AI multi-feature fusion-based phishing mail automatic identification system

Abstract

The invention relates to a phishing mail automatic identification system based on AI multi-feature fusion. According to the system, text, visual and interactive features of mails are extracted through a multi-modal data analysis module, and a cross-modal semantic relationship network is constructed through a cross-modal semantic relationship network construction module; and the cross-modal semantic conflict mining module further mines semantic conflict information, calculates a risk score in combination with a risk assessment model, and finally judges whether the mail is a phishing mail or not through the judgment module. By adopting the system, multi-modal features can be effectively fused, semantic conflicts can be mined, the detection accuracy of phishing mails can be remarkably improved, and the misjudgment and missed judgment risks can be reduced.

Description

Technical Field

[0001] This invention belongs to the field of phishing email identification, and in particular relates to an automatic identification system for phishing emails based on AI multi-feature fusion. Background Technology

[0002] With the rapid development of network communication technology, email has become an indispensable communication tool in people's daily lives. However, the proliferation of phishing emails poses a serious threat to users' information security. Phishing emails typically disguise themselves as legitimate emails, inducing users to disclose sensitive information or perform malicious operations, thereby causing users financial losses and privacy breaches.

[0003] Traditional phishing email detection methods primarily rely on keyword matching within the email content, sender reputation assessment, and security checks of email links. While these methods can identify some phishing emails to a certain extent, their limitations are becoming increasingly apparent as phishing tactics become more sophisticated. Existing technologies mainly focus on single-modal feature analysis, neglecting the rich multimodal information within emails, such as visual layout, image content, and interactive behavior. However, single-modal analysis methods struggle to comprehensively capture the complex features of phishing emails, resulting in low detection accuracy and a high likelihood of false positives and false negatives. Summary of the Invention

[0004] Therefore, it is necessary to provide an AI-based multi-feature fusion-based automatic identification system for phishing emails that can integrate multimodal features and mine cross-modal semantic conflict information to address the aforementioned technical problems.

[0005] Firstly, this application provides an automatic phishing email identification system based on AI multi-feature fusion, including:

[0006] The multimodal data parsing module is used to perform multimodal data parsing on the target email to obtain email text features, email visual features, and email interaction features.

[0007] The cross-modal semantic relationship network construction module is used to construct a cross-modal semantic relationship network based on email text features, email visual features, and email interaction features.

[0008] The cross-modal semantic conflict mining module is used to mine cross-modal semantic conflicts in target emails based on cross-modal semantic relationship networks and generate semantic conflict information.

[0009] The risk assessment module is used to calculate the cross-modal conflict risk score of the target email based on semantic conflict information and a preset risk assessment model.

[0010] The judgment module is used to determine the target email as a phishing email and generate a phishing email judgment result when the cross-modal conflict risk score is greater than a preset risk threshold.

[0011] In one embodiment, the cross-modal semantic relationship network construction module includes:

[0012] The feature projection unit is used to project email text features, email visual features and email interaction features onto a unified semantic space to obtain aligned text vectors, visual vectors and interaction vectors.

[0013] The interactive attention calculation unit is used to perform interactive attention calculation based on the aligned text vectors and visual vectors to obtain a cross-modal attention score matrix.

[0014] The attention map generation unit is used to normalize the cross-modal attention score matrix and generate a text-visual attention map.

[0015] The cross-modal fusion feature generation unit is used to concatenate the text-visual attention map with the interaction vector to generate cross-modal fusion features;

[0016] The graph structure building unit is used to construct a graph structure representing the semantic relationships between different modalities based on cross-modal fusion features, thereby obtaining a cross-modal semantic relationship network.

[0017] In one embodiment, the cross-modal semantic conflict mining module includes:

[0018] The association weight extraction unit is used to extract the association weights between text and visual nodes based on a cross-modal semantic relationship network, and obtain a set of text-visual association weights.

[0019] The visual semantic conflict recognition unit is used to identify weakly related node pairs in the text-visual association weight set that is below a preset conflict judgment threshold, and generate a visual semantic conflict set.

[0020] The association path extraction unit is used to extract the association paths between text nodes and interactive behavior nodes based on a cross-modal semantic relationship network, so as to obtain a set of text-interaction association paths;

[0021] The interaction semantic conflict detection unit is used to detect abnormal patterns in the set of text-interaction related paths and generate an interaction semantic conflict set.

[0022] The conflict set merging module is used to merge visual semantic conflict sets and interactive semantic conflict sets to generate semantic conflict information.

[0023] In one embodiment, the risk assessment module includes:

[0024] The training sample construction unit is used to build a labeled training sample set based on historical email data and corresponding phishing email labels.

[0025] The model prediction unit is used to input the training sample set into the initial risk assessment model and generate model prediction values ​​through forward propagation calculation.

[0026] The loss calculation unit is used to calculate the loss value based on the model's predicted values ​​and the corresponding true labels using the cross-entropy loss function. The formula for calculating the cross-entropy loss function is as follows:

[0027]

[0028] in, The loss value. For the sample size, Let i be the true label of the i-th sample. This is the model prediction value for the i-th sample;

[0029] The gradient value calculation unit is used to perform error backpropagation calculation based on the loss value to generate the gradient values ​​of each weight in the initial risk assessment model;

[0030] The parameter update unit is used to update all weight parameters of the initial neural network model based on the gradient value, and generate the updated risk assessment model.

[0031] The convergence and update unit is used to repeatedly execute the forward propagation calculation, loss value generation, and weight parameter update steps until the decrease in the loss value of the updated risk assessment model in the training rounds is lower than a preset threshold, and a preset risk assessment model is generated.

[0032] In one embodiment, the risk assessment module further includes:

[0033] The conflict feature quantization unit is used to statistically quantify the visual semantic conflict set and the interactive semantic conflict set in the semantic conflict information to obtain the visual conflict intensity value and the interactive conflict intensity value.

[0034] A multi-dimensional conflict feature vector construction unit is used to construct multi-dimensional conflict feature vectors based on visual conflict intensity values ​​and interactive conflict intensity values.

[0035] The risk scoring calculation unit is used to input multi-dimensional conflict feature vectors into a preset risk assessment model and obtain cross-modal conflict risk scores through forward propagation calculation.

[0036] In one embodiment, the multimodal data parsing module includes:

[0037] The text data processing unit is used to perform word segmentation and syntactic structure analysis on the raw text data of the target email to obtain structured text data; and to perform semantic encoding on the structured text data to generate email text features.

[0038] The visual feature extraction unit is used to perform visual analysis on the images and HTML rendering styles embedded in the target email to obtain primary visual elements; and to perform deep feature extraction on the primary visual elements to generate email visual features.

[0039] The interaction feature analysis unit is used to acquire the raw interaction data of the target email. The raw interaction data includes the sender's reputation, sending frequency, and the recipient's historical click behavior. The unit performs behavioral pattern analysis on the raw interaction data to generate email interaction features.

[0040] In one embodiment, the determination module further includes:

[0041] The feature tracing unit is used to trace the source of target emails identified as phishing emails based on the judgment results, and obtain the original threat features of the phishing emails.

[0042] The threat intelligence generation unit is used to extract sender domains, lead-in links, and key wording based on the original threat characteristics, and generate standardized threat intelligence.

[0043] The threat intelligence matching unit is used to match standardized threat intelligence with the global threat intelligence database to obtain threat matching results;

[0044] The intelligence database update and early warning unit is used to generate a known threat early warning notification when the threat matching result is a known threat; and to enter the key threat identifier into the threat intelligence database and generate a new threat early warning notification when the threat matching result is an unknown threat.

[0045] Secondly, this application also provides a method for automatically identifying phishing emails based on AI multi-feature fusion, including:

[0046] Multimodal data analysis is performed on the target email to obtain email text features, email visual features, and email interaction features;

[0047] A cross-modal semantic relationship network is constructed based on email text features, email visual features, and email interaction features.

[0048] Based on a cross-modal semantic relationship network, cross-modal semantic conflict mining is performed on target emails to generate semantic conflict information;

[0049] Based on semantic conflict information, the cross-modal conflict risk score of the target email is calculated using a pre-defined risk assessment model.

[0050] When the cross-modal conflict risk score is greater than the preset risk threshold, the target email is identified as a phishing email, and a phishing email determination result is generated.

[0051] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the AI-based multi-feature fusion-based automatic phishing email identification system as described in the first aspect.

[0052] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the AI-based multi-feature fusion-based automatic phishing email identification system as described in the first aspect.

[0053] The aforementioned AI-based multi-feature fusion-based automatic phishing email identification system employs a multi-modal data parsing module to comprehensively capture information from email text, visual dimensions, and interactive aspects, avoiding the limitations of single-feature analysis. A cross-modal semantic relationship network construction module establishes connections between different modal features, providing a foundation for conflict mining. A cross-modal semantic conflict mining module accurately locates contradictions and vulnerabilities between modalities, capturing the core disguise traces of phishing emails. A risk assessment module quantifies conflict risks through models, making judgments more objective. A judgment module achieves automated identification based on thresholds, improving detection efficiency. Traditional phishing email identification often relies on single features, making it difficult to cope with AI-generated multi-modal spoofing attacks, resulting in incomplete identification, high false positive rates, and poor adaptability to new types of attacks. This system acquires comprehensive features through multimodal data parsing, constructs cross-modal semantic relationship networks and mines conflicts to accurately capture hidden contradictions in phishing emails, and then quantifies and automatically determines risks through a risk assessment model. This effectively overcomes the limitations of single-feature recognition, improves the ability to identify multimodal phishing emails, reduces the risk of false positives, and achieves automated detection, enhancing adaptability to new phishing attack methods and providing more reliable technical support for email security protection. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A schematic diagram of the structure of an automatic phishing email identification system based on AI multi-feature fusion provided by the present invention;

[0056] Figure 2A schematic diagram of the structure of a determination module provided by the present invention;

[0057] Figure 3 This is a flowchart illustrating an automatic identification method for phishing emails based on AI multi-feature fusion, provided by the present invention. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0059] In one embodiment, such as Figure 1 As shown, an automatic phishing email identification system based on AI multi-feature fusion is provided. This embodiment illustrates the application of the system to a terminal. It can be understood that the system can also be applied to a server and implemented through interaction between the terminal and the server. In this embodiment, the system 10 includes the following steps:

[0060] The multimodal data parsing module 11 is used to perform multimodal data parsing on the target email to obtain email text features, email visual features, and email interaction features.

[0061] Optionally, the email parsing interface is called to extract the text content, embedded images, HTML (HyperTextMarkup Language) source code, and interaction log data of the target email. The text content undergoes word segmentation, syntactic analysis, and semantic encoding; the embedded images and HTML source code undergo visual element extraction and deep feature mining; and the interaction log data undergoes behavioral pattern analysis, resulting in email text features, visual features, and interaction features. Text processing utilizes jieba word segmentation and BERT (Bidirectional Encoder Representations from Transformers) encoding; visual processing leverages OpenCV and CNN (Convolutional Neural Network); and interaction data is obtained through log parsing and sequence pattern mining. All three types of features are transformed into fixed-dimensional vector forms. This process comprehensively covers different dimensions of email information, breaking the limitations of single features.

[0062] The cross-modal semantic relationship network construction module 12 is used to construct a cross-modal semantic relationship network based on email text features, email visual features, and email interaction features.

[0063] Optionally, linear projection is used to map text, visual, and interaction feature vectors to the same semantic space. A scaling dot product attention mechanism is used to calculate the association strength between text and visual features, generating an attention score matrix, which is then normalized and concatenated with the interaction feature vector to obtain cross-modal fusion features. Using the fusion features as nodes, and calculating the association weights between nodes based on cosine similarity as edges, a graph structure representing the semantic relationships between modalities is constructed. Nodes in the graph correspond to various features, and edge weights reflect the degree of association. This approach achieves effective association and structured representation of multimodal features, laying the foundation for accurate semantic conflict detection.

[0064] The cross-modal semantic conflict mining module 13 is used to mine cross-modal semantic conflicts in target emails based on cross-modal semantic relationship networks and generate semantic conflict information.

[0065] Optionally, the constructed graph structure is traversed to extract the association weights between text and visual nodes, and weakly associated node pairs below a preset threshold are selected to form a visual semantic conflict set. Breadth-first search is used to extract the association paths between text and interactive nodes, and density clustering algorithms are used to identify abnormal paths deviating from normal patterns, forming an interactive semantic conflict set. The two conflict sets are then joined, and duplicates are removed to obtain semantic conflict information. This process accurately locates the contradictions between different modalities, captures the core disguise traces of phishing emails, and provides crucial evidence for risk assessment.

[0066] The risk assessment module 14 is used to calculate the cross-modal conflict risk score of the target email based on semantic conflict information and through a preset risk assessment model.

[0067] Optionally, the preset risk assessment model is a trained and optimized MLP (Multi-Layer Perceptron). The training process constructs a sample set using historical labeled email data, and iteratively updates the parameters through forward propagation, cross-entropy loss calculation, backpropagation, and stochastic gradient descent until the loss value decreases below a threshold. Semantic conflict information is quantified into a multi-dimensional feature vector, which is input into the trained model. Through linear transformations of the input and hidden layers and processing with the ReLU activation function, the output layer outputs a cross-modal conflict risk score, which directly reflects the degree of email phishing risk. This method achieves quantitative risk assessment, improving the objectivity and accuracy of the judgment.

[0068] The judgment module 15 is used to judge the target email as a phishing email and generate a phishing email judgment result when the cross-modal conflict risk score is greater than the preset risk threshold.

[0069] Optionally, a preset risk threshold is set based on historical phishing email identification data and industry security standards to distinguish between phishing emails and legitimate emails. The calculated cross-modal conflict risk score is compared with this threshold. When the score is not less than the threshold, the phishing email determination logic is triggered, and the determination result is output as a phishing email. The comparison process is executed through conditional statements, and the determination result is output in a structured data format.

[0070] The aforementioned AI-based multi-feature fusion-based automatic phishing email identification system projects three types of features—text, visual, and interactive—into a unified semantic space for alignment. Then, it calculates and generates a score matrix through interactive attention, normalizes it to obtain a text-visual attention map, and concatenates it with the interactive vector to generate cross-modal fusion features. Finally, based on these features, it constructs a graph structure representing the semantic relationships between modalities. This effectively solves the problems of semantic incompatibility and unclear associations among multimodal features, achieving deep feature fusion and structured representation, and laying a solid foundation for accurately identifying cross-modal semantic conflicts.

[0071] In one embodiment, the cross-modal semantic relationship network construction module includes:

[0072] The feature projection unit is used to project email text features, email visual features, and email interaction features onto a unified semantic space to obtain aligned text vectors, visual vectors, and interaction vectors.

[0073] Optionally, a linear transformation matrix is ​​used to project the email text features, visual features, and interaction features separately. Specifically, the original feature vectors of each modality are multiplied by a preset projection matrix, mapping feature vectors of different dimensions and distributions to a unified semantic space. For example, the initial value of the projection matrix is ​​randomly initialized and subsequently participates in training optimization synchronously with the weight parameters of the risk assessment model. During the model training process, the projected vectors sequentially participate in interaction attention calculation, cross-modal fusion feature generation, and semantic conflict mining. Finally, the risk assessment model outputs a predicted value. When the loss value calculated based on the cross-entropy loss function is backpropagated, the projection matrix is ​​updated along with the model weights. The matrix parameters are continuously adjusted during the iteration process to ensure that the aligned text vectors, visual vectors, and interaction vectors are in the same dimensional space and semantically interoperable, thus solving the problems of inconsistent multimodal feature dimensions and semantic heterogeneity.

[0074] The interactive attention calculation unit is used to perform interactive attention calculation based on the aligned text vectors and visual vectors to obtain a cross-modal attention score matrix.

[0075] Optionally, based on the aligned text and visual vectors, a scaled dot product attention mechanism is used to calculate interactive attention. Specifically, the text vector is used as the query vector and the visual vector as the key vector. First, the dot product of the query vector and the key vector is calculated, and then the result is scaled by dividing by the square root of the key vector's dimension to obtain a preliminary attention score. All scores are then integrated to form a cross-modal attention score matrix, where each element represents the correlation strength between a certain dimension of the text vector and a certain dimension of the visual vector. This calculation method can accurately quantify the correlation between text and visual features, highlighting key correlated features and weakening interference from irrelevant information.

[0076] The attention map generation unit is used to normalize the cross-modal attention score matrix and generate a text-visual attention map.

[0077] Optionally, the cross-modal attention score matrix is ​​normalized by performing a softmax function operation. The softmax function converts each element in the matrix into a value between 0 and 1, and makes the sum of the elements in each row of the matrix equal to 1. The normalized data is presented in the form of a two-dimensional matrix, which is the text-visual attention map. The higher the value in the map, the stronger the association between the text and visual features. Specifically, the softmax function operation does not require additional parameter adjustment and is directly applied to the score matrix, ensuring that the generated attention map can intuitively reflect the association priority of cross-modal features.

[0078] The cross-modal fusion feature generation unit is used to concatenate the text-visual attention map with the interaction vector to generate cross-modal fusion features.

[0079] Optionally, a vector concatenation method is used to process the text-visual attention map and the interaction vector. First, the two-dimensional text-visual attention map is transformed into a one-dimensional vector through a flattening operation. Then, this one-dimensional vector and the interaction vector are concatenated end-to-end in sequence. The concatenated vector is the cross-modal fusion feature. The flattening operation is completed by arranging matrix elements in row or column order. The vector concatenation process keeps the feature values ​​of each dimension unchanged, only expanding the dimension of the feature vector.

[0080] The graph structure building unit is used to construct a graph structure representing the semantic relationships between different modalities based on cross-modal fusion features, thereby obtaining a cross-modal semantic relationship network.

[0081] Optionally, based on cross-modal fusion features, the feature vectors corresponding to text, vision, and interaction are respectively used as nodes in the graph structure. The edge weights between nodes are determined by calculating the cosine similarity of the feature vectors of nodes from different modalities. Specifically, the cosine similarity measures the cosine value of the angle between two vectors; the closer the value is to 1, the stronger the connection between the nodes. The edge weight parameters are set accordingly. Furthermore, the node, edge, and weight information are stored in a graph data format, and the resulting graph structure is a cross-modal semantic relationship network. This network can intuitively present the semantic association strength between different modalities.

[0082] In the above embodiments, the three types of features—text, visual, and interactive—are projected onto a unified semantic space for alignment. Then, a score matrix is ​​generated through interactive attention calculation and normalized to obtain a text-visual attention graph. Subsequently, it is concatenated with the interactive vector to generate cross-modal fusion features. Finally, a graph structure representing the semantic relationship between modalities is constructed, which effectively solves the problems of semantic heterogeneity and ambiguous association of multimodal features, and realizes deep feature fusion and structured association.

[0083] In one embodiment, the cross-modal semantic conflict mining module includes:

[0084] The association weight extraction unit is used to extract the association weights between text and visual nodes based on a cross-modal semantic relationship network, and obtain a text-visual association weight set.

[0085] Optionally, all edges in the cross-modal semantic relationship network are traversed, and edges connecting text nodes and visual nodes are selected. The weight parameters corresponding to these edges are extracted and integrated to form a text-visual association weight set. The traversal operation uses a depth-first search algorithm, starting from the text node and sequentially visiting the connected visual nodes, recording the weight value of each edge to ensure that no text-visual node pair association weight is missed.

[0086] The visual semantic conflict recognition unit is used to identify weakly related node pairs in the text-visual association weight set that is below a preset conflict judgment threshold, and generate a visual semantic conflict set.

[0087] Optionally, a conflict determination threshold is preset. This threshold is set based on historical experience in phishing email identification within the industry and is used to distinguish between normal and weak associations. Each weight value in the text-visual association weight set is compared one by one with this threshold, and node pairs corresponding to weights below the threshold are selected. These node pairs are considered weakly associated node pairs. All weakly associated node pairs are further integrated to generate a visual semantic conflict set, because a weak association between text and visual features often indicates that the email contains phishing features that are visually disguised and do not match the text. By using weight filtering to accurately locate visual semantic conflicts, visual conflict data is provided for overall conflict analysis.

[0088] The association path extraction unit is used to extract the association paths between text nodes and interactive behavior nodes based on a cross-modal semantic relationship network, so as to obtain a set of text-interaction association paths.

[0089] Optionally, a breadth-first search algorithm is employed to traverse the cross-modal semantic relationship network, starting from text nodes and ending at interaction behavior nodes, searching for all feasible node connection paths. During the search, information about all nodes and edges traversed along the path is recorded, and the corresponding complete paths are integrated to form a set of text-interaction association paths. Breadth-first search ensures that all short and long paths are obtained, avoiding the omission of potential association paths, and the search process uses a queue to store nodes to be visited, improving the orderliness of path extraction.

[0090] The interaction semantic conflict detection unit is used to detect abnormal patterns in the text-interaction association path set and generate an interaction semantic conflict set.

[0091] Optionally, a density-based clustering algorithm is used to detect abnormal patterns in the text-interaction associated path set. First, the feature distance between each path is calculated. Paths with close feature distances are grouped into the same cluster, while paths that deviate from all clusters and have excessively large feature distances are identified as abnormal paths. Further, the node pairs and associated information corresponding to all abnormal paths are integrated to generate an interaction semantic conflict set. For example, Euclidean distance is used to calculate the feature distance, ensuring that the clustering results reflect the similarity differences between paths. This detection method can accurately identify abnormal situations where text descriptions do not match interactive behaviors, supplementing interaction-level conflict data beyond visual conflicts.

[0092] The conflict set merging module is used to merge visual semantic conflict sets and interactive semantic conflict sets to generate semantic conflict information.

[0093] Optionally, the visual semantic conflict set and the interactive semantic conflict set can be merged using the union operation of sets. Specifically, all elements in the two conflict sets are traversed, duplicate conflict records are removed, and all unique conflict information is retained. The merged set is the semantic conflict information. During the merging process, a hash table is used to record the conflicting elements that have appeared, quickly determining whether new elements are duplicates, thus improving merging efficiency.

[0094] In the above embodiments, based on the cross-modal semantic relationship network, the text-visual node association weights are first extracted and weak associations are identified to generate a visual semantic conflict set. Then, the text-interaction node association paths are extracted and anomalies are detected to generate an interaction semantic conflict set. Finally, the two conflict sets are merged to obtain semantic conflict information, which comprehensively covers the core conflict points of visual and interaction dimensions, effectively avoids the limitations of single-dimensional conflict mining, and improves the targeting of phishing email identification.

[0095] In one embodiment, the risk assessment module includes:

[0096] The training sample construction unit is used to build a labeled training sample set based on historical email data and corresponding phishing email labels.

[0097] Optionally, a large amount of historical email data is collected, and invalid data with corrupted format or missing information is filtered out. Then, professionals label the emails based on whether they are phishing emails. The labeling results are divided into phishing emails and legitimate emails. After labeling, the data is proportionally divided into training and validation sets, which together constitute a labeled training sample set. Preferably, the labeling process employs a dual-review mechanism to reduce labeling errors, and the partitioning process ensures that the data distribution of the training and validation sets is consistent, avoiding data skew that could affect the model training effect.

[0098] The model prediction unit is used to input the training sample set into the initial risk assessment model and generate model prediction values ​​through forward propagation calculation.

[0099] Optionally, the initial risk assessment model uses a multilayer perceptron, which includes an input layer, hidden layers, and an output layer. Feature vectors from the training sample set are input to the model's input layer. The features are progressively processed through linear transformations and activation function operations in the hidden layers, with ReLU being the preferred activation function. Finally, the output layer outputs a value between 0 and 1 as the model's predicted value, representing the probability that the email is a phishing email. Specifically, during forward propagation, the output of each neuron is obtained by multiplying the output of the previous layer by its corresponding weight matrix and then adding a bias term, ensuring that features are transformed into prediction results layer by layer. This process realizes the transformation from features to prediction results, providing a basis for model optimization.

[0100] The loss calculation unit is used to calculate the loss value based on the model's predicted values ​​and the corresponding true labels using the cross-entropy loss function. The formula for calculating the cross-entropy loss function is as follows:

[0101]

[0102] in, The loss value. For the sample size, Let i be the true label of the i-th sample. This is the model prediction value for the i-th sample.

[0103] Optionally, the loss value can be calculated using the cross-entropy loss function, the formula of which is: ,in For the i-th sample, phishing emails are labeled with 1, and legitimate emails are labeled with 0. Let L be the model's predicted value, and N be the number of samples involved in the calculation. Specifically, the true label and predicted value of each sample are substituted into the formula. First, the product and logarithm of each term are calculated, then the sum is taken, the negative is calculated, and the result is divided by the number of samples. The resulting L is the loss value, which reflects the degree of deviation between the predicted value and the true label. This calculation method can accurately quantify the model's prediction error, providing a clear direction for adjusting model parameters.

[0104] The gradient value calculation unit is used to perform error backpropagation calculation based on the loss value to generate the gradient values ​​of each weight in the initial risk assessment model.

[0105] Optionally, based on the obtained loss value, the chain rule is used to perform backpropagation calculation of the error. Starting from the output layer, the partial derivative of the loss value with respect to each weight parameter is calculated sequentially; this partial derivative is the gradient value of the corresponding weight. Specifically, the output layer error is calculated first, and then the error is derived backward step by step towards the hidden layer and the input layer. The error of each layer is obtained by multiplying the error of the previous layer by the derivative of the activation function, and finally, the gradient values ​​corresponding to all weight parameters are obtained. The sign of the gradient value indicates the direction of parameter adjustment, and the magnitude of the absolute value indicates the adjustment magnitude. This process provides core gradient data for model weight updates and is a key step in model optimization.

[0106] The parameter update unit is used to update all weight parameters of the initial neural network model based on the gradient values, thereby generating an updated risk assessment model.

[0107] Optionally, stochastic gradient descent is used to update all weight parameters of the initial neural network model based on gradient values. Specifically, each weight parameter is subtracted from the product of the learning rate and the corresponding gradient value. The learning rate is preset to a small, fixed value to ensure update stability. The update process iterates through the training samples in batches, performing a parameter update after processing each batch of samples, generating an updated risk assessment model. Furthermore, gradient pruning can be used to prevent gradient explosion, ensuring a smooth parameter update process, avoiding abnormal fluctuations in model training, achieving iterative optimization of model parameters, and gradually improving the model's prediction accuracy.

[0108] The convergence and update unit is used to repeatedly execute the forward propagation calculation, loss value generation, and weight parameter update steps until the decrease in the loss value of the updated risk assessment model in the training rounds is lower than a preset threshold, and a preset risk assessment model is generated.

[0109] Optionally, the complete process of model prediction, loss calculation, and weight parameter update is repeated, with each complete cycle counted as a training epoch. After each training epoch, the difference between the current epoch's loss value and the previous epoch's loss value is calculated, i.e., the decrease in loss value. When this decrease consistently falls below a preset threshold, it indicates that the model's prediction accuracy has stabilized, training is stopped, and the latest updated risk assessment model is used as the preset risk assessment model. The preset threshold, for example, is set based on model training experience to ensure that the model avoids overtraining while maintaining accuracy, thus guaranteeing that the final model possesses stable and reliable risk assessment capabilities.

[0110] In the above embodiments, a training sample set is constructed using historical labeled email data, and predicted values ​​are generated through forward propagation of the initial model. The prediction error is quantified using the cross-entropy loss function, and the gradient is solved and the model weights are updated by combining backpropagation of the error. The process is iterated until the loss decreases steadily to obtain the preset risk assessment model, thus completing the model training in a standardized and accurate manner, enabling the model to have a reliable ability to quantify cross-modal conflict risks.

[0111] In one embodiment, the risk assessment module further includes:

[0112] The conflict feature quantization unit is used to statistically quantify the visual semantic conflict set and the interactive semantic conflict set in the semantic conflict information to obtain the visual conflict intensity value and the interactive conflict intensity value.

[0113] Optionally, the number of conflicting node pairs is counted for the visual semantic conflict set, and the visual conflict intensity value is calculated by combining the average association weight of the conflicting node pairs; the number of abnormal paths is counted for the interactive semantic conflict set, and the interactive conflict intensity value is calculated by combining the deviation degree of the abnormal paths. Specifically, the deviation degree is represented by the average feature distance between the abnormal path and the normal cluster. The calculation of the conflict intensity value does not require complex calculations and can be completed through basic statistics and weighted averaging, thereby achieving a quantitative representation of the two types of conflict sets. Discrete conflict information is transformed into computable numerical values, providing quantitative data for constructing feature vectors.

[0114] The multi-dimensional conflict feature vector construction unit is used to construct multi-dimensional conflict feature vectors based on visual conflict intensity values ​​and interactive conflict intensity values.

[0115] Optionally, the visual conflict intensity values ​​and interactive conflict intensity values ​​are arranged in a preset order to form a one-dimensional multi-dimensional conflict feature vector. Specifically, the visual conflict intensity value can be used as the first element of the vector, and the interactive conflict intensity value as the second element. If the conflict dimensions are subsequently expanded, elements can be added sequentially according to the newly added dimensions. The dimension of this vector is consistent with the number of conflict types, and each element precisely corresponds to the intensity of a type of conflict. The construction process involves vector combination operations to ensure that the vector can fully reflect the quantitative situation of various types of conflicts, providing a standardized input feature format for risk scoring calculation.

[0116] The risk scoring calculation unit is used to input multi-dimensional conflict feature vectors into a preset risk assessment model and obtain cross-modal conflict risk scores through forward propagation calculation.

[0117] Optionally, multi-dimensional conflict feature vectors are input into a pre-defined risk assessment model, which has been trained to map conflict features to risk scores. Through the model's forward propagation process, the feature vectors undergo feature transformations in the input and hidden layers, with the output layer outputting the corresponding numerical value as the cross-modal conflict risk score. Specifically, during propagation, the features are processed through weight matrix operations and activation functions to progressively extract risk information from the conflict features. The final output score directly reflects the degree of phishing risk posed by cross-modal conflicts in emails. This process achieves accurate conversion of conflict features to risk scores, providing a quantitative basis for email judgment.

[0118] In the above embodiments, the visual and interactive semantic conflict sets in the semantic conflict information are first statistically quantified to obtain the corresponding conflict intensity value. Then, a multi-dimensional conflict feature vector is constructed based on the intensity value. The vector is input into a preset risk assessment model and calculated through forward propagation to obtain a cross-modal conflict risk score. This realizes the standardization and quantitative transformation of discrete conflict information, making the risk assessment more objective and accurate, and providing a reliable quantitative basis for phishing email judgment.

[0119] In one embodiment, the multimodal data parsing module includes:

[0120] The text data processing unit is used to perform word segmentation and syntactic structure analysis on the raw text data of the target email to obtain structured text data; and to perform semantic encoding on the structured text data to generate email text features.

[0121] Optionally, the jieba word segmentation tool is used to segment the original text data, resulting in a word sequence. The Stanford parser is then used to analyze the grammatical relationships between words, clarifying the subject-verb-object structure and forming structured text data. A BERT pre-trained model (preferably the BERT-base-uncased version) is selected for semantic encoding. Specifically, the publicly available pre-trained weights of the model are loaded first, and then the model is fine-tuned and adapted using a text dataset labeled with phishing / normal emails. That is, the structured text data is converted into the input format according to the model requirements, including text sequences, segmentation labels, and attention masks. After being input into the model, the self-attention mechanism of the multi-layer Transformer encoder captures the semantic associations and long-distance dependencies of word contexts. Finally, the vector corresponding to the [CLS] (Classification Token) label output by the model is extracted as the text feature vector. This vector is a dense vector of fixed dimensions, i.e., the email text features. During the fine-tuning process, the cross-entropy loss function is used to calculate the prediction error, and the model parameters are updated by the stochastic gradient descent method, so that the encoding results are more in line with the semantic representation requirements of phishing email text. The encoding process does not require additional manual feature engineering. It achieves accurate and contextualized representation of text semantics through pre-training and fine-tuning, providing high-quality text data with strong adaptability and high discriminativeness for cross-modal fusion.

[0122] The visual feature extraction unit is used to perform visual analysis on the images and HTML rendering styles embedded in the target email to obtain primary visual elements; and to perform deep feature extraction on the primary visual elements to generate email visual features.

[0123] Optionally, the embedded images can be parsed using the OpenCV library to extract primary visual elements such as color, texture, and shape. The HTML document's DOM (Document Object Model) tree can be parsed to obtain HTML rendering style information such as layout structure, font styles, and element nesting relationships, integrating these into a set of primary visual elements. A CNN is then used to extract deep features from these primary visual elements. Convolutional layers capture local visual features, pooling layers compress feature dimensions, and fully connected layers output fixed-dimensional vectors as the email's visual features. This approach effectively extracts key visual information from emails, meeting the needs of identifying phishing emails disguised as images and HTML.

[0124] The interaction feature analysis unit is used to acquire the raw interaction data of the target email. The raw interaction data includes the sender's reputation, sending frequency, and the recipient's historical click behavior. The unit performs behavioral pattern analysis on the raw interaction data to generate email interaction features.

[0125] Optionally, raw interaction data is obtained through the mail server log interface. Sender reputation is retrieved from the API (Application Programming Interface) of a third-party anti-spam platform, sending frequency is obtained by statistically analyzing the number of times a sender sends messages within a specified time period, and recipient historical click behavior is extracted from email client behavior logs. A sequence pattern mining algorithm is used to analyze the raw interaction data, identifying sender behavior patterns and recipient operating habits. The analysis results are then transformed into fixed-dimensional feature vectors to generate email interaction features. This process comprehensively mines risk information across email interaction dimensions, supplementing the deficiencies of textual and visual features and improving feature completeness.

[0126] In the above embodiments, the original text of the target email is segmented, its grammatical structure is analyzed and its semantics is encoded. The embedded images and HTML rendering styles are visually analyzed and deep features are extracted. The original interaction data such as sender reputation and sending frequency are obtained and behavioral pattern analysis is performed. Three types of features are generated respectively, which comprehensively cover the key information of the email semantic, visual and behavioral dimensions, avoid the one-sidedness of single-modal features, and ensure the reliability of the basic data of the recognition process.

[0127] In an optional embodiment, such as Figure 2 As shown, the determination module 15 also includes:

[0128] The feature tracing unit 151 is used to perform feature tracing on target emails identified as phishing emails based on the judgment result, and obtain the original threat features of the phishing emails.

[0129] Optionally, based on the phishing email's determination, the various features generated during multimodal parsing and conflict mining can be traced back to pinpoint the core conflict features that triggered the determination. The corresponding core conflict features and their original data constitute the original threat features. Specifically, by logging the feature data and processing flow of each stage, the source can be traced back along the flow to identify the conflict features most correlated with the risk score, clarifying the key threat points at the text, visual, and interactive levels, thus accurately locating the core threat root of the phishing email.

[0130] Threat intelligence generation unit 152 is used to extract sender domain names, lead-in links and key wording based on the original threat characteristics, and generate standardized threat intelligence.

[0131] Optionally, based on the original threat characteristics, the sender's domain name is extracted using regular expression matching, the link parsing tool is used to extract misleading links in the email, and the keyword matching algorithm is used to extract key phrases from the text, including misleading statements and false identity representations. The extracted information is further standardized, with unified format and field naming to generate structured threat intelligence. This ensures that the intelligence has a unified storage and retrieval format, transforming scattered threat characteristics into standardized intelligence data and providing standardized materials for intelligence matching.

[0132] Threat intelligence matching unit 153 is used to match standardized threat intelligence with the global threat intelligence database to obtain threat matching results.

[0133] Optionally, a hash algorithm is used to generate unique hash values ​​for standardized threat intelligence. Simultaneously, corresponding hash values ​​are also generated for existing intelligence in the global threat intelligence database. Threat matching results are obtained by comparing the hash values ​​of the target email threat intelligence with those in the global threat intelligence database. Optionally, for complex intelligence, a fuzzy string matching algorithm can be used to assist in verification. When the matching degree is higher than a preset ratio, it is determined to be a known threat. This matching method combines efficiency and accuracy, quickly identifying threat types and providing clear direction for further warning and update operations.

[0134] The intelligence database update and early warning unit 154 is used to generate a known threat early warning notification when the threat matching result is a known threat; and to enter the key threat identifier into the threat intelligence database and generate a new threat early warning notification when the threat matching result is an unknown threat.

[0135] Optionally, when the threat matching result is a known threat, a pre-formatted known threat warning notification is pushed to the administrator terminal via the email server interface, clearly specifying the threat type and related characteristics. When the threat is determined to be unknown, the write interface of the intelligence database is called to enter the hash value of the key threat identifier and the corresponding standardized intelligence into the threat intelligence database, and a new threat warning notification is generated and pushed to the terminal. Specifically, the warning notification includes key information such as the threat source and core characteristics. The data entry process uses transaction processing to ensure data consistency and avoid data anomalies in the intelligence database.

[0136] In the above embodiments, based on the phishing email determination results, the original threat characteristics are traced, the sender's domain name, inducement links and key wording are extracted to generate standardized threat intelligence, and after matching with the global threat intelligence database, warnings are generated for known threats and unknown threats are entered into the intelligence database and warned. This ensures the timeliness and accuracy of threat warnings, while continuously enriching the threat intelligence reserve, thereby improving the adaptability of email security protection to new threats and the continuous protection effect.

[0137] The aforementioned AI-based multi-feature fusion-based automatic phishing email identification system acquires comprehensive email features through multimodal parsing, locates core threat features through cross-modal network construction and conflict mining, generates quantitative scores using a well-trained risk assessment model, and achieves threat warnings and intelligence database updates by combining source tracing and intelligence processing. These operations form a complete phishing email identification and protection system, effectively overcoming the limitations of traditional single-feature identification, accurately capturing phishing emails disguised in multiple modalities, and improving adaptability to new phishing threats through dynamic intelligence database updates. This significantly enhances the comprehensiveness, accuracy, and proactiveness of email security protection, providing reliable technical support for email communication security.

[0138] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0139] Based on the same inventive concept, this application also provides a method for implementing the AI-based multi-feature fusion-based automatic phishing email identification system described above. The solution provided by this method is similar to the implementation scheme described in the above system. Therefore, the specific limitations in one or more embodiments of the AI-based multi-feature fusion-based automatic phishing email identification method provided below can be found in the limitations of the AI-based multi-feature fusion-based automatic phishing email identification system described above, and will not be repeated here.

[0140] In one exemplary embodiment, such as Figure 3 As shown, an automatic identification method for phishing emails based on AI multi-feature fusion is provided, including:

[0141] S101. Perform multimodal data analysis on the target email to obtain email text features, email visual features, and email interaction features.

[0142] S102. Construct a cross-modal semantic relationship network based on email text features, email visual features, and email interaction features.

[0143] S103. Based on the cross-modal semantic relationship network, perform cross-modal semantic conflict mining on the target email and generate semantic conflict information.

[0144] S104. Based on semantic conflict information, calculate the cross-modal conflict risk score of the target email using a preset risk assessment model.

[0145] S105. When the cross-modal conflict risk score is greater than the preset risk threshold, the target email is identified as a phishing email, and a phishing email identification result is generated.

[0146] In one embodiment, a cross-modal semantic relationship network is constructed based on email text features, email visual features, and email interaction features, including:

[0147] S201. Project the email text features, email visual features, and email interaction features onto a unified semantic space to obtain aligned text vectors, visual vectors, and interaction vectors.

[0148] S202. Based on the aligned text vectors and visual vectors, perform interactive attention calculation to obtain the cross-modal attention score matrix.

[0149] S203. Normalize the cross-modal attention score matrix to generate a text-visual attention map.

[0150] S204. Concatenate the text-visual attention map with the interaction vector to generate cross-modal fusion features.

[0151] S205. Based on cross-modal fusion features, construct a graph structure representing the semantic relationships between modalities to obtain a cross-modal semantic relationship network.

[0152] In one embodiment, based on a cross-modal semantic relationship network, cross-modal semantic conflict mining is performed on the target email to generate semantic conflict information, including:

[0153] S301. Based on the cross-modal semantic relationship network, extract the association weights between text and visual nodes to obtain a set of text-visual association weights.

[0154] S302. Weakly associated node pairs are identified in the set of text-visual association weights that are below the preset conflict determination threshold to generate a set of visual semantic conflicts.

[0155] S303. Based on the cross-modal semantic relationship network, extract the association paths between text nodes and interactive behavior nodes to obtain the text-interaction association path set.

[0156] S304. Perform abnormal pattern detection on the text-interaction associated path set to generate an interaction semantic conflict set.

[0157] S305. Merge the visual semantic conflict set and the interactive semantic conflict set to generate semantic conflict information.

[0158] In one embodiment, the preset risk assessment model training method includes:

[0159] S401. Based on historical email data and corresponding phishing email labels, construct a labeled training sample set.

[0160] S402. Input the training sample set into the initial risk assessment model, and generate the model prediction value through forward propagation calculation.

[0161] S403. Based on the model's predicted values ​​and the corresponding true labels, the loss value is calculated using the cross-entropy loss function; the formula for calculating the cross-entropy loss function is:

[0162]

[0163] in, The loss value. For the sample size, Let i be the true label of the i-th sample. This is the model prediction value for the i-th sample.

[0164] S404. Perform backpropagation calculation based on the loss value to generate the gradient values ​​of each weight in the initial risk assessment model.

[0165] S405. Based on the gradient value, update all weight parameters of the initial neural network model to generate the updated risk assessment model.

[0166] S406. Repeat the forward propagation calculation, loss value generation and weight parameter update steps until the decrease in the loss value of the updated risk assessment model in the training round is lower than the preset threshold, and generate the preset risk assessment model.

[0167] In one embodiment, based on semantic conflict information, a cross-modal conflict risk score for the target email is calculated using a preset risk assessment model, including:

[0168] S501. Perform statistical quantification on the visual semantic conflict set and the interactive semantic conflict set in the semantic conflict information to obtain the visual conflict intensity value and the interactive conflict intensity value.

[0169] S502. Construct a multi-dimensional conflict feature vector based on visual conflict intensity value and interactive conflict intensity value.

[0170] S503. Input the multi-dimensional conflict feature vector into the preset risk assessment model, and obtain the cross-modal conflict risk score through forward propagation calculation.

[0171] In one embodiment, multimodal data parsing is performed on the target email to obtain email text features, email visual features, and email interaction features, including:

[0172] S601. Perform word segmentation and syntactic structure analysis on the original text data of the target email to obtain structured text data; and perform semantic encoding on the structured text data to generate email text features.

[0173] S602. Perform visual analysis on the images and HTML rendering styles embedded in the target email to obtain primary visual elements; and perform deep feature extraction on the primary visual elements to generate email visual features.

[0174] S603. Obtain the original interaction data of the target email; the original interaction data includes the sender's reputation, sending frequency and the recipient's historical click behavior; and perform behavioral pattern analysis on the original interaction data to generate email interaction features.

[0175] In one embodiment, when the cross-modal conflict risk score is greater than a preset risk threshold, the target email is identified as a phishing email. After generating the phishing email identification result, the method further includes:

[0176] S701. Based on the judgment result, the target emails judged as phishing emails are traced by feature to obtain the original threat characteristics of the phishing emails.

[0177] S702. Based on the original threat characteristics, extract the sender's domain name, misleading links, and key wording to generate standardized threat intelligence.

[0178] S703. Match standardized threat intelligence with the global threat intelligence database to obtain threat matching results.

[0179] S704. When the threat matching result is a known threat, generate a known threat warning notification; when the threat matching result is an unknown threat, enter the key threat identifier into the threat intelligence database and generate a new threat warning notification.

[0180] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement a module of an AI-based multi-feature fusion-based automatic phishing email identification system as described above.

[0181] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements a module of an AI-based multi-feature fusion-based automatic phishing email identification system as described above.

[0182] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0183] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. An automatic phishing email identification system based on AI multi-feature fusion, characterized in that, The system includes: The multimodal data parsing module is used to perform multimodal data parsing on the target email to obtain email text features, email visual features, and email interaction features. A cross-modal semantic relationship network construction module is used to construct a cross-modal semantic relationship network based on the email text features, email visual features, and email interaction features. The cross-modal semantic conflict mining module is used to perform cross-modal semantic conflict mining on the target email based on the cross-modal semantic relationship network, and generate semantic conflict information; The risk assessment module is used to calculate the cross-modal conflict risk score of the target email based on the semantic conflict information and through a preset risk assessment model. The determination module is used to determine the target email as a phishing email and generate a phishing email determination result when the cross-modal conflict risk score is greater than a preset risk threshold.

2. The system according to claim 1, characterized in that, The cross-modal semantic relation network construction module includes: The feature projection unit is used to project the email text features, email visual features and email interaction features onto a unified semantic space to obtain aligned text vectors, visual vectors and interaction vectors. An interactive attention calculation unit is used to perform interactive attention calculation based on the aligned text vector and visual vector to obtain a cross-modal attention score matrix. The attention map generation unit is used to normalize the cross-modal attention score matrix and generate the text-visual attention map; A cross-modal fusion feature generation unit is used to concatenate the text-visual attention map with the interaction vector to generate cross-modal fusion features; The graph structure construction unit is used to construct a graph structure representing the semantic relationships between modalities based on the cross-modal fusion features, thereby obtaining the cross-modal semantic relationship network.

3. The system according to claim 2, characterized in that, The cross-modal semantic conflict mining module includes: The association weight extraction unit is used to extract the association weights between text and visual nodes based on the cross-modal semantic relationship network, and obtain a text-visual association weight set. A visual semantic conflict identification unit is used to identify weakly related node pairs in the text-visual association weight set that are below the preset conflict determination threshold, and generate a visual semantic conflict set. The association path extraction unit is used to extract the association paths between text nodes and interactive behavior nodes based on the cross-modal semantic relationship network, so as to obtain a text-interaction association path set; An interactive semantic conflict detection unit is used to perform abnormal pattern detection on the text-interaction association path set and generate an interactive semantic conflict set. The conflict set merging module is used to merge the visual semantic conflict set and the interactive semantic conflict set to generate the semantic conflict information.

4. The system according to claim 1, characterized in that, The risk assessment module includes: The training sample construction unit is used to build a labeled training sample set based on historical email data and corresponding phishing email labels. The model prediction unit is used to input the training sample set into the initial risk assessment model and generate model prediction values ​​through forward propagation calculation. The loss calculation unit is used to calculate the loss value based on the model's predicted values ​​and the corresponding true labels using the cross-entropy loss function; the calculation formula for the cross-entropy loss function is: in, The loss value. For the sample size, Let i be the true label of the i-th sample. This is the model prediction value for the i-th sample; The gradient value calculation unit is used to perform error backpropagation calculation based on the loss value to generate the gradient value of each weight in the initial risk assessment model; The parameter update unit is used to update all weight parameters of the initial neural network model based on the gradient value, and generate an updated risk assessment model. The convergence and update unit is used to repeatedly execute the forward propagation calculation, loss value generation and weight parameter update steps until the decrease in the loss value of the updated risk assessment model in the training round is lower than a preset threshold, and then generate the preset risk assessment model.

5. The system according to claim 4, characterized in that, The risk assessment module also includes: The conflict feature quantization unit is used to perform statistical quantization on the visual semantic conflict set and the interactive semantic conflict set in the semantic conflict information to obtain the visual conflict intensity value and the interactive conflict intensity value. A multi-dimensional conflict feature vector construction unit is used to construct a multi-dimensional conflict feature vector based on the visual conflict intensity value and the interactive conflict intensity value. The risk scoring calculation unit is used to input the multi-dimensional conflict feature vector into the preset risk assessment model and obtain the cross-modal conflict risk score through forward propagation calculation.

6. The system according to claim 1, characterized in that, The multimodal data parsing module includes: The text data processing unit is used to perform word segmentation and syntactic structure analysis on the original text data of the target email to obtain structured text data; and to perform semantic encoding on the structured text data to generate the email text features; The visual feature extraction unit is used to perform visual analysis on the images and HTML rendering styles embedded in the target email to obtain primary visual elements; and to perform deep feature extraction on the primary visual elements to generate the visual features of the email. An interaction feature analysis unit is used to acquire the original interaction data of the target email; the original interaction data includes sender reputation, sending frequency, and recipient's historical click behavior; and to perform behavioral pattern analysis on the original interaction data to generate the email interaction features.

7. The system according to claim 1, characterized in that, The determination module also includes: The feature tracing unit is used to perform feature tracing on target emails determined to be phishing emails based on the determination result, and obtain the original threat features of the phishing emails. The threat intelligence generation unit is used to extract sender domain names, inducement links and key wording based on the original threat characteristics, and generate standardized threat intelligence. The threat intelligence matching unit is used to match the standardized threat intelligence with the global threat intelligence database to obtain threat matching results; The intelligence database update and early warning unit is used to generate a known threat early warning notification when the threat matching result is a known threat; and to enter the key threat identifier into the threat intelligence database and generate a new threat early warning notification when the threat matching result is an unknown threat.

8. A method for automatically identifying phishing emails based on AI multi-feature fusion, characterized in that, The method includes: Multimodal data analysis is performed on the target email to obtain email text features, email visual features, and email interaction features; Based on the email text features, email visual features, and email interaction features, a cross-modal semantic relationship network is constructed. Based on the cross-modal semantic relationship network, cross-modal semantic conflict mining is performed on the target email to generate semantic conflict information; Based on the semantic conflict information, the cross-modal conflict risk score of the target email is calculated using a preset risk assessment model; When the cross-modal conflict risk score is greater than a preset risk threshold, the target email is identified as a phishing email, and a phishing email determination result is generated.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the system according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the system according to any one of claims 1 to 7.

Images