Junk short message identification method and system based on multi-source data feature feedback

Abstract

The invention discloses a junk short message identification method and system based on multi-source data feature feedback, and relates to the technical field of junk short message identification, and the method comprises the steps: obtaining a sending number of a target short message, short message content, a risk label of the sending number, historical reported times, a malicious domain name library and user interaction behavior data, and according to the user interaction behavior data, carrying out the identification of the junk short message. And obtaining a trust scoring coefficient, and obtaining a second risk score according to the short message content. According to the method, the identification precision is improved by comprehensively sending the number risk tag, the short message content, the user interaction behavior and the link risk, the deformed sensitive words are identified based on initial consonant, vowel and tone digital codes and the weighted editing distance, the risk judgment threshold is optimized according to misjudgment feedback and correct interception feedback, and the method adapts to communication habits of different users; a time decay factor and a user reply proportion are introduced, a real relationship between a sending number and a target user is evaluated, and the misjudgment rate of short message interception is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of spam message recognition, and specifically to a spam message recognition method and system based on multi-source data feature feedback. Background Art

[0002] As the core barrier to maintaining the health of the digital communication ecosystem, the spam message recognition method permeates multiple dimensions of the operation of the digital society. By relying on intelligent algorithms and big data analysis, this method can accurately identify and intercept various types of fraud information, harassment content, and malicious promotion information, curbing the modus operandi of fraudsters from the source and effectively protecting the property safety of users. At the same time, by filtering out unnecessary information intrusions, it respects and protects the privacy and dignity of users, enabling everyone to obtain peace and a sense of security in the digital space.

[0003] Existing systems rely on static sensitive word libraries and simple rules (such as keyword matching), but spam message senders often evade detection by means such as homophone substitution (e.g., "微 → 威"), letter substitution (e.g., "信 → X"), emoji or special character confusion, resulting in the failure of static rules. At the same time, traditional methods judge the trust level based on the number of historical messages or the sender number label, which is prone to misjudging trusted contacts with high-frequency interactions or missing malicious numbers, and lacks the ability to dynamically respond to user feedback (such as misjudgment or missed detection). In addition, existing technologies are difficult to integrate multi-source data such as sender number risk labels, text content features, user interaction behaviors (such as reply rate, interaction frequency), and link risks (such as domain name registration duration), resulting in limited recognition capabilities. Summary of the Invention

[0004] To solve the above technical problems, a spam message recognition method and system based on multi-source data feature feedback are provided. This technical solution solves the problems proposed in the above background art that spam message senders often evade detection by means such as homophone substitution, letter substitution, emoji or special character confusion, resulting in the failure of static rules, and existing technologies are difficult to integrate multi-source data such as sender number risk labels, text content features, user interaction behaviors, and link risks, resulting in limited recognition capabilities.

[0005] To achieve the above purposes, the technical solution adopted by the present invention is as follows:

[0006] A spam message recognition method based on multi-source data feature feedback, comprising:

[0007] Obtaining the sender number, text content, risk label of the sender number, historical reported times, malicious domain name library, and user interaction behavior data of the target message;

[0008] Obtaining a trust score coefficient according to the user interaction behavior data;

[0009] Based on the risk label of the sending number and the number of reports it has received in the past, a first risk score is obtained using a deep learning network model.

[0010] Based on the content of the text message, obtain a second risk score;

[0011] A risk score is obtained based on the first risk score, the second risk score, and the trust score coefficient. If the risk score is less than the risk judgment threshold, it is judged as spam.

[0012] Send spam SMS blocking notifications to target users and obtain the target users' actions on the blocking notifications;

[0013] Adjust the risk assessment threshold based on the target user's actions regarding the blocked notification;

[0014] Preferably, obtaining the trust score coefficient based on user interaction behavior data specifically includes:

[0015] Based on the target SMS message, obtain the total number of historical messages, the response rate of the target user, and the number of days since the last interaction.

[0016] Obtain the time decay factor based on the number of days since the most recent interaction;

[0017] The trust score coefficient is obtained based on the total number of historical messages, the response rate of the target user, and the time decay factor.

[0018] If the trust score is less than a preset threshold, the target SMS message will be blocked.

[0019] Specifically, the time decay factor is:

[0020] η = max(0.5, 1 - IID / 365);

[0021] In the formula, η is the time decay factor, max is the maximum value function, and IID is the number of days between the most recent interactions;

[0022] The formula for the trust scoring coefficient is as follows:

[0023]

[0024] In the formula, TSC is the trust score coefficient, min is the minimum value function, HM is the total number of historical messages, ratio is the proportion of responses from target users, and η is the time decay factor.

[0025] Preferably, obtaining the second risk score based on the SMS content specifically includes:

[0026] Obtain the interception word database, which consists of interception words and obfuscation words. The interception words are pre-set sensitive words or phrases, and the obfuscation words are letters, homophones and emoticons used by spam text messages to evade interception rules.

[0027] Based on user interaction behavior data, extract potential intercept words from spam SMS messages marked by users. If the number of occurrences of a potential intercept word exceeds a preset threshold, add the potential intercept word to the potential intercept word database.

[0028] Based on the SMS content and data preprocessing, a first SMS string is obtained. The data preprocessing includes deleting spaces and punctuation marks from the SMS and translating recognizable English words into Chinese characters. The first string contains only Chinese characters, letters, emoticons, and emojis extracted from the SMS.

[0029] Obtain keywords, where the keywords are the verbs, nouns, adjectives, and adverbs contained in the first string;

[0030] Obtain a spam SMS database, and based on the spam SMS database and keywords, obtain a risk probability. The risk probability is the maximum duplicate rate between the first string and the matching SMS messages in the spam SMS database. The matching SMS messages refer to SMS messages in the spam SMS database matched based on keywords.

[0031] Based on risk identification, a first threshold and a second threshold are obtained;

[0032] If the risk probability is greater than the first threshold, then the SMS message will be blocked.

[0033] If the risk probability is greater than the second threshold and less than the first threshold, obtain the second SMS string based on the first SMS string using dynamic programming; otherwise, use the first SMS string as the second SMS string.

[0034] A second risk score is obtained based on the second SMS string and the intercepted word database.

[0035] Preferably, if the risk probability is greater than the second threshold and less than the first threshold, a second SMS string is obtained based on the first SMS string using dynamic programming; otherwise, the first SMS string is used as the second SMS string. Specifically, this includes:

[0036] Based on initials, finals, and tones, obtain the numerical codes of intercepted words and keywords;

[0037] Based on the numerical codes of the intercepted words and keywords, a target word string array is obtained, wherein the target word string array is a string array composed of obfuscated words;

[0038] Obtain an obfuscation table, which contains obfuscated terms and obfuscation costs;

[0039] Based on the first SMS string, the target word string array, and the obfuscation table, the replacement cost is obtained. The replacement cost is the cost required to replace the characters in the first SMS string with the characters in the target word string array obtained from the obfuscation table.

[0040] Based on the first SMS string and the target word string array, obtain the deletion cost and the insertion cost. The deletion cost is the cost required to delete a character from the first SMS string, and the insertion cost is the cost required to insert a character from the target word string array into the corresponding position in the first SMS string.

[0041] The weighted edit distance is obtained based on the replacement cost, deletion cost, and insertion cost.

[0042] Preferably, obtaining the second risk score based on the second SMS string and the intercepted word database specifically includes:

[0043] Obtain the words in the second SMS string, wherein the words are the verbs, nouns, adjectives and adverbs contained in the second SMS string;

[0044] Based on the initial consonant, final vowel, and tone, obtain the numerical codes of the words in the second SMS string and the numerical codes of the intercepted words;

[0045] Based on the numerical encoding of the words in the second SMS string and the numerical encoding of the intercepted words, a judgment set is obtained using the intercepted word dictionary;

[0046] Based on the judgment set and the risk of the blocked words, a blocked word risk table is obtained, which includes the blocked words in the judgment set and the risk coefficients corresponding to the blocked words.

[0047] Obtain the second SMS English string and the intercepted word English string in the judgment set, wherein the second SMS English string is the pinyin of the second SMS string and the intercepted word English string is the pinyin of the intercepted word;

[0048] Based on the number of blocked words in the second SMS English string and the blocked word risk table, obtain the average and maximum risk coefficients of the blocked words in the second SMS English string;

[0049] The matching risk of the second SMS English string is obtained based on the number of blocked words, the average risk coefficient, and the maximum risk coefficient contained in the second SMS English string;

[0050] If the second SMS string contains a link, obtain the link data information, which includes the link domain name, domain name registration duration, and path keywords.

[0051] Based on the risk and link data information matched with the second SMS English string, a second risk score is obtained;

[0052] Specifically, the risk of matching the second type of English string in the text message is as follows:

[0053] Re=min(1,0.7*max_risk_i+0.3*aver_risk);

[0054] In the formula, Re represents the matching risk of the second SMS English string, min is the minimum value function, max_risk_i is the maximum risk coefficient of the blocked words contained in the second SMS English string, and aver_risk is the average risk coefficient of the blocked words contained in the second SMS English string;

[0055] The second risk score is specifically as follows:

[0056] Rl=min(1,domain+freshess+path);

[0057]

[0058] In the formula, Rl is the link risk coefficient, min is the minimum value function, domain is the domain risk coefficient, freshess is the domain registration duration risk coefficient, and path is the path keyword risk coefficient.

[0059] Preferably, adjusting the risk assessment threshold based on the target user's actions on the blocked notification specifically includes:

[0060] Based on the target user's actions on the blocked notification, obtain the feedback category and feedback frequency, where the feedback category includes misjudgment feedback and correct blocking feedback;

[0061] Based on user interaction data, obtain the number of incorrect feedbacks, the total number of interactions, the number of correctly blocked feedbacks, and the total number of blocked responses;

[0062] Based on the feedback category, an adjustment coefficient is obtained using the number of incorrectly judged feedbacks, the total number of interactions, the number of correctly blocked feedbacks, and the total number of blocked feedbacks.

[0063] Based on the risk assessment threshold and adjustment coefficient, obtain the updated risk assessment threshold;

[0064] The trust score is obtained based on the total number of historical messages and the response rate of the target users;

[0065] Adjust the risk assessment threshold based on the trust level;

[0066] Specifically, the updated risk assessment threshold is as follows:

[0067]

[0068] Rdt2=Rdt1+δ;

[0069] In the formula, δ is the adjustment coefficient, IOM is the false judgment intensity, which is the ratio of the number of false judgment feedbacks to the total number of interactions, IOC is the correct interception intensity, which is the ratio of the number of correct interception feedbacks to the total number of interceptions, Rdt2 is the updated risk judgment threshold, and Rdt1 is the original risk judgment threshold.

[0070] Specifically, the adjusted risk assessment threshold is as follows:

[0071]

[0072] In the formula, Rdt is the adjusted risk assessment threshold, and Tc is the trust coefficient, which is the product of the total number of historical messages and the proportion of responses from target users.

[0073] Furthermore, a spam SMS identification system based on multi-source data feature feedback is proposed to implement the spam SMS identification method based on multi-source data feature feedback as described above, including:

[0074] The main control module is used to acquire the sending number, text message content, risk label of the sending number, number of historical reports, malicious domain database, and user interaction behavior data of the target text message. Based on the user interaction behavior data, it acquires a trust score coefficient. Based on the risk label of the sending number and the number of historical reports, it acquires a first risk score based on a deep learning network model. Based on the text message content, it acquires a second risk score. Based on the first risk score, the second risk score, and the trust score coefficient, it acquires a risk score. If the risk score is less than the risk judgment threshold, it is judged as a spam text message, and a spam text message blocking notification is pushed to the target user. The module acquires the target user's operation on the blocking notification and adjusts the risk judgment threshold based on the target user's operation on the blocking notification.

[0075] The scoring module is used to obtain a first risk score based on the risk label and historical number of reports of the sending number, using a deep learning network model; obtain an interception word library, which consists of interception words and obfuscated words; obtain a first SMS string based on the SMS content and data preprocessing; obtain keywords based on the interception word library and the first string; obtain a spam SMS library; obtain a risk probability based on the spam SMS library and keywords; obtain a first threshold and a second threshold based on risk identification; if the risk probability is greater than the first threshold, the SMS is blocked; if the risk probability is greater than the second threshold and less than the first threshold, a second SMS string is obtained based on the first SMS string using dynamic programming; otherwise, the first SMS string is used as the second SMS string; and obtain a second risk score based on the second SMS string and the interception word library.

[0076] The trust scoring module is used to obtain the total number of historical messages, the target user's reply ratio, and the number of days since the last interaction based on the target SMS message. Based on the number of days since the last interaction, it obtains a time decay factor. Based on the total number of historical messages, the target user's reply ratio, and the time decay factor, it obtains a trust scoring coefficient. If the trust scoring coefficient is less than a preset threshold, the target SMS message is blocked.

[0077] Optionally, the main control module specifically includes:

[0078] The control unit is used to obtain a trust score coefficient based on user interaction behavior data, obtain a first risk score based on the risk label of the sending number and the number of times it has been reported in the past, and obtain a second risk score based on the content of the text message. It also obtains a risk score based on the first risk score, the second risk score and the trust score coefficient. If the risk score is less than the risk judgment threshold, it is judged as a spam text message and a spam text message blocking notification is pushed to the target user. The control unit obtains the target user's operation on the blocking notification and adjusts the risk judgment threshold based on the target user's operation on the blocking notification.

[0079] The information acquisition unit is used to acquire the sending number of the target SMS, the SMS content, the risk label of the sending number, the number of times it has been reported in the past, the malicious domain name database, and user interaction behavior data.

[0080] Optionally, the scoring module specifically includes:

[0081] The first scoring unit is used to obtain a first risk score based on the risk label of the sending number and the number of times it has been reported in the past, using a deep learning network model.

[0082] The second scoring unit is used to obtain an interception word library, which consists of interception words and obfuscated words. Based on the SMS content and data preprocessing, a first SMS string is obtained. Based on the interception word library and the first string, keywords are obtained, and a spam SMS library is obtained. Based on the spam SMS library and keywords, a risk probability is obtained. Based on risk identification, a first threshold and a second threshold are obtained. If the risk probability is greater than the first threshold, the SMS is blocked. If the risk probability is greater than the second threshold but less than the first threshold, a second SMS string is obtained based on the first SMS string using dynamic programming. Otherwise, the first SMS string is used as the second SMS string. A second risk score is obtained based on the second SMS string and the interception word library.

[0083] Optionally, the trust scoring module specifically includes:

[0084] A time decay acquisition unit is used to acquire the total number of historical messages, the target user's reply ratio, and the number of days since the last interaction based on the target SMS message, and to acquire a time decay factor based on the number of days since the last interaction.

[0085] The determination unit is used to obtain a trust score coefficient based on the total number of historical messages, the target user's reply ratio, and the time decay factor. If the trust score coefficient is less than a preset threshold, the target SMS message is blocked.

[0086] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0087] This invention proposes a method and system for identifying spam SMS messages based on multi-source data feature feedback. It improves identification accuracy by comprehensively considering the sender's number risk label, SMS content, and user interaction behavior. Based on a weighted edit distance algorithm, it identifies modified sensitive words and replaces letters, homophones, and emoticons used in SMS messages to evade blocking rules with their original Chinese characters. This method effectively addresses the problem of senders using obfuscated words to bypass filtering mechanisms, improving the interception efficiency and false positive rate of spam SMS messages. Simultaneously, it obtains the digital codes of SMS content and blocked words based on initials, finals, and tones, and uses these codes to obtain a judgment set, thus saving computational resources. Furthermore, it analyzes the domain names, domain registration duration, and path keywords containing links in SMS messages to obtain link risk coefficients. By integrating sender's number risk label, SMS content, user interaction behavior, and link risk coefficients, the system's ability to identify spam SMS messages is improved. Attached Figure Description

[0088] Figure 1 This is a flowchart of a spam SMS identification method based on multi-source data feature feedback proposed in this invention;

[0089] Figure 2 This is a flowchart of the trust rating coefficient acquisition process in this invention;

[0090] Figure 3 This is a flowchart of the second risk score acquisition process in this invention;

[0091] Figure 4 This is a block diagram of a spam SMS identification system based on multi-source data feature feedback proposed in this invention. Detailed Implementation

[0092] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0093] Reference Figure 1 - Figure 3As shown, an embodiment of the present invention provides a method for identifying spam text messages based on multi-source data feature feedback, comprising:

[0094] Obtain the sender's number, message content, risk label of the sender's number, number of historical reports, malicious domain database, and user interaction behavior data of the target SMS message;

[0095] Trust rating coefficients are obtained based on user interaction behavior data;

[0096] Based on the risk label of the sending number and the number of reports it has received in the past, a first risk score is obtained using a deep learning network model.

[0097] Based on the content of the text message, obtain a second risk score;

[0098] A risk score is obtained based on the first risk score, the second risk score, and the trust score coefficient. If the risk score is less than the risk judgment threshold, it is judged as spam.

[0099] Send spam SMS blocking notifications to target users and obtain the target users' actions on the blocking notifications;

[0100] Adjust the risk assessment threshold based on the target user's actions regarding the blocked notification;

[0101] Specifically, a trust score is obtained based on user interaction behavior data, including:

[0102] Based on the target SMS message, obtain the total number of historical messages, the response rate of the target user, and the number of days since the last interaction.

[0103] Obtain the time decay factor based on the number of days since the most recent interaction;

[0104] The trust score coefficient is obtained based on the total number of historical messages, the response rate of the target user, and the time decay factor.

[0105] If the trust score is less than a preset threshold, the target SMS message will be blocked.

[0106] Specifically, the time decay factor is:

[0107] η = max(0.5, 1 - IID / 365);

[0108] In the formula, η is the time decay factor, max is the maximum value function, and IID is the number of days between the most recent interactions;

[0109] The formula for the trust scoring coefficient is as follows:

[0110]

[0111] In the formula, TSC is the trust score coefficient, min is the minimum value function, HM is the total number of historical messages, ratio is the target user reply ratio, and η is the time decay factor.

[0112] In this embodiment, the preset threshold is 0.1. If the trust score coefficient is less than 0.1, the total number of historical messages is greater than 2, and the target user's reply ratio is 0, then the target SMS message will be blocked.

[0113] This solution calculates a trust scoring coefficient by using the total number of historical messages, the target user's response rate, and the number of days since the last interaction. This improves the accuracy of the trust relationship between the sending number and the target user. Traditional solutions only use the total number of historical messages to judge the trust level between the sending number and the target user. In practice, this method can lead to misjudgments of trust level. For example, if a sending number sends 10 spam messages to a target user, it may be mistakenly judged as having a high trust level between the sending number and the target user. However, this solution considers the target user's response rate in addition to the total number of historical messages. Even if the sending number sends 100 or more spam messages to the target user, and the target user's response rate is 0, the calculated trust level between the sending number and the target user is still low, thus reducing the risk of misjudgment. It can also distinguish between trusted contacts with high-frequency interactions and potential spam sending numbers. In addition, calculating a time decay factor using the number of days since the last interaction prevents the system from over-relying on outdated historical data and improves the system's sensitivity to changes in the target user's communication behavior.

[0114] Specifically, a second risk score is obtained based on the content of the text message, including:

[0115] Obtain the interception word database, which consists of interception words and obfuscation words. The interception words are pre-set sensitive words or phrases, and the obfuscation words are letters, homophones and emoticons used by spam text messages to evade interception rules.

[0116] Based on user interaction behavior data, extract potential intercept words from spam SMS messages marked by users. If the number of occurrences of a potential intercept word exceeds a preset threshold, add the potential intercept word to the intercept word database.

[0117] Based on the SMS content and data preprocessing, a first SMS string is obtained. The data preprocessing includes deleting spaces and punctuation marks from the SMS and translating recognizable English words into Chinese characters. The first string contains only Chinese characters, letters, emoticons, and emojis extracted from the SMS.

[0118] Obtain keywords, where the keywords are the verbs, nouns, adjectives, and adverbs contained in the first string;

[0119] Obtain a spam SMS database, and based on the spam SMS database and keywords, obtain a risk probability. The risk probability is the maximum duplicate rate between the first string and the matching SMS messages in the spam SMS database. The matching SMS messages refer to SMS messages in the spam SMS database matched based on keywords.

[0120] Based on risk identification, a first threshold and a second threshold are obtained;

[0121] If the risk probability is greater than the first threshold, then the SMS message will be blocked.

[0122] If the risk probability is greater than the second threshold and less than the first threshold, obtain the second SMS string based on the first SMS string using dynamic programming; otherwise, use the first SMS string as the second SMS string.

[0123] A second risk score is obtained based on the second SMS string and the intercepted word database.

[0124] In this embodiment, the preset threshold is 5, the first threshold is 0.75, and the second threshold is 0.3;

[0125] Specifically, if the risk probability is greater than the second threshold and less than the first threshold, the second SMS string is obtained based on the first SMS string using dynamic programming; otherwise, the first SMS string is used as the second SMS string. This includes:

[0126] Based on initials, finals, and tones, obtain the numerical codes of intercepted words and keywords;

[0127] Based on the numerical codes of the intercepted words and keywords, a target word string array is obtained, wherein the target word string array is a string array composed of obfuscated words;

[0128] Obtain an obfuscation table, which contains obfuscated terms and obfuscation costs;

[0129] Based on the first SMS string, the target word string array, and the obfuscation table, the replacement cost is obtained. The replacement cost is the cost required to replace the characters in the first SMS string with the characters in the target word string array obtained from the obfuscation table.

[0130] Based on the first SMS string and the target word string array, obtain the deletion cost and the insertion cost. The deletion cost is the cost required to delete a character from the first SMS string, and the insertion cost is the cost required to insert a character from the target word string array into the corresponding position in the first SMS string.

[0131] The weighted edit distance is obtained based on the replacement cost, deletion cost, and insertion cost.

[0132] The first SMS string is adjusted based on the weighted edit distance to obtain the second SMS string.

[0133] In this embodiment, the first short message string is adjusted as follows:

[0134] The substitution cost is specifically:

[0135]

[0136] In the formula, cost_sub(s1[i], s2[j]) is the substitution cost, s1[i] is the i-th character of the first short message string, s2[j] is the j-th character of the target word string array, and w(s1[i], s2[j]) is the cost of the i-th character of the first short message string and the j-th character of the target word string array in the confusion table;

[0137] The deletion cost is specifically:

[0138]

[0139] In the formula, cost_del is the deletion cost, and char is a character in the first short message string or the target word string array;

[0140] The insertion cost is specifically:

[0141]

[0142] In the formula, cost_ins is the deletion cost, and char is a character in the first short message string or the target word string array;

[0143] The weighted edit distance is specifically:

[0144]

[0145] In the formula, dp[i][j] is the minimum edit cost of the first i characters of the first short message string and the first j characters of the target word string array, min is the minimum value function, cost_del is the deletion cost, cost_ins is the insertion cost, and cost_sub is the substitution cost;

[0146] Assume that the first short message string s1 = "v letter", and the target word string array s2 = "WeChat", and the confusion table is as follows:

[0147] a b Confusion Cost v micro 0 Written earn 0.5 drill earn 0.2 ￥ money 0 ;

[0148] Initial weighted edit distance table:

[0149]

[0150] The cost of deleting 'v': dp[1][1] = dp[0][1] + cost_del['v'] = 1 + 1 = 2;

[0151] The cost of inserting '微' after 'v': dp[1][1] = dp[1][0] + cost_ins['微'] = 1 + 1 = 2;

[0152] The cost of replacing 'v' with '微': dp[1][1] = dp[0][0] + cost_ins['v', '微'] = 0 + 0 = 0;

[0153] The weighted edit distance dp[1][1] takes the minimum value of 0 among the deletion, insertion, and replacement operations, and updates the weighted edit distance table:

[0154]

[0155] Repeat the operation to obtain the final weighted edit distance table:

[0156]

[0157] The minimum value in the table dp[1][1] = 0, dp[2,2] = 0. Although both are the minimum values, in this embodiment, the latter is taken, and the first short message string "v信" is replaced with "微信", and the replaced string is the second string;

[0158] In the actual process, s1 may be "内部渠d@o:低息代款,秒批30万,还有红 !联系13xxxx". According to the weighted edit distance, after replacing "渠d@o" in s1 with "渠道", the system will perform an operation, and will repeat the operation from the next word, that is, "低息", to replace the letters, homophones, and emojis used in the first short message string to avoid the interception rule until the second short message string is obtained: "内部渠道:低息贷款,秒批30万,还有红包!联系13xxxx";

[0159] Specifically, according to the second short message string and the interception word library, obtain the second risk score, specifically including:

[0160] Obtain the words of the second short message string, and the words are the verbs, nouns, adjectives, and adverbs included in the second short message string;

[0161] According to the initials, finals, and tones, obtain the digital codes of the words in the second short message string and the digital codes of the interception words;

[0162] According to the digital codes of the words in the second short message string and the digital codes of the interception words, based on the interception word library, obtain the determination set;

[0163] Based on the judgment set and the risk of the blocked words, a blocked word risk table is obtained, which includes the blocked words in the judgment set and the risk coefficients corresponding to the blocked words.

[0164] Obtain the second SMS English string and the intercepted word English string in the judgment set, wherein the second SMS English string is the pinyin of the second SMS string and the intercepted word English string is the pinyin of the intercepted word;

[0165] Based on the number of blocked words in the second SMS English string and the blocked word risk table, obtain the average and maximum risk coefficients of the blocked words in the second SMS English string;

[0166] The matching risk of the second SMS English string is obtained based on the number of blocked words, the average risk coefficient, and the maximum risk coefficient contained in the second SMS English string;

[0167] If the second SMS string contains a link, obtain the link data information, which includes the link domain name, domain name registration duration, and path keywords.

[0168] Based on the risk and link data information matched with the second SMS English string, a second risk score is obtained;

[0169] Specifically, the risk of matching the second type of English string in the text message is as follows:

[0170] Re=min(1,0.7*max_risk_i+0.3*aver_risk);

[0171] In the formula, Re represents the matching risk of the second SMS English string, min is the minimum value function, max_risk_i is the maximum risk coefficient of the blocked words contained in the second SMS English string, and aver_risk is the average risk coefficient of the blocked words contained in the second SMS English string;

[0172] The second risk score is specifically as follows:

[0173] Rl=min(1,domain+freshess+path);

[0174]

[0175] In the formula, Rl is the link risk coefficient, min is the minimum value function, domain is the domain risk coefficient, freshess is the domain registration duration risk coefficient, and path is the path keyword risk coefficient.

[0176] In this embodiment, based on the numerical encoding of the words in the second SMS string and the numerical encoding of the intercepted words, and using the intercepted word dictionary, a determination set is obtained, specifically including: Suppose a word in the second SMS string is taken as "winning a prize" for example, and its pinyin is converted into feature units. The feature units are [zh, j, ong, iang, 4, 3], where the first two are the initials of "winning a prize", the third and fourth are the finals of "winning a prize", and the last two are the tones of "winning a prize". If the word is a four-character idiom or more, it can be deduced by analogy. Zh and j are the 15th and 12th respectively in the initial table, ong and iang are the 34th and 29th in the final table. The code of "zhong" is: 15 * 100000 + 34 * 1000 + 4 * 10 = 184040, and the code of "jiang" is: 12 * 100000 + 29 * 1000 + 3 * 10 = 149030. Therefore, the code of "winning a prize" is: 184040 + 149030 = 333070; Similarly, obtain the digital codes of all words in the intercepted word library. If the absolute value difference between the digital code of the word in the second SMS string and the digital code of the intercepted word is less than 100000, add the intercepted word to the judgment set; Specifically, the shielding word risk table is as follows: ; The shielding word risk is the result output based on the deep network model according to the type of spam SMS (such as false inducement), the occurrence frequency and the harm degree where the shielding word appears; Specifically, the specific method for obtaining the risk score is as follows:

[0177] In the formula, Rc is the risk score, Rs is the second risk score, Rf is the first risk score, and TSC is the trust score coefficient;

[0178] Specifically, the link risk coefficient is specifically as follows:

[0179] If the domain name is in the malicious domain name library, then domain is 1, otherwise it is 0; if the domain name registration time is less than 7 days, then freshess is 0.7, freshess is 0.3 for 7 to 30 days, otherwise it is 0; if the path contains high-risk keywords, each keyword path gets 0.2, and the maximum value of path is 0.4;

[0180] In this solution, the deformed spam SMS content is identified through the weighted edit distance. In the traditional solution, the pinyin string of the SMS content is compared with the judgment set (the pinyin string of the shielding words). If the continuously appearing pinyin in the pinyin string of the SMS content is the same as the pinyin string in the judgment set, the SMS is blocked. This method has many defects in the actual application process. For example, in the spam SMS, there are letters, emoticons and emoji used to avoid the interception rules. Just delete the letters, emoticons and emoji, and then compare the pinyin string of the SMS content with the judgment set. There will be due to key information (such as "red ”will be processed as “red”) is deleted, resulting in the inability to identify spam messages. At the same time, comparing the pinyin string of the message content with all the words in the judgment set consumes a large amount of computing resources. In this solution, according to the weighted edit distance, the letters, homophones, and emojis used in the message to avoid the interception rule are replaced with their original Chinese characters. For example, “earn￥” is converted to “make money” and “v letter” is converted to “WeChat”, etc. This method can effectively address the problem that the sender's number uses confusing words to bypass the filtering mechanism, improving the interception efficiency and misjudgment rate of spam messages. In addition, according to the initials, finals, and tones, the digital codes of the message content and the blocked words are obtained, and the judgment set is obtained based on the digital codes of the two, thus saving computing resources.

[0181] Specifically, according to the operations of the target user on the interception notification, the risk judgment threshold is adjusted, specifically including:

[0182] According to the operations of the target user on the interception notification, the feedback category and feedback frequency are obtained, and the feedback category includes misjudgment feedback and correct interception feedback;

[0183] According to the user interaction behavior data, the number of misjudgment feedbacks, the total number of interactions, the number of correct interception feedbacks, and the total number of interceptions are obtained;

[0184] According to the feedback category, based on the number of misjudgment feedbacks, the total number of interactions, the number of correct interception feedbacks, and the total number of interceptions, an adjustment coefficient is obtained;

[0185] According to the risk judgment threshold and the adjustment coefficient, an updated risk judgment threshold is obtained;

[0186] According to the total number of historical messages and the target user's reply ratio, a trust coefficient is obtained;

[0187] According to the trust coefficient, the risk judgment threshold is adjusted;

[0188] Among them, the updated risk judgment threshold is specifically:

[0189]

[0190] Rdt2 = Rdt1 + δ;

[0191] In the formula, δ is the adjustment coefficient, IOM is the misjudgment intensity, the misjudgment intensity is the ratio of the number of misjudgment feedbacks to the total number of interactions, IOC is the correct interception intensity, the correct interception intensity is the ratio of the number of correct interception feedbacks to the total number of interceptions, Rdt2 is the updated risk judgment threshold, and Rdt1 is the risk judgment threshold before update;

[0192] Among them, the adjustment of the risk judgment threshold is specifically:

[0193]

[0194] In the formula, Rdt is the adjusted risk assessment threshold, and Tc is the trust coefficient, which is the product of the total number of historical messages and the proportion of responses from target users;

[0195] In this solution, an adjustment coefficient (combining the intensity of misjudgment and the intensity of correct interception) is calculated based on user behavior data, and a trust coefficient is introduced. The risk threshold is optimized through mathematical formulas. This design enables the system to respond to the target user's feedback on misjudgment or missed detection, which reduces the interference of high-frequency misjudgment on user experience (such as mistakenly intercepting normal SMS messages) and strengthens the ability to intercept malicious SMS messages. It effectively balances the interception accuracy rate and the misjudgment rate and adapts to the dynamic evolution of spam SMS formats.

[0196] Reference Figure 4 As shown, further, combining the above-mentioned spam SMS identification method based on multi-source data feature feedback, a spam SMS identification system based on multi-source data feature feedback is proposed, including:

[0197] The main control module is used to acquire the sending number, text message content, risk label of the sending number, number of historical reports, malicious domain database, and user interaction behavior data of the target text message. Based on the user interaction behavior data, it acquires a trust score coefficient. Based on the risk label of the sending number and the number of historical reports, it acquires a first risk score based on a deep learning network model. Based on the text message content, it acquires a second risk score. Based on the first risk score, the second risk score, and the trust score coefficient, it acquires a risk score. If the risk score is less than the risk judgment threshold, it is judged as a spam text message, and a spam text message blocking notification is pushed to the target user. The module acquires the target user's operation on the blocking notification and adjusts the risk judgment threshold based on the target user's operation on the blocking notification.

[0198] The scoring module is used to obtain a first risk score based on the risk label and historical number of reports of the sending number, using a deep learning network model; obtain an interception word library, which consists of interception words and obfuscated words; obtain a first SMS string based on the SMS content and data preprocessing; obtain keywords based on the interception word library and the first string; obtain a spam SMS library; obtain a risk probability based on the spam SMS library and keywords; obtain a first threshold and a second threshold based on risk identification; if the risk probability is greater than the first threshold, the SMS is blocked; if the risk probability is greater than the second threshold and less than the first threshold, a second SMS string is obtained based on the first SMS string using dynamic programming; otherwise, the first SMS string is used as the second SMS string; and obtain a second risk score based on the second SMS string and the interception word library.

[0199] The trust scoring module is used to obtain the total number of historical messages, the target user's reply ratio, and the number of days since the last interaction based on the target SMS message. Based on the number of days since the last interaction, it obtains a time decay factor. Based on the total number of historical messages, the target user's reply ratio, and the time decay factor, it obtains a trust scoring coefficient. If the trust scoring coefficient is less than a preset threshold, the target SMS message is blocked.

[0200] Optionally, the main control module specifically includes:

[0201] The control unit is used to obtain a trust score coefficient based on user interaction behavior data, obtain a first risk score based on the risk label of the sending number and the number of times it has been reported in the past, and obtain a second risk score based on the content of the text message. It also obtains a risk score based on the first risk score, the second risk score and the trust score coefficient. If the risk score is less than the risk judgment threshold, it is judged as a spam text message and a spam text message blocking notification is pushed to the target user. The control unit obtains the target user's operation on the blocking notification and adjusts the risk judgment threshold based on the target user's operation on the blocking notification.

[0202] The information acquisition unit is used to acquire the sending number of the target SMS, the SMS content, the risk label of the sending number, the number of times it has been reported in the past, the malicious domain name database, and user interaction behavior data.

[0203] Optionally, the scoring module specifically includes:

[0204] The first scoring unit is used to obtain a first risk score based on the risk label of the sending number and the number of times it has been reported in the past, using a deep learning network model.

[0205] The second scoring unit is used to obtain an interception word library, which consists of interception words and obfuscated words. Based on the SMS content and data preprocessing, a first SMS string is obtained. Based on the interception word library and the first string, keywords are obtained, and a spam SMS library is obtained. Based on the spam SMS library and keywords, a risk probability is obtained. Based on risk identification, a first threshold and a second threshold are obtained. If the risk probability is greater than the first threshold, the SMS is blocked. If the risk probability is greater than the second threshold but less than the first threshold, a second SMS string is obtained based on the first SMS string using dynamic programming. Otherwise, the first SMS string is used as the second SMS string. A second risk score is obtained based on the second SMS string and the interception word library.

[0206] Optionally, the trust scoring module specifically includes:

[0207] A time decay acquisition unit is used to acquire the total number of historical messages, the target user's reply ratio, and the number of days since the last interaction based on the target SMS message, and to acquire a time decay factor based on the number of days since the last interaction.

[0208] The determination unit is used to obtain a trust score coefficient based on the total number of historical messages, the target user's reply ratio, and the time decay factor. If the trust score coefficient is less than a preset threshold, the target SMS message is blocked.

[0209] In summary, the advantages of this invention are as follows: It improves recognition accuracy by comprehensively considering the risk tags of the sending number, SMS content, and user interaction behavior. Based on a weighted edit distance algorithm, it identifies deformed sensitive words and replaces letters, homophones, and emoticons used in SMS messages to evade blocking rules with their original Chinese characters. This method effectively addresses the problem of sending numbers using obfuscated words to bypass filtering mechanisms, improving the interception efficiency and false positive rate of spam SMS messages. Furthermore, it obtains the digital codes of SMS content and blocked words based on initials, finals, and tones, and uses these codes to obtain a judgment set, thus saving computational resources. In addition, it analyzes the domain names, domain registration duration, and path keywords containing links in SMS messages to obtain link risk coefficients. By integrating the risk tags of the sending number, SMS content, user interaction behavior, and link risk coefficients, the system's ability to identify spam SMS messages is improved.

[0210] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A method for recognizing spam short message based on multi-source data feature feedback, characterized in that, The method comprises the following steps: obtaining the sending number, the content of the target short message, the risk label of the sending number, the historical number of reports, the malicious domain name library and the user interaction behavior data of the target short message; obtaining the trust score coefficient according to the user interaction behavior data; obtaining the first risk score based on the deep learning network model according to the risk label of the sending number and the historical number of reports; obtaining the second risk score according to the content of the short message; obtaining the risk score according to the first risk score, the second risk score and the trust score coefficient, and determining the target short message as a spam short message if the risk score is less than the risk judgment threshold; pushing the interception notification of the spam short message to the target user, and obtaining the operation of the target user on the interception notification; adjusting the risk judgment threshold according to the operation of the target user on the interception notification. 2.The method of claim 1, wherein, The method comprises the following steps: obtaining the historical message total number, the target user reply ratio and the latest interaction interval days according to the target short message; obtaining the time decay factor according to the latest interaction interval days; obtaining the trust score coefficient according to the historical message total number, the target user reply ratio and the time decay factor; shielding the target short message if the trust score coefficient is less than the preset threshold; The time decay factor is specifically as follows: η = max (0.5, 1 - IID / 365); In the formula, η is the time decay factor, max is the maximum function, and IID is the latest interaction interval days. The trust score coefficient formula is specifically as follows: In the formula, TSC is the trust score coefficient, min is the minimum function, HM is the historical message total number, ratio is the target user reply ratio, and η is the time decay factor. 3.The method of claim 1, wherein, The method comprises the following steps: obtaining the interception word library, which is composed of interception words and confusion words, the interception words being pre-set sensitive words or phrases, and the confusion words being letters, homophonic characters and emoticons used by spam short messages to avoid interception rules; extracting quasi-interception words from the spam short messages marked by the user according to the user interaction behavior data, and adding the quasi-interception words to the interception word library if the number of occurrences of the quasi-interception words is greater than a preset threshold; obtaining the first short message string based on data preprocessing according to the content of the short message, the data preprocessing including deleting spaces, punctuation marks in the short message and translating recognizable English words into Chinese characters, the first string containing only Chinese characters, letters, emoticons and emoticons in the short message; obtaining the keywords, which are verbs, nouns, adjectives and adverbs contained in the first string; obtaining the spam short message library, obtaining the risk probability according to the spam short message library and the keywords, the risk probability being the maximum value of the duplicate detection rate of the first string and the matching short message in the spam short message library, the matching short message representing the short message matched in the spam short message library according to the keywords; obtaining the first threshold and the second threshold based on risk identification; shielding the short message if the risk probability is greater than the first threshold; obtaining the second short message string based on dynamic programming according to the first short message string if the risk probability is greater than the second threshold and less than the first threshold, otherwise taking the first short message string as the second short message string. According to the second short message string and the intercept word library, a second risk score is obtained. 4.The method of claim 3, wherein, If the risk probability is greater than the second threshold value and less than the first threshold value, a second short message string is obtained according to the first short message string based on dynamic programming, otherwise the first short message string is taken as the second short message string, and the method specifically comprises the following steps: Based on the initial consonant, the final consonant and the tone, the digital code of the intercept word and the digital code of the key word are obtained. According to the digital code of the intercept word and the key word, a target word string array is obtained, and the target word string array is a string array composed of the confusion words. An obfuscation table is obtained, and the obfuscation table contains the confusion words and the confusion cost. According to the first short message string, the target word string array and the obfuscation table, a replacement cost is obtained, and the replacement cost is the cost required for replacing the characters in the first short message string with the characters in the target word string array obtained according to the obfuscation table. According to the first short message string and the target word string array, a deletion cost and an insertion cost are obtained, the deletion cost is the cost required for deleting the characters in the first short message string, and the insertion cost is the cost required for inserting the characters in the target word string array into the corresponding positions of the first short message string. According to the replacement cost, the deletion cost and the insertion cost, a weighted edit distance is obtained. According to the weighted edit distance, the first short message string is adjusted to obtain a second short message string. 5.The method of claim 3, wherein, The second risk score is obtained according to the second short message string and the intercept word library, and the method specifically comprises the following steps: Second short message string words are obtained, and the words are verbs, nouns, adjectives and adverbs contained in the second short message string. Based on the initial consonant, the final consonant and the tone, the digital code of the second short message string words and the digital code of the intercept word are obtained. Based on the intercept word library, a judgment set is obtained according to the digital code of the second short message string words and the digital code of the intercept word. Based on the judgment set, a shielding word risk table is obtained based on the shielding word risk, and the shielding word risk table contains the shielding words in the judgment set and the risk coefficients corresponding to the shielding words. Second short message English strings and intercept word English strings in the judgment set are obtained, the second short message English strings are pinyin of the second short message string, and the intercept word English strings are pinyin of the intercept word. According to the number of shielding words contained in the second short message English string and the shielding word risk table, the average risk coefficient and the maximum risk coefficient of the shielding words contained in the second short message English string are obtained. According to the number of shielding words contained in the second short message English string, the average risk coefficient and the maximum risk coefficient, a second short message English string matching risk is obtained. If the second short message string contains a link, link data information is obtained, and the link data information contains a link domain name, a domain name registration time length and a path key word. According to the second short message English string matching risk and the link data information, a second risk score is obtained. The second short message English string matching risk is specifically as follows: Re = min (1, 0.7 * max_risk_i + 0.3 * aver_risk). In the formula, Re is a second short message English string matching risk, min is a minimum function, max_risk_i is a maximum risk coefficient of a shielding word contained in the second short message English string, and aver_risk is a risk coefficient mean value of the shielding word contained in the second short message English string; The second risk score is specifically: Rl = min (1, domain + freshess + path); In the formula, Rl is a link risk coefficient, min is a minimum function, domain is a domain name risk coefficient, freshess is a domain name registration time length risk coefficient, and path is a path keyword risk coefficient. 6.The method of claim 1, wherein, The adjusting of the risk determination threshold according to the operation of the target user on the interception notification specifically includes: According to the operation of the target user on the interception notification, a feedback category and a feedback frequency are obtained, the feedback category including misjudgment feedback and correct interception feedback; According to the user interaction behavior data, a misjudgment feedback frequency, a total interaction frequency, a correct interception feedback frequency, and a total interception frequency are obtained; According to the feedback category, an adjustment coefficient is obtained based on the misjudgment feedback frequency, the total interaction frequency, the correct interception feedback frequency, and the total interception frequency; According to the risk determination threshold and the adjustment coefficient, an updated risk determination threshold is obtained; According to the total number of historical messages and the target user reply ratio, a trust coefficient is obtained; According to the trust coefficient, the risk determination threshold is adjusted; The updated risk determination threshold is specifically: Rdt2 = Rdt1 + δ; In the formula, δ is an adjustment coefficient, IOM is a misjudgment intensity, the misjudgment intensity being a ratio of the misjudgment feedback frequency to the total interaction frequency, IOC is a correct interception intensity, the correct interception intensity being a ratio of the correct interception feedback frequency to the total interception frequency, Rdt2 is the updated risk determination threshold, and Rdt1 is the risk determination threshold before updating; The adjusting of the risk determination threshold is specifically: In the formula, Rdt is the adjusted risk determination threshold, and Tc is the trust coefficient, the trust coefficient being a product of the total number of historical messages and the target user reply ratio.

7. A multi-source data feature feedback based spam short message identification system for implementing the multi-source data feature feedback based spam short message identification method according to any one of claims 1-6, characterized in that, The method comprises the following steps: The main control module is configured to obtain a sending number of a target short message, a short message content, a risk label of the sending number, a historical number of reports, a malicious domain name library, and user interaction behavior data, obtain a trust score coefficient according to the user interaction behavior data, obtain a first risk score based on a deep learning network model according to the risk label of the sending number and the historical number of reports, obtain a second risk score according to the short message content, obtain a risk score according to the first risk score, the second risk score, and the trust score coefficient, determine that the target short message is a spam short message if the risk score is less than a risk determination threshold, push an interception notification of the spam short message to a target user, obtain an operation of the target user on the interception notification, and adjust the risk determination threshold according to the operation of the target user on the interception notification. The scoring module is configured to obtain a first risk score based on a deep learning network model according to a risk label and a historical reported number of a sending number, obtain an intercept word library composed of intercept words and obfuscated words, obtain a first short message string based on data preprocessing according to short message content, obtain a keyword according to the intercept word library and the first string, obtain a spam short message library, obtain a risk probability according to the spam short message library and the keyword, obtain a first threshold value and a second threshold value based on risk identification, shield the short message if the risk probability is greater than the first threshold value, obtain a second short message string based on dynamic programming according to the first short message string if the risk probability is greater than the second threshold value and less than the first threshold value, or otherwise take the first short message string as the second short message string, and obtain a second risk score according to the second short message string and the intercept word library. The trust score module is configured to obtain a historical message total number, a target user reply ratio and a recent interaction interval day number according to a target short message, obtain a time decay factor according to the recent interaction interval day number, obtain a trust score coefficient according to the historical message total number, the target user reply ratio and the time decay factor, and shield the target short message if the trust score coefficient is less than a preset threshold value. 8.The system of claim 7, wherein, The main control module specifically comprises: The control unit is configured to obtain a trust score coefficient according to user interaction behavior data, obtain a first risk score based on a deep learning network model according to a risk label and a historical reported number of a sending number, obtain a second risk score according to short message content, obtain a risk score according to the first risk score, the second risk score and the trust score coefficient, determine that the short message is a spam short message if the risk score is less than a risk judgment threshold value, push an intercept notification of the spam short message to a target user, obtain an operation of the target user on the intercept notification, and adjust the risk judgment threshold value according to the operation of the target user on the intercept notification. The information acquisition unit is configured to obtain a sending number, short message content, a risk label of the sending number, a historical reported number, a malicious domain name library and user interaction behavior data of a target short message. 9.The system of claim 7, wherein, The scoring module specifically comprises: The first scoring unit is configured to obtain a first risk score based on a deep learning network model according to a risk label and a historical reported number of a sending number. The second scoring unit is configured to obtain an intercept word library composed of intercept words and obfuscated words, obtain a first short message string based on data preprocessing according to short message content, obtain a keyword according to the intercept word library and the first string, obtain a spam short message library, obtain a risk probability according to the spam short message library and the keyword, obtain a first threshold value and a second threshold value based on risk identification, shield the short message if the risk probability is greater than the first threshold value, obtain a second short message string based on dynamic programming according to the first short message string if the risk probability is greater than the second threshold value and less than the first threshold value, or otherwise take the first short message string as the second short message string, and obtain a second risk score according to the second short message string and the intercept word library. 10.The system of claim 7, wherein, The trust score module specifically comprises: A time decay acquisition unit, which is configured to acquire a total number of historical messages, a target user reply ratio and a number of days of a latest interaction interval according to the target short message, and acquire a time decay factor according to the number of days of the latest interaction interval; A determination unit, which is configured to acquire a trust score coefficient according to the total number of historical messages, the target user reply ratio and the time decay factor, and shield the target short message if the trust score coefficient is less than a preset threshold.

Images