Security detection method and device for 5G message link
By combining decision tree models and large language models, multi-level risk assessment is conducted, which solves the problems of insufficient real-time performance and accuracy of 5G message review in existing technologies, and enables early and accurate security detection of 5G message links.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-26
- Publication Date
- 2026-04-03
AI Technical Summary
In the existing 5G message content review, manual sampling and static rule databases are insufficient in real-time performance and have a high rate of missed detection, making it impossible to identify the security risks of malicious links in a timely and accurate manner.
By combining a decision tree model with a large language model, multi-level risk assessment is conducted by receiving basic information and link characteristics of 5G message links. This includes surface detection of the decision tree model, risk level assessment, and final interface content analysis to identify the security risks of the links.
This enables earlier and more accurate identification of security risks in 5G messaging links, providing service providers with sufficient time to take preventative measures, reducing costs and improving applicability.
Smart Images
Figure CN121793015A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for secure detection of 5G message links. Background Technology
[0002] With the rapid development and widespread application of 5G technology, 5G messaging services have become an indispensable part of people's daily lives and work. 5G messaging services not only support the transmission of multimedia content such as text, images, and videos, but also support the sharing of links. However, the security of linked content is becoming increasingly prominent. Malicious links may lead to user devices being infected with malware, personal information being leaked, or users suffering from phishing attacks. External links embedded in 5G messages may pose security risks, such as: malicious URLs (phishing, fraud, Trojan viruses), illegal content (pornography, political content, sensitive information), and misleading links (fraudulent marketing, illegal redirects), etc. Currently, 5G message content review mainly relies on manual sampling and static rule bases.
[0003] However, manual sampling and static rule databases suffer from insufficient real-time performance and high false negative rates, necessitating a timely and accurate 5G message short chain security detection technology to ensure the security and reliability of the 5G message ecosystem. Summary of the Invention
[0004] This application provides a security detection method and apparatus for 5G message links, which can identify the security risks of 5G message link content earlier and more accurately, giving service providers sufficient time to take preventive measures.
[0005] In a first aspect, embodiments of this application provide a method for secure detection of 5G message links, including: Receive 5G message links and determine the corresponding 5G message port; Input the basic information of the 5G message port into the decision tree model to obtain the short chain risk probability; Determine whether the probability of short chain risk is greater than a preset probability threshold; If yes, then perform a message blocking operation; otherwise, extract the link characteristics of the 5G message link. Analyze the characteristics of the links to determine the risk level of 5G message links; Depending on the risk level, either perform a message blocking operation or send a 5G message link.
[0006] Furthermore, the basic information of the 5G messaging port includes the real-name verification result, domain name registration duration, and daily message sending volume.
[0007] Furthermore, the link characteristics include the number of link jumps, the number of user triggers, the jump duration, the final domain name, and the initial declaration of the 5G message link.
[0008] Furthermore, based on the above analysis of link characteristics, the risk levels of 5G message links are obtained, including: The risk score for 5G message links is determined based on the number of link redirects and the number of user triggers. Determine whether the jump duration exceeds the preset normal time threshold; if so, multiply the risk base score and the preset first factor to obtain the real-time risk score; if not, use the risk base score as the real-time risk score. Alternatively, determine whether the final domain name is consistent with the initial declaration; if not, multiply the risk base score by the preset second factor to obtain the real-time risk score; if yes, use the risk base score as the real-time risk score. The risk level can be obtained by querying the preset risk classification table based on the real-time risk score.
[0009] Furthermore, the aforementioned actions of blocking messages or sending 5G message links based on risk levels include: If the risk level is high-risk, then a message blocking operation will be performed; If the risk level is low, then send a 5G message link; If the risk level is medium risk, the final interface content of the 5G message link is analyzed based on the large language model to obtain the final interface security probability; based on the final interface security probability, a message blocking operation is performed or a 5G message link is sent.
[0010] Furthermore, the above analysis of the final interface content of 5G message links based on large language models yields the final interface security probability, including: The final interface content of 5G message links is extracted using an OCR algorithm; Analyzing the final interface content reveals textual semantic contradictions in 5G message links; By inputting the dynamic JS behavior features and semantic contradiction features of 5G message links into a large language model for multimodal analysis, the final interface security probability is obtained.
[0011] Furthermore, the aforementioned actions of performing message blocking or sending 5G message links based on the ultimate interface security probability include: If the final interface security probability is less than or equal to the first security threshold, and the daily message sending volume is less than or equal to the first traffic threshold, then a 5G message link will be sent. If the final interface security probability is greater than the first security threshold and less than the second security threshold, and the daily message sending volume is greater than the first traffic threshold and less than the second traffic threshold, then a 5G message link and risk warning information will be sent. If the final interface security probability is greater than the second security threshold, and the daily message sending volume is greater than the second traffic threshold, then a message blocking operation will be performed.
[0012] Secondly, embodiments of this application provide a security detection device for 5G message links, comprising: The message receiving module is used to receive 5G message links and determine the corresponding 5G message port; The surface detection module is used to input the basic information of the 5G message port into the decision tree model to obtain the short chain risk probability. The surface-level judgment module is used to determine whether the probability of short chain risk is greater than a preset probability threshold; if so, a message blocking operation is performed; if not, the link characteristics of the 5G message link are extracted. The risk assessment module is used to analyze link characteristics and determine the risk level of 5G message links. The risk execution module is used to perform message blocking operations or send 5G message links based on the risk level.
[0013] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the steps of a 5G message link security detection method as described in any of the above embodiments.
[0014] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of a 5G message link security detection method as described in any of the above embodiments.
[0015] In summary, compared with the prior art, the beneficial effects of the technical solution provided in this application include at least the following: This application provides a security detection method for 5G message links. Upon receiving a 5G message link, the basic information of the message port corresponding to the 5G message link is first input into a decision tree model for surface detection. If the short link risk probability output by the decision tree model is higher than a preset probability threshold, it indicates that the link is risky, and its transmission is directly blocked. If the short link risk probability is lower than the preset risk threshold, a risk assessment is further performed based on the link characteristics of the 5G message link. The transmission of the 5G message link is determined based on the assessed risk level. The above method performs security detection based on early signs such as the basic information of the message port and the link characteristics of the message link. It can identify the security risks of 5G message link content earlier and more accurately, providing service providers with sufficient time to take preventive measures. It also has wider applicability and lower cost. Attached Figure Description
[0016] Figure 1 A flowchart illustrating a security detection method for 5G message links provided as an exemplary embodiment of this application.
[0017] Figure 2 A flowchart of a risk level determination step provided for an exemplary embodiment of this application.
[0018] Figure 3 This is a structural diagram of a 5G message link security detection device provided as an exemplary embodiment of this application. Detailed Implementation
[0019] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.
[0020] Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0021] Please see Figure 1 This application provides a method for secure detection of 5G message links, including: Step S1: Receive the 5G message link and determine the corresponding 5G message port.
[0022] 5G messaging links typically point to a specific port, which is assigned by the service provider to identify different 5G messaging services. For example, industry ports (such as numbers starting with 95, 12, or 106) are common 5G messaging ports.
[0023] Step S2: Input the basic information of the 5G message port into the decision tree model to obtain the short chain risk probability.
[0024] The basic information for the 5G messaging port includes the real-name verification result, domain name registration duration, and daily message sending volume.
[0025] Specifically, you can obtain the real-name verification status of a specified port through API requests, use the whois library to resolve domain registration information, obtain the domain registration duration, and filter message records by date through the API to calculate the daily message sending volume.
[0026] This application can also use an improved decision tree model to classify 5G message links, adding the features corresponding to the real-name verification of the 5G message port to the loss function of the decision tree model, directly improving the decision tree model. The improved decision tree model is more suitable for scenarios of short link risk probability estimation, considering both the basic attributes of the link itself and the real-name verification status of the port, further improving the accuracy of 5G message link content security detection.
[0027] Step S3: Determine whether the probability of short chain risk is greater than the preset probability threshold.
[0028] Step S4: If yes, then perform a message blocking operation; if no, then extract the link characteristics of the 5G message link.
[0029] Specifically, if the short link risk probability output by the improved decision tree model is greater than a preset probability threshold (e.g., 0.85), the 5G message link is classified as high-risk, and message transmission is blocked in real time. Otherwise, the 5G message short link is classified as a potential risk, and the link features of the 5G message link are extracted to trigger the next step of review. These link features include the number of link jumps, the number of user triggers, the jump duration, the final domain name, and the initial declaration of the 5G message link.
[0030] In practical implementation, redirection can be achieved through HTTP / HTTPS protocol redirection mechanisms (such as 301 / 302 status codes). Each redirection records the status code and target URL, which this application uses to obtain the link redirection count. Click events record the number of user triggers, and each click updates the redirection log. Redirection duration can be calculated from the time the user clicks the link to the final page loading. Each domain name in the redirection chain is resolved using the DNS system, ultimately pointing to the actual service provider's server to obtain the final domain name. The initial declaration refers to the link source that must be explicitly displayed in the 5G message.
[0031] Step S5: Analyze the link characteristics to obtain the risk level of the 5G message link.
[0032] Specifically, the above analysis of link characteristics yields the risk levels of 5G message links, including: Step S51: Obtain the basic risk score of the 5G message link based on the number of link redirects and the number of user triggers.
[0033] Specifically, the initial score is P0. Each time a link redirects, P1 points are added. When the number of times a user triggers the link exceeds the normal triggering range, P2 points are added for each additional triggering. This results in a basic risk score. The P0, P1, and P2 scores can be set by the user.
[0034] Step S52: Determine whether the redirection time exceeds the preset normal time threshold; if yes, multiply the risk base score by the preset first factor to obtain the real-time risk score; if no, use the risk base score as the real-time risk score; or, determine whether the final domain name is consistent with the initial declaration; if no, multiply the risk base score by the preset second factor to obtain the real-time risk score; if yes, use the risk base score as the real-time risk score.
[0035] Specifically, if the redirection time exceeds the preset normal time threshold, it means that the redirection time is much slower than normal, and the risk base score is multiplied by R0; if the final page is inconsistent with the initial statement, it means that the message contains false information, and the risk base score is multiplied by R1.
[0036] Furthermore, the two judgment scenarios can be combined. If the redirection time exceeds the preset normal time threshold and the final page is inconsistent with the initial statement, then the risk base score is multiplied by R0 and R1 to obtain the real-time risk score.
[0037] Step S53: Query the preset risk classification table based on the real-time risk score to obtain the risk level.
[0038] Specifically, such as Figure 2 As shown, if the real-time risk score is less than or equal to Q0, it is determined to be in the low-risk category; if the real-time risk score is greater than Q1, it is determined to be in the high-risk category; Q0, Q1, R0, and R1 can all be manually set by the user.
[0039] Step S6: Perform a message blocking operation or send a 5G message link according to the risk level.
[0040] Specifically, the aforementioned actions of blocking messages or sending 5G message links based on risk levels include: Step S61: If the risk level is high-risk, then perform a message blocking operation.
[0041] Step S62: If the risk level is low, then send a 5G message link.
[0042] The above embodiment provides a 5G message link security detection method. After receiving a 5G message link, the basic information of the message port corresponding to the 5G message link is first input into a decision tree model for surface detection. If the short link risk probability output by the decision tree model is higher than a preset probability threshold, it indicates that the link is risky, and its transmission is directly blocked. If the short link risk probability is lower than the preset risk threshold, a risk assessment is further performed based on the link characteristics of the 5G message link. The 5G message link can be transmitted based on the assessed risk level. The above method performs security detection based on early signs such as the basic information of the message port and the link characteristics of the message link. It can identify the security risks of 5G message link content earlier and more accurately, providing service providers with sufficient time to take preventive measures. It also has wider applicability and lower cost.
[0043] In some embodiments, if the real-time risk score is greater than Q0 and less than Q1, it is determined to be a medium-risk level. The method further includes: step S63, if the risk level is medium-risk level, then analyze the final interface content of the 5G message link based on the large language model to obtain the final interface security probability; and perform a message blocking operation or send a 5G message link based on the final interface security probability.
[0044] Specifically, an OCR algorithm is used to extract the final interface content of the 5G message link; the final interface content is analyzed to obtain the textual semantic contradiction features of the 5G message link; the JS dynamic behavior features and textual semantic contradiction features of the 5G message link are input into a large language model for multimodal analysis for recognition to obtain the final interface security probability. If the final interface security probability is less than or equal to the first security threshold, and the daily message sending volume is less than or equal to the first traffic threshold, then the 5G message link is sent; if the final interface security probability is greater than the first security threshold and less than the second security threshold, and the daily message sending volume is greater than the first traffic threshold and less than the second traffic threshold, then the 5G message link and risk warning information are sent; if the final interface security probability is greater than the second security threshold, and the daily message sending volume is greater than the second traffic threshold, then a message blocking operation is performed.
[0045] First, addressing the issues of OCR's sensitivity to character structure and the inability of traditional OCR to detect content security issues due to its limited recognition of visible text, this application proposes a layered pruning ratio in the OCR pruning algorithm. This pruning technique significantly improves the speed of link content security detection.
[0046] However, the OCR algorithm essentially only extracts the content of the screenshot after the link jumps, that is, the final interface content. This application also needs to extract the text semantic contradiction features in the final interface content, such as logical contradictions, such as the black ball being white. All places in the final interface content that have text semantic contradictions will be extracted as text semantic contradiction features.
[0047] Secondly, this application also introduces JS dynamic behavior features, including the number of link jumps mentioned above, and can also add user behavior response methods (such as whether there is abnormal event binding), the execution environment of JS code in the message link (such as whether it is restricted by sandbox or cross-domain policy), dynamic loading behavior (whether it dynamically injects or loads external resources), etc.; JS dynamic behavior features and text semantic contradiction features well interpret the characteristics of 5G message link content security.
[0048] Then, the dynamic behavior features of JS and the semantic contradiction features of text are input into the LLM model of multimodal analysis for analysis to obtain the final interface security probability. This approach takes into account the advantages of the multimodal analysis LLM model for image and text detection, and combines the key factors of 5G message link content security, which can identify the risks of 5G message link content security in a more real-time and accurate manner.
[0049] Furthermore, an improved multimodal analysis (LLM) model can be used. The original loss function of the LLM model only included word-level classification loss function and sentence-level classification loss function. On this basis, loss terms corresponding to JS dynamic behavior features and text semantic contradiction features can be added to further improve the accuracy of 5G link content security detection.
[0050] Finally, after obtaining the ultimate interface security probability, a 5G message link content security intelligent early warning mechanism is constructed by combining the ultimate interface security probability and the daily message sending volume, further shaping a secure and reliable 5G message link content security ecosystem: If the daily message sending volume is less than or equal to the first traffic threshold, and the final interface security probability is less than or equal to the first security threshold (e.g., the first traffic threshold is 50,000, and the first security threshold is 0.3), it is marked as risk-free, and the message can be sent normally. If the daily message sending volume is greater than the first traffic threshold but less than the second traffic threshold, and the final interface security probability is greater than the first security threshold but less than the second security threshold (e.g., the second traffic threshold is 100,000, and the second security threshold is 0.6), it is marked as potentially risky, and the message can be sent, but the SMS is marked as potentially risky. If the daily message sending volume is greater than the second traffic threshold, and the final interface security probability is greater than the second security threshold, it is marked as high risk, and the SMS is blocked from being sent.
[0051] When the real-time risk score is at the medium-risk level, the above embodiment initiates the final layer of interface content security detection. By introducing JS dynamic behavior features and text semantic contradiction features, it is more in line with the 5G message short link security detection scenario. Through the three-layer penetration detection mechanism, the detection speed and accuracy of 5G message link content security are greatly improved.
[0052] Please see Figure 3 Another embodiment of this application provides a security detection device for 5G message links, including: The message receiving module 101 is used to receive 5G message links and determine the corresponding 5G message port.
[0053] The surface detection module 102 is used to input the basic information of the 5G message port into the decision tree model to obtain the short chain risk probability.
[0054] The surface judgment module 103 is used to determine whether the probability of short link risk is greater than a preset probability threshold; if so, a message blocking operation is performed; if not, the link characteristics of the 5G message link are extracted.
[0055] The risk assessment module 104 is used to analyze link characteristics and obtain the risk level of 5G message links.
[0056] The risk execution module 105 is used to perform message blocking operations or send 5G message links according to the risk level.
[0057] The specific limitations of the 5G message link security detection device provided in this embodiment can be found in the embodiment of the 5G message link security detection method described above, and will not be repeated here. Each module in the above-described 5G message link security detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.
[0058] This application provides a computer device that may include a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it causes the processor to perform the steps of a 5G message link security detection method as described in any of the above embodiments.
[0059] The working process, working details, and technical effects of the computer device provided in this embodiment can be found in the embodiment of a 5G message link security detection method described above, and will not be repeated here.
[0060] This application provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of a 5G message link security detection method as described in any of the above embodiments. The computer-readable storage medium refers to a data storage carrier, which may include, but is not limited to, floppy disks, optical disks, hard disks, flash memory, USB flash drives, and / or Memory Sticks. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The working process, details, and technical effects of the computer-readable storage medium provided in this embodiment can be found in the embodiments of a 5G message link security detection method described above, and will not be repeated here.
[0061] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM).
[0062] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0063] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.
Claims
1. A method for secure detection of 5G message links, characterized in that, include: Receive 5G message links and determine the corresponding 5G message port; Input the basic information of the 5G message port into the decision tree model to obtain the short chain risk probability; Determine whether the probability of the short chain risk is greater than a preset probability threshold; If yes, then perform a message blocking operation; if no, then extract the link characteristics of the 5G message link. Analyzing the link characteristics, the risk level of the 5G message link is obtained; Execute message blocking operation or send the 5G message link according to the risk level.
2. The 5G message link security detection method according to claim 1, characterized in that, The basic information of the 5G messaging port includes the real-name verification result, domain name registration duration, and daily message sending volume.
3. The 5G message link security detection method according to claim 1, characterized in that, The link characteristics include the number of link jumps, the number of user triggers, the jump duration, the final domain name, and the initial declaration of the 5G message link.
4. The 5G message link security detection method according to claim 3, characterized in that, The analysis of the link characteristics yields the risk level of the 5G message link, including: The risk score of the 5G message link is obtained based on the number of link redirects and the number of user triggers. Determine whether the jump duration exceeds a preset normal time threshold; if so, multiply the risk base score by a preset first factor to obtain a real-time risk score; if not, use the risk base score as the real-time risk score. Alternatively, determine whether the final domain name is consistent with the initial declaration; if not, multiply the risk base score by the preset second factor to obtain a real-time risk score; if yes, use the risk base score as the real-time risk score. The risk level is obtained by querying the preset risk classification table based on the real-time risk score.
5. The 5G message link security detection method according to claim 2, characterized in that, The step of performing message blocking operation or sending the 5G message link according to the risk level includes: If the risk level is high-risk, then a message blocking operation will be performed; If the risk level is low, then send the 5G message link; If the risk level is medium risk, the final interface content of the 5G message link is analyzed based on the large language model to obtain the final interface security probability; based on the final interface security probability, a message blocking operation is performed or the 5G message link is sent.
6. The 5G message link security detection method according to claim 5, characterized in that, The method of analyzing the final interface content of 5G message links based on large language models to obtain the final interface security probability includes: The final interface content of the 5G message link is extracted using an OCR algorithm; Analyzing the content of the final interface, we obtain the textual semantic contradiction features of the 5G message link; The JS dynamic behavior features and text semantic contradiction features of the 5G message link are input into a large language model for multimodal analysis for identification, thereby obtaining the ultimate interface security probability.
7. The 5G message link security detection method according to claim 5, characterized in that, The step of performing message blocking operations or sending the 5G message link based on the ultimate interface security probability includes: If the final interface security probability is less than or equal to the first security threshold, and the daily message sending volume is less than or equal to the first traffic threshold, then the 5G message link is sent; if the final interface security probability is greater than the first security threshold and less than the second security threshold, and the daily message sending volume is greater than the first traffic threshold and less than the second traffic threshold, then the 5G message link and risk warning information are sent; if the final interface security probability is greater than the second security threshold, and the daily message sending volume is greater than the second traffic threshold, then a message blocking operation is performed.
8. A security detection device for 5G message links, characterized in that, include: The message receiving module is used to receive 5G message links and determine the corresponding 5G message port; The surface detection module is used to input the basic information of the 5G message port into the decision tree model to obtain the short chain risk probability. The surface-level judgment module is used to determine whether the probability of the short link risk is greater than a preset probability threshold; if so, a message blocking operation is performed; if not, the link features of the 5G message link are extracted. The risk assessment module is used to analyze the link characteristics and obtain the risk level of the 5G message link; The risk execution module is used to perform message blocking operations or send the 5G message link according to the risk level.
9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the 5G message link security detection method as described in any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the 5G message link security detection method as described in any one of claims 1 to 7.