Short message link security identification method and device, equipment, medium and program product

Abstract

The invention discloses a short message link security identification method and device, electronic equipment, a medium and a program product, and relates to security identification of links contained in a short message so as to guarantee user information security and equipment security. The short message link security identification method comprises the following steps: monitoring a short message sending process in real time, and when a short message enters a sending queue or the short message is received, extracting all links from the content of the short message; performing multi-dimensional feature analysis on the extracted link, analyzing text content of the short message, and extracting keywords and semantic information; analyzing related historical records of the extracted links; performing real-time data interaction with a cloud security database, obtaining latest malicious link feature information and security intelligence, and uploading a local analysis result to the cloud; and based on an analysis result, keywords and semantic information of multi-dimensional feature analysis, related historical records, malicious link feature information and security intelligence, the security of the link is judged by using an intelligent model.

Description

Technical Field

[0001] This application relates to the field of information security, specifically to a method, apparatus, electronic device, computer-readable storage medium, and computer program product for secure identification of SMS links. Background Technology

[0002] With the rapid development of mobile internet, SMS, as an important communication method, not only serves as a means of daily communication but has also become a crucial channel for delivering various service notifications, verification codes, and marketing promotions. However, links contained in SMS messages often become the primary vehicle for online fraud and phishing attacks, posing a serious threat to user information and financial security. Therefore, effectively identifying the safety of SMS links has become an urgent need. Summary of the Invention

[0003] This application provides a method, apparatus, electronic device, medium, and program product for identifying the security of SMS links, solving the problem of effectively identifying whether SMS links are secure.

[0004] This application aims to address the issues of lag and high false positive rates in existing technologies for identifying secure links in SMS messages, achieving comprehensive security monitoring during SMS sending and receiving. Furthermore, it uses scientifically set coefficients to accurately determine link security and promptly notify users of insecure links.

[0005] In a first aspect, embodiments of this application provide a method for secure identification of SMS links, comprising: real-time monitoring of the SMS sending process of an operator; when an SMS enters the sending queue, extracting link information from the content of the SMS, or automatically extracting all links from the content of the SMS when the SMS is received; performing multi-dimensional feature analysis on the extracted links, including the domain name features, path features, and parameter features of the links, and analyzing the text content of the SMS to extract keywords and semantic information therein; analyzing the relevant historical records of the extracted links; performing real-time data interaction with a cloud security database to obtain the latest malicious link feature information and security intelligence, and uploading the results of the local analysis to the cloud; and judging the security of the links using an intelligent model constructed by a machine learning algorithm based on the analysis results of the multi-dimensional feature analysis, the extracted keywords and semantic information, the relevant historical records, and the malicious link feature information and security intelligence obtained in real time from the cloud security database.

[0006] Optionally, the domain name characteristics of the link refer to the domain name's registration time and whether the domain name has a complaint record; the path characteristics of the link refer to analyzing whether there are abnormal characters or special directory structures in the path; and the parameter characteristics of the link refer to judging whether there is sensitive information or abnormal format in the parameters.

[0007] Optionally, the relevant historical records of the link include whether the link has ever been marked as an insecure link, changes in the frequency of access to the link, and the reputation of the associated SMS sending source.

[0008] Optionally, the intelligent model adopts a structure combining a deep neural network (DNN) with a recurrent neural network (RNN) and its variant, the long short-term memory network (LSTM), and updates the intelligent model using incremental learning.

[0009] Optionally, the SMS link security identification method further includes: calculating a risk coefficient based on the analysis results of the multi-dimensional feature analysis, the keywords and semantic information, and the relevant historical records. The formula for calculating the risk coefficient is as follows: R = ω1 × D + ω2 × P + ω3 × A + ω4 × T + ω5 × H, where R represents the risk coefficient, and the larger the value, the higher the security risk of the link; ω1, ω2, ω3, ω4, and ω5 are the weights corresponding to domain name features, path features, parameter features, SMS text features, and historical data features, respectively. The values ​​are determined using the Analytic Hierarchy Process (AHP), ranging from 0 to 1, with ω1+ω2+ω3+ω4+ω5=1; D represents the domain name feature value, calculated based on the domain registration time and complaint records; P represents the path feature value, determined based on the number of abnormal characters in the path and special directory structures; A represents the parameter feature value, judged based on sensitive information and abnormal formats in the parameters; T represents the SMS text feature value, obtained through keyword extraction and semantic analysis; H represents the historical data feature value, calculated based on link history markers, changes in access frequency, and the reputation of the sending source.

[0010] Optionally, the SMS link security identification method further includes: when it is determined that the link is unsafe, sending a reminder to the user via at least one of SMS, mobile communication messages, and operator telephone calls.

[0011] Secondly, embodiments of this application provide a text message link security identification device, comprising: a real-time monitoring module, which monitors the text message sending process of an operator in real time, and extracts link information from the content of the text message when the text message enters the sending queue; a link extraction module, which automatically extracts all links from the content of the text message when the text message is received; a feature analysis module, which performs multi-dimensional feature analysis on the extracted links, including the domain name features, path features, and parameter features of the links, and analyzes the text content of the text message to extract keywords and semantic information; a historical data analysis module, which analyzes the relevant historical records of the extracted links; a real-time data interaction module, which performs real-time data interaction with a cloud security database to obtain the latest malicious link feature information and security intelligence, and uploads the results of local analysis to the cloud; and an intelligent judgment module, which judges the security of the links based on the analysis results of the multi-dimensional feature analysis, the extracted keywords and semantic information, the relevant historical records, and the malicious link feature information and security intelligence obtained in real time from the cloud security database, using an intelligent model constructed by a machine learning algorithm.

[0012] Thirdly, embodiments of this application provide an electronic device, which includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the steps of the SMS link security identification method as described in the first aspect.

[0013] Fourthly, embodiments of this application provide a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, it implements the steps of the SMS link security identification method as described in the first aspect.

[0014] Fifthly, embodiments of this application provide a computer program product, which includes computer instructions that, when executed by a processor, implement the steps of the SMS link security identification method as described in the first aspect.

[0015] Compared to existing technologies, this application focuses on the security identification of SMS links themselves. Compared to methods that emphasize DDoS (Distributed Denial of Service) protection, this application not only ensures secure link access but also deeply analyzes link content to determine whether it is a malicious link. Compared to methods that focus on SMS interface management, this application directly targets SMS link security, overcoming the lag and high false positive rate problems of existing technologies in identifying SMS link security through real-time monitoring, multi-dimensional analysis, risk coefficient setting, and intelligent judgment. According to the technical solution of this application, the security of SMS links can be determined in real time and accurately, greatly improving the ability to identify new malicious links. Furthermore, it can promptly alert users, providing them with more reliable security protection. Attached Figure Description

[0016] Figure 1 This is one of the flowcharts of the SMS link security identification method involved in the embodiments of this application.

[0017] Figure 2 This is one of the structural diagrams of the SMS link security identification device involved in the embodiments of this application.

[0018] Figure 3 This is the second flowchart of the SMS link security identification method involved in the embodiments of this application.

[0019] Figure 4 This is the second structural diagram of the SMS link security identification device involved in the embodiments of this application.

[0020] Figure 5 This is a structural diagram of the electronic device involved in this application. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0022] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, the first object can be one or more. Furthermore, "and / or" in this application indicates at least one of the connected objects. For example, the scope of protection for "A or B" covers at least three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B.

[0023] The term "instruction" in this application can be either a direct instruction (or explicit instruction) or an indirect instruction (or implicit instruction). A direct instruction can be understood as the sender explicitly informing the receiver of specific information, the required operation, or the requested result in the instruction sent. An indirect instruction can be understood as the receiver determining the corresponding information based on the instruction sent by the sender, or making a judgment and determining the required operation or requested result based on the judgment result.

[0024] The SMS link security identification method and apparatus involved in the embodiments of this application will be described in detail below with reference to the accompanying drawings and through some embodiments and their modifications.

[0025] First, see Figure 1 , Figure 1 This is one of the flowcharts of the SMS link security identification method involved in the embodiments of this application. For example... Figure 1 As shown, the SMS link security identification method includes the following steps:

[0026] S1: Monitor the SMS sending process of the operator in real time. When an SMS enters the sending queue, extract the link information in the content of the SMS, or when the SMS is received, automatically extract all links from the content of the SMS.

[0027] When acting as the sender, operators embed security detection mechanisms into the SMS sending process. This allows the system to automatically scan the SMS content as soon as it enters the sending queue, extracting links immediately. Conversely, when acting as the receiver, the terminal device can automatically extract all links from the received SMS using efficient text parsing algorithms, preparing for subsequent analysis.

[0028] S2, perform multi-dimensional feature analysis on the extracted link, including the domain name feature, path feature, and parameter feature of the link, and analyze the text content of the SMS message to extract keywords and semantic information to help determine the security of the link.

[0029] The domain characteristics of a link refer to factors such as its registration date and the presence of complaint records. This is because newly registered domains are often used by malicious attackers for fraud, and checking the registration date can help analyze the domain. Furthermore, a domain with numerous complaint records is usually flagged as insecure by users, making this method also useful for domain analysis. The path characteristics of a domain refer to the presence of unusual characters such as numerous random characters, obfuscated characters, or uncommon directory structures within the path. The parameter characteristics of a link refer to determining whether the parameters contain sensitive information or abnormal formats, such as personal identification information, bank account information, or other sensitive data, or exhibit abnormal parameter loads or high encryption levels.

[0030] S3, Analyze the relevant historical records of the extracted links.

[0031] This involves analyzing historical data to understand the link's history, including whether it has ever been marked as an insecure link, changes in its access frequency, and the reputation of the associated SMS source. This historical data provides a reference for assessing the link's security. Furthermore, the analysis also examines whether there has been an abnormal increase in the link's recent access volume.

[0032] S4 interacts with the cloud security database in real time to obtain the latest malicious link characteristics and security intelligence, and uploads the results of local analysis to the cloud.

[0033] The cloud-based database stores malicious link characteristics and security threat information across the entire network. By interacting with the cloud in real time, a more comprehensive security assessment can be obtained. Furthermore, by uploading local analysis results, the cloud-based database can be further enriched, thereby improving the overall security identification capability.

[0034] S5. Based on the analysis results of the multi-dimensional feature analysis, the extracted keywords and semantic information, the relevant historical records, and the malicious link feature information and security intelligence obtained in real time from the cloud security database, the security of the link is judged using an intelligent model constructed by machine learning algorithms.

[0035] This model employs a deep neural network (DNN) combined with a recurrent neural network (RNN) and its variant, the Long Short-Term Memory (LSTM). DNN's powerful feature extraction capabilities allow for deep abstraction and learning of multi-dimensional link and SMS features, while RNN and LSTM excel at processing sequence data, proving highly effective for analyzing semantic information in SMS text and the time-series changes of link-related features. For example, LSTM can capture the order and contextual relationships of keywords in SMS messages, thus more accurately determining the security of SMS links. The model is trained using a large number of normal and malicious SMS link samples, including different types of malicious links such as phishing links and malware download links, as well as various legitimate business links. During training, cross-entropy loss and stochastic gradient descent optimization algorithms are used to continuously adjust the model's parameters, improving its accuracy and generalization ability.

[0036] Meanwhile, to prevent overfitting, L1 and L2 regularization techniques are employed to constrain the model's weights. As new SMS link data is continuously generated, the model is updated using incremental learning. L1 regularization adds a penalty term (L1 norm) to the loss function, representing the sum of the absolute values ​​of the parameters, forcing some parameters to approach zero, thus achieving feature selection. Its advantages include generating a sparse model and automatically filtering important features, making it suitable for high-dimensional data or scenarios with redundant features. L2 regularization adds a penalty term (L2 norm) to the loss function, representing the sum of squared parameters, limiting the overall size of the parameters without forcing them to zero. Its advantages include reducing model complexity, avoiding overfitting, and being suitable for scenarios with strong correlations between parameters.

[0037] When new sample data becomes available, the model is not retrained with the entire dataset. Instead, it is fine-tuned using the new data to allow the model to quickly adapt to new malicious link patterns, maintaining the accuracy and timeliness of its link security assessments. For links that are difficult to assess, further in-depth analysis is conducted in conjunction with risk coefficients.

[0038] The following reference Figure 2 , Figure 2 This is one of the structural diagrams of the SMS link security identification device involved in the embodiments of this application.

[0039] like Figure 2 As shown, the SMS link security identification device 10 includes a real-time monitoring module 1, a link extraction module 2, a feature analysis module 3, a historical data analysis module 4, a real-time data interaction module 5, and an intelligent judgment module 6.

[0040] The real-time monitoring module 1 is used to monitor the SMS sending process of the operator in real time. When an SMS enters the sending queue, it extracts the link information from the content of the SMS.

[0041] The link extraction module 2 is used to receive the SMS message and uses an efficient text parsing algorithm to automatically extract all links from the content of the SMS message when it is received, so as to prepare for subsequent analysis.

[0042] The feature analysis module 3 is used to perform multi-dimensional feature analysis on the extracted links, including the domain name features, path features, and parameter features of the links, and to analyze the text content of the SMS messages to extract keywords and semantic information, etc., to help determine the security of the links.

[0043] The historical data analysis module 4 is used to analyze the relevant historical records of the extracted links.

[0044] The real-time data interaction module 5 is used to interact with the cloud security database in real time, obtain the latest malicious link feature information and security intelligence, and upload the results of local analysis to the cloud.

[0045] The intelligent judgment module 6 is used to judge the security of the link based on the analysis results of the multi-dimensional feature analysis, the extracted keywords and semantic information, the relevant historical records, and the malicious link feature information and security intelligence obtained in real time from the cloud security database, using an intelligent model built by machine learning algorithms.

[0046] Optionally, the domain name characteristics of the link refer to the domain name's registration time and whether the domain name has a complaint record; the path characteristics of the link refer to analyzing whether there are abnormal characters or special directory structures in the path; and the parameter characteristics of the link refer to judging whether there is sensitive information or abnormal format in the parameters.

[0047] Optionally, the relevant historical records of the link include whether the link has ever been marked as an insecure link, changes in the frequency of access to the link, and the reputation of the associated SMS sending source.

[0048] Optionally, the intelligent model adopts a structure combining a deep neural network (DNN) with a recurrent neural network (RNN) and its variant, the long short-term memory network (LSTM), and updates the intelligent model using incremental learning.

[0049] Therefore, the SMS link security identification method and apparatus according to the above embodiments can achieve comprehensive security analysis of links in SMS messages through the collaborative work of multiple modules, further reducing the lag and high false positive rate of SMS link security identification, thereby effectively preventing users from being attacked by network threats such as fraudulent information, phishing websites, and malicious software downloads, and improving the security of the mobile communication environment.

[0050] Next, refer to Figure 3 , Figure 3 This is the second flowchart of the SMS link security identification method involved in the embodiments of this application.

[0051] Optionally, such as Figure 3 As shown, the SMS link security identification method further includes: S6, calculating a risk coefficient based on the analysis results of the multi-dimensional feature analysis, the keywords and semantic information, and the relevant historical records. The formula for calculating the risk coefficient is as follows:

[0052] R=ω1×D+ω2×P+ω3×A+ω4×T+ω5×H

[0053] in,

[0054] R represents the risk coefficient; the higher the value, the higher the security risk of the link.

[0055] ω1, ω2, ω3, ω4, and ω5 are the weights corresponding to domain name features, path features, parameter features, SMS text features, and historical data features, respectively. They are determined by the Analytic Hierarchy Process (AHP) and their values ​​range from 0 to 1, with ω1+ω2+ω3+ω4+ω5=1.

[0056] D represents the domain name characteristic value, which is calculated based on the domain name registration time and complaint records;

[0057] P represents the path characteristic value, which is determined based on the number of abnormal characters in the path and special directory structures.

[0058] A represents the parameter characteristic value, which is determined based on sensitive information and abnormal formats in the parameter;

[0059] T represents the text message feature value, which is obtained through keyword extraction and semantic analysis;

[0060] H represents the historical data feature value, which is calculated based on link history markers, changes in access frequency, and the reputation of the sending source.

[0061] S7. When it is determined that the link is insecure, a reminder is sent to the user via at least one of SMS, mobile communication message and operator telephone.

[0062] The following reference Figure 4 , Figure 4 This is the second structural diagram of the SMS link security identification device involved in the embodiments of this application.

[0063] Optionally, such as Figure 4As shown, the SMS link security identification device 10 also includes a risk coefficient calculation module 7, which is used to calculate the risk coefficient based on the analysis results of the multi-dimensional feature analysis, the keywords and semantic information, and the relevant historical records. The formula for calculating the risk coefficient is as follows: R=ω1×D+ω2×P+ω3×A+ω4×T+ω5×H, where R represents the risk coefficient, and the larger the value, the higher the security risk of the link; ω1, ω2, ω3, ω4, and ω5 are respectively the domain name feature, path feature, parameter feature, SMS text feature, and historical data feature. The weights are determined using the Analytic Hierarchy Process (AHP), with values ​​ranging from 0 to 1, and ω1+ω2+ω3+ω4+ω5=1; D represents the domain name feature value, calculated based on the domain name registration time and complaint records; P represents the path feature value, determined based on the number of abnormal characters in the path and special directory structures; A represents the parameter feature value, judged based on sensitive information and abnormal formats in the parameters; T represents the SMS text feature value, obtained through keyword extraction and semantic analysis; H represents the historical data feature value, calculated based on link history markers, changes in access frequency, and the reputation of the sending source.

[0064] Optionally, the SMS link security identification device 10 further includes: an alert notification module 8, which is used to send an alert to the user via at least one of SMS, mobile communication messages and operator telephone when it is determined that the link is unsafe.

[0065] Therefore, according to the SMS link security identification method and apparatus involved in the above embodiments, by calculating the risk coefficient, the risk level of the SMS link can be further determined, different alarms can be issued according to the risk level of the link, and reminders can be sent to the user in various ways, thereby helping the user to clearly understand the potential risks of the relevant link.

[0066] Furthermore, the SMS link security identification method and apparatus involved in the embodiments of this application can also be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices besides a terminal. For example, the electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. Non-mobile electronic devices can also be servers, network attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc.

[0067] Specifically, such as Figure 5 As shown, this application embodiment also provides an electronic device 20, including a processor 21 and a memory 22. The memory 22 stores a program or instructions that can run on the processor 21. When the program or instructions are executed by the processor 21, they implement the various steps of the SMS link security identification method involved in the above embodiments and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0068] Furthermore, this application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the SMS link security identification method described in the above embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0069] In addition, this application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the SMS link security identification method involved in the above embodiments and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0070] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0071] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0072] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for securely identifying SMS links, characterized in that, include: The system monitors the SMS sending process of the operator in real time. When an SMS enters the sending queue, it extracts the link information from the content of the SMS, or when the SMS is received, it automatically extracts all links from the content of the SMS. The extracted links are subjected to multi-dimensional feature analysis, including the domain name features, path features, and parameter features of the links. The text content of the SMS is also analyzed to extract keywords and semantic information. Analyze the relevant historical records of the extracted links; It interacts with the cloud security database in real time to obtain the latest malicious link characteristics and security intelligence, and uploads the results of local analysis to the cloud. Based on the analysis results of the multi-dimensional feature analysis, the extracted keywords and semantic information, the relevant historical records, and the malicious link feature information and security intelligence obtained in real time from the cloud security database, the security of the link is judged using an intelligent model constructed by machine learning algorithms.

2. The SMS link security identification method according to claim 1, characterized in that, The domain characteristics of the link refer to the domain's registration time and whether the domain has any complaint records. The path characteristics of the link refer to analyzing whether there are abnormal characters or special directory structures in the path. The parameter characteristics of the link refer to determining whether the parameters contain sensitive information or have an abnormal format.

3. The SMS link security identification method according to claim 1, characterized in that, The relevant historical records of the link include whether the link has ever been marked as an insecure link, changes in the frequency of access to the link, and the reputation of the associated SMS sending source.

4. The SMS link security identification method according to claim 1, characterized in that, The intelligent model adopts a structure combining a deep neural network (DNN) with a recurrent neural network (RNN) and its variant, the long short-term memory network (LSTM), and updates the intelligent model using incremental learning.

5. The SMS link security identification method according to claim 1, characterized in that, The SMS link security identification method further includes: calculating a risk coefficient based on the analysis results of the multi-dimensional feature analysis, the keywords and semantic information, and the relevant historical records. The formula for calculating the risk coefficient is as follows: R=ω1×D+ω2×P+ω3×A+ω4×T+ω5×H in, R represents the risk coefficient; the higher the value, the higher the security risk of the link. ω1, ω2, ω3, ω4, and ω5 are the weights corresponding to domain name features, path features, parameter features, SMS text features, and historical data features, respectively. They are determined by the Analytic Hierarchy Process (AHP) and their values ​​range from 0 to 1, with ω1+ω2+ω3+ω4+ω5=1. D represents the domain name characteristic value, which is calculated based on the domain name registration time and complaint records; P represents the path characteristic value, which is determined based on the number of abnormal characters in the path and special directory structures. A represents the parameter characteristic value, which is determined based on sensitive information and abnormal formats in the parameter; T represents the text message feature value, which is obtained through keyword extraction and semantic analysis; H represents the historical data feature value, which is calculated based on link history markers, changes in access frequency, and the reputation of the sending source.

6. The SMS link security identification method according to claim 5, characterized in that, The SMS link security identification method further includes: when it is determined that the link is unsafe, sending a reminder to the user via at least one of SMS, mobile communication messages, and operator calls.

7. A secure identification device for SMS links, characterized in that, include: The real-time monitoring module monitors the SMS sending process of the operator in real time. When an SMS enters the sending queue, it extracts the link information from the content of the SMS. The link extraction module automatically extracts all links from the content of the SMS message upon receiving it. The feature analysis module performs multi-dimensional feature analysis on the extracted links, including the domain name features, path features, and parameter features of the links, and analyzes the text content of the SMS message to extract keywords and semantic information. The historical data analysis module analyzes and extracts the relevant historical records of the links; The real-time data interaction module interacts with the cloud security database in real time to obtain the latest malicious link feature information and security intelligence, and uploads the results of local analysis to the cloud. The intelligent judgment module, based on the analysis results of the multi-dimensional feature analysis, the extracted keywords and semantic information, the relevant historical records, and the malicious link feature information and security intelligence obtained in real time from the cloud security database, uses an intelligent model built by machine learning algorithms to judge the security of the link.

8. An electronic device, characterized in that, Includes a processor, memory, and computer programs stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the steps of the SMS link security identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program. When the computer program is executed by the processor, it implements the steps of the SMS link security identification method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the SMS link security identification method as described in any one of claims 1 to 6.

Images