A short message exception detection method, device and equipment and storage medium

Abstract

The application discloses a short message anomaly detection method and device, equipment and storage medium, and relates to the technical field of short message security monitoring. The method comprises the following steps: performing historical data analysis on an account as an object, subdividing time into multiple time slices to predict the short message sending quantity, and improving the granularity of prediction analysis; the prediction value is corrected by using the disturbance factor corresponding to the target account, so that the accuracy and rationality of the prediction value are improved; meanwhile, the content type corresponding to each short message is identified through semantic feature analysis, and the short message content deviation rate in the time slice is determined; finally, the time sequence prediction of the sending quantity and the semantic category analysis are combined for multidimensional detection, so that the problem of low accuracy of single-dimensional detection is avoided, and the high-disguised short message stealing behavior is effectively identified and blocked.

Description

Technical Field

[0001] This invention relates to the field of SMS security monitoring technology, and in particular to a method, apparatus, device, and storage medium for detecting SMS anomalies. Background Technology

[0002] Short Message Service (SMS), as a low-cost, high-reach instant messaging method, is widely used in scenarios such as financial services, user registration, identity verification, and marketing promotion. With the increasing level of enterprise informatization, more and more enterprise customers are integrating SMS sending capabilities into their own business systems through the API interfaces provided by SMS SaaS platforms to achieve automated and batch message sending. However, the efficient transmission and wide coverage of SMS services also provide a channel for malicious actors. Once an enterprise's business system or account is compromised by attackers, its SMS sending function may be illegally invoked for the large-scale sending of illegal content. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for detecting SMS anomalies, which can improve the ability to detect SMS anomalies. The specific solution is as follows:

[0004] Firstly, this application discloses a method for detecting SMS anomalies, including:

[0005] Collect SMS service data of the target account, and generate a historical sequence for each time slot based on the SMS volume of the target account in different time slots over the most recent consecutive days.

[0006] The basic predicted value corresponding to each time slice is determined based on the historical sequence, and the basic predicted value is corrected using the perturbation factor corresponding to the target account. The final predicted value corresponding to each time slice is obtained based on the corrected predicted value.

[0007] The semantic feature analysis identifies the content type of each text message. Based on the content types of all text messages within the same time slice and the category whitelist of the target account, the text message content deviation rate of the time slice is calculated.

[0008] The abnormal risk level is determined based on the difference between the actual amount of messages sent by the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot.

[0009] Optionally, generating a historical sequence corresponding to each time slot based on the SMS sending volume of the target account in different time slots over several consecutive days includes:

[0010] The day is divided into N time segments to obtain multiple time slices; where N is determined based on the start time, end time, and time interval of the day.

[0011] Based on the SMS service data of the target account over the most recent M consecutive days, determine the SMS sending volume corresponding to each time slot within different days;

[0012] Based on the number of SMS messages sent in the same time slot on different days, a historical sequence corresponding to that time slot is generated to obtain the historical sequence corresponding to each time slot.

[0013] Optionally, determining the basic predicted value corresponding to each time slice based on the historical sequence includes:

[0014] Based on the median and weighted moving average of the historical sequence corresponding to the time slice, as well as the weights of the median and the weighted moving average, the basic predicted value of the time slice is obtained by weighted summation.

[0015] The weighted moving average is calculated based on the transmission volume of the time slice in the most recent K consecutive days, combined with a linearly decreasing weight sequence, and the weight corresponding to the transmission volume is higher the closer the time.

[0016] Optionally, obtaining the final predicted value for each time slice based on the corrected predicted value includes:

[0017] Based on the corrected predicted values ​​corresponding to the adjacent time slices of the target time slice, a moving average is applied to the corrected predicted values ​​of the target time slice to obtain the final predicted value of the target time slice.

[0018] Optionally, determining the abnormal risk level based on the difference between the actual sending volume of the target account in the current time slice and the final predicted value corresponding to the current time slice, as well as the SMS content deviation rate in the current time slice, includes:

[0019] Based on the difference between the actual amount of messages sent by the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot, the abnormal risk level is determined according to the judgment rules.

[0020] Based on the mapping relationship between risk level and processing operation, determine and execute the target processing operation corresponding to the current abnormal risk level.

[0021] Optionally, the step of correcting the basic predicted value using the perturbation factor corresponding to the target account includes:

[0022] The target account's behavioral characteristics are analyzed based on its total daily sending volume over the most recent M consecutive days, and the disturbance factor is determined based on these characteristics.

[0023] Wherein, when the account behavior characteristics indicate a recent surge in the total daily sending volume of the target account, the disturbance factor is greater than 1; when the account behavior characteristics indicate a recent decrease in the total daily sending volume of the target account, the disturbance factor is less than 1.

[0024] Optionally, the step of analyzing account behavior characteristics based on the total daily sending volume of the target account over the most recent M consecutive days, and determining the disturbance factor based on the account behavior characteristics, includes:

[0025] Based on the total daily sending volume of the target account, obtain the sequence of total sending volume of the target account for the most recent M consecutive days;

[0026] The median of the total transmission volume sequence is used as the baseline value, and the total transmission volume of the most recent day in the total transmission volume sequence is used as the actual value.

[0027] Based on the benchmark value, the actual value, and the disturbance adjustment coefficient, the disturbance factor corresponding to the target account is calculated using the disturbance factor calculation formula.

[0028] Secondly, this application discloses a text message anomaly detection device, comprising:

[0029] The data collection module is used to collect SMS service data of the target account and generate a historical sequence for each time slot based on the SMS sending volume of the target account in different time slots over the most recent consecutive days.

[0030] The prediction value determination module is used to determine the basic prediction value corresponding to each time slice based on the historical sequence, and to correct the basic prediction value using the perturbation factor corresponding to the target account, and to obtain the final prediction value corresponding to each time slice based on the corrected prediction value.

[0031] The content deviation rate determination module is used to identify the content type of each SMS message through semantic feature analysis, and to calculate the SMS content deviation rate of the time slice based on the content types of all SMS messages in the same time slice and the category whitelist of the target account.

[0032] The risk assessment module is used to determine the level of abnormal risk based on the difference between the actual amount of messages sent by the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot.

[0033] Thirdly, this application discloses an electronic device, including:

[0034] Memory, used to store computer programs;

[0035] A processor is used to execute the computer program to implement the aforementioned SMS anomaly detection method.

[0036] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned SMS anomaly detection method.

[0037] In this application, SMS service data of the target account is collected. Based on the SMS sending volume of the target account in different time slots over several consecutive days, a historical sequence corresponding to each time slot is generated. A basic predicted value corresponding to each time slot is determined based on the historical sequence, and the basic predicted value is corrected using the perturbation factor corresponding to the target account. Based on the corrected predicted value, a final predicted value corresponding to each time slot is obtained. The content type corresponding to each SMS is identified through semantic feature analysis. Based on the content types of all SMS messages in the same time slot and the category whitelist of the target account, the SMS content deviation rate of the time slot is calculated. Based on the difference between the actual sending volume of the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the SMS content deviation rate of the current time slot, the abnormal risk level is determined.

[0038] As can be seen, by analyzing historical data on an account-by-account basis and dividing time into multiple time slices, the prediction volume of SMS messages sent by the same account in different time slices is made, improving the granularity of the predictive analysis. Furthermore, by using the perturbation factor corresponding to the target account to correct the basic prediction value, the accuracy and reasonableness of the prediction value are improved. At the same time, semantic feature analysis is used to identify the content type of each SMS message and determine the content deviation rate of SMS messages within the time slice. Finally, by combining the difference between the actual sending volume of the target account in the current time slice and the final prediction value corresponding to the current time slice, as well as the content deviation rate of the current time slice, the level of abnormal risk is determined. Through multi-dimensional detection using time-series prediction of sending volume and semantic category analysis, the problem of low accuracy of single-dimensional detection is avoided, effectively identifying and blocking highly disguised SMS theft behavior. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0040] Figure 1 A flowchart of a method for detecting SMS anomalies provided in this application;

[0041] Figure 2A specific schematic diagram of the final predicted value provided by this application;

[0042] Figure 3 A specific flowchart of the predicted value calculation method provided by this application;

[0043] Figure 4 A specific flowchart of the method for determining the type of short message content provided by this application;

[0044] Figure 5 A specific flowchart of the short message anomaly detection method provided by this application;

[0045] Figure 6 A schematic diagram of the structure of a short message anomaly detection device provided by this application;

[0046] Figure 7 A structural diagram of an electronic device provided by this application. Detailed implementation manners

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are only some of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0048] In the related art, anomaly detection is performed through sensitive word filtering; that is, by maintaining a keyword library to match the short message content, short messages containing preset sensitive words (such as "winning a prize" and "remittance") are intercepted, or further, combinations of sensitive words are used for judgment. However, Chinese semantic combinations are variable, and attackers can bypass detection by means of synonym replacement (such as using "匯款" instead of "remittance") and inserting irrelevant characters (such as "汇_款"). In the related art, anomaly detection is also performed through fixed threshold traffic alarms, etc.; that is, the short message sending volume of a single sending account or sending source IP is counted, and if it exceeds the set threshold within a fixed time window, an alarm or interception is performed; however, setting the threshold too high is likely to result in missed judgments, and attackers can avoid detection by controlling the sending rate; setting the threshold too low is likely to result in false judgments. For example, legitimate marketing short messages during e-commerce big promotions are easily intercepted by mistake. To overcome the above technical problems, this application proposes a short message anomaly detection method, which can improve the accuracy of short message anomaly detection.

[0049] An embodiment of this application discloses a short message anomaly detection method. Refer to Figure 1 As shown, the method may include the following steps:

[0050] Step S11: Collect SMS service data of the target account, and generate a historical sequence corresponding to each time slot based on the SMS sending volume of the target account in different time slots over the most recent consecutive days.

[0051] In this embodiment, SMS service data of the target account is collected in real time. Subsequent analysis is account-based, with each account modeled independently, without relying on the behavior of other accounts. SMS service data includes information such as the account, time, and content of the SMS messages. Based on the collected SMS service data, the SMS sending volume of the target account in different time slots over several consecutive days can be determined, and a historical sequence corresponding to each time slot can be generated accordingly. That is, a historical sequence of the target account in time slot 1, time slot 2, time slot 3… time slot N is generated. A time slot is a time period, such as time slot 1 being 8:00-8:10. This allows for the characterization of the account's sending characteristics at different times.

[0052] When calculating the predicted value, this application proposes an adaptive weighted time pattern projection prediction algorithm. It first constructs a historical sequence, that is, aggregates the historical sending volume according to account and fixed time slice to form a multi-dimensional time series. By performing sliding window segmentation on the historical sequence, it retains the multi-scale features of short-term and long-term. It extracts the statistical features of the same account under different days and the same time slice, such as mean and volatility.

[0053] In some embodiments, generating a historical sequence corresponding to each time slice based on the SMS sending volume of the target account in different time slices over the most recent consecutive days may include: dividing the day into N time segments to obtain multiple time slices; where N is determined based on the start time, end time, and time interval of the day; determining the SMS sending volume corresponding to each time slice in different days based on the SMS service data of the target account over the most recent M consecutive days; and generating a historical sequence corresponding to the same time slice in different days based on the SMS sending volume of the same time slice in different days, so as to obtain a historical sequence corresponding to each time slice.

[0054] For example, divide each day's time slices into N segments. Where START_OUR is the start time, END_OUR is the end time, and STEP_MINUTES is the time interval; the preferred time interval is divisible by 60. For example, if the start time is 06:00 and the end time is 22:00, and STEP_MINUTES = 10 minutes, a single-day period will be divided into 48 time slices; of course, if anomaly detection is required throughout the day, the start time can be 00:00 and the end time can be 24:00. A two-dimensional array is obtained based on the number of SMS messages sent by the target account in different time slices over several consecutive days: Each row represents a day, and each column represents a time slice: for example, x(d,t) represents the amount of data sent on day d (1≤d≤DAYS) and in time slice t (1≤t≤N).

[0055] For each time slice t, filter out the transmission volume over the past few days to construct a historical sequence: Finally, we obtain the historical sequences corresponding to N time slices.

[0056] Step S12: Determine the basic predicted value corresponding to each time slice based on the historical sequence, and correct the basic predicted value using the perturbation factor corresponding to the target account. Based on the corrected predicted value, obtain the final predicted value corresponding to each time slice.

[0057] First, a basic predicted value for that time slice is calculated based on historical sequences. This yields the basic predicted value for the target account for each time segment within a day, i.e., the predicted SMS sending volume. This allows for subsequent comparative analysis based on the predicted values ​​and real-time data to determine if any anomalies exist, enabling personalized monitoring of the account's historical sending behavior patterns. Furthermore, this embodiment considers the differences between the account's recent overall behavior and historical patterns to avoid overall bias, i.e., overestimation or underestimation of the prediction curve. An adaptive global perturbation factor is introduced to perform overall correction on the prediction results.

[0058] In some embodiments, before determining the base predicted value corresponding to each time slice based on the historical sequence, the method further includes: identifying and removing outliers in each historical sequence using interquartile range (IQR) for each Ht. That is, to improve robustness, extreme outliers are removed for each Ht using IQR. The retained data must meet the following requirements: Where Q1 is the 25th quantile, Q3 is the 75th quantile, and IQR = Q3 - Q1; where k is a relaxation factor, the default value is k = 1.5, and the preferred range is [1.2, 2.0]. Finally, the anomaly-handled historical sequence is obtained: .

[0059] In some embodiments, determining the basic predicted value corresponding to each time slice based on the historical sequence includes: obtaining the basic predicted value of the time slice by weighted summation based on the median, weighted moving average, weight of the median, and weight of the weighted moving average of the historical sequence corresponding to the time slice; wherein the weighted moving average is calculated based on the transmission volume of the time slice in the most recent K consecutive days combined with a linearly decreasing weight sequence, and the weight corresponding to the transmission volume is higher the closer the time.

[0060] The base prediction value for time slice t The calculation formula is as follows:

[0061] ;

[0062] in, The median of the historical sequence. It is a weighted moving average. The weights are [0.6, 0.8] for static accounts and [0.4, 0.6] for dynamic accounts. The median, as a steady-state feature, captures the most common sending behavior in that time slice and has strong noise resistance. Since the impact of data at different times varies, a weighted average is used to balance the influence. For example, the sending volume in the most recent k days: The weights decrease linearly: k, k-1, ..., 1; then the weighted moving average is:

[0063] .

[0064] In some embodiments, correcting the base prediction value using a perturbation factor corresponding to the target account includes: analyzing account behavior characteristics based on the total daily sending volume of the target account over the most recent M consecutive days, and determining a perturbation factor based on the account behavior characteristics; wherein, when the account behavior characteristics indicate a recent surge in the total daily sending volume of the target account, the perturbation factor is greater than 1; when the account behavior characteristics indicate a recent decrease in the total daily sending volume of the target account, the perturbation factor is less than 1. That is, if the total daily sending volume of the target account surges recently, a perturbation factor greater than 1 is designed to make the overall prediction value too high; if the total daily sending volume of the target account decreases recently, a perturbation factor less than 1 is designed to make the overall prediction value lower.

[0065] In some embodiments, the step of analyzing account behavior characteristics based on the total daily sending volume of the target account over the most recent M consecutive days, and determining the disturbance factor based on the account behavior characteristics, includes: obtaining a total sending volume sequence corresponding to the target account over the most recent M consecutive days based on the total daily sending volume of the target account; using the median of the total sending volume sequence as a benchmark value, and using the total sending volume of the most recent day in the total sending volume sequence as the actual value; and calculating the disturbance factor corresponding to the target account using the disturbance factor calculation formula based on the benchmark value, the actual value, and the disturbance adjustment coefficient.

[0066] This involves analyzing account behavior characteristics using the median of the total sent volume sequence and the total sent volume of the most recent day; perturbation factor. for: Among them, the total daily sending volume of the account , , This represents the amount of data sent on day d and in time slice t. The total number of messages sent by the account over the past DAYS days is as follows: The median of the total transmission volume sequence is The total number of messages sent in the most recent day was ; This is the disturbance adjustment coefficient, which can be taken as 0.2 to 0.5. A smoothing term to prevent division by zero can be set to 0.1. The final corrected forecast for each time slice is as follows: .

[0067] In some embodiments, obtaining the final predicted value for each time slice based on the corrected predicted values ​​includes: performing a moving average on the corrected predicted values ​​of the target time slice according to the corrected predicted values ​​corresponding to the adjacent time slices of the target time slice, to obtain the final predicted value of the target time slice. For example, exponential smoothing or a training-free moving average algorithm can be used to obtain the predicted value curve for the next day.

[0068] Taking the three-point moving average as an example, to prevent discontinuities in the curve due to jumps, the three-point moving average is applied from t=2 to t=N-1, and the final predicted value is: At this point, the boundary points can be processed using the nearest neighbor mean, i.e. , .

[0069] Finally, the final predicted value sequence for the target account is obtained: .For example Figure 2 The data shows the historical transmission volume for different time slots within different days, as well as the final predicted value for the next day.

[0070] For example Figure 3The diagram illustrates a specific final prediction value forecasting process. It involves outlier removal based on historical data, calculation of the base prediction value, determination of the perturbation factor for each account, correction using the perturbation factor, smoothing all corrected prediction values, and finally obtaining the final prediction value sequence. As can be seen, for each SMS sending account, an adaptive weighted time-mode projection prediction algorithm is designed based on its historical sending volume data. Based on the account's historical sending volume data, intraday patterns and recent fluctuation characteristics are extracted by time slice, and a weighted sliding projection is used to generate prediction values. Furthermore, the weights can be adaptively adjusted to adapt to abnormal patterns such as holidays and peak business periods. Short-term predictions are performed at the time-slice level, fully automated without manual intervention, and can generate expected sending volume curves for each time slice at night. Moreover, the prediction model can adaptively adjust weights according to the account's historical traffic patterns, allowing for rapid deployment without complex training. It achieves personalized and timely sending volume prediction without model training, reducing false positives / false negatives caused by fixed thresholds. Generating the prediction algorithm model based on the account's own historical data avoids the problem of insufficient adaptability of fixed thresholds to accounts with different business models, achieving personalized prediction capabilities. It can run without offline training, has low prediction and inference latency, is suitable for high-concurrency scenarios, and avoids the high cost of training a corresponding model for a single account. It can be easily integrated into any microservice.

[0071] Step S13: Identify the content type of each SMS message through semantic feature analysis, and calculate the SMS content deviation rate of the time slice based on the content types of all SMS messages within the same time slice and the category whitelist of the target account.

[0072] In this embodiment, for example Figure 4 As shown, a unified global SMS content classifier can be built using a pre-trained Chinese language model (such as ERNIE) to divide SMS messages into several business categories, and pre-configure a whitelist (or blacklist) of categories that can be sent to each account; the model output is a multi-classification head, that is, the probability of each category. For example, if 70% of the SMS messages within a time slice are not in the whitelist, then the SMS content deviation rate is 70%.

[0073] In existing technologies, spam SMS classification models based on machine learning or deep learning typically only use text features to binary classify SMS content into legitimate or illegitimate categories. However, they are difficult to identify SMS messages that attackers use to mimic legitimate business messages. This embodiment determines the content category of the SMS message and then combines this with the types of SMS messages that the current account can send (i.e., the aforementioned category whitelist) to analyze whether the account has sent SMS messages with irrelevant content.

[0074] Specifically, SMS service data is preprocessed, including but not limited to: character standardization, such as unifying full-width / half-width characters and removing abnormal symbols; word segmentation and sub-word segmentation, such as using sub-word granular word segmentation algorithms to divide SMS text into word sequence; and vectorized encoding of input to map word sequence into token ID sequence acceptable to the model.

[0075] After preprocessing, the SMS text is input into a text encoder based on a pre-trained Chinese language model; the input is [token_1, token_2, ..., token_n]. The encoder can adopt a multi-layer Transformer structure to obtain the contextual semantic representation of the text. The encoder outputs the corresponding hidden layer vector representations h_1, h_2, ..., h_n and the globally pooled semantic vector h_cls.

[0076] Based on the semantic feature h_cls, a fully connected classifier is used to output the probability distribution of the current SMS message belonging to various content types. Content types can include, but are not limited to: banking, accommodation and catering, payment, internet finance, retail, recruitment, entertainment and social media, internet, e-commerce, tourism, education and training, funds, insurance brokerage, traditional insurance, manufacturing, and lifestyle services; representing the dual attributes of the SMS content itself and the sender (company). Due to the nature of the organization, it can only send content related to its industry; for example, an e-commerce company cannot send fund-related SMS messages. The final output is the SMS category label and its confidence score.

[0077] By using a pre-trained Chinese language model as an encoder, combined with a multi-category classification head, the business category of SMS messages can be uniformly identified. By configuring an account-level category whitelist, deviations between content categories and the account's daily business categories can be detected, and anomalies can be found even if the text semantics appear legal.

[0078] By accurately classifying SMS text messages and integrating this data with traffic prediction results, the system avoids the problem of failing to detect spoofed SMS illegal activities using only one dimension (content or traffic alone). When an account's actual sending volume deviates significantly from the predicted range during nighttime hours, and the SMS content category does not belong to the sender's pre-configured whitelist of sendable categories, the system triggers a dual-dimensional alarm and interception.

[0079] Step S14: Determine the abnormal risk level based on the difference between the actual sending volume of the target account in the current time slice and the final predicted value corresponding to the current time slice, as well as the deviation rate of the SMS content in the current time slice.

[0080] For example Figure 5As shown, the enterprise business system triggers an SMS sending request. The SMS SaaS platform (Software as a Service) receives the request and routes it to the gateways of various operators. The SMS SaaS platform access layer forwards the SMS to the sending volume prediction module and the SMS content classification module to determine the final predicted value and the SMS content deviation rate. Finally, a two-dimensional alarm analysis is performed based on the final predicted value and the SMS content deviation rate. By detecting the matching degree between the SMS content category and the enterprise business category in real time, the two indicators of abnormal sending volume and content category deviation are jointly judged, and the weights can be dynamically allocated and the thresholds adjusted to avoid relying on a single content detection method to identify spoofed SMS and the problem of inflexible detection. This improves the accuracy of anomaly detection, balances recall and precision, and reduces false alarms. Through an adaptive weighted time pattern projection prediction algorithm and a global SMS content classification model, personalized traffic prediction and content category deviation detection for accounts during specific time periods (such as nighttime) are achieved. A two-dimensional alarm and interception mechanism is adopted to effectively identify and block highly disguised SMS theft. Without relying on or interfering with enterprise business systems, anomaly detection can be achieved from the SMS SaaS platform side by combining account-level sending volume prediction and SMS content category matching analysis. This can quickly detect and block suspected SMS theft during high-risk periods such as nighttime, thereby effectively reducing the risk of illegal SMS transmission.

[0081] In some embodiments, determining the abnormal risk level based on the difference between the actual sending volume of the target account in the current time slice and the final predicted value corresponding to the current time slice, as well as the SMS content deviation rate of the current time slice, includes: determining the abnormal risk level according to the judgment rules based on the difference between the actual sending volume of the target account in the current time slice and the final predicted value corresponding to the current time slice, as well as the SMS content deviation rate of the current time slice; and determining and executing the target processing operation corresponding to the current abnormal risk level based on the mapping relationship between the risk level and the processing operation.

[0082] The system combines the prediction interval results from the root transmission volume prediction module with the category labels and confidence scores from the SMS classification module to form two-dimensional feature data: "traffic deviation index + category deviation index". Based on preset rules and threshold models, the two-dimensional feature data is comprehensively judged, and the system outputs statuses such as normal, alarm, and block. Finally, based on the judgment results, corresponding system operations are triggered, including logging, early warning notification, and forced block.

[0083] The difference R between the actual amount of data sent by the target account in the current time slice and the final predicted value corresponding to the current time slice can be calculated using the following formula:

[0084] The actual transmission volume is used. The denominator of the formula is selected by choosing the maximum value between 1 and the most predicted value to avoid the denominator being zero or too small, thus ensuring the stability of the calculation. When the predicted value is less than 1, the system considers it unreliable or unimportant, and the baseline 1 is used for measurement.

[0085] The judgment rules in this embodiment are not limited. For example, within each time slice, the difference between the actual amount sent by the account and the predicted value range is calculated. If the difference is within the normal threshold range, the traffic is considered normal; if the difference exceeds the upper or lower threshold, it is marked as abnormal traffic. The threshold can be customized according to the usage. If the content deviation rate P is lower than the risk threshold, the content is considered normal; if it is higher than the threshold, it is marked as high-risk content. If R is abnormal and P is normal, a level 1 alarm is output, triggering manual review; if R is normal and P is high-risk, a level 2 alarm is output, triggering SMS channel rate limiting; if R is abnormal and P is high-risk, a severe anomaly is output, directly triggering interception and freezing of the account channel.

[0086] Furthermore, a specific judgment rule is as follows: if Ratio > 3.0 and content deviation rate > 70%, then blocking is performed; if Ratio > 2.0 and content deviation rate > 50%, then a severe alarm is issued; if Ratio > 1.5 and content deviation rate > 30%, then a minor alarm is issued. It supports automatically generating alarm logs and pushing them to the monitoring backend, and immediately executing account blocking or issuing blocking commands in severe cases. The dual-dimensional alarm parameters can be dynamically adjusted according to business risk level and different business types of accounts, supporting rapid response to sudden security incidents.

[0087] By jointly monitoring the time patterns and semantic content of account SMS sending behavior, a two-dimensional detection mechanism is constructed by combining the predicted sending volume with the content category matching degree. This enables high-precision identification and low false alarm rate interception of highly disguised abnormal SMS messages. Anomaly detection triggers alarms; real-time early warning and automatic handling are supported during nighttime or high-risk periods to ensure system security and compliance. If the category deviates by more than a certain proportion within the same time slice, interception is directly triggered. Furthermore, the two dimensions can be weighted and thresholds dynamically adjusted to achieve flexible policy control. For example, if the account's sending volume is between 200% and 300% of the predicted value within the same time slice, and more than 70% of the SMS categories deviate from the preset category, an alarm and interception mechanism is triggered. The entire process is automated, facilitating automatic activation of situational awareness mode during nighttime hours. Once an account begins sending SMS messages, prediction and classification analysis are immediately initiated to ensure a response in the early stages of an attack.

[0088] As can be seen from the above, this embodiment collects SMS service data of the target account, generates a historical sequence corresponding to each time slot based on the SMS sending volume of the target account in different time slots over several consecutive days, determines the basic predicted value corresponding to each time slot based on the historical sequence, and corrects the basic predicted value using the perturbation factor corresponding to the target account, and obtains the final predicted value corresponding to each time slot based on the corrected predicted value, identifies the content type corresponding to each SMS through semantic feature analysis, and calculates the SMS content deviation rate of the time slot based on the content types of all SMS within the same time slot and the category whitelist of the target account, and determines the abnormal risk level based on the difference between the actual sending volume of the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the SMS content deviation rate of the current time slot.

[0089] As can be seen, by analyzing historical data on an account-by-account basis and dividing time into multiple time slices, the prediction volume of SMS messages sent by the same account in different time slices is made, improving the granularity of the predictive analysis. Furthermore, by using the perturbation factor corresponding to the target account to correct the basic prediction value, the accuracy and reasonableness of the prediction value are improved. At the same time, semantic feature analysis is used to identify the content type of each SMS message and determine the content deviation rate of SMS messages within the time slice. Finally, by combining the difference between the actual sending volume of the target account in the current time slice and the final prediction value corresponding to the current time slice, as well as the content deviation rate of the current time slice, the level of abnormal risk is determined. Through multi-dimensional detection using time-series prediction of sending volume and semantic category analysis, the problem of low accuracy of single-dimensional detection is avoided, effectively identifying and blocking highly disguised SMS theft behavior.

[0090] Accordingly, this application also discloses a text message anomaly detection device, see [link to relevant documentation]. Figure 6 As shown, the device includes:

[0091] The acquisition module 11 is used to collect SMS service data of the target account and generate a historical sequence corresponding to each time slot based on the SMS sending volume of the target account in different time slots over the most recent consecutive days.

[0092] The prediction value determination module 12 is used to determine the basic prediction value corresponding to each time slice based on the historical sequence, and to correct the basic prediction value using the disturbance factor corresponding to the target account, and to obtain the final prediction value corresponding to each time slice based on the corrected prediction value.

[0093] The content deviation rate determination module 13 is used to identify the content type of each SMS message through semantic feature analysis, and to calculate the SMS content deviation rate of the time slice based on the content types of all SMS messages in the same time slice and the category whitelist of the target account.

[0094] The risk assessment module 14 is used to determine the abnormal risk level based on the difference between the actual amount of messages sent by the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot.

[0095] As can be seen from the above, this embodiment collects SMS service data of the target account, generates a historical sequence corresponding to each time slot based on the SMS sending volume of the target account in different time slots over several consecutive days, determines the basic predicted value corresponding to each time slot based on the historical sequence, and corrects the basic predicted value using the perturbation factor corresponding to the target account, and obtains the final predicted value corresponding to each time slot based on the corrected predicted value, identifies the content type corresponding to each SMS through semantic feature analysis, and calculates the SMS content deviation rate of the time slot based on the content types of all SMS within the same time slot and the category whitelist of the target account, and determines the abnormal risk level based on the difference between the actual sending volume of the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the SMS content deviation rate of the current time slot.

[0096] As can be seen, by analyzing historical data on an account-by-account basis and dividing time into multiple time slices, the prediction volume of SMS messages sent by the same account in different time slices is made, improving the granularity of the predictive analysis. Furthermore, by using the perturbation factor corresponding to the target account to correct the basic prediction value, the accuracy and reasonableness of the prediction value are improved. At the same time, semantic feature analysis is used to identify the content type of each SMS message and determine the content deviation rate of SMS messages within the time slice. Finally, by combining the difference between the actual sending volume of the target account in the current time slice and the final prediction value corresponding to the current time slice, as well as the content deviation rate of the current time slice, the level of abnormal risk is determined. Through multi-dimensional detection using time-series prediction of sending volume and semantic category analysis, the problem of low accuracy of single-dimensional detection is avoided, effectively identifying and blocking highly disguised SMS theft behavior.

[0097] In some specific embodiments, the acquisition module 11 may specifically include:

[0098] A segmentation unit is used to divide a day into N time segments to obtain multiple time slices; where N is determined based on the start time of the day, the end time of the day, and the time interval.

[0099] The SMS sending volume determination unit is used to determine the SMS sending volume corresponding to each time slice in different days based on the SMS service data of the target account in the most recent consecutive M days.

[0100] The historical sequence generation unit is used to generate the historical sequence corresponding to the same time slice based on the number of SMS messages sent in the same time slice on different days, so as to obtain the historical sequence corresponding to each time slice.

[0101] In some specific embodiments, the predicted value determination module 12 may specifically include:

[0102] The basic prediction value determination unit is used to obtain the basic prediction value of the time slice by weighted summation based on the median, weighted moving average, weight of the median and weight of the weighted moving average of the historical sequence corresponding to the time slice.

[0103] The weighted moving average is calculated based on the amount of data sent within the most recent K consecutive days of the time slice, combined with a linearly decreasing weight sequence, with higher weights corresponding to data sent more recently.

[0104] In some specific embodiments, the predicted value determination module 12 may specifically include:

[0105] The smoothing unit is used to perform a moving average process on the corrected predicted value of the target time slice based on the corrected predicted values ​​corresponding to the adjacent time slices of the target time slice, so as to obtain the final predicted value of the target time slice.

[0106] In some specific embodiments, the risk assessment module 14 may specifically include:

[0107] An abnormal risk level judgment unit is used to judge the abnormal risk level based on the difference between the actual sending volume of the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the SMS content deviation rate in the current time slot, according to the judgment rules.

[0108] The execution unit is used to determine and execute the target processing operation corresponding to the current abnormal risk level based on the mapping relationship between risk level and processing operation.

[0109] In some specific embodiments, the predicted value determination module 12 may specifically include:

[0110] The disturbance factor determination unit is used to analyze the account behavior characteristics based on the total daily sending volume of the target account in the most recent M consecutive days, and determine the disturbance factor based on the account behavior characteristics.

[0111] Wherein, when the account behavior characteristics indicate a recent surge in the total daily sending volume of the target account, the disturbance factor is greater than 1; when the account behavior characteristics indicate a recent decrease in the total daily sending volume of the target account, the disturbance factor is less than 1.

[0112] In some specific embodiments, the disturbance factor determination unit may be used to: obtain a sequence of total transmission volume corresponding to the target account for the most recent M consecutive days based on the target account's total daily transmission volume; use the median of the total transmission volume sequence as a benchmark value and the total transmission volume of the most recent day in the total transmission volume sequence as the actual value; and calculate the disturbance factor corresponding to the target account using the disturbance factor calculation formula based on the benchmark value, the actual value, and the disturbance adjustment coefficient.

[0113] Furthermore, this application also discloses an electronic device, see [link to relevant documentation]. Figure 7 As shown, the content in the figure should not be considered as any limitation on the scope of use of this application.

[0114] Figure 7 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the SMS anomaly detection method disclosed in any of the foregoing embodiments.

[0115] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0116] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223 including historical sequence, etc., and the storage method can be temporary storage or permanent storage.

[0117] The operating system 221 manages and controls the various hardware devices on the electronic device 20 and the computer program 222 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the SMS anomaly detection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0118] Furthermore, this application also discloses a computer storage medium storing computer-executable instructions. When the computer-executable instructions are loaded and executed by a processor, they implement the steps of the SMS anomaly detection method disclosed in any of the foregoing embodiments.

[0119] Furthermore, this application also discloses a computer program product, including a computer program that, when executed by a processor, implements the SMS anomaly detection method steps disclosed in any of the foregoing embodiments.

[0120] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0121] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0122] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0123] The present invention provides a detailed description of a method, apparatus, device, and storage medium for detecting SMS anomalies. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for detecting SMS anomalies, characterized in that, include: Collect SMS service data of the target account, and generate a historical sequence for each time slot based on the SMS volume of the target account in different time slots over the most recent consecutive days. The basic predicted value corresponding to each time slice is determined based on the historical sequence, and the basic predicted value is corrected using the perturbation factor corresponding to the target account. The final predicted value corresponding to each time slice is obtained based on the corrected predicted value. The semantic feature analysis identifies the content type of each text message. Based on the content types of all text messages within the same time slice and the category whitelist of the target account, the text message content deviation rate of the time slice is calculated. The abnormal risk level is determined based on the difference between the actual amount of messages sent by the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot. The determination of the basic predicted value corresponding to each time slice based on the historical sequence includes: Based on the median and weighted moving average of the historical sequence corresponding to the time slice, as well as the weight of the median and the weight of the weighted moving average, the basic predicted value of the time slice is obtained by weighted summation; wherein, the weighted moving average is calculated based on the transmission volume of the time slice in the most recent K consecutive days combined with a linearly decreasing weight sequence, and the more recent the time, the higher the weight of the transmission volume. The correction of the base prediction value using the perturbation factor corresponding to the target account includes: Based on the total daily sending volume of the target account, obtain the sequence of total sending volume of the target account for the most recent M consecutive days; The median of the total transmission volume sequence is used as the baseline value, and the total transmission volume of the most recent day in the total transmission volume sequence is used as the actual value. Based on the benchmark value, the actual value, and the disturbance adjustment coefficient, the disturbance factor corresponding to the target account is calculated using the disturbance factor calculation formula.

2. The SMS anomaly detection method according to claim 1, characterized in that, Based on the SMS sending volume of the target account in different time slots over several consecutive days, a historical sequence corresponding to each time slot is generated, including: The day is divided into N time segments to obtain multiple time slices; where N is determined based on the start time, end time, and time interval of the day. Based on the SMS service data of the target account over the most recent M consecutive days, determine the SMS sending volume corresponding to each time slot within different days; Based on the number of SMS messages sent in the same time slot on different days, a historical sequence corresponding to that time slot is generated to obtain the historical sequence corresponding to each time slot.

3. The SMS anomaly detection method according to claim 1, characterized in that, The final predicted value for each time slice is obtained based on the corrected predicted value, including: Based on the corrected predicted values ​​corresponding to the adjacent time slices of the target time slice, a moving average is applied to the corrected predicted values ​​of the target time slice to obtain the final predicted value of the target time slice.

4. The SMS anomaly detection method according to claim 1, characterized in that, Based on the difference between the actual sending volume of the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot, the abnormal risk level is determined, including: Based on the difference between the actual amount of messages sent by the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot, the abnormal risk level is determined according to the judgment rules. Based on the mapping relationship between risk level and processing operation, determine and execute the target processing operation corresponding to the current abnormal risk level.

5. The SMS anomaly detection method according to any one of claims 1 to 4, characterized in that, The basic predicted value is corrected using the perturbation factor corresponding to the target account, including: The target account's behavioral characteristics are analyzed based on its total daily sending volume over the most recent M consecutive days, and the disturbance factor is determined based on these characteristics. Wherein, when the account behavior characteristics indicate a recent surge in the total daily sending volume of the target account, the disturbance factor is greater than 1; when the account behavior characteristics indicate a recent decrease in the total daily sending volume of the target account, the disturbance factor is less than 1.

6. A text message anomaly detection device, characterized in that, include: The data collection module is used to collect SMS service data of the target account and generate a historical sequence for each time slot based on the SMS sending volume of the target account in different time slots over the most recent consecutive days. The prediction value determination module is used to determine the basic prediction value corresponding to each time slice based on the historical sequence, and to correct the basic prediction value using the perturbation factor corresponding to the target account, and to obtain the final prediction value corresponding to each time slice based on the corrected prediction value. The content deviation rate determination module is used to identify the content type of each SMS message through semantic feature analysis, and to calculate the SMS content deviation rate of the time slice based on the content types of all SMS messages in the same time slice and the category whitelist of the target account. The risk assessment module is used to determine the abnormal risk level based on the difference between the actual amount of messages sent by the target account in the current time slot and the final predicted value corresponding to the current time slot, as well as the deviation rate of the SMS content in the current time slot. The prediction value determination module is used to obtain the basic prediction value of the time slice by weighted summation based on the median, weighted moving average, weight of the median and weight of the weighted moving average of the historical sequence corresponding to the time slice; wherein the weighted moving average is calculated based on the transmission volume of the time slice in the most recent K consecutive days combined with a linearly decreasing weight sequence, and the weight of the transmission volume is higher the closer the time. The prediction value determination module obtains the total sending volume sequence of the target account over the most recent M consecutive days based on the target account's total daily sending volume; uses the median of the total sending volume sequence as a benchmark value and the total sending volume of the most recent day in the total sending volume sequence as the actual value; and calculates the disturbance factor corresponding to the target account based on the benchmark value, the actual value, and the disturbance adjustment coefficient using the disturbance factor calculation formula.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the SMS anomaly detection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein the computer programs, when executed by a processor, implement the SMS anomaly detection method as described in any one of claims 1 to 5.

Images