.g., 39-dimensional) is used as input, and each convolutional kernel slides across the vector sequence with a stride of 1, generating a feature value with each slide (calculating the inner product of the three features within the window and the kernel weights, plus a bias term). Then, all feature values ​​are processed using the ReLU activation function to filter out negative values, ensuring the feature values ​​are non-negative. Finally, the output feature values ​​corresponding to the 64 convolutional kernels are arranged by channel to form a 39×64 feature map, i.e., the first local feature. In this process, each convolutional kernel focuses on capturing a local feature pattern (e.g., one kernel focuses on capturing the association of "many URLs + containing clickbait semantics = 1", while another kernel focuses on capturing the association of "many images + fake official statements = 1"). The 64 convolutional kernels collectively cover common local feature types in phishing emails.

[0151] Step S62: Deploy the pooling layer by setting the pooling window size to reduce the dimensionality of the first local feature and retain key information to obtain the second local feature;

[0152] It should be noted that the pooling window size refers to the length of the window used to filter key information in the pooling layer, which can be specifically set to 2, meaning each pooling window covers two consecutive feature dimensions in the first local feature. The pooling layer refers to the intermediate submodule of the feature fusion layer, deployed based on a pooling window size of 2. Its core function is to perform dimensionality reduction processing on the first local feature while preserving key information, using the "MaxPooling1D (one-dimensional max pooling)" method. Dimensionality reduction refers to compressing the sequence dimension of the first local feature through the pooling window, downsampling the original sequence length by the pooling window size of 2 to calculate the new sequence length, thus reducing the amount of feature data and the complexity of subsequent calculations.

[0153] It should be further explained that key information preservation refers to using a max pooling strategy, selecting the element with the largest eigenvalue within each pooling window as the output. This largest element corresponds to the most significant local feature response within the window, effectively filtering redundant information and noise (such as non-critical responses with small eigenvalues) within the window. The second local feature refers to the dimensionality-reduced feature map output by the pooling layer, such as a dimension of 19×64 (19 being the length of the dimensionality-reduced sequence and 64 being the number of filters), which retains the key local response information of each channel in the first local feature. The purpose of this step is to preserve the core risk information in the first local feature while compressing the feature dimension and reducing the model's computational cost through parameterized deployment of the pooling layer, avoiding redundant data from interfering with the feature mapping of subsequent fully connected layers, and improving the efficiency and effectiveness of feature processing.

[0154] Specifically, firstly, based on a pooling window size of 2, the sliding step size of the pooling operation is determined to be 2 (consistent with the window size to avoid information duplication caused by window overlap). Secondly, the first local feature (39×64) is processed one by one according to the channel (the feature sequence corresponding to the 64 filters). For the 39-dimensional feature sequence of each channel, starting from the starting position, every two consecutive feature dimensions are divided into a pooling window (forming a total of 19 complete windows; the last remaining feature dimension is discarded directly or merged with the previous window because it is insufficient for the window size). Subsequently, the maximum value of the feature value within each pooling window is taken as the output feature value corresponding to that window. Finally, the 19-dimensional output feature values ​​of the 64 channels are arranged according to the channel to form a 19×64 feature map, i.e., the second local feature. In this process, the key local responses of each channel (such as the maximum feature value reflecting "multiple URLs + induced semantics" in a certain channel) are completely preserved, while irrelevant low feature value noise is filtered out, ensuring that the information density of the second local feature is higher than that of the first local feature.

[0155] Step S63: Deploy the fully connected layer by setting the output dimension and activation function to map the second local feature into a dual-feature fusion vector.

[0156] It should be noted that the output dimension refers to the dimension of the feature vector output by the fully connected layer, which can be specifically set to 128 dimensions. This dimension is determined by considering the complexity of the phishing email detection task and the input requirements of the subsequent XGBoost classifier, ensuring that the output features can cover sufficient risk information without causing computational redundancy due to excessive dimensionality. The activation function refers to the function used to introduce a non-linear transformation into the output of the fully connected layer, which can be set to the "ReLU" function. This can filter negative numerical features, enhance the model's ability to express non-linear features, and maintain consistency with the activation function of the convolutional layer to ensure the coherence of the feature processing logic.

[0157] It should be further explained that the fully connected layer refers to the final submodule of the feature fusion layer. Deployed based on an output dimension of 128 and the ReLU activation function, its core function is to transform the two-dimensional feature map of the second local feature into a one-dimensional fixed-dimensional vector, achieving global integration and dimensional unification of local features. Mapping refers to the fully connected layer transforming the flattened second local feature into a 128-dimensional vector through weight matrix operations. During this process, all key local features are globally weighted and combined, highlighting feature combinations strongly related to phishing emails and suppressing irrelevant features. The dual-feature fusion vector refers to the 128-dimensional vector output by the fully connected layer, denoted as F. fused The fusion layer is the final carrier of statistical and semantic features after deep fusion through convolution, pooling, and fully connected processing, containing global feature information of the overall risk of phishing emails. The purpose of this step is to transform the two-dimensional second local features into a one-dimensional fixed-dimensional fusion vector by parameterizing the fully connected layer, thereby achieving global integration and dimensional standardization of local features. This ensures that the output features can directly adapt to the input requirements of the subsequent XGBoost classifier. At the same time, global weighted combination is used to mine the global correlation between local features, improving the feature's comprehensive representation ability of phishing emails.

[0158] Specifically, in this embodiment, the deployment and feature mapping process of the fully connected layer is divided into two steps: "feature flattening" and "weighted mapping". The first step, feature flattening, transforms the two-dimensional feature map of the second local feature (19×64) into a one-dimensional vector. The calculation method is "sequence length × number of filters", i.e., 19×64=1216 dimensions. This operation unfolds all 19-dimensional local key features of the 64 channels, forming a one-dimensional sequence containing all local feature information. The second step, weighted mapping, initializes a "1216×128" weight matrix (weights are randomly initialized and subsequently optimized through model training iterations) and a "1×128" bias vector based on the fully connected layer's output dimension of 128. The flattened 1216-dimensional vector is then multiplied by the weight matrix, and the bias vector is added to obtain the original 128-dimensional output vector. The third step, activation processing, inputs the 128-dimensional original output vector into the "ReLU" activation function to filter all negative values ​​and retain non-negative feature values, ultimately obtaining the 128-dimensional vector. The process involves a dual-feature fusion vector. Each column vector of the weight matrix corresponds to a weighting coefficient for an output dimension, which is used to combine information related to that output dimension from the 1216 local features (e.g., a column vector focuses on weighting local features such as "multiple URLs + misleading semantics" or "multiple images + disguised statements" to form a comprehensive risk dimension). The 128 column vectors together construct 128 comprehensive risk dimensions, comprehensively reflecting the phishing risk of emails.

[0159] This embodiment deploys convolutional layers by setting the number of filters and activation functions, which can specifically capture the interaction patterns of local continuous features in the dual-feature correlation vector. Compared with extraction methods without parameter constraints, it can more accurately locate the key local risk features of phishing emails. The pooling layer downsamples the first local features output by the convolutional layer by setting a fixed pooling window size. While retaining local key response values ​​(such as the maximum risk feature value), it compresses the feature dimension (such as halving the feature length), reducing the computational cost of subsequent fully connected layers and avoiding redundant data from interfering with model learning. The fully connected layer sets a fixed output dimension and activation function to map the variable-dimensional second local features (which vary with the input vector length) to a fixed-dimensional dual-feature fusion vector, ensuring a uniform output feature format that can be directly adapted to subsequent XGBoost. The input requirements for the classifier avoid model training errors caused by dimension mismatch. From local extraction in the convolutional layer to key preservation in the pooling layer, and then to dimension mapping in the fully connected layer, each layer forms a collaborative process through parameter settings. This process gradually integrates the local correlation information of statistical features and semantic features into a unified dual-feature fusion vector. Compared with simple concatenation, this achieves deep fusion of the two types of features, allowing the fused features to more comprehensively reflect the phishing risk of emails.

[0160] In one feasible implementation, the step of testing the undetermined phishing email detection model based on the model test set and the sample tag set corresponding to the model test set to obtain the target phishing email detection model includes:

[0161] Step S71: For any phishing email sample in the model test set, input the phishing email sample into the pending phishing email detection model for detection, and obtain the sample detection result output by the pending phishing email detection model to obtain the sample detection result set corresponding to the model test set.

[0162] It should be noted that the sample detection result refers to the detection conclusion output by the model to be determined for a single phishing email sample, including two parts: first, the classification result of "whether it is a phishing email" (e.g., "is a phishing email" or "is not a phishing email"), and second, the probability value of the sample being a phishing email (the value ranges from [0,1], obtained by the XGBoost classifier through the sigmoid function). The sample detection result set refers to the set formed by summarizing the detection results of all samples after inputting all samples from the model test set into the model to be determined. Each record in the set is associated with the sample ID, the detection classification result, and the probability value, so as to verify the performance of the model to be determined through the model test set, obtain the detection results of the model on independent data, and avoid the detection bias caused by the model "overfitting" the training set data.

[0163] It should be noted that in this embodiment, the detection process of inputting phishing email samples into the model to be determined is completely consistent with the feature processing process in the model training stage, ensuring the continuity of the detection logic, which will not be elaborated here.

[0164] Step S72: Compare and analyze the sample detection result set with the sample label set to obtain model test analysis data;

[0165] It should be noted that the sample label set refers to the set of true attribute annotations for all samples in the model test set, which corresponds one-to-one with the sample detection result set through sample IDs. The labels are completed simultaneously during sample collection and parsing / cleaning to ensure the authenticity and accuracy of the labels. Comparative analysis refers to the process of matching the "detection classification result" with the "true label" of each sample one by one by associating the sample detection result set and the sample label set through sample IDs, counting the number of matches and non-matches, and then calculating the model performance metrics. Model test analysis data refers to the set of metrics that quantitatively reflect the model's detection performance, calculated through comparative analysis. Core metrics include accuracy, recall, precision, F1 score, and AUC (Area Under ROC Curve). These metrics evaluate model performance from different dimensions (e.g., accuracy reflects the overall detection accuracy, recall reflects the phishing email identification rate, and precision reflects the proportion of genuine phishing emails among the samples detected as phishing emails).

[0166] Specifically, in one embodiment, the model test set contains 30,000 samples. After comparing the sample detection result set with the sample label set, the statistics are as follows: True Positive (TP) = 8730 (detected as phishing and actually phishing), False Positive (FP) = 420 (detected as phishing but actually normal), False Negative (FN) = 270 (detected as normal but actually phishing), and True Negative (TN) = 20580 (detected as normal and actually normal). Based on these data, the model test analysis data are calculated: accuracy, recall, precision, and F1 score, and an ROC curve is plotted to obtain an AUC value of 0.982. These indicators together constitute the model test analysis data, comprehensively reflecting the performance of the model under test from dimensions such as overall accuracy, phishing email identification rate, and false positive rate.

[0167] Step S73: Compare the model test analysis data with the preset threshold to obtain the target phishing email detection model.

[0168] It should be noted that the preset performance thresholds refer to pre-set critical values ​​for judging whether the model performance meets the needs of actual applications. The threshold settings need to be combined with the requirements of the enterprise email security protection scenario (e.g., a higher recall threshold is needed for scenarios sensitive to false negatives, and a higher precision threshold is needed for scenarios sensitive to false positives), for example, precision ≥ 95%, recall ≥ 94%, precision ≥ 93%, F1 score ≥ 94%, AUC value ≥ 0.95. The target phishing email detection model refers to the pending phishing email detection model that meets all the preset performance thresholds after comparison. This model has stable and accurate phishing email detection capabilities and can be used in actual enterprise email security protection scenarios. If any indicator of the pending model fails to meet the threshold, it needs to return to the model training stage (e.g., adjust CNN module parameters, increase the amount of training data, optimize the XGBoost classifier regularization term, etc.), retrain, and re-enter the testing process until all indicators meet the threshold. It should also be noted that in this embodiment, the comparison between the model test analysis data and the preset threshold should follow the principle of "full metric compliance" rather than "single metric compliance." This is because phishing email detection scenarios need to balance "no missed detections" and "no false positives." Compliance with a single metric may have performance limitations (e.g., if the recall rate meets the standard but the precision rate is too low, a large number of legitimate emails will be falsely identified; if the precision rate meets the standard but the recall rate is too low, a large number of phishing emails will be missed). Furthermore, the model test analysis data should use the average of multiple tests (e.g., the average precision and recall rates of three independent tests) before comparing it with the preset threshold. This avoids misjudging model performance due to random errors in a single test (e.g., if the model's precision meets the standard in a single test due to fluctuations in sample distribution, but the average of multiple tests does not meet the standard, retraining is still required). In addition, the preset threshold is not fixed and can be dynamically adjusted according to the company's business needs (for example, if the company has recently encountered multiple new types of phishing emails generated by AI, it can appropriately lower the precision threshold and increase the recall threshold to ensure that new types of phishing emails are not missed). However, after the adjustment, the model needs to be re-verified through the testing process to see if it meets the standards.

[0169] Specifically, in one embodiment, all indicators meet the preset threshold, thus determining the undetermined phishing email detection model as the target phishing email detection model, which can be used in actual enterprise email detection scenarios. If the test analysis data of an undetermined model is: accuracy 94.8% (<95%), recall 96% (≥94%), and other indicators all meet the standards, then because the accuracy does not meet the standard, it is necessary to return to the training stage to adjust the model parameters (such as optimizing the output dimension of the fully connected layer of the CNN module, adjusting the number of XGBoost classifier trees), retrain, and test again.

[0170] This embodiment sets the model test set to data independent of the training set (split in a 7:3 ratio), which avoids the model "memorizing" the training data and truly verifies the model's ability to identify unseen phishing email samples. This ensures that the target model has the generalization ability required for practical applications. At the same time, it calculates model test analysis data such as accuracy, recall, and precision (e.g., taking the average of multiple experiments) to quantitatively evaluate the model's detection performance and avoid subjective judgment errors. Furthermore, since the phishing email samples in the model test set are from the same source as the training set and are consistent with the characteristics of phishing emails that may be encountered in practical applications, the target model selected based on this test set can better adapt to real-world email detection scenarios in enterprises and reduce the risk of missing new types of phishing emails.

[0171] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0172] This application also provides a phishing email detection device based on strategy game theory and large language model; please refer to [reference needed]. Figure 4 The phishing email detection device based on strategy game theory and large language model includes:

[0173] Module 21 is used to acquire target detection emails;

[0174] The detection module 22 is used to input the target email into the target phishing email detection model for detection and obtain the phishing email detection result. The target phishing email detection model is jointly trained by statistical features and semantic features. The statistical features are obtained through strategy game and the semantic features are extracted through a large language model.

[0175] The phishing email detection device based on strategy game theory and large language model provided in this application, employing the phishing email detection method based on strategy game theory and large language model in the above embodiments, can solve the technical problems mentioned in the background art. Compared with the prior art, the beneficial effects of the phishing email detection device based on strategy game theory and large language model provided in this application are the same as the beneficial effects of the phishing email detection method based on strategy game theory and large language model provided in the above embodiments, and other technical features in the phishing email detection device based on strategy game theory and large language model are the same as the features disclosed in the methods of the above embodiments, and will not be repeated here.

[0176] This application provides a phishing email detection device based on strategy game theory and large language model. The phishing email detection device based on strategy game theory and large language model includes: at least one processor; and a memory communicatively connected to at least one processor; wherein the memory stores instructions executable by at least one processor, and the instructions are executed by at least one processor to enable at least one processor to execute the phishing email detection method based on strategy game theory and large language model in the above embodiment 1.

[0177] The following is for reference. Figure 5 This document illustrates a structural diagram of a phishing email detection device based on strategy game theory and large language modeling, suitable for implementing embodiments of this application. The phishing email detection device based on strategy game theory and large language modeling in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital radio receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The phishing email detection device based on strategy game theory and large language model shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0178] like Figure 5As shown, a phishing email detection device based on strategy game theory and large language modeling may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory 1002 or a program loaded from storage device 1003 into random access memory 1004. Random access memory 1004 also stores various programs and data required for the operation of the phishing email detection device based on strategy game theory and large language modeling. The processing unit 1001, read-only memory 1002, and random access memory 1004 are interconnected via bus 1005. Input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to input / output interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the phishing email detection device based on strategy game theory and large language modeling to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows phishing email detection devices based on strategy game theory and large language modeling with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0179] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0180] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the phishing email detection methods provided by the methods described above.

[0181] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0182] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0183] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A phishing email detection method based on strategy game theory and large language model, characterized in that, include: Retrieve target detection emails; The target email is input into the target phishing email detection model for detection to obtain the phishing email detection result. The target phishing email detection model is jointly trained by statistical features and semantic features. The statistical features are obtained through strategy game and the semantic features are extracted through a large language model. The training process of the target phishing email detection model includes: Several phishing email samples are obtained. After parsing and cleaning each phishing email sample, feature fields are extracted and sample labels are added to obtain the model training set and the model test set. Based on the model training set, strategic game analysis is performed to obtain the statistical feature set corresponding to the model training set. Semantic feature extraction is then performed based on the model training set to obtain the semantic feature set corresponding to the model training set. Specifically, for any phishing email sample in the model training set, a non-cooperative game model between the phishing attacker and defender in the phishing email sample is constructed; the Nash equilibrium of the non-cooperative game model is solved to determine the defender's defense strategy; and based on the defender's defense strategy, statistical features of the phishing email sample are extracted to obtain the statistical feature set corresponding to the model training set. The statistical feature set and the semantic feature set are associated and combined to construct a dual-feature association vector set; The dual-feature association vector set is input into the initial phishing email detection model for iterative training to obtain the undetermined phishing email detection model. The model to be tested is performed on the model test set and the sample tag set corresponding to the model test set to obtain the target phishing email detection model.

2. The phishing email detection method based on strategy game theory and large language model as described in claim 1, characterized in that, The step of extracting semantic features based on the model training set to obtain the semantic feature set corresponding to the model training set includes: For any phishing email sample in the model training set, the phishing email sample and preset prompt words are input into the first semantic feature extraction model to obtain the dialogue corpus information corresponding to the phishing email sample output by the first semantic feature extraction model, so as to obtain the dialogue corpus information database corresponding to the model training set. The dialogue corpus information database is input into the second semantic feature extraction model for model fine-tuning; The model training set is input into the second semantic feature extraction model after the model fine-tuning is completed to extract semantic features, thereby obtaining the semantic feature set corresponding to the model training set.

3. The phishing email detection method based on strategy game theory and large language model as described in claim 1, characterized in that, The initial phishing email detection model includes an input layer, a feature fusion layer, and a classifier; The step of inputting the dual-feature association vector set into the initial phishing email detection model for iterative training to obtain the undetermined phishing email detection model includes: The dual-feature association vector set is received through the input layer; For any dual-feature association vector in the set of dual-feature association vectors, the dual-feature association vector is input to the feature fusion layer for local spatial feature extraction and feature fusion, and a dual-feature fusion vector is output to obtain a set of dual-feature fusion vectors; The classifier outputs the probability value corresponding to the dual-feature fusion vector set, and compares the probability value with a preset threshold to determine the pending phishing email detection model.

4. The phishing email detection method based on strategy game theory and large language model as described in claim 3, characterized in that, The feature fusion layer includes a convolutional layer, a pooling layer, and a fully connected layer; The step of inputting the dual-feature correlation vector into the feature fusion layer for local spatial feature extraction and feature fusion, and outputting a dual-feature fusion vector, includes: The convolutional layer is deployed by setting the number of filters, the kernel size, and the activation function, and local features are extracted from the dual-feature correlation vector through the convolutional layer to obtain the first local feature. The pooling layer is deployed by setting the pooling window size to reduce the dimensionality of the first local feature and retain key information, thereby obtaining the second local feature; The fully connected layer is deployed by setting the output dimension and activation function to map the second local features into a dual-feature fusion vector.

5. The phishing email detection method based on strategy game theory and large language model as described in claim 1, characterized in that, The step of testing the undetermined phishing email detection model based on the model test set and the corresponding sample tag set to obtain the target phishing email detection model includes: For any phishing email sample in the model test set, the phishing email sample is input into the undetermined phishing email detection model for detection, and the sample detection result output by the undetermined phishing email detection model is obtained, so as to obtain the sample detection result set corresponding to the model test set; The sample detection result set is compared and analyzed with the sample label set to obtain model test analysis data; The model test analysis data is compared with the preset threshold to obtain the target phishing email detection model.

6. A phishing email detection device based on strategy game theory and large language model, characterized in that, include: The acquisition module is used to acquire target detection emails; The detection module is used to input the target email into the target phishing email detection model for detection and obtain the phishing email detection result. The target phishing email detection model is jointly trained by statistical features and semantic features. The statistical features are obtained through strategy game and the semantic features are extracted through a large language model. The training module is used to acquire several phishing email samples, parse and clean each sample, extract feature fields, and add sample labels to obtain a model training set and a model test set. Based on the model training set, strategic game analysis is performed to obtain a statistical feature set corresponding to the model training set, and semantic feature extraction is performed to obtain a semantic feature set corresponding to the model training set. Specifically, for any phishing email sample in the model training set, a non-cooperative game model between the phishing attacker and defender is constructed. The Nash equilibrium of the non-cooperative game model is solved to determine the defender's defense strategy. Based on the defender's defense strategy, statistical features of the phishing email sample are extracted to obtain a statistical feature set corresponding to the model training set. The statistical feature set and the semantic feature set are associated and combined to construct a dual-feature association vector set. The dual-feature association vector set is input into an initial phishing email detection model for iterative training to obtain a pending phishing email detection model. Based on the model test set and the sample label set corresponding to the model test set, the pending phishing email detection model is tested to obtain the target phishing email detection model.

7. A phishing email detection device based on strategy game theory and large language model, characterized in that, The phishing email detection device based on strategy game theory and large language model includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the phishing email detection method based on strategy game theory and large language model as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the phishing email detection method based on strategy game theory and large language model as described in any one of claims 1 to 5.

Images