Multi-modal fusion short message compliance and security dual-auditing method and multi-modal fusion short message compliance and security dual-auditing system

Abstract

The invention discloses a multi-modal fusion short message compliance and security dual auditing method and system, and the method comprises the steps: encrypting account information through employing an irreversible algorithm based on SHA256 and a random salt value, and decomposing the content of a short message into a text stream, a link stream and a symbol stream through employing a regular expression; traversing each character in the short message content by adopting a prefix mode based on a Trie tree in combination with an AC automaton algorithm to detect sensitive words; performing symbol semantic classification mapping and analysis on the special symbol feature data extracted from the symbol stream; carrying out sending behavior analysis on the text feature data extracted from the text stream; performing special detection on link feature data extracted from the link stream; based on the factors corresponding to the sensitive words, the semantics, the behaviors and the links and the weights of the factors, a multi-modal feature fusion decision risk assessment algorithm is adopted to output a risk score value and a risk decision rule of the risk score value so as to execute short message interception operation or short message release operation. According to the invention, full-dimension perception and dynamic defense of risks can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of communication security and management, and particularly to a dual-audit method and system for SMS compliance and security with multi-modal fusion. Background Art

[0002] Although instant messaging applications have become increasingly popular, SMS still plays an irreplaceable key role in the communication between enterprises and users due to its core advantages such as strong universality, high reliability, and good instantaneity without the need to install a specific APP and being able to cover all mobile terminals. Especially when enterprises or institutions conduct large-scale SMS services, in scenarios such as sending important notifications (such as bank transaction reminders, logistics status updates), identity verification messages (such as secondary verification codes, login verification codes), and service interaction messages (such as appointment confirmations, membership services, marketing notifications), SMS is the preferred official communication channel. Therefore, ensuring the compliance and security of SMS communication is crucial for safeguarding user rights and interests, corporate reputation, and communication order.

[0003] In recent years, the supervision of personal information protection and communication content management has been continuously strengthened globally. Regulatory authorities have put forward strict requirements for SMS services, especially for commercial SMS such as marketing and promotion. For example, sending commercial SMS must obtain the explicit consent of users in advance and provide a convenient and effective unsubscribe channel. Unauthorized SMS sending is strictly prohibited, and the violation cost is extremely high. Another example is that SMS content must be true, accurate, and legal, and the inclusion of illegal and违规 information as well as overly harassing content is prohibited.

[0004] In the current market, in the detection technologies for SMS content compliance, most of them adopt rule matching technologies based on sensitive word libraries, whose principle is to preset a violation word library and perform string matching on SMS content. Another part adopts semantic analysis technologies of natural language processing, whose principle is to use text classification models to identify malicious intentions.

[0005] With the tightening of supervision and the upgrading of security requirements, in the process of implementing the technical solution of the present invention, at least the following technical problems are found in the traditional SMS audit mechanism: One is the failure of single-dimensional detection. For example, in the rule matching technology based on a sensitive word library, its disadvantage is that it cannot handle variant words (such as "V letter" replacing "WeChat") and semantically implicit violations (such as emoji of "coin" implying interest inducement), resulting in its inability to fully identify violation content and a high false positive rate. Another example is that in the semantic analysis technology based on a text classification model, its disadvantage is that the feature extraction of short texts (the average length of SMS is 70 words) is also insufficient, and it cannot detect non-text risks (such as malicious links), resulting in a relatively high misjudgment rate.

[0006] Second, the dynamic defense capability is insufficient. Existing technologies are mainly based on passive defense, relying heavily on post-event interception or user reports. They lack the ability to proactively intervene and block potentially high-risk behaviors (such as abnormal sending patterns, high-risk content, and suspicious receiving numbers) before or during sending. Illegal SMS content can bypass the rule engine through behavioral spoofing (such as low-frequency sending attacks), resulting in a high false negative rate.

[0007] Third, there is a lack of cross-modal fragmentation. Existing technologies generally only set up separate functional modules for text analysis, link detection, or behavior monitoring. For example, if only a text analysis module is set up, there is a lack of risk collaborative judgment mechanism, which cannot identify the combination attack of "compliant text + malicious link" or "normal content + abnormal sending behavior". This results in unauthorized and security-risk SMS messages being sent to end users, leading to customer complaints and regulatory penalties.

[0008] Fourth, compliance and security are disconnected. Many solutions only focus on compliance review (such as content filtering and unsubscription management) or basic security protection (such as anti-spam), lacking a unified platform that organically combines in-depth compliance review with proactive security defense.

[0009] Fifth, the level of intelligence is insufficient, the rule base is updated in a lagging manner, the ability to identify new sensitive words is weak, and there is a lack of intelligent analysis and real-time risk assessment capabilities based on context and behavioral patterns.

[0010] In conclusion, traditional SMS verification mechanisms cannot meet actual usage needs. Summary of the Invention

[0011] This invention provides a multimodal fusion method and system for dual verification of SMS compliance and security. It adopts a multimodal intelligent verification mechanism that integrates sensitive words, semantics, sending behavior, and link features, organically combining in-depth compliance review with proactive security defense. This enables full-dimensional risk perception and dynamic defense, effectively identifying combined attacks and solving the problem that traditional SMS verification mechanisms cannot meet actual usage needs.

[0012] Firstly, this invention provides a multimodal fusion method for dual verification of SMS compliance and security, applicable to scenarios where enterprises or institutions conduct large-scale SMS business, simultaneously performing automated compliance review and real-time security risk prevention on SMS content and sending behavior. The method includes: During the SMS sending process for enterprises or organizations, an irreversible algorithm based on SHA256 and random salt is used to encrypt account information in order to authenticate the sender's request. Once identity authentication is successful, regular expressions are used to decompose the SMS content into a text stream, a link stream, and a symbol stream. Extract text feature data, link feature data, and special symbol feature data from text stream, link stream, and symbol stream; Based on a real-time updated sensitive word library configured according to the business attributes of enterprises or institutions, a prefix pattern based on Trie trees and combined with the AC automaton algorithm are used to traverse each character in the SMS content to obtain sensitive word matching factors. The special symbol feature data extracted from the symbol stream is subjected to symbol semantic classification mapping, and the semantic type mapped is analyzed to determine whether it is an undesirable semantic type in the real-time updated semantic type library, so as to obtain the semantic analysis factor. The text feature data extracted from the text stream is analyzed to determine whether there are any malicious behaviors, in order to obtain behavior analysis factors. The link feature data extracted from the link stream is specifically tested, and the test results are analyzed to determine whether there are any security risks, so as to obtain link analysis factors. Based on sensitive word matching factors, semantic analysis factors, behavioral analysis factors, and link analysis factors and their weights, a multimodal feature fusion decision risk assessment algorithm is used to calculate the risk score of SMS messages. Based on the risk decision rules corresponding to the risk score, SMS interception or SMS release operations are performed.

[0013] Optionally, the process of encrypting account information using an irreversible algorithm based on SHA256 and a random salt includes: The original password from the account information is concatenated with a randomly generated salt value; The concatenated string is first encrypted using SHA256 to generate an initial hash value; The initial hash value is concatenated with the salt value again, and the concatenated string is then encrypted with SHA256 twice to generate the final hash value.

[0014] Optional steps for constructing the prefix pattern of the Trie tree include: Initialize the root node q0. The initial state of the root node q0 is Q0. The root node q0 has no character association. For each sensitive word character sequence c1c2...ck, where c is the character of the sensitive word and k is the character sequence number, start traversing from the initial state Q0, perform word-by-word analysis and character-by-character insertion for each sensitive word. If the transition edge corresponding to the current character does not exist, create a new state Qnew and establish a transition function δ(Qcurrent,cj)=Qnew, where Qcurrent is the current state, cj is the character of the j-th sensitive word, and the state corresponding to the last character of the word is marked as the final state; The number of states is reduced by merging common prefixes, and a failure transition is added to each non-final state node, pointing to the state corresponding to the longest common suffix.

[0015] Optionally, the step of using a Trie tree-based prefix pattern combined with the AC automaton algorithm to traverse each character in the SMS content to obtain the sensitive word matching factor specifically includes: Initialize the current node as the root node and the sensitive word matching set matches, set the start index start_index=-1, and iterate through each character i∈[0,m-1] in the SMS content, where m is the length of the SMS content; A prefix matching pattern based on Trie trees, combined with the AC automaton algorithm, is used for matching. Successfully matched sensitive words are stored in the set matches, and the sensitive word matching factor is defined as the number of successfully matched sensitive words.

[0016] Optionally, the text feature data includes the sending time period, sending frequency, word count, digit ratio, and telephone number.

[0017] Optionally, the step of performing specific detection on the link feature data extracted from the link stream and analyzing whether the detection results pose any security risks specifically includes at least one of the following steps: Query the real-time updated malicious domain database and analyze the link feature data to find any illegal links; A lightweight sandbox detection method is used to simulate clicking on link addresses in link feature data to analyze whether link redirection exists in the link feature data; Obtain the number of path levels in the link feature data and analyze whether the number of path levels exceeds the preset number. Query the real-time updated database of reported links and analyze whether the link addresses in the link feature data are reported links.

[0018] Optionally, the calculation formula for the multimodal feature fusion decision risk assessment algorithm is as follows: R = Pm × W1 + Pf × W2 + Px × W3 + Pu × W4, In the formula, R is the risk score, Pm is the sensitive word matching factor, W1 is the sensitive word weight, Pf is the semantic analysis factor, W2 is the semantic weight, Px is the behavioral analysis factor, W3 is the behavioral weight, Pu is the link analysis factor, and W4 is the link weight.

[0019] Optionally, the sensitive word weight W1 is set to 0.3, the semantic weight W2 is set to 0.1, the behavior weight W3 is set to 0.2, and the link weight W4 is set to 0.4.

[0020] Optional risk decision rules corresponding to the risk score include: When the risk score R ≥ 0.9, it is defined as high-level violation content, and the SMS business of enterprises or institutions should be immediately blocked, accounts frozen, and alarms triggered for real-time monitoring. When the risk score R ≥ 0.7, it is defined as medium-level violation content, and the SMS business of enterprises or institutions should be immediately blocked, alarms should be triggered, and real-time monitoring should be carried out. When the risk score R ≥ 0.5, it is defined as low to medium level violation content. For enterprises or institutions, SMS messages should be delayed, manually reviewed, and manual review reminders should be triggered. When the risk score R ≥ 0.3, it is defined as content requiring supervision. The SMS service of enterprises or institutions should be sent normally, but an alarm needs to be triggered for real-time monitoring. When the risk score R < 0.3, it is defined as normal compliant content, and SMS messages should be sent normally to enterprises or institutions.

[0021] Secondly, this invention also provides a multimodal integrated SMS compliance and security dual-audit system, which is suitable for scenarios where enterprises or institutions conduct large-scale SMS business, simultaneously performing automated compliance review and real-time security risk prevention on SMS content and sending behavior. The system includes: An encryption authenticator is used to encrypt account information using an irreversible algorithm based on SHA256 and a random salt value during the sending of text messages by enterprises or organizations, in order to authenticate the sender's request. A multimodal decomposer is used to decompose SMS content into a text stream, a link stream, and a symbol stream using regular expressions after successful authentication. Feature extractors are used to extract text feature data, link feature data, and special symbol feature data from text streams, link streams, and symbol streams. The multimodal detection module includes a sensitive word analyzer, a symbol analyzer, a behavior analyzer, and a link analyzer, among which: The sensitive word analyzer is used to obtain sensitive word matching factors by traversing each character in the SMS content using a Trie tree-based prefix pattern combined with the AC automaton algorithm, based on a real-time updated sensitive word library configured according to the business attributes of the enterprise or organization. The symbol analyzer is used to perform symbol semantic classification mapping on the special symbol feature data extracted from the symbol stream, and analyze whether the mapped semantic type is an undesirable semantic type in the real-time updated semantic type library in order to obtain a semantic analysis factor. The behavior analyzer is used to perform sending behavior analysis on the text feature data extracted from the text stream, analyze whether there is any bad behavior, and obtain behavior analysis factors. The link analyzer is used to perform specific detection on the link feature data extracted from the link stream, analyze whether there are any security risks in the detection results, and obtain the link analysis factor. The risk decision fusion engine is used to calculate the risk score of SMS messages based on a multimodal feature fusion decision risk assessment algorithm, which is based on sensitive word matching factors, semantic analysis factors, behavioral analysis factors, and link analysis factors. The real-time interceptor is used to perform SMS interception or SMS release operations based on the risk decision rules corresponding to the risk score.

[0022] One or more technical solutions provided by this invention have at least the following technical effects or advantages: In addition to using traditional naming requirements for signature and sub-account registration, and enterprise real-name registration as compliance requirements, this invention also conducts compliance reviews of SMS content. Specifically, it employs a prefix pattern based on a Trie tree combined with an AC automaton algorithm to traverse characters one by one, ensuring that the SMS content does not contain sensitive words, thus improving compliance review. Besides using traditional IP access control, this invention uses an irreversible algorithm based on SHA256 and random salt to encrypt account information for identity authentication. Compared to traditional MD5 encryption or SHA256 encryption alone, the randomly generated salt enhances the security of the password hash, preventing identical encryption results for the same password and significantly reducing the risk of rainbow table attacks. Combined with random salt, it can resist common password cracking methods such as brute-force attacks and dictionary attacks. Furthermore, in addition to security reviews related to access control, this invention also conducts security reviews of SMS sending behavior and SMS content. SMS sending behavior, such as SMS sending frequency and time periods, must not contain inappropriate content; the semantics of the SMS content must not contain inappropriate meaning; and links in the SMS content must not contain security risks, thus improving security review. This invention, by improving compliance review and security review, can meet the actual needs of simultaneously conducting automated compliance review and real-time security risk prevention and control of SMS content and sending behavior, and organically combines in-depth compliance review with proactive security defense.

[0023] This invention, by simultaneously establishing sensitive word matching, semantic analysis, sending behavior analysis, and link analysis, can integrate multimodal data to achieve a collaborative risk judgment mechanism. This improves the intelligent analysis and real-time risk assessment capabilities based on context and behavioral patterns, effectively identifies combined attacks, achieves multi-dimensional detection, and enhances dynamic defense capabilities, as detailed below: The present invention adopts a prefix pattern based on a Trie tree and combines it with the Aho-Corasick automaton algorithm to traverse each character in the SMS content. Different from traditional binary search trees, the keys in the string dataset are not directly stored in the nodes in the Trie tree, but are determined by the positions of the nodes in the tree. Compared with the traditional method of matching sensitive words using regular expressions, the improved algorithm can improve the performance of matching sensitive words in the SMS content and enhance the ability to identify new types of sensitive words.

[0024] To solve the technical problem in the prior art that semantic implicit violations (such as the "coin" emoji implying interest inducement) cannot be processed, the present invention performs symbol semantic classification mapping on the special symbol feature data extracted from the SMS content, and analyzes whether the mapped semantic type is a bad semantic type. For example, for content with semantic implicit violations such as the "coin" icon, it is mapped to the semantic type of interest inducement, which can effectively identify content with semantic implicit violations and improve the recognition accuracy.

[0025] To solve the technical problem in the prior art that variant words (such as "V letter" replacing "WeChat") cannot be processed during the matching of sensitive words, the present invention classifies variant words and special symbols into the same type of data, that is, special symbol feature data. By establishing a semantic type library for special symbols and updating the semantic type library in real time, through symbol semantic classification mapping of the special symbol feature data, and through a method similar to sensitive word matching for inspection and filtering, variant words can be identified and the recognition accuracy can be improved.

[0026] To solve the technical problem that the semantic analysis technology of the existing text classification model extracts insufficient features for short texts, the present invention first uses regular expressions to decompose the SMS content into text streams, link streams, and symbol streams, and then extracts text feature data, link feature data, and special symbol feature data from the three types of stream files, solving the technical problem of insufficient feature extraction for short texts in the prior art.

[0027] To solve the technical problem that the semantic analysis technology of the existing text classification model cannot identify non-text risks (such as malicious links), the present invention classifies non-text feature data into link feature data and special symbol feature data for targeted identification and processing. For example, for a malicious link, it will be identified as link feature data and subject to special detection, such as querying the malicious domain name library, querying the reported link library, simulating clicking on the link address to determine whether there is a redirect link, and / or analyzing whether the number of path levels exceeds the preset number of levels to effectively identify the malicious link, effectively detecting link-type non-text risks, improving the recognition accuracy, and avoiding misjudgment. For example, for gift box or coin emojis, they will be identified as special symbol feature data and mapped to the semantic category of interest inducement, effectively detecting special symbol-type non-text risks, improving the recognition accuracy, and avoiding misjudgment.

[0028] To address the technical problem of insufficient dynamic defense capabilities in existing technologies, this invention first identifies and processes SMS content and sending behavior during the SMS sending process for enterprises or institutions. This includes: decomposing and extracting text feature data from the SMS content for sending behavior analysis; performing sensitive word traversal on each character of the SMS content, which can effectively identify abnormal sending methods, suspicious receiving numbers, and illegal content before or during sending; decomposing and extracting link feature data and special symbol feature data from the SMS content for link-specific detection and symbol semantic analysis, which can effectively identify malicious links and high-risk content before or during sending. Furthermore, by proactively intervening and blocking potentially high-risk behaviors before or during sending, this invention prevents illegal SMS messages from bypassing the rule engine through disguise (such as low-frequency sending attacks), effectively identifying combined attacks of "compliant text + malicious links" or "normal content + abnormal sending behavior," improving identification accuracy, avoiding missed detections, preventing customer complaints and regulatory penalties, and improving user experience.

[0029] The sensitive word database and semantic type database of this invention are updated in real time, which can avoid missed detections caused by the lag in rule database updates and improve the ability to identify new sensitive words and new malicious semantic types. Preferably, the malicious domain name database and the reported link database used by this invention for special detection of link feature data are also updated synchronously to avoid missed detections caused by the lag in rule database updates and improve the ability to identify new malicious links and new reported links.

[0030] In summary, the multimodal fusion SMS compliance and security dual-audit method and system of this invention focuses on constructing a dual-audit model for compliance and security. It employs a multimodal risk collaborative judgment mechanism that integrates sensitive words, semantics, behavior, and link features. Through an innovative design of integrated "compliance + security" management, it fundamentally solves the core problems faced in SMS services, such as high compliance costs, weak security protection, poor user experience, and low operational efficiency. By extracting behavioral characteristics and content features of SMS messages sent by enterprise or institutional customers, and combining them with pre-set sensitive word and semantic type libraries, it utilizes various improved audit rules and their matching data. These include, for example, prefix patterns based on Trie trees combined with AC automata algorithms, symbolic semantic classification mapping rules, sending behavior analysis rules, and link-specific detection rules. This enables the SMS platform to assess the compliance and security of SMS messages in real time before and during sending. By collecting four categories of decision factors from multimodal data feature transformation in real time—sensitive word matching factors, semantic analysis factors, behavioral analysis factors, and link analysis factors—and calculating risk scores in real time based on the weights of each decision factor, the compliant and secure delivery of SMS messages is achieved according to the risk scores and risk decision rules.

[0031] Furthermore, the multimodal fusion method and system for dual review of SMS compliance and security of the present invention achieves deep synergy between compliance review and security protection, and organic unity of intelligent decision-making and real-time response through technological innovation. Compared with the prior art, the implementation of the present invention can bring the following significant benefits: First, it significantly improves the efficiency and accuracy of SMS compliance management. By building a dynamic compliance rule base, it synchronizes the latest regulatory policies (such as sensitive word databases and sending time restrictions) in real time, ensuring that the enterprise's SMS business always complies with the requirements of local regulations, and provides full-link auditing and traceability of SMS, which can provide strong evidence for enterprises to deal with regulatory reviews and reduce legal risks. Second, by building a proactive SMS security defense system, it effectively blocks the sending and dissemination of high-risk SMS messages. For example, it breaks through the traditional passive interception mode, and conducts real-time risk assessment of SMS content and sending behavior patterns in a multimodal fusion before sending, achieving millisecond-level blocking of high-risk content such as fraud, phishing, and malicious links. It also uses behavioral analysis and anomaly detection models (such as high-frequency verification code request identification and abnormal regional sending monitoring) to accurately identify new threats such as verification code theft attacks and SMS bombing, preventing problems before they occur. The practical application of this invention can not only create direct economic benefits for enterprises (cost reduction and efficiency improvement, risk avoidance), but also enhance the security and credibility of the SMS communication environment in the whole society, and help build a clean cyberspace. Attached Figure Description

[0032] Figure 1 A simplified flowchart illustrating the overall process of a multimodal integrated dual-audit method for SMS compliance and security; Figure 2 A flowchart for configuring account security audit rules; Figure 3 This is a flowchart illustrating the overall operation of extracting and analyzing multimodal feature data. Figure 4 This is a flowchart of the sensitive word matching operation based on the prefix pattern of a Trie tree. Figure 5 Here is a structural diagram of the Trie tree constructed in the first example; Figure 6 Here is a structural diagram of the Trie tree constructed in the second example; Figure 7 This is a structural diagram of a multimodal integrated SMS compliance and security dual-verification system. Detailed Implementation

[0033] This invention provides a multimodal fusion method and system for dual verification of SMS compliance and security. It adopts a multimodal intelligent verification mechanism that integrates sensitive words, semantics, sending behavior, and link features, organically combining in-depth compliance review with proactive security defense. This enables full-dimensional risk perception and dynamic defense, effectively identifying combined attacks and solving the problem that traditional SMS verification mechanisms cannot meet actual usage needs.

[0034] To better understand, a detailed description will be provided below with reference to the accompanying drawings and specific embodiments. Obviously, the embodiments described in this invention are only a part of the embodiments of this invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0035] Please refer to the following. Figure 1 Before implementing the multimodal fusion SMS compliance and security dual audit method in this embodiment of the invention, step 1 needs to be performed: the SMS platform creates an enterprise sending account. Step 1 includes steps S11 to S13.

[0036] Step S11: Establish Enterprise Information Profiles. Based on the enterprise customer's requirements for accessing the SMS platform, create enterprise information profiles for them. These profiles include the enterprise name, mailing address, business license, brand logo, legal representative's identity and contact information, and the identity and contact information of the authorized representative. Establishing enterprise information profiles is the foundation for enterprise credit authorization and also serves as a communication bridge between the SMS platform and the enterprise for feedback and tracing of compliance issues related to SMS content.

[0037] Step S12: Create an enterprise API sending account. Create a corresponding API access account based on the enterprise's business type. The API access account configuration information includes account name, enterprise, key, business type, access IP, maximum sending speed, and sending time period. Generate a unique sending account identifier for the enterprise account. The identifier is generated according to the following rule: "First letters of the enterprise's full name in Pinyin + business type + 13-digit timestamp". The SMS sending account information is the unique identity token for the enterprise sending SMS messages and is an important technical guarantee for verifying the legitimacy of the enterprise's SMS sending.

[0038] Step S13: Bind the sending account security audit rules. To better manage and standardize the compliance of SMS sending by enterprise customers and meet industry standards, a set of configuration and rule sets for dynamic compliance of account configuration has been built for each sending account. The configuration and rules are as follows: Figure 2 As shown.

[0039] Signature content specifications: The SMS signature is located within the symbol 【】 before the SMS content and is used to identify the enterprise, product, or business. As an identifier of the SMS sender's attributes, the signature must clearly identify the sender's company information, product, or business. Ambiguous neutral signatures are not supported. Signatures containing words such as "test," "test," or "for testing" are not supported. The signature length is limited to 2-12 characters and cannot be removed. Chinese characters, English letters, and numbers are counted as one character. Domestic SMS signatures consist of Chinese characters, English letters, or numbers; all-English signatures, all-numeric signatures, and signatures combining "English letters" and "numeric numbers" are not supported.

[0040] Signature Registration Configuration: An SMS signature is an identifier of the SMS sender's attributes. A complete SMS message consists of an SMS signature and the SMS content. Each enterprise sending account must register the signature of the SMS content sent by that account and the corresponding channel extension sub-number, depending on its business type. The name of the SMS signature must meet one of the following conditions: enterprise / institution name, an online app, or a registered trademark, to ensure the normal delivery of subsequent SMS messages.

[0041] Extended Subnumber Registration: The extended subnumber is a component of the SMS code number. The SMS code number consists of a channel number and an extended subnumber, with a total length typically not exceeding 20 digits. The channel number begins with 106, representing different operators or a unified three-network channel; for example, 10657 represents a mobile gateway channel; 10690 represents a unified three-network channel. The number following the channel number is the extended subnumber, used to match uplink SMS messages (such as the reply command TD). For example, the complete SMS number for a signature is 10690759000000000001.

[0042] SMS referral content reporting: Currently, there are two main methods for using SMS content to attract traffic: including phone numbers or links. Before sending any referral SMS messages, it is essential to report the numbers and links beforehand. Unreported SMS messages may contain fake links, contact information, or other misleading information, making them vulnerable to fraud. For example, in cases involving fake loans, credit repair, or online order rebates, fraudsters often induce users to click on links or make phone calls. Therefore, unreported referral numbers or links will be identified as illegitimate and blocked during SMS transmission.

[0043] Sending time period rule configuration: Configure different sending time period rules according to the sending time period requirements of the business type, such as prohibiting the sending of marketing SMS from 22:00 to 8:00.

[0044] Unsubscribe response rule configuration: According to the latest operator requirements, all notification SMS messages must include the standardized instruction "reply T to unsubscribe".

[0045] All the above configurations and rules are described using a domain-specific language strategy for Scalable DSLs, and are updated in real time with hot updates. Rule changes are automatically synchronized to all associated accounts.

[0046] Please continue to refer to this. Figure 1 Next, a multimodal fusion method for dual review of SMS compliance and security in an embodiment of the present invention will be described in detail. This method is applicable to scenarios in which enterprises or institutions conduct automated compliance review and real-time security risk prevention and control of SMS content and sending behavior when carrying out large-scale SMS business. The method includes steps S2 to S6.

[0047] Step 2: Sending Enterprise SMS. During the enterprise SMS sending process, the sender's request is authenticated, and accounts sending abnormal requests are blocked, data is logged, and monitoring alerts are issued to prevent unsafe or non-compliant requests or account theft attacks. The account SMS sending authentication process includes steps 21 and 22.

[0048] Step 21: Request IP Address Detection and Blocking. The SMS platform uses IP authentication to verify the legitimacy of the requester. If the IP address corresponding to the SMS sending request is not a pre-set or pre-reported IP address, the request is rejected. IP authentication, or IP identity verification, is the process of confirming the user's network environment and requesting identity to ensure that only legitimate networks can access the network. This not only prevents unauthorized IP access and abuse but also improves the security and accuracy of data transmission.

[0049] Step 22, Identity Authentication Detection and Interception. The account information and key in the request message are verified for identity. During the request sending process, the account information is encrypted using an irreversible algorithm based on SHA256 and a random salt value to authenticate the sender's request.

[0050] It should be noted that most government and enterprise clients in the original system used API interfaces to connect to the original SMS platform via sockets to send SMS messages. The original system created an API connection account for each government and enterprise client for identity authentication and authorization. Account information included: username, password, accessing IP address, and service type. Therefore, the irreversible algorithm based on SHA256 and random salt in step 22 mainly encrypts the password in the account information.

[0051] This invention improves data encryption algorithms by providing an irreversible algorithm based on SHA256 and random salt values. Existing technologies generally use MD5 encryption or SHA256 encryption alone. Traditional MD5 encryption cannot resist pre-collision attacks, and when using only SHA256 encryption, because SHA256 only performs fixed-length hashing on the input data, it cannot resist rainbow table attacks, which involve storing a large number of pre-computed hash values.

[0052] The irreversible algorithm based on SHA256 and random salt provided by this invention enhances password security by adding a random salt to the original password before performing SHA256 encryption.

[0053] Specifically, the process of encrypting account information using an irreversible algorithm based on SHA256 and random salt includes: Step S221, concatenate salt value: concatenate the original password in the account information with the randomly generated salt value, for example: original password + salt value.

[0054] Step S222, Initial SHA256 Encryption: Perform SHA256 encryption on the concatenated string for the first time to generate an initial hash value.

[0055] Step S223, Secondary Encryption and Storage: The initial hash value and salt value are concatenated again, and the concatenated string is encrypted with SHA256 twice to generate the final hash value (usually a 64-bit hexadecimal string). The final hash value is then stored.

[0056] Step S3: Multimodal Feature Data Extraction. After successful authentication in Step S2, the SMS platform receives SMS messages sent by the customer and extracts the multimodal feature data from the SMS content. The overall operation flow for multimodal feature data extraction and analysis is as follows: Figure 3 As shown.

[0057] Step S31: The multimodal decomposer uses regular expressions to decompose the SMS content into a text stream, a link stream, and a symbol stream.

[0058] For symbol streams, regular expressions are used to match special symbols and emojis. The regular expression is [@#$%^&*()\\[\\]{}\\uD83D-\\uD83E\\u2600-\\u27BF]. Special symbols and emojis occupy specific character ranges in the Unicode encoding system. For example, the specific Unicode range for emojis is \u200d to \u27bf.

[0059] For link streams, all URL links in the SMS are extracted using a regular matching method. The regular expression is [(([a-zA-Z0-9]+\\.)+[a-zA-Z]{2}|(\\d{1,3}\\.){3}\\d{1,3})]. Usually, the links in the SMS content do not start with http / https. Therefore, when extracting links, we should not start with http / https to avoid missing any links.

[0060] For text streams, after extracting special links and special symbols, the remaining content is all treated as text streams, and the content with numbers in the text is stripped. The regular expression for stripping numbers is [(?<!\\d)\\d{7,12}(?!\\d)]. The numbers in the SMS content are an important means of marketing drainage and also an important way used by fraudulent SMS. The numbers carried in the SMS content usually indicate possible illegal drainage. For example, fraudulent SMS often uses overseas numbers (such as 00522440007904) or forges official numbers of banks, payment platforms, etc., disguising themselves as trustworthy sources to induce users to contact. Now, there is a trend in the SMS industry that requires numbers carried in the SMS content to be reported in advance, and numbers that have not been reported are not recommended to be sent or are rejected for sending. Therefore, the numbers are extracted separately, and the subsequent steps of extracting text feature data from the text stream will collect the numbers in the SMS content for subsequent risk assessment.

[0061] Step S32: After the SMS content is decomposed, further analyze and extract various types of feature data respectively.

[0062] For special symbol feature data, map the symbols in the symbol stream to semantic classifications of symbols. The types of semantics include: emergency induction, interest induction, variant substitution, emotional manipulation, legal identification, etc. Map the extracted special symbols to the corresponding semantic types. For example, map gift or currency emojis to the semantic type of interest induction.

[0063] For link feature data, extract data such as the protocol, domain name, and number of path levels in the link stream.

[0064] For text feature data, extract the following feature data from the separated text stream, including the sending time period, sending frequency, word count, digital ratio, phone numbers, etc.

[0065] Step S33: Use a cross-modal fusion device to classify and store the feature data of special symbols, links, and texts in different address spaces of the same memory.

[0066] In step S3, the multimodal decomposer classifies and extracts the SMS content and outputs it to the cross-modal fusion unit. The next step S4 requires classifying and detecting the compliance and potential risks of the extracted feature data, i.e., security.

[0067] Step S4: The multimodal detection module performs sensitive word matching, semantic analysis, behavioral analysis, and link analysis to obtain four types of modality detection result data, namely four major decision factors: sensitive word matching factor Pm, semantic analysis factor Pf, behavioral analysis factor Px, and link analysis factor Pu. It should be noted that this invention does not limit the execution order of sensitive word matching, semantic analysis, behavioral analysis, and link analysis. Different execution orders can be set according to the actual situation, for example: sensitive word matching → semantic analysis → behavioral analysis → link analysis, or semantic analysis → sensitive word matching → link analysis → behavioral analysis. This invention does not impose any limitations. Generally, the multimodal detection module performs the above four analyses sequentially. When conditions permit, the above four analyses can also be performed in parallel. This invention does not impose any limitations.

[0068] In step S4, different detection methods will be used for different feature data. The following section will detail the inspection and auditing of various feature data.

[0069] Step S41: Sensitive Word Matching. Sensitive word matching detection is a crucial component of SMS content security auditing. To improve the performance of sensitive word matching in SMS content, a Trie tree-based approach will be used for sensitive word checking. Based on a real-time updated sensitive word library configured according to the business attributes of the enterprise or organization, a prefix pattern based on a Trie tree, combined with an AC automaton algorithm, is used to traverse each character in the SMS content to obtain sensitive word matching factors. The sensitive word matching operation process based on the prefix pattern of a Trie tree is as follows: Figure 4 As shown.

[0070] Step S411, Load Sensitive Word Database: When creating the sending account for enterprise or institutional clients in Step 1, corresponding sensitive word detection rules were configured according to the client's business attributes. In this step, the corresponding sensitive word database is loaded according to the sensitive word detection rules configured for the sending account. The sensitive word list dataset to be detected is S={w1,w2,...,wn}, for example: sensitive word list dataset S=["loan", "brushing", "cashback"], where S represents the sensitive word data set, w1 is the first sensitive word, w2 is the second sensitive word, and so on, wn is the nth sensitive word.

[0071] Step S412, Construct the Trie tree structure: In computer science, a Trie tree, also known as a prefix tree or dictionary tree, is a tree structure used for quickly retrieving keys from a string dataset. Unlike a binary search tree, keys are not directly stored in nodes, but are determined by the node's position in the tree (edges). All descendants of a node share the same prefix.

[0072] The steps for constructing the prefix pattern of a Trie tree include: Step S4121: Initialize the root node q0. The initial state of the root node q0 is Q0, and the root node q0 has no character association.

[0073] Step S4122: For each sensitive word's character sequence c1c2...ck, where c is the character of the sensitive word and k is the character sequence number, traverse starting from the initial state Q0. Perform word-by-word analysis and character-by-character insertion for each sensitive word. If the transition edge corresponding to the current character does not exist, create a new state Qnew and establish a transition function δ(Qcurrent,cj)=Qnew, where Qcurrent is the current state, cj is the character of the j-th sensitive word, and the state corresponding to the last character of the word is marked as the final state, i.e., the accepting state. For example, after inserting "loan", the path is: Q0→loan→Q1→fund→Q2 (Q2 is the final state).

[0074] Step S4123: Reduce the number of states by merging common prefixes, such as "loan" and "lender" sharing the "loan" prefix, and add a failure transition for each non-final state node, pointing to the state corresponding to the longest common suffix.

[0075] The following describes the constructed Trie tree, using the sensitive words "XYD", "XFJ", "PPD", and "DK" as examples. The constructed Trie tree is as follows: Figure 5 As shown. Each node is labeled with a state number, a character, and a failure pointer. Gray circles represent terminating nodes, and white circles represent root nodes or non-terminating nodes. Each node corresponds to a state, and the state number is the node's unique identifier. In a Trie tree, state and node are usually the same concept; each node represents a state, and the state number is the node's unique identifier.

[0076] Taking the sensitive words "XYD", "PPD", "DK", "WDW", "KQ", and "DXQZ" as examples, the constructed Trie tree is as follows: Figure 6 As shown. Each node is labeled with a status number, a character, and a failure pointer. Status 0 is the root node, the failure pointer points to itself, and the terminating node is marked with "[terminal]".

[0077] The technical terms used in the Trie tree are explained below.

[0078] Node: In a Trie tree, each node stores a single character (except for the root node) and may be marked as a terminating node (indicating the end of a keyword). Nodes are connected by pointers to form a tree structure.

[0079] State: In automata theory, a state represents the current matching progress. Each node corresponds to a state, and a state number is used to uniquely identify that node. For example, Figure 6 In the diagram, state 0 is the root node, state 1 is the node containing the character "X", and so on.

[0080] Transition function: A transition from one state to another based on the input character. For example, Figure 6 In the process, inputting "X" from state 0 transitions to state 1. It should be noted that if two words start with the same character, they will share the same node; however, if the two words have different positions of the same character, they cannot share a node. Figure 5 Both "PPD" and "DK" contain "D", but when constructing the Trie tree, state 8 and state 9 are separated.

[0081] Failure Link: Each state (node) has a failure link that points to another state. If the current state has no matching character to transition to, the automaton jumps to the state pointed to by the failure link and continues matching. The failure link points to the state corresponding to the longest common suffix to improve matching efficiency.

[0082] After constructing the Trie tree structure in step S412, step S413 is executed.

[0083] Step S413, Sensitive Word Matching Detection, is a step that uses a prefix pattern based on a Trie tree combined with the AC automaton algorithm to traverse each character in the SMS content to obtain the sensitive word matching factor. Specifically, it includes: Step S4131: Initialize the current node as the root node and the sensitive word matching set matches, set the start index start_index=-1, and traverse each character i∈[0,m-1] in the SMS content, where m is the length of the SMS content.

[0084] Step S4132: Use prefix matching mode and combine it with AC automaton algorithm for matching.

[0085] Step S4133: Successfully matched sensitive words are stored in the matches set. The sensitive word matching factor Pm is defined as the number of matched sensitive words (i.e., the size of the matches set) for subsequent cross-modal fusion processing.

[0086] Step S42, Semantic Analysis. The special symbol feature data extracted from the symbol stream is subjected to symbolic semantic classification mapping. The semantic type mapped is analyzed to determine whether it is an undesirable semantic type in the real-time updated semantic type library, thus obtaining a semantic analysis factor. For example, if a gift or coin emoji in a text message is mapped to the semantic type of incentive, it is marked as one instance of incentive (Pf=1), indicating the number of times such a text message contains incentive. The semantic analysis factor Pf = the number of semantic markings is defined for subsequent processing by the cross-modal fusion processor.

[0087] It should be noted that various semantic types are stored in a semantic type library. "Emergency inducement," "profit inducement," "variant substitution," and "emotional manipulation" in the semantic type library are considered malicious semantic types, while legitimate identifiers in the semantic type library are considered normal semantic types. The semantic type library is updated in real time to identify new semantic types. The checking and filtering methods for semantic types and the semantic type database are similar to those for sensitive words and sensitive word libraries, and will not be elaborated further.

[0088] Step S43, Behavioral Analysis. Text feature data extracted from the text stream, including sending time period, sending frequency, word count, number ratio, and phone number information, is analyzed to determine if any inappropriate behavior exists, thus obtaining a behavioral analysis factor Px. For example, a sudden increase in sending frequency is marked as one instance of unauthorized sending (Px1=1), indicating a possibility of unauthorized SMS sending. Similarly, if marketing SMS messages are sent at night, it is marked as one instance of harassment (Px2=1), indicating a possibility of harassment. Furthermore, if the SMS content contains a phone number that is not registered, it is marked as one instance of fraudulent number sending (Px3=2), indicating a possibility of fraudulent numbers. By marking various inappropriate behaviors in SMS sending behavior through behavioral analysis, a behavioral analysis factor Px = the number of times inappropriate behavior is marked is defined for subsequent processing by the cross-modal fusion processor.

[0089] Step S44: Link Analysis. The link feature data extracted from the link stream undergoes specialized detection to analyze whether the detection results contain security risks, thereby obtaining the link analysis factor Pu. The link analysis factor Pu is defined as the number of link tags. The specialized detection specifically includes at least one of the following steps: Query the real-time updated malicious domain database and analyze the link feature data to identify any illegitimate links. For example, if a domain extracted from the link stream is a malicious domain, mark it as an illegitimate link (Pu1=1), indicating that such SMS messages may involve malicious traffic redirection.

[0090] A lightweight sandbox detection method is used to simulate clicking on link addresses in the link feature data to analyze whether link redirection exists. For example, if a link address extracted from the link stream contains a link redirection, it is marked as a link reset risk (Pu2=1).

[0091] Obtain the number of path levels in the link feature data and analyze whether the number of path levels exceeds the preset number. For example, if the number of path levels extracted from the link stream exceeds 5, it is marked as one link risk alert (Pu3=1).

[0092] The system queries the real-time updated database of reported links and analyzes the link characteristics to determine if the link addresses are reported links. For example, if an extracted link address is a reported link, it is considered a safe link (Pu=0).

[0093] Example of combined special detection: If the domain name extracted from the link stream is a malicious domain name, the link address extracted from the link stream contains link redirection, or the number of path levels extracted from the link stream exceeds 5 levels, then it is marked as 1 illegal link (Pu1=1), 1 link reset risk (Pu2=1), and 1 alarm link risk (Pu3=1), and the link analysis factor Pu=Pu1+Pu2+Pu3=3.

[0094] Step 5: The risk decision fusion engine calculates the risk score of the SMS message based on the sensitive word matching factor, semantic analysis factor, behavioral analysis factor, and link analysis factor and their weights, using a multimodal feature fusion decision risk assessment algorithm.

[0095] Based on the detection results of the four modalities in step 4, a multimodal feature fusion decision risk assessment algorithm and decision rules were developed. The decision algorithm includes four categories of decision factors: sensitive word matching factor Pm, semantic analysis factor Pf, behavioral analysis factor Px, and link analysis factor Pu.

[0096] The calculation formula for the multimodal feature fusion decision risk assessment algorithm is as follows: R = Pm × W1 + Pf × W2 + Px × W3 + Pu × W4, In the formula, R is the risk score, Pm is the sensitive word matching factor, W1 is the sensitive word weight, Pf is the semantic analysis factor, W2 is the semantic weight, Px is the behavioral analysis factor, W3 is the behavioral weight, Pu is the link analysis factor, and W4 is the link weight.

[0097] In practical applications, specific values ​​can be set for sensitive word weight W1, semantic weight W2, behavioral weight W3, and link weight W4 according to specific circumstances; this invention does not impose any limitations.

[0098] Preferably, the weights for sensitive words (W1) and semantics (W2) in the analysis of whether the detection results indicate potential security risks are set to 0.3, 0.1, 0.2, and 0.4 respectively. The calculation formula for the multimodal feature fusion decision risk assessment algorithm is as follows: R = Pm × 0.3 + Pf × 0.1 + Px × 0.2 + Pu × 0.4.

[0099] Step 6: The real-time interceptor executes SMS interception or SMS release operations based on the risk decision rules corresponding to the risk score.

[0100] The real-time interceptor is a key execution node for SMS compliance risk decision-making. This interceptor will decide whether to perform the interception operation based on the score and risk decision rules calculated by the multimodal feature fusion decision risk assessment algorithm in the previous step.

[0101] The risk decision-making rules corresponding to the risk score specifically include: When the risk score R ≥ 0.9, it is defined as high-level violation content, and the SMS business of enterprises or institutions should be immediately blocked, accounts frozen, and alarms triggered for real-time monitoring. When the risk score R ≥ 0.7, it is defined as medium-level violation content, and the SMS business of enterprises or institutions should be immediately blocked, alarms should be triggered, and real-time monitoring should be carried out. When the risk score R ≥ 0.5, it is defined as low to medium level violation content. For enterprises or institutions, SMS messages should be delayed, manually reviewed, and manual review reminders should be triggered. When the risk score R ≥ 0.3, it is defined as content requiring supervision. The SMS service of enterprises or institutions should be sent normally, but an alarm needs to be triggered for real-time monitoring. When the risk score R < 0.3, it is defined as normal compliant content, and SMS messages should be sent normally to enterprises or institutions.

[0102] For example, a corporate client sends a text message that reads, "Notice from the State Financial Supervision and Administration Bureau: Your loan is overdue. Please contact 123456789 for processing, otherwise it will be reported to the credit bureau." Based on the multimodal detection results Pm=1 (containing one loan-sensitive word), Pf=0, Px=1 (containing one misleading number), and Pu=0, the risk score calculated by the multimodal feature fusion decision risk assessment algorithm is R = Pm × 0.3 + Pf × 0.2 = 0.5. Matching the risk decision rule corresponding to R≥0.5, this is defined as low to medium violation content. The real-time interceptor will delay the execution and send it for manual review, triggering a manual review reminder. The reviewer will decide whether to approve the message based on the actual business situation of the enterprise.

[0103] For example, a corporate client receives an SMS message stating, "[Financial Provider] Your pre-approved credit limit has been adjusted from 98,000 yuan to 165,000 yuan today, valid only today. Activate by clicking the work order aaa.com / bb, reply T to unsubscribe." Based on the multimodal detection results Pm=1 (containing one sensitive word related to credit limit), Pf=0, Px=0, and Pu=1 (containing one unreported link), the risk score calculated by the multimodal feature fusion decision risk assessment algorithm is R = Pm × 0.3 + Pu × 0.4 = If the value is 0.7, and the risk decision rule corresponding to R≥0.7 is matched, it is defined as medium-level violation content. The real-time interceptor will intercept it and trigger an alarm for real-time monitoring. If the subsequent link has been reported, then R=Pm×0.3=0.3, which is defined as content requiring supervision. The real-time interceptor will allow the SMS to be sent normally. However, due to the high probability of complaints about such SMS in the industry, real-time monitoring will be carried out. If the monitoring results reach the complaint limit, then operational control will be used for intervention.

[0104] like Figure 7 As shown, in a second aspect, the present invention provides a multimodal fusion SMS compliance and security dual-audit system, which is applicable to scenarios where enterprises or institutions conduct large-scale SMS business, simultaneously performing automated compliance review and real-time security risk prevention on SMS content and sending behavior, and analyzing whether the detection results contain security risks. The system includes: An encryption authenticator is used to encrypt account information using an irreversible algorithm based on SHA256 and a random salt value during the sending of text messages by enterprises or organizations, in order to authenticate the sender's request. A multimodal decomposer is used to decompose SMS content into a text stream, a link stream, and a symbol stream using regular expressions after successful authentication. Feature extractors are used to extract text feature data, link feature data, and special symbol feature data from text streams, link streams, and symbol streams. The multimodal detection module includes a sensitive word analyzer, a symbol analyzer, a behavior analyzer, and a link analyzer, among which: The sensitive word analyzer analyzes whether the detection results pose security risks. It is used to analyze the sensitive word library that is configured according to the business attributes of the enterprise or organization and updated in real time. It uses a prefix pattern based on the Trie tree and combined with the AC automaton algorithm to traverse each character in the text message content to obtain the sensitive word matching factor. The symbol analyzer is used to analyze whether the detection results have safety hazards. It is used to perform symbol semantic classification mapping on the special symbol feature data extracted from the symbol stream, and analyze whether the mapped semantic type is an undesirable semantic type in the real-time updated semantic type library in order to obtain semantic analysis factors. A behavior analyzer is used to analyze the text feature data extracted from the text stream to determine whether there are any security risks in the detection results. This analyzer is used to perform sending behavior analysis on the text feature data extracted from the text stream and to determine whether there are any bad behaviors in order to obtain behavior analysis factors. The link analyzer is used to specifically detect the link feature data extracted from the link stream and analyze whether the detection results have any security risks in order to obtain the link analysis factor. The risk decision fusion engine is used to calculate the risk score of SMS messages based on a multimodal feature fusion decision risk assessment algorithm, which is based on sensitive word matching factors, semantic analysis factors, behavioral analysis factors, and link analysis factors. The real-time interceptor is used to perform SMS interception or SMS release operations based on the risk decision rules corresponding to the risk score.

[0105] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A multimodal fusion method for dual verification of SMS compliance and security, characterized in that, This method is applicable to scenarios where enterprises or institutions conduct large-scale SMS services, simultaneously performing automated compliance review and real-time security risk prevention on SMS content and sending behavior. The method includes: During the SMS sending process for enterprises or organizations, an irreversible algorithm based on SHA256 and random salt is used to encrypt account information in order to authenticate the sender's request. Once identity authentication is successful, regular expressions are used to decompose the SMS content into a text stream, a link stream, and a symbol stream. Extract text feature data, link feature data, and special symbol feature data from text stream, link stream, and symbol stream; Based on a real-time updated sensitive word library configured according to the business attributes of enterprises or institutions, a prefix pattern based on Trie trees and combined with the AC automaton algorithm are used to traverse each character in the SMS content to obtain sensitive word matching factors. The special symbol feature data extracted from the symbol stream is subjected to symbol semantic classification mapping, and the semantic type mapped is analyzed to determine whether it is an undesirable semantic type in the real-time updated semantic type library, so as to obtain the semantic analysis factor. The text feature data extracted from the text stream is analyzed to determine whether there are any malicious behaviors, in order to obtain behavior analysis factors. The link feature data extracted from the link stream is specifically tested, and the test results are analyzed to determine whether there are any security risks, so as to obtain link analysis factors. Based on sensitive word matching factors, semantic analysis factors, behavioral analysis factors, and link analysis factors and their weights, a multimodal feature fusion decision risk assessment algorithm is used to calculate the risk score of SMS messages. Based on the risk decision rules corresponding to the risk score, SMS interception or SMS release operations are performed.

2. The method as described in claim 1, characterized in that, The process of encrypting account information using an irreversible algorithm based on SHA256 and random salt includes: The original password from the account information is concatenated with a randomly generated salt value; The concatenated string is first encrypted using SHA256 to generate an initial hash value; The initial hash value is concatenated with the salt value again, and the concatenated string is then encrypted with SHA256 twice to generate the final hash value.

3. The method as described in claim 1, characterized in that, The steps for constructing the prefix pattern of a Trie tree include: Initialize the root node q0. The initial state of the root node q0 is Q0. The root node q0 has no character association. For each sensitive word character sequence c1c2...ck, where c is the character of the sensitive word and k is the character sequence number, start traversing from the initial state Q0, perform word-by-word analysis and character-by-character insertion for each sensitive word. If the transition edge corresponding to the current character does not exist, create a new state Qnew and establish a transition function δ(Qcurrent,cj)=Qnew, where Qcurrent is the current state, cj is the character of the j-th sensitive word, and the state corresponding to the last character of the word is marked as the final state; The number of states is reduced by merging common prefixes, and a failure transition is added to each non-final state node, pointing to the state corresponding to the longest common suffix.

4. The method as described in claim 1, characterized in that, The steps for obtaining sensitive word matching factors by using a prefix pattern based on a Trie tree and combining it with the AC automaton algorithm to traverse each character in the SMS content include: Initialize the current node as the root node and the sensitive word matching set matches, set the start index start_index=-1, and iterate through each character i∈[0,m-1] in the SMS content, where m is the length of the SMS content; A prefix matching pattern based on Trie trees, combined with the AC automaton algorithm, is used for matching. Successfully matched sensitive words are stored in the set matches, and the sensitive word matching factor is defined as the number of successfully matched sensitive words.

5. The method as described in claim 1, characterized in that, The text feature data includes the sending time period, sending frequency, word count, number ratio, and phone number.

6. The method as described in claim 1, characterized in that, The specific steps involved in performing targeted detection on the link feature data extracted from the link stream and analyzing whether the detection results pose any security risks include at least one of the following: Query the real-time updated malicious domain database and analyze the link feature data to find any illegal links; A lightweight sandbox detection method is used to simulate clicking on link addresses in link feature data to analyze whether link redirection exists in the link feature data; Obtain the number of path levels in the link feature data and analyze whether the number of path levels exceeds the preset number. Query the real-time updated database of reported links and analyze whether the link addresses in the link feature data are reported links.

7. The method as described in claim 1, characterized in that, The calculation formula for the multimodal feature fusion decision risk assessment algorithm is as follows: R = Pm × W1 + Pf × W2 + Px × W3 + Pu × W4, In the formula, R is the risk score, Pm is the sensitive word matching factor, W1 is the sensitive word weight, Pf is the semantic analysis factor, W2 is the semantic weight, Px is the behavioral analysis factor, W3 is the behavioral weight, Pu is the link analysis factor, and W4 is the link weight.

8. The method as described in claim 7, characterized in that, The sensitive word weight W1 is set to 0.3, the semantic weight W2 is set to 0.1, the behavioral weight W3 is set to 0.2, and the link weight W4 is set to 0.

4.

9. The method as described in claim 1, characterized in that, The risk decision-making rules corresponding to the risk score specifically include: When the risk score R ≥ 0.9, it is defined as high-level violation content, and the SMS business of enterprises or institutions should be immediately blocked, accounts frozen, and alarms triggered for real-time monitoring. When the risk score R ≥ 0.7, it is defined as medium-level violation content, and the SMS business of enterprises or institutions should be immediately blocked, alarms should be triggered, and real-time monitoring should be carried out. When the risk score R ≥ 0.5, it is defined as low to medium level violation content. For enterprises or institutions, SMS messages should be delayed, manually reviewed, and manual review reminders should be triggered. When the risk score R ≥ 0.3, it is defined as content requiring supervision. The SMS service of enterprises or institutions should be sent normally, but an alarm needs to be triggered for real-time monitoring. When the risk score R < 0.3, it is defined as normal compliant content, and SMS messages should be sent normally to enterprises or institutions.

10. A multimodal fusion SMS compliance and security dual-verification system, characterized in that, It is applicable to scenarios where enterprises or institutions conduct large-scale SMS business, simultaneously performing automated compliance review and real-time security risk prevention on SMS content and sending behavior. The system includes: An encryption authenticator is used to encrypt account information using an irreversible algorithm based on SHA256 and a random salt value during the sending of text messages by enterprises or organizations, in order to authenticate the sender's request. A multimodal decomposer is used to decompose SMS content into a text stream, a link stream, and a symbol stream using regular expressions after successful authentication. Feature extractors are used to extract text feature data, link feature data, and special symbol feature data from text streams, link streams, and symbol streams. The multimodal detection module includes a sensitive word analyzer, a symbol analyzer, a behavior analyzer, and a link analyzer, among which: The sensitive word analyzer is used to obtain sensitive word matching factors by traversing each character in the SMS content using a Trie tree-based prefix pattern combined with the AC automaton algorithm, based on a real-time updated sensitive word library configured according to the business attributes of the enterprise or organization. The symbol analyzer is used to perform symbol semantic classification mapping on the special symbol feature data extracted from the symbol stream, and analyze whether the mapped semantic type is an undesirable semantic type in the real-time updated semantic type library in order to obtain a semantic analysis factor. The behavior analyzer is used to perform sending behavior analysis on the text feature data extracted from the text stream, analyze whether there is any bad behavior, and obtain behavior analysis factors. The link analyzer is used to perform specific detection on the link feature data extracted from the link stream, analyze whether there are any security risks in the detection results, and obtain the link analysis factor. The risk decision fusion engine is used to calculate the risk score of SMS messages based on a multimodal feature fusion decision risk assessment algorithm, which is based on sensitive word matching factors, semantic analysis factors, behavioral analysis factors, and link analysis factors. The real-time interception executor is used to perform SMS interception or SMS release operations based on the risk decision rules corresponding to the risk score.

Images