Message checking method and device, storage medium, program product and computer equipment
By dynamically allocating levels based on communication distance and combining information entropy and violation risk weights, the problem of insufficient accuracy and efficiency caused by fixed-area inspections is solved, and more efficient message inspection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-22
- Publication Date
- 2026-04-03
AI Technical Summary
In existing technologies, checking communication messages based on fixed areas is difficult to adapt to an increase in the number of messages, resulting in insufficient accuracy and efficiency in the checks.
The message hierarchy is dynamically allocated based on communication distance, and the initial screening of violations for each group of messages is determined through binning and Bayesian smoothing calculation. Sampling checks are then performed by combining information entropy and violation risk weights.
It improves the accuracy and efficiency of message inspection, dynamically allocates hierarchical groupings to ensure rationality, and enhances the accuracy of violation identification and the representativeness of sampling inspection.
Smart Images
Figure CN121792484A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and in particular to a message inspection method, apparatus, storage medium, program product, and computer equipment. Background Technology
[0002] With the development of communication technology, the number of messages exchanged during communication is increasing. Some of these messages may carry information with related problems (such as security issues or non-compliance issues), which can lead to the spread of such information and affect public communication security.
[0003] In related technologies, communication messages within each pre-defined fixed area are typically inspected (e.g., for security or compliance). However, simply inspecting communication messages according to these fixed areas is insufficient to handle the increasing complexity of inspections due to the growing number of messages, leading to inadequate accuracy and / or efficiency. Summary of the Invention
[0004] To address the aforementioned technical problems, embodiments of this application propose a message inspection method, apparatus, storage medium, program product, and computer equipment, which can improve the accuracy and efficiency of message inspection.
[0005] In a first aspect, embodiments of this application provide a message inspection method, including: Acquire the communication message data to be inspected, wherein the communication message data includes multiple messages; The hierarchy of each of the multiple messages is determined based at least on the communication distance corresponding to each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the hierarchy; Determine the initial violation information corresponding to each group of messages; Based on the initial screening violation information corresponding to each group of messages, a sampling inspection is performed on each group of messages, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages.
[0006] Optionally, the at least one set of messages corresponds one-to-one with each of the levels, and each message at the same level is included in a set of messages corresponding to that level.
[0007] Optionally, determining the hierarchy of each of the multiple messages based at least on the communication distance corresponding to each of the multiple messages includes: Based on at least one preset distance range and the communication distance corresponding to each of the multiple messages, the multiple messages are binned to obtain the level of each of the multiple messages.
[0008] Optionally, determining the initial screening violation information corresponding to each group of messages includes: Determine the total number of messages in each group and the number of messages that initially violated the rules; Based on the total number of messages in each group and the number of initial violation messages, the initial screening violation information corresponding to each group of messages is determined.
[0009] Optionally, determining the initial screening violation information corresponding to each group of messages based on the total number of messages in each group and the number of initial violation messages includes: Based on the total number of messages in each group and the number of messages with initial violations, the initial violation rate of each group is calculated using Bayesian smoothing to generate the initial screening violation information for each group.
[0010] Optionally, the step of sampling and checking each group of messages based on the initial screening violation information corresponding to each group of messages includes: Based on the initial screening violation information corresponding to each group of messages, determine the information entropy corresponding to each group of messages; Based on the initial screening violation information and information entropy corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined. Based on the comprehensive sampling weight corresponding to each group of messages, each group of messages is sampled and checked.
[0011] Optionally, determining the information entropy of each group of messages based on the initial screening violation information includes: Based on the initial screening violation information corresponding to each group of messages, the information entropy corresponding to each group of messages is approximately calculated using a binomial distribution.
[0012] Optionally, the information entropy corresponding to each group of messages is suitable for characterizing the entropy weight corresponding to that group of messages; The determination of the comprehensive sampling weight for each group of messages based on the initial screening violation information and information entropy corresponding to each group of messages includes: The initial screening violation information corresponding to each group of messages is normalized to obtain the corresponding violation risk weight. Based on the violation risk weight and entropy weight corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined.
[0013] Optionally, the sampling check of each group of messages based on the comprehensive sampling weight corresponding to each group of messages includes: Based on the principle that the weight value is positively correlated with the number of samples drawn, random sampling checks are performed on each group of messages according to the comprehensive sampling weight corresponding to each group of messages.
[0014] Secondly, embodiments of this application provide a message inspection apparatus, including: The data acquisition module is used to acquire communication message data to be inspected, wherein the communication message data includes multiple messages; A layering module is used to determine the layer of each of the multiple messages based at least on the communication distance corresponding to each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the layer; The initial screening module is used to determine the initial violation information corresponding to each group of messages; The result generation module is used to perform sampling inspection on each group of messages based on the preliminary screening violation information corresponding to each group of messages, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages.
[0015] Optionally, the at least one set of messages corresponds one-to-one with each of the levels, and each message at the same level is included in a set of messages corresponding to that level.
[0016] Optionally, determining the hierarchy of each of the multiple messages based at least on the communication distance corresponding to each of the multiple messages includes: Based on at least one preset distance range and the communication distance corresponding to each of the multiple messages, the multiple messages are binned to obtain the level of each of the multiple messages.
[0017] Optionally, determining the initial screening violation information corresponding to each group of messages includes: Determine the total number of messages in each group and the number of messages that initially violated the rules; Based on the total number of messages in each group and the number of initial violation messages, the initial screening violation information corresponding to each group of messages is determined.
[0018] Optionally, determining the initial screening violation information corresponding to each group of messages based on the total number of messages in each group and the number of initial violation messages includes: Based on the total number of messages in each group and the number of messages with initial violations, the initial violation rate of each group is calculated using Bayesian smoothing to generate the initial screening violation information for each group.
[0019] Optionally, the step of sampling and checking each group of messages based on the initial screening violation information corresponding to each group of messages includes: Based on the initial screening violation information corresponding to each group of messages, determine the information entropy corresponding to each group of messages; Based on the initial screening violation information and information entropy corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined. Based on the comprehensive sampling weight corresponding to each group of messages, each group of messages is sampled and checked.
[0020] Optionally, determining the information entropy of each group of messages based on the initial screening violation information includes: Based on the initial screening violation information corresponding to each group of messages, the information entropy corresponding to each group of messages is approximately calculated using a binomial distribution.
[0021] Optionally, the information entropy corresponding to each group of messages is suitable for characterizing the entropy weight corresponding to that group of messages; The determination of the comprehensive sampling weight for each group of messages based on the initial screening violation information and information entropy corresponding to each group of messages includes: The initial screening violation information corresponding to each group of messages is normalized to obtain the corresponding violation risk weight. Based on the violation risk weight and entropy weight corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined.
[0022] Optionally, the sampling check of each group of messages based on the comprehensive sampling weight corresponding to each group of messages includes: Based on the principle that the weight value is positively correlated with the number of samples drawn, random sampling checks are performed on each group of messages according to the comprehensive sampling weight corresponding to each group of messages.
[0023] Thirdly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any of the above-mentioned embodiments.
[0024] Fourthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the above-described embodiments.
[0025] Fifthly, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.
[0026] In summary, the embodiments of this application have at least the following beneficial effects: By employing the embodiments of this application, communication message data to be inspected is acquired, wherein the communication message data includes multiple messages; the hierarchy of each of the multiple messages is determined based at least on the communication distance corresponding to each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the hierarchy; preliminary screening violation information corresponding to each group of messages is determined; based on the preliminary screening violation information corresponding to each group of messages, each group of messages is sampled for inspection, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages. In this way, the hierarchy of each message can be dynamically allocated and messages can be grouped using the communication distance corresponding to each message, so as to improve the rationality and accuracy of message layering and grouping, thereby improving the accuracy of message inspection, and each group of messages can be sampled for inspection according to its corresponding preliminary screening violation information, so as to improve the efficiency and accuracy of message inspection. Attached Figure Description
[0027] Figure 1 This is a flowchart illustrating the message inspection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the message inspection device provided in the embodiments of this application; Figure 3 This is a schematic diagram of the computer device provided in the embodiments of this application. Detailed Implementation
[0028] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments / examples are only a part of the embodiments / examples of this application, and not all of the embodiments / examples. Based on the embodiments / examples in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0029] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "multiple" means two or more. In the description of this application, the term "comprising" and its variations are open-ended, meaning "including but not limited to." The term "based on" means "at least partially based on." The term "according to" means "at least partially according to." The term "one embodiment / example" means "at least one embodiment / example"; the term "another embodiment / example" means "at least one additional embodiment / example"; the term "some embodiments / examples" means "at least some embodiments / examples."
[0030] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.
[0031] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this application is for the purpose of describing specific embodiments only and is not intended to limit the application. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.
[0032] In related technologies, message inspection can be achieved by using clustering sampling. For example, message data can be automatically clustered based on similarity features (region, sending time, etc.). The clustering algorithm divides the message data into several groups with high internal similarity and significant differences between groups. Then, a portion of the groups are randomly selected from the clustering results for full inspection, thereby completing a message inspection.
[0033] However, the aforementioned technologies only group messages based on region and time, ignoring the multimodal characteristics of message violation types, resulting in a mismatch between grouping and violation complexity. For example, a certain group may have a higher proportion of violations identified by machine review, while other groups may have a lower proportion of violations, leading to low reliability and accuracy of the judgment results.
[0034] In view of this, subsequent embodiments of this application provide a message inspection scheme, which aims to at least partially solve the shortcomings of the above-mentioned related technologies.
[0035] Firstly, see [the following] Figure 1 The diagram shows a flowchart of a message inspection method provided in an embodiment of this application. The message inspection method can be applied to a computer device with data processing capabilities (exemplarily, the computer device can be a cloud, a server, etc.). The method includes S101-S104, as follows.
[0036] S101, Obtain the communication message data to be inspected, wherein the communication message data includes multiple messages.
[0037] In some examples, the communication message data may be obtained by collecting communication messages within a preset time period and / or a preset area. For example, the communication message data may be generated by the aforementioned computer device based on communication messages collected and sent by various base stations within a preset area within a preset time period. Exemplarily, the preset time period may be one day or one week, and the communication messages may be all 5G messages.
[0038] In some examples, the multiple messages may include communication messages from different times and / or different locations.
[0039] S102, at least based on the communication distance corresponding to each of the multiple messages, determine the level of each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the level.
[0040] In some examples, the communication distance for each message can be used to indicate the distance between the sender and receiver of the message. This distance can include either the straight-line distance between the sender and receiver, or the sum of the straight-line distances between any two adjacent communication devices along the path of the message transmission between the sender and receiver.
[0041] In some examples, the multiple messages can be clustered based on their respective communication distances to obtain multiple levels. The level of each message can be determined based on the difference between the distance indicated by the cluster center of each level and the communication distance of each message. For example, each message can be assigned to the level corresponding to the minimum difference.
[0042] In some examples, messages at the same level can be grouped into the same group of messages. Furthermore, it is easy to understand that in this embodiment, a group of messages can contain only messages at one level, or a group of messages can contain messages corresponding to at least two levels. This embodiment is not the only one.
[0043] S103, determine the initial screening violation information corresponding to each group of messages.
[0044] In some examples, the initial violation information corresponding to each group of messages may refer to the violation information initial screening process obtained by performing violation information initial screening on at least some of the messages contained in the group of messages. The violation information initial screening process may refer to a preliminary machine review. For example, preset rules (such as discrimination rules based on violation keywords and / or violation keywords) may be used to determine whether at least some of the messages are in violation to obtain the corresponding initial screening results. Alternatively, a lightweight, pre-trained neural network may be used to identify violations in at least some of the messages to obtain the corresponding initial screening results. Thus, the initial violation information can be generated based on the initial screening results.
[0045] S104, based on the preliminary screening violation information corresponding to each group of messages, perform sampling inspection on each group of messages, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages.
[0046] In some examples, the initial screening violation information for each group of messages can be used to indicate the severity of the initial screening violation for that group of messages. In this way, each group of messages can be sampled and checked according to the severity of the initial screening violation (the more severe the initial screening violation, the larger the sample size can be).
[0047] In some examples, the sampling check may include: extracting a number of sample messages from each group of messages that match the initial screening violation information corresponding to that group of messages, and performing violation checks on the extracted sample messages to obtain the sampling check results for that group of messages. For example, this violation check may be a more accurate correlation check than the initial screening process described above; for instance, a powerful large language model may be invoked to perform precise violation checks on the extracted sample messages.
[0048] In one optional implementation, the at least one set of messages corresponds one-to-one with each of the levels, and each message at the same level is included in a set of messages corresponding to that level.
[0049] In this embodiment, at least one set of messages is defined to correspond one-to-one with each level, that is, different levels correspond to different sets of messages. In addition, it is defined that each message at the same level is included in the set of messages corresponding to that level. Thus, it is easy to understand that this embodiment can make each set of messages contain only the messages corresponding to one level, which helps to achieve more accurate violation identification during the initial screening of violation information. It can also make subsequent sampling more representative to improve the sampling accuracy, thereby improving the accuracy of violation checks on the sampled messages. In addition, it can also make it possible to set more targeted identification schemes for each set of messages during the initial screening of violation information and / or the violation check, which helps to improve the accuracy of message checks.
[0050] In one optional implementation, determining the hierarchy of each of the plurality of messages based at least on the communication distance corresponding to each of the plurality of messages includes: Based on at least one preset distance range and the communication distance corresponding to each of the multiple messages, the multiple messages are binned to obtain the level of each of the multiple messages.
[0051] In some examples, the at least one distance range may be a distance range divided according to a preset distance length (10km), for example, the at least one distance range may include at least one of the following: [0,10km), [10km,20km), [20km,30km)...
[0052] In some examples, at least one distance range can be associated with at least one level. In this way, each message can be placed in the level corresponding to the distance range of its corresponding communication distance, thereby completing the binning process for that message.
[0053] In one optional implementation, determining the initial screening violation information corresponding to each group of messages includes: Determine the total number of messages in each group and the number of messages that initially violated the rules; Based on the total number of messages in each group and the number of initial violation messages, the initial screening violation information corresponding to each group of messages is determined.
[0054] In some examples, the total number of messages in each group can be used to characterize the total number of messages contained in that group.
[0055] In some examples, the initial number of non-compliant messages in each message group can be used to characterize the number of messages in that group that were initially identified as non-compliant by the aforementioned non-compliant information screening process.
[0056] In some examples, the ratio between the number of initially detected violations in each group of messages and the total number of messages can be calculated, and the initial screening violation information corresponding to that group of messages can be generated based on this ratio.
[0057] In this embodiment, the initial screening violation information corresponding to each group of messages can be quantified based on the total number of messages and the number of initial screening violation messages. This is beneficial for a more intuitive and reasonable comparison of the severity of initial screening violations between different groups of messages, making the subsequent sampling inspections of each group of messages more accurate and reliable.
[0058] In one optional implementation, determining the initial screening violation information corresponding to each group of messages based on the total number of messages in each group and the number of initial violation messages includes: Based on the total number of messages in each group and the number of messages with initial violations, the initial violation rate of each group is calculated using Bayesian smoothing to generate the initial screening violation information for each group.
[0059] In this embodiment, the initial violation rate calculated by Bayesian smoothing is beneficial for handling the bias of the small sample layer, reducing the error caused by individual initial violation messages in the small sample layer, and thus enabling the initial violation rate of each group of messages to more accurately reflect the severity of the initial screening violation of that group of messages.
[0060] In some examples, it is assumed that the total number of messages in the i-th group is The number of initial violation reports was The total number of messages in each group and the number of initial violation messages can be represented by Table 1 below.
[0061] Table 1
[0062] In Table 1, message group number 1 (i.e., message group 1) can represent a group of messages at the level corresponding to a distance range of [0, 10 km), message group number 2 (i.e., message group 2) can represent a group of messages at the level corresponding to a distance range of [10 km, 20 km), and message group number 3 (i.e., message group 3) can represent a group of messages at the level corresponding to a distance range of [20 km, 30 km).
[0063] In some examples, it is assumed that the total number of messages in the i-th group is The number of initial inspection violation reports is The initial violation rate for each group of messages, calculated using Bayesian smoothing, can be expressed as: ,in, This represents the initial violation rate of the i-th group of messages.
[0064] Therefore, the initial inspection violation rate can be added to Table 1 above. The results are shown in Table 2 below.
[0065] Table 2
[0066] In one optional implementation, the step of sampling and checking each group of messages based on the initial screening violation information corresponding to each group of messages includes: Based on the initial screening violation information corresponding to each group of messages, determine the information entropy corresponding to each group of messages; Based on the initial screening violation information and information entropy corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined. Based on the comprehensive sampling weight corresponding to each group of messages, each group of messages is sampled and checked.
[0067] Understandably, information entropy can be used to measure the uncertainty of the initial screening violation information of each group of messages (such as the uncertainty of the initial detection violation rate corresponding to each communication distance when estimating). The higher the information entropy, the higher the uncertainty, which allows for more sampling of that group of messages.
[0068] In this embodiment, it is possible to avoid the situation where a sampling strategy determined solely by initial screening violation information may overlook message groups with low initial screening violation severity but high complexity (e.g., groups with high entropy values may hide disguised violation information). By combining information entropy, this embodiment can combine the explicit risk characteristics represented by the initial screening violation information and the implicit risk characteristics (complexity / uncertainty) represented by information entropy for each message group, making the calculation of sampling weights more comprehensive and minimizing sampling bias caused by single-dimensional judgment.
[0069] In some examples, the overall sampling weight for each group of messages can be obtained by weighted multiplication of the initial screening violation information and information entropy corresponding to that group of messages.
[0070] In one optional implementation, determining the information entropy of each group of messages based on the initial screening violation information includes: Based on the initial screening violation information corresponding to each group of messages, the information entropy corresponding to each group of messages is approximately calculated using a binomial distribution.
[0071] In some examples, the information entropy for each group of messages, approximated using the binomial distribution, can be expressed as: ,in, Let represent the information entropy corresponding to the i-th group of messages.
[0072] Therefore, Table 2 above can be added. The results are shown in Table 3 below.
[0073] Table 3
[0074] In some cases, the information entropy weights introduced in related technologies may be relatively simple, for example, without considering the estimation unreliability of small sample groups, making it difficult to effectively identify and process areas with high violation risk and high uncertainty. However, this embodiment can use a binomial distribution approximation to make statistical corrections to the violation probability of small sample groups, thereby enabling more effective identification of areas with high violation risk and high uncertainty.
[0075] In one optional implementation, the information entropy corresponding to each group of messages is suitable for characterizing the entropy weight corresponding to that group of messages; The determination of the comprehensive sampling weight for each group of messages based on the initial screening violation information and information entropy corresponding to each group of messages includes: The initial screening violation information corresponding to each group of messages is normalized to obtain the corresponding violation risk weight. Based on the violation risk weight and entropy weight corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined.
[0076] In some examples, this violation risk weight can be obtained using the following formula: ,in, This represents the violation risk weight corresponding to the i-th message group. This represents the initial screening violation information corresponding to the i-th group of messages. The indicated original violation risk weight.
[0077] In some examples, the violation risk weight and entropy weight corresponding to each group of messages can be multiplied to obtain the comprehensive weight for each group of messages. This comprehensive weight can then be normalized to obtain the comprehensive sampling weight for each group of messages. For example, this comprehensive weight can be obtained using the following formula: ,in, The overall weight corresponding to the i-th group of messages, This represents the entropy weight represented by the information entropy corresponding to the i-th message group.
[0078] In one optional implementation, the sampling check of each group of messages based on the comprehensive sampling weight corresponding to each group of messages includes: Based on the principle that the weight value is positively correlated with the number of samples drawn, random sampling checks are performed on each group of messages according to the comprehensive sampling weight corresponding to each group of messages.
[0079] In some examples, it is assumed Let represent the total number of samples corresponding to the communication message data. Then, the number of samples drawn from the i-th message group can be... ,in .
[0080] In conjunction with the aforementioned embodiments, the embodiments of this application have the following advantages: They employ a dual-weight fusion mechanism, using entropy weights to quantify uncertainty and Bayesian smoothing to correct risk weights, introducing information entropy into sampling weights to enable more samples to be extracted from groups of messages with high uncertainty. Using Bayesian smoothing to adjust the small sample violation rate avoids extreme values, resolves small sample statistical bias, and synergistically optimizes weight allocation with entropy weights. Furthermore, the embodiments of this application can provide a dynamic adaptive sampling framework, where weights are updated in real time with data. When new data flows in, violation risk and entropy values are recalculated, and the sampling ratio is automatically adjusted. Additionally, the embodiments of this application are easily integrated with existing systems, requiring no complex feature engineering or high-dimensional calculations, making them suitable for rapid deployment and implementation under large-scale data, thus providing a basic framework for subsequent refined analysis (such as combining violation type and communication distance).
[0081] Secondly, correspondingly, this application also provides a message inspection device that can implement all the processes of the message inspection method provided in the above embodiments.
[0082] See Figure 2 The diagram shows a schematic of the structure of a message inspection device 200 provided in an embodiment of this application. The message inspection device 200 includes: The data acquisition module 201 is used to acquire communication message data to be inspected, wherein the communication message data includes multiple messages; The layering module 202 is used to determine the layer of each of the multiple messages based at least on the communication distance corresponding to each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the layer; The initial screening module 203 is used to determine the initial screening violation information corresponding to each group of messages; The result generation module 204 is used to perform sampling inspection on each group of messages based on the preliminary screening violation information corresponding to each group of messages, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages.
[0083] In one optional implementation, the at least one set of messages corresponds one-to-one with each of the levels, and each message at the same level is included in a set of messages corresponding to that level.
[0084] In one optional implementation, determining the hierarchy of each of the plurality of messages based at least on the communication distance corresponding to each of the plurality of messages includes: Based on at least one preset distance range and the communication distance corresponding to each of the multiple messages, the multiple messages are binned to obtain the level of each of the multiple messages.
[0085] In one optional implementation, determining the initial screening violation information corresponding to each group of messages includes: Determine the total number of messages in each group and the number of messages that initially violated the rules; Based on the total number of messages in each group and the number of initial violation messages, the initial screening violation information corresponding to each group of messages is determined.
[0086] In one optional implementation, determining the initial screening violation information corresponding to each group of messages based on the total number of messages in each group and the number of initial violation messages includes: Based on the total number of messages in each group and the number of messages with initial violations, the initial violation rate of each group is calculated using Bayesian smoothing to generate the initial screening violation information for each group.
[0087] In one optional implementation, the step of sampling and checking each group of messages based on the initial screening violation information corresponding to each group of messages includes: Based on the initial screening violation information corresponding to each group of messages, determine the information entropy corresponding to each group of messages; Based on the initial screening violation information and information entropy corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined. Based on the comprehensive sampling weight corresponding to each group of messages, each group of messages is sampled and checked.
[0088] In one optional implementation, determining the information entropy of each group of messages based on the initial screening violation information includes: Based on the initial screening violation information corresponding to each group of messages, the information entropy corresponding to each group of messages is approximately calculated using a binomial distribution.
[0089] In one optional implementation, the information entropy corresponding to each group of messages is suitable for characterizing the entropy weight corresponding to that group of messages; The determination of the comprehensive sampling weight for each group of messages based on the initial screening violation information and information entropy corresponding to each group of messages includes: The initial screening violation information corresponding to each group of messages is normalized to obtain the corresponding violation risk weight. Based on the violation risk weight and entropy weight corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined.
[0090] In one optional implementation, the sampling check of each group of messages based on the comprehensive sampling weight corresponding to each group of messages includes: Based on the principle that the weight value is positively correlated with the number of samples drawn, random sampling checks are performed on each group of messages according to the comprehensive sampling weight corresponding to each group of messages.
[0091] Thirdly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any of the above-mentioned embodiments.
[0092] Fourthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the above-described embodiments.
[0093] Fifthly, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.
[0094] See Figure 3 The computer device in this embodiment includes a processor 301, a memory 302, and a computer program, such as a message checking program, stored in the memory 302 and executable on the processor 301. When the processor 301 executes the computer program, it implements the steps in the various message checking method embodiments described above, for example... Figure 1 The steps S101-S104 are shown.
[0095] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 302 and executed by the processor 301 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the computer device.
[0096] The computer device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that the schematic diagram is merely an example of a computer device and does not constitute a limitation on the computer device. It may include more or fewer components than shown, or combine certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.
[0097] The processor 301 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor 301 can be any conventional processor. The processor 301 is the control center of the computer device, connecting various parts of the entire computer device through various interfaces and lines.
[0098] The memory 302 can be used to store the computer programs and / or modules. The processor 301 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 302 and calling the data stored in the memory 302. The memory 302 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 302 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.
[0099] Wherein, if the modules / units integrated into the computer device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a non-transitory computer-readable storage medium. When the computer program is executed by the processor 301, it can implement the steps of the various method embodiments described above. Wherein, the computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.
[0100] In summary, the embodiments of this application have at least the following beneficial effects: By employing the embodiments of this application, communication message data to be inspected is acquired, wherein the communication message data includes multiple messages; the hierarchy of each of the multiple messages is determined based at least on the communication distance corresponding to each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the hierarchy; preliminary screening violation information corresponding to each group of messages is determined; based on the preliminary screening violation information corresponding to each group of messages, each group of messages is sampled for inspection, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages. In this way, the hierarchy of each message can be dynamically allocated and messages can be grouped using the communication distance corresponding to each message, so as to improve the rationality and accuracy of message layering and grouping, thereby improving the accuracy of message inspection, and each group of messages can be sampled for inspection according to its corresponding preliminary screening violation information, so as to improve the efficiency and accuracy of message inspection.
[0101] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary hardware platforms, or it can be implemented entirely by hardware. Based on this understanding, all or part of the technical solutions of this application that contribute to the background technology can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM (Read-Only Memory) / RAM (Random Access Memory), magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.
[0102] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.
Claims
1. A message inspection method, characterized in that, include: Acquire the communication message data to be inspected, wherein the communication message data includes multiple messages; The hierarchy of each of the multiple messages is determined based at least on the communication distance corresponding to each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the hierarchy; Determine the initial violation information corresponding to each group of messages; Based on the initial screening violation information corresponding to each group of messages, a sampling inspection is performed on each group of messages, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages.
2. The method according to claim 1, characterized in that, The at least one set of messages corresponds one-to-one with each of the levels, and each message at the same level is included in a set of messages corresponding to that level.
3. The method according to claim 1, characterized in that, The determination of the hierarchy of each of the multiple messages based at least on the communication distance corresponding to each of the multiple messages includes: Based on at least one preset distance range and the communication distance corresponding to each of the multiple messages, the multiple messages are binned to obtain the level of each of the multiple messages.
4. The method according to claim 1, characterized in that, The determination of the initial screening violation information corresponding to each group of messages includes: Determine the total number of messages in each group and the number of messages that initially violated the rules; Based on the total number of messages in each group and the number of initial violation messages, the initial screening violation information corresponding to each group of messages is determined.
5. The method according to claim 4, characterized in that, The determination of initial screening violation information for each group of messages based on the total number of messages in each group and the number of initial violation messages includes: Based on the total number of messages in each group and the number of messages with initial violations, the initial violation rate of each group is calculated using Bayesian smoothing to generate the initial screening violation information for each group.
6. The method according to any one of claims 1-5, characterized in that, The sampling inspection of each group of messages based on the initial screening violation information corresponding to each group of messages includes: Based on the initial screening violation information corresponding to each group of messages, determine the information entropy corresponding to each group of messages; Based on the initial screening violation information and information entropy corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined. Based on the comprehensive sampling weight corresponding to each group of messages, each group of messages is sampled and checked.
7. The method according to claim 6, characterized in that, The process of determining the information entropy of each group of messages based on the initial screening violation information includes: Based on the initial screening violation information corresponding to each group of messages, the information entropy corresponding to each group of messages is approximately calculated using a binomial distribution.
8. The method according to claim 6, characterized in that, The information entropy corresponding to each group of messages is suitable for characterizing the entropy weight corresponding to that group of messages; The determination of the comprehensive sampling weight for each group of messages based on the initial screening violation information and information entropy corresponding to each group of messages includes: The initial screening violation information corresponding to each group of messages is normalized to obtain the corresponding violation risk weight. Based on the violation risk weight and entropy weight corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined.
9. The method according to claim 6, characterized in that, The sampling inspection of each group of messages based on the comprehensive sampling weight corresponding to each group of messages includes: Based on the principle that the weight value is positively correlated with the number of samples drawn, random sampling checks are performed on each group of messages according to the comprehensive sampling weight corresponding to each group of messages.
10. A message checking device, characterized in that, include: The data acquisition module is used to acquire communication message data to be inspected, wherein the communication message data includes multiple messages; A layering module is used to determine the layer of each of the multiple messages based at least on the communication distance corresponding to each of the multiple messages, wherein the multiple messages are divided into at least one group of messages according to the layer; The initial screening module is used to determine the initial violation information corresponding to each group of messages; The result generation module is used to perform sampling inspection on each group of messages based on the preliminary screening violation information corresponding to each group of messages, so as to determine the inspection result corresponding to the communication message data according to the sampling inspection results of each of the at least one group of messages.
11. The apparatus according to claim 10, characterized in that, The at least one set of messages corresponds one-to-one with each of the levels, and each message at the same level is included in a set of messages corresponding to that level.
12. The apparatus according to claim 10, characterized in that, The determination of the hierarchy of each of the multiple messages based at least on the communication distance corresponding to each of the multiple messages includes: Based on at least one preset distance range and the communication distance corresponding to each of the multiple messages, the multiple messages are binned to obtain the level of each of the multiple messages.
13. The apparatus according to claim 10, characterized in that, The determination of the initial screening violation information corresponding to each group of messages includes: Determine the total number of messages in each group and the number of messages that initially violated the rules; Based on the total number of messages in each group and the number of initial violation messages, the initial screening violation information corresponding to each group of messages is determined.
14. The apparatus according to claim 13, characterized in that, The determination of initial screening violation information for each group of messages based on the total number of messages in each group and the number of initial violation messages includes: Based on the total number of messages in each group and the number of messages with initial violations, the initial violation rate of each group is calculated using Bayesian smoothing to generate the initial screening violation information for each group.
15. The apparatus according to any one of claims 10-14, characterized in that, The sampling inspection of each group of messages based on the initial screening violation information corresponding to each group of messages includes: Based on the initial screening violation information corresponding to each group of messages, determine the information entropy corresponding to each group of messages; Based on the initial screening violation information and information entropy corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined. Based on the comprehensive sampling weight corresponding to each group of messages, each group of messages is sampled and checked.
16. The apparatus according to claim 15, characterized in that, The process of determining the information entropy of each group of messages based on the initial screening violation information includes: Based on the initial screening violation information corresponding to each group of messages, the information entropy corresponding to each group of messages is approximately calculated using a binomial distribution.
17. The apparatus according to claim 15, characterized in that, The information entropy corresponding to each group of messages is suitable for characterizing the entropy weight corresponding to that group of messages; The determination of the comprehensive sampling weight for each group of messages based on the initial screening violation information and information entropy corresponding to each group of messages includes: The initial screening violation information corresponding to each group of messages is normalized to obtain the corresponding violation risk weight. Based on the violation risk weight and entropy weight corresponding to each group of messages, the comprehensive sampling weight corresponding to each group of messages is determined.
18. The apparatus according to claim 15, characterized in that, The sampling inspection of each group of messages based on the comprehensive sampling weight corresponding to each group of messages includes: Based on the principle that the weight value is positively correlated with the number of samples drawn, random sampling checks are performed on each group of messages according to the comprehensive sampling weight corresponding to each group of messages.
19. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-9.
20. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the method described in any one of claims 1-9.
21. A computer device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-9.