A Deep Learning-Based Intelligent Review Method and System for Communication Information Content

Abstract

This application provides a method and system for intelligent content moderation of communication information based on deep learning, belonging to the field of communication information moderation technology. First, it acquires the text stream of the session to be moderated in an enterprise-level instant messaging system. For each complete session thread, it models the message intent evolution trajectory, extracts message intent tags, and concatenates them into an intent evolution state transition sequence. This sequence is then compared with a pre-set library of state transition graphs for violating business intents to identify suspected violating intent trajectories. Next, it constructs a session context evidence chain around the core violating intent, and then inputs it into a pre-trained deep learning network for multi-level violation feature extraction, generating a comprehensive violation confidence score and the final content moderation interception command. This invention can effectively improve the accuracy and intelligence level of content moderation in enterprise-level instant messaging systems.

Description

Technical Field

[0001] This application relates to the field of communication information review technology, and more specifically, to a method and system for intelligent review of communication information content based on deep learning. Background Technology

[0002] With the widespread application of enterprise-level instant messaging systems, internal communication and collaboration within enterprises heavily rely on such systems. A large amount of business communication information flows through the system in the form of conversational text streams. These conversational text streams contain key information on various aspects of enterprise operations, management, and business development. Effective content review of these streams is crucial for ensuring enterprise information security, regulating employee behavior, and maintaining normal enterprise operations.

[0003] Currently, traditional methods for reviewing communication content primarily rely on keyword matching and simple rule-based judgment. Keyword matching methods search the conversation text for pre-defined keywords that may indicate violations, identifying any matching keywords as violations. However, these methods have significant limitations, easily leading to numerous false positives and false negatives. For example, normal business terms may be incorrectly identified as violations in different contexts, while some implicitly worded violations may escape keyword matching. Simple rule-based judgment methods, while considering contextual information to some extent, often have fixed and rigid rules, making it difficult to adapt to complex and ever-changing business scenarios and evolving violation methods. They also fail to accurately identify violation conversation content with complex evolving intent. Therefore, existing communication content review methods are insufficient to meet the accuracy and comprehensiveness requirements of enterprise-level instant messaging systems for content review. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a method and system for intelligent review of communication information content based on deep learning.

[0005] According to a first aspect of this application, a method for intelligent review of communication information content based on deep learning is provided, the method comprising:

[0006] Obtain the pending session text stream from the enterprise instant messaging system. The pending session text stream contains multiple complete session threads sorted by session initiation timestamp. Each complete session thread consists of at least one message sent by an employee and at least one corresponding work group reply message.

[0007] For each complete session thread, a message intent evolution trajectory modeling process is performed. The message intent tags of each employee's message and the reply intent tags of each work group reply message in the complete session thread are extracted. The message intent tags and reply intent tags are then concatenated into an intent evolution state transition sequence according to the message sending time order.

[0008] The intent evolution state transition sequence is compared with each standard illegal intent state transition path in the preset illegal business intent state transition map library. The intent evolution state transition sequence with a similarity exceeding the preset similarity threshold with the standard illegal intent state transition path is identified as a suspected illegal intent trajectory.

[0009] Based on the employee-sent messages and work group reply messages in the complete session thread corresponding to the suspected violation intent trajectory, a session context evidence chain is constructed around the core violation intent. The session context evidence chain includes at least one employee-sent message as the starting point of the violation intent, at least one work group reply message as the reinforcement of the violation intent, and at least one employee-sent message as the confirmation of the execution of the violation intent.

[0010] The session context evidence chain is input into a pre-trained message content deep parsing network for multi-level violation feature extraction processing, generating a comprehensive violation confidence score corresponding to the session context evidence chain, and generating a final content review interception instruction based on the comprehensive violation confidence score. The content review interception instruction includes a globally unique identifier of the message to be intercepted and the corresponding violation type code.

[0011] According to a second aspect of this application, a deep learning-based intelligent review system for communication information content is provided. The deep learning-based intelligent review system for communication information content includes a machine-readable storage medium and a processor. The machine-readable storage medium stores machine-executable instructions. When the processor executes the machine-executable instructions, the deep learning-based intelligent review system for communication information content implements the aforementioned deep learning-based intelligent review method for communication information content.

[0012] Based on any of the above aspects, the technical effect of this application is as follows:

[0013] By acquiring the text stream of pending conversations in an enterprise-level instant messaging system and modeling the message intent evolution trajectory on a complete conversation thread basis, the intent tags of each message can be extracted and concatenated into an intent evolution state transition sequence. The intent evolution state transition sequence is then compared with a pre-set library of violation business intent state transitions to efficiently identify suspected violation intent trajectories, significantly improving the accuracy and efficiency of initial screening for violations. A conversation context evidence chain centered around the core violation intent is constructed, comprehensively considering key aspects such as the starting point, reinforcement, and execution confirmation of the violation intent. Finally, the conversation context evidence chain is input into a pre-trained message content deep parsing network for multi-level violation feature extraction, generating a comprehensive violation confidence score and the final content review interception command. This achieves intelligent processing throughout the entire process, from intent analysis to in-depth violation feature mining to precise review and interception, effectively improving the accuracy, comprehensiveness, and intelligence of content review in enterprise-level instant messaging systems. Attached Figure Description

[0014] Figure 1 A flowchart illustrating the intelligent review method for communication information content based on deep learning provided in an embodiment of this application is shown.

[0015] Figure 2 This paper illustrates a schematic diagram of the component structure of a deep learning-based intelligent review system for communication information content provided in an embodiment of this application. Detailed Implementation

[0016] Figure 1 This paper illustrates a flowchart of a deep learning-based intelligent review method and system for communication information content provided in an embodiment of this application. The detailed steps include:

[0017] Step S110: Obtain the pending session text stream from the enterprise instant messaging system. The pending session text stream contains multiple complete session threads sorted by session initiation timestamps. Each complete session thread consists of at least one message sent by an employee and at least one corresponding work group reply message.

[0018] The system retrieves all session records from the enterprise-level instant messaging server's log database within a preset review period. This review period is set from midnight to noon. The retrieved raw data consists of log entries in JSON format, each containing a unique message identifier (msg_id), a session identifier (conv_id), a sender identifier (sender_id), a receiver identifier (receiver_id), a message timestamp, and a message content. The raw log entries are grouped and aggregated using the session identifier (conv_id) to form multiple complete session threads. For example, a specific session thread has the session identifier conv_001. All message entries within this thread are parsed and arranged in chronological order according to their timestamps, generating an ordered list. The first message in the list is sent by employee "Zhang San" at 9:01 AM: "Li Si, are you there? I have a project I'd like to collaborate on." The sender identifier (sender_id) is linked to the enterprise employee database, confirming that the message was sent by an employee. The second message was an automated reply from the official bot account of the work group "Project Alpha Collaboration Group" at 9:02 AM: "Your message has been forwarded to Li Si, please wait patiently." This account was marked as a work group bot in the enterprise system. The third message was a reply from employee "Li Si" in the group at 9:05 AM: "Zhang San, what are the specific project details?" These three messages together constitute a complete conversation thread that meets the definition. All conversation threads with similar structures that aggregated within the review period together constitute the text stream of the conversation to be reviewed.

[0019] Step S120: Perform message intent evolution trajectory modeling for each complete session thread, extract the message intent tag of each employee's message and the reply intent tag of each work group reply message in the complete session thread, and concatenate the message intent tags and reply intent tags into an intent evolution state transition sequence according to the message sending time order.

[0020] For each complete conversation thread in the pending conversation text stream, such as the conv_001 thread mentioned above, intent evolution trajectory modeling is performed. This modeling process converts each natural language message in the thread into a pre-defined intent label. The thread's time-ordered message list is traversed, and message types are distinguished based on the sender identifier. For messages sent by employees, a pre-trained employee intent classification model is invoked; for messages replied to by work groups, a pre-trained group reply intent classification model is invoked. Through these two models, Zhang San's message is converted into the intent label "Initiate informal work contact"; the robot's automatic reply is converted into the intent label "Automatic system notification"; and Li Si's message is converted into the intent label "Inquire about project details". Subsequently, strictly following the chronological order of the messages in the list, the above intent labels are concatenated into an ordered sequence. Thus, the above conversation thread is modeled as an intent evolution state transition sequence, with the form: "Initiate informal work contact" -> "Automatic system notification" -> "Inquire about project details".

[0021] Step S121: Obtain the first complete session thread from the enterprise-level instant messaging system, parse the message sending timestamps of all messages in the first complete session thread, sort all messages in the first complete session thread according to the order of message sending timestamps, and generate a time-ordered message list of the first complete session thread.

[0022] From the pending session text stream, the first complete session thread to be processed is located, with its session identifier being conv_001. The metadata of all messages within this thread is parsed, and the message sending timestamp field is extracted. The timestamps for Zhang San's messages are t1=1698116460, the robot's messages are t2=1698116520, and Li Si's messages are t3=1698116700. These three values ​​are compared, and the original message objects are sorted in ascending order to reconstruct a message list. After sorting, the first element of the list is Zhang San's message object, the second element is the robot's message object, and the third element is Li Si's message object. This list, sorted in ascending order of timestamps, is output as the time-ordered message list L_msg for this thread.

[0023] Step S122: Traverse the first message in the time-ordered message list of the first complete session thread, identify the sender role attribute of the first message, and when the sender role attribute of the first message is employee, mark the first message as a message sent by an employee, and input the first message into a pre-trained employee intent classifier.

[0024] The system iterates through the first message in the time-ordered message list L_msg, which is the message sent by Zhang San. It queries the company's unified identity authentication service to obtain the role attribute field corresponding to the sender identifier zhangsan@company.com. The service returns a role value of 'employee'. Based on this identification result, a type marker field msg_type is added to the message's metadata, and its value is assigned to 'employee_msg'. Next, the intent analysis process is triggered, using the complete text content of the message as input data to pass to the pre-trained employee intent classifier model M_emp_intent.

[0025] Step S123: Perform deep semantic analysis on the text content of the first message using the pre-trained employee intent classifier, extract the core employee demand keywords hidden in the first message, match the core employee demand keywords with a preset employee intent tag library, and generate the first employee message intent tag corresponding to the first message.

[0026] After receiving the input text, the employee intent classifier M_emp_intent processes the text as follows: It performs character-level and word-level segmentation, generating character sequences and word sequences. These sequences are then converted into character embedding matrices E_char and E_word embedding matrices E_word, respectively, through an embedding layer. Both embedding dimensions are d=256, resulting in E_char having a shape of [len_char, 256] and E_word having a shape of [len_word, 256]. A bidirectional long short-term memory network layer encodes these two matrices, capturing the contextual dependencies of the sequences and outputting two feature matrices F_char and F_word with identical shapes. An attention fusion layer calculates the importance weights of character-level and word-level features, weights them, and fuses them to generate a final comprehensive semantic feature vector V_semantic, with a dimension of 512. V_semantic is then fed into a fully connected classification layer. The number of output nodes in this fully connected classification layer is equal to the size of a pre-defined employee intent label library containing 80 categories. The fully connected layer uses the Softmax activation function to map a 512-dimensional vector into an 80-dimensional probability distribution vector P_intent, where each value represents the probability that the input text belongs to the corresponding category intent. The index idx corresponding to the maximum value is taken, and the corresponding intent tag text is retrieved from the employee intent tag library based on this index. For this message, the obtained intent tag is "Initiate informal work contact," which is the first employee message intent tag L_emp1 corresponding to the first message.

[0027] The training steps for the employee intent classifier include:

[0028] Step S123-1: Construct an employee message training dataset for training an employee intent classifier. The employee message training dataset contains M employee messages extracted from the historical session database. Each employee message corresponds to an employee intent label manually labeled. The number of categories of the employee intent labels is P, and the value of P is 80.

[0029] Before pre-training the employee intent classifier, a large-scale training dataset was first constructed. All archived conversation records from the past three years were extracted from the historical archive database of the enterprise instant messaging system. From these conversation records, messages sent by employee accounts were selected, resulting in M ​​employee-sent messages, where M is a multiple of 500,000. Then, an annotation team composed of compliance audit experts labeled each employee-sent message with intent tags. Based on the message content, the annotation team selected the most matching intent tag for each message from a pre-defined employee intent tag library containing 80 categories. This employee intent tag library covers common intents in daily enterprise communication, including "initiating work inquiries," "seeking approval," "providing feedback," "confirming information," "initiating informal work contact," "inquiring about project details," "requesting resources," and "reporting progress." After annotation, each employee-sent message was associated with a unique manually labeled intent tag, and the annotated dataset together constituted the employee message training dataset.

[0030] Step S123-2: Construct the model architecture of the employee intent classifier. The employee intent classifier adopts a Transformer-based encoder structure, which includes an input embedding layer, a position encoding layer, N Transformer encoder layers, and a classification output layer, where N is 12.

[0031] The specific network structure for constructing the employee intent classifier is described. This employee intent classifier adopts a Transformer-based encoder architecture. In the input embedding layer, the input text is first segmented into words, and each word is converted into a dense word vector of dimension D (768) through a learnable word embedding matrix. Simultaneously, the positional encoding layer adds positional encoding information to each word, enabling the model to perceive the sequential relationship between words. The word vector sequence after embedding and positional encoding is fed into N stacked Transformer encoder layers, where N is 12. Each Transformer encoder layer contains a multi-head self-attention sublayer and a feedforward neural network sublayer, and each sublayer is followed by residual connections and layer normalization operations. After processing by N encoder layers, a context-enhanced feature matrix with the same length as the input sequence is output. The classification output layer extracts the output vector of the first position of the feature matrix (corresponding to the special label CLS) and inputs the vector into a fully connected classification network. The number of output nodes of the fully connected classification network is equal to the total number of categories P in the employee intent label library, where P is 80. Finally, the fully connected classification network outputs a P-dimensional probability distribution vector through the Softmax activation function.

[0032] Step S123-3: Train the employee intent classifier using the employee message training dataset. During the training process, use the cross-entropy loss function to calculate the loss value between the predicted intent label distribution and the manually labeled intent labels, and update the network parameters of the employee intent classifier through the backpropagation algorithm until the cross-entropy loss function value converges to obtain the pre-trained employee intent classifier.

[0033] The employee intent classifier constructed in step S123-2 is trained using the employee message training dataset built in step S123-1. During training, the employee message training dataset is divided into a training set and a validation set. The training set contains 450,000 samples, and the validation set contains 50,000 samples. In each iteration, a batch of samples of size B (where B is 32) is drawn from the training set, and the message text sent by employees in each batch is input into the employee intent classifier. After forward propagation, the employee intent classifier outputs a P-dimensional predicted intent probability distribution vector. Simultaneously, the manually labeled intent tags corresponding to each message in the batch are obtained and converted into one-hot encoded vectors as the true intent distribution. The cross-entropy loss function is used to calculate the loss value between the predicted intent probability distribution and the true intent distribution. The gradient of the loss function with respect to all trainable parameters of the employee intent classifier is calculated using the backpropagation algorithm, and the Adam optimizer is used to update the network parameters with an initial learning rate of LR_init (where LR_init is 0.0001). After each iteration through all training samples, the classification accuracy of the model is calculated on the validation set. When the classification accuracy on the validation set no longer improves in several consecutive rounds, training is stopped, and the network parameters at this point are saved to form a pre-trained employee intent classifier.

[0034] Step S124: Continue to traverse the second message in the time-ordered message list of the first complete session thread, identify the sender role attribute of the second message, and mark the second message as a work group reply message when the sender role attribute of the second message is a work group robot or a work group administrator.

[0035] Continuing to iterate through the time-ordered message list L_msg, the second message is retrieved and processed. This second message is a reply sent by a work group robot account. By querying the enterprise instant messaging system's account database, the sender's account type, identified as project_alpha_bot, is determined. The database shows that the account type is app_robot and that it has admin privileges within the group. Based on this identification, the sender's role attribute is determined to be group_robot. Therefore, a type marker field msg_type is added to the metadata of this message, assigned the value group_reply_msg.

[0036] Step S125: Input the second message into a pre-trained group reply intent classifier, perform response pattern analysis on the text content of the second message through the group reply intent classifier, extract the response type of the second message to the first message, match the response type with a preset group reply intent tag library, and generate the first group reply intent tag corresponding to the second message.

[0037] The robot's reply text, labeled `group_reply_msg`, is input into a pre-trained group reply intent classifier `M_group_intent`. This classifier employs a Transformer-based encoder architecture. The first message and the current reply message are concatenated into an input sequence, separated by a special delimiter `[SEP]`. This concatenated sequence is then processed by an embedding layer, transforming it into an embedding matrix of shape `[total_len, 512]`. This embedding matrix is ​​processed through multiple Transformer blocks, where each layer's multi-head self-attention mechanism calculates the attention weight of each word in the reply message to each word in the first message, thus modeling the semantic association strength between the two. After encoding, the output corresponding to the reply message portion is taken and average pooled to obtain a 512-dimensional response pattern feature vector `V_response`. This response pattern feature vector is then input into a classification network. The number of output layer nodes in this classification network is equal to the size of a pre-defined group reply intent label library containing 30 categories. The classification network outputs a 30-dimensional probability distribution. The index corresponding to the maximum probability is taken and searched in the group response intent tag library to obtain the corresponding intent tag. For this message, its response intent is identified as "confirmation of information delivery", which is the first group response intent tag L_group1 corresponding to the second message.

[0038] The training steps for the group reply intent classifier include: Step S125-1: Constructing a group reply message training dataset for training the group reply intent classifier. The group reply message training dataset contains K working group reply messages extracted from the historical session database. Each working group reply message corresponds to a manually labeled group reply intent label. The number of categories for the group reply intent label is Q, and the value of Q is 30.

[0039] Before pre-training the group reply intent classifier, its training dataset was first constructed. All reply messages sent by workgroup bot accounts or workgroup administrator accounts were extracted from the historical session database, resulting in K workgroup reply messages, where K is set to 300,000. The annotation team selected the most matching intent tag for each message from a pre-defined group reply intent tag library containing 30 categories, based on the content of each reply message and its preceding message. This tag library covers common reply intents of group bots and administrators, including "information delivery confirmation," "automatic reply," "problem transfer," "process guidance," "prompt guidelines," "warning reminders," and "approval result notifications." After annotation, each workgroup reply message was associated with a unique manually annotated group reply intent tag. The annotated dataset together constituted the group reply message training dataset.

[0040] Step S125-2: Construct the model architecture of the group reply intent classifier. The group reply intent classifier adopts a Transformer-based dual-tower encoder structure, which includes a context message encoder, a reply message encoder, an interaction attention fusion layer, and a classification output layer.

[0041] The specific network structure for constructing a group reply intent classifier is described. This classifier employs a Transformer-based dual-tower encoder architecture to handle the interaction between the reply message and its preceding message. The preceding message encoder encodes the employee message being replied to, and its internal structure is identical to the Transformer encoder in the employee intent classifier, including an input embedding layer, a positional encoding layer, and multiple Transformer encoder layers. The reply message encoder uses the same structure to encode the current reply message. After processing by the two encoders, the context-enhanced feature matrix of the preceding message and the context-enhanced feature matrix of the reply message are obtained. The interaction attention fusion layer first performs average pooling on the feature matrix of the reply message to obtain a global feature vector for the reply message; then, it performs cross-attention calculation between the feature matrix of the preceding message and this global feature vector to obtain the weighted features of the preceding message most relevant to the current reply. The weighted features are then concatenated with the global feature vector of the reply message to form a fused feature vector. The classification output layer inputs the fused feature vector into a fully connected classification network. The number of output nodes of this fully connected classification network is equal to the total number of categories Q in the group response intent label library, where Q is 30. Finally, a Q-dimensional probability distribution vector is output through the Softmax activation function.

[0042] Step S125-3: Train the group reply intent classifier using the group reply message training dataset. During the training process, use the focus loss function to calculate the loss value between the predicted reply intent label distribution and the manually labeled reply intent labels, and update the network parameters of the group reply intent classifier through the backpropagation algorithm until the focus loss function value converges to obtain the pre-trained group reply intent classifier.

[0043] The group reply message training dataset constructed in step S125-1 is used to train the group reply intent classifier constructed in step S125-2. The training dataset is divided into a training set containing 270,000 samples and a validation set containing 30,000 samples. In each iteration, each reply message and its corresponding preceding message are extracted from a batch, and these messages are input into the group reply intent classifier. The classifier outputs a Q-dimensional predicted reply intent probability distribution vector. Since the distribution of group reply intent labels may be imbalanced, a focus loss function is used as the optimization objective. This focus loss function reduces the weight of easily classified samples by introducing a modulation factor, making the model focus more on difficult-to-classify samples. The focus loss value between the predicted distribution and the manually labeled one-hot vector is calculated, the gradient is calculated using the backpropagation algorithm, and the network parameters are updated using the Adam optimizer. Training stops when the focus loss value on the validation set tends to stabilize, the network parameters are saved, and a pre-trained group reply intent classifier is formed.

[0044] Step S126: Arrange the first employee message intent tag and the first group reply intent tag in sequence according to the order of the message sending timestamps to form the initial intent evolution fragment of the first complete session thread.

[0045] At this point, the intent tags for the first two messages in the first complete session thread have been obtained. These two tags are concatenated, strictly following their order in the chronologically ordered message list. The concatenated result is a binary sequence: "Initiate Informal Working Contact" -> "Message Confirmation". This binary sequence is considered an initial intent evolution fragment F_init in the thread's evolution process.

[0046] Step S127: Continue to traverse each remaining message in the time-ordered message list of the first complete session thread, and repeatedly perform sender role attribute identification processing, corresponding intent classifier call processing, and intent tag generation processing for each message to obtain the message intent tag or reply intent tag corresponding to each message.

[0047] Continuing to process the remaining messages in the time-ordered message list L_msg, specifically the third message sent by Li Si. The sender Li Si's role attribute is identified, and he is confirmed as an employee through the unified identity authentication service. This message is labeled as employee_msg. Its text content is input into the same pre-trained employee intent classifier M_emp_intent, undergoing the same deep semantic parsing process, outputting an 80-dimensional probability distribution. The index corresponding to the maximum probability is taken, and the intent tag corresponding to this message is retrieved from the employee intent tag library. For Li Si's message, the intent is identified as "inquiring about project details" L_emp2.

[0048] Step S128: Concatenate all message intent tags and reply intent tags generated between the first message and the last message in the time-ordered message list according to the order of message sending timestamps to generate the complete intent evolution state transition sequence corresponding to the first complete session thread.

[0049] The generated tags "Initiate Informal Working Contact" (L_emp1), "Confirm Message Transmission" (L_group1), and "Inquire about Project Details" (L_emp2) are concatenated strictly in chronological order. The result is an ordered sequence of tags: "Initiate Informal Working Contact" -> "Confirm Message Transmission" -> "Inquire about Project Details," which is defined as the complete intent evolution state transition sequence S_seq corresponding to the first complete session thread conv_001.

[0050] Step S129: Repeat the above steps from parsing the message sending timestamp to generating a complete intent evolution state transition sequence for each complete session thread in the enterprise instant messaging system, to obtain the intent evolution state transition sequence corresponding to each complete session thread, forming an intent evolution state transition sequence set.

[0051] The processing flow described in steps S121 to S128 above is applied to each complete session thread in the session text stream to be reviewed. After all threads have finished processing, the intent evolution state transition sequence set Set_S is obtained.

[0052] Step S130: Perform path similarity comparison processing between the intent evolution state transition sequence and each standard illegal intent state transition path in the preset illegal business intent state transition map library, and identify intent evolution state transition sequences whose similarity with the standard illegal intent state transition path exceeds a preset similarity threshold as suspected illegal intent trajectories.

[0053] Violation pattern matching is performed on the set of intent evolution state transition sequences, Set_S. A pre-constructed library of violation business intent state transition graphs, Lib_path, stores the intent evolution paths corresponding to various known violations. For example, a standard "violation of benefit transfer" intent path might be: "Initiating a sensitive benefit topic" -> "Providing personal account information" -> "Confirming transaction details". The core task of this step is to compare each intent evolution state transition sequence S_seq in the set with each standard path P_std in the graph and calculate their similarity. When the similarity score between a sequence and a standard path exceeds a preset threshold th_sim, the sequence is determined to potentially contain violation behavior and is marked as a suspected violation intent trajectory T_suspect.

[0054] Step S131: Take out the first intention evolution state transition sequence to be compared from the set of intention evolution state transition sequences, and extract all intention label types contained in the first intention evolution state transition sequence to be compared and the order position index of each intention label type in the sequence.

[0055] Take the first sequence S_seq1 to be compared from the set of intent evolution state transition sequences Set_S. Assume this sequence is "Initiate Informal Working Contact" -> "Confirm Message Transmission" -> "Inquire about Project Details". Parse this sequence and extract its constituent elements. First, extract all unique intent label types contained in the sequence, resulting in a type set Set_type, for example, {"Initiate Informal Working Contact", "Confirm Message Transmission", "Inquire about Project Details"}. Then, create a position index idx for each element in the sequence, starting from 0. The position index for "Initiate Informal Working Contact" is 0, the position index for "Confirm Message Transmission" is 1, and the position index for "Inquire about Project Details" is 2.

[0056] Step S132: Read the first standard violation intent state transition path from the preset violation business intent state transition graph library. The first standard violation intent state transition path consists of multiple standard violation intent nodes arranged in a fixed order, and each standard violation intent node corresponds to a specific violation intent tag.

[0057] The first standard violation intent state transition path P_std1 is read from the violation intent state transition graph library Lib_path. Assume the first standard path stored in the graph is a typical pattern of "disclosing trade secrets," with the node sequence: "Inquire about confidential information" -> "Confirm the value of the information" -> "Provide confidential documents." These three nodes are arranged in a fixed order, and each node corresponds to a predefined violation intent label.

[0058] Step S133: Calculate the length of the longest common subsequence between the first intent evolution state transition sequence to be compared and the first standard violation intent state transition path. The length of the longest common subsequence is used to measure the maximum number of intent tags that the two sequences can match while keeping the element order unchanged.

[0059] The longest common subsequence (LCS) algorithm is used to compute the longest subsequence between S_seq1 and P_std1. This algorithm finds the longest subsequence that appears sequentially in both original sequences, but is not required to be consecutive. The intent labels of the two sequences are compared element-wise. Through dynamic programming, it is found that "asking about project details" and "asking about confidential information" belong to different semantic levels and cannot be matched. Ultimately, the algorithm yields a LCS_len of 0.

[0060] Step S134: Divide the length of the longest common subsequence by the total number of standard violation intent nodes contained in the first standard violation intent state transition path to obtain the first path coverage ratio of the first intent evolution state transition sequence to the first standard violation intent state transition path.

[0061] Obtain the total number of nodes in the first standard path P_std1, which contains 3 nodes. Divide the length of the longest common subsequence (LCS_len) by the total number of nodes using the formula: cov_ratio = LCS_len / len(P_std1). Since LCS_len is 0 and len(P_std1) is 3, the calculated first path coverage ratio cov_ratio is 0.

[0062] Step S135: Calculate the edit distance between the first intent evolution state transition sequence to be compared and the first standard violation intent state transition path. The edit distance is used to measure the minimum number of operations required to transform one sequence into another through insertion, deletion, or replacement operations.

[0063] Continue calculating the edit distance for S_seq1 and P_std1. The edit distance algorithm considers the minimum number of single-character edit operations required to transform sequence A into sequence B. For the sequence to be compared with a length of 3 and the standard path with a length of 3, calculate the minimum number of operations required to transform the former into the latter. Since the two sequences are semantically very different, it may be necessary to replace all three labels of the sequence to be compared with the three labels of the standard path; therefore, the edit distance edit_dist is 3.

[0064] Step S136: Perform a weighted summation operation based on the first path coverage ratio and the edit distance to generate a comprehensive path similarity score between the first intent evolution state transition sequence to be compared and the first standard violation intent state transition path.

[0065] To obtain a comprehensive similarity score, the path coverage ratio and edit distance are combined. First, the edit distance is normalized, converting it into a similarity component between 0 and 1: edit_sim = 1 - (edit_dist / max_len), where max_len is the maximum possible length of the two sequences, which is 3 in this example. Therefore, edit_sim = 1 - (3 / 3) = 0. Preset weights are assigned to the path coverage ratio and edit distance similarity components: the coverage weight w_cov is set to 0.6, and the distance weight w_edit is set to 0.4. The final comprehensive path similarity score is calculated as: sim_total = (w_cov × cov_ratio) + (w_edit × edit_sim) = (0.6 × 0) + (0.4 × 0) = 0.

[0066] Step S137: Compare the comprehensive path similarity score with a preset similarity threshold. When the comprehensive path similarity score is greater than the preset similarity threshold, mark the first intent evolution state transition sequence to be compared as a suspected illegal intent trajectory that matches the first standard illegal intent state transition path.

[0067] The overall path similarity score sim_total=0 is compared with the pre-set similarity threshold th_sim=0.75. Since 0 is less than 0.75, the comparison result is negative. Therefore, this sequence to be compared will not be marked as a suspected violation intent trajectory matching the first standard path.

[0068] Step S138: Read the next standard illegal intent state transition path from the preset illegal business intent state transition graph library, and repeatedly perform the longest common subsequence length calculation, path coverage ratio calculation, edit distance calculation, and comprehensive path similarity score calculation until all standard illegal intent state transition paths in the preset illegal business intent state transition graph library have been traversed.

[0069] After completing the comparison with the first standard path, read the next standard path P_std2 from the violation business intent state transition graph library. Repeat the calculation process of steps S133 to S136. Calculate again the longest common subsequence length, path coverage ratio, edit distance, and overall similarity score with S_seq1. Continue reading the next standard path, and repeat this process until all standard paths in the graph library have been traversed and compared with the current sequence to be compared.

[0070] Step S139: Summarize all the intent evolution state transition sequences to be compared that have a comprehensive path similarity score exceeding a preset similarity threshold with at least one standard illegal intent state transition path to form a set of suspected illegal intent trajectories.

[0071] After comparing all intent evolution state transition sequences with all standard paths in the library, sequences whose overall path similarity score exceeds a preset threshold th_sim in any given comparison are filtered out. Each of these filtered sequences indicates that its corresponding original session thread is highly similar to a known violation in its intent evolution pattern. These sequences are then aggregated into a new set, known as the suspected violation intent trajectory set Set_T.

[0072] Step S140: Based on the employee-sent messages and work group reply messages in the complete session thread corresponding to the suspected violation intent trajectory, construct a session context evidence chain around the core violation intent. The session context evidence chain includes at least one employee-sent message as the starting point of the violation intent, at least one work group reply message as the reinforcement of the violation intent, and at least one employee-sent message as the confirmation of the execution of the violation intent.

[0073] For each trajectory in the set of suspected violation intent trajectories Set_T, it is necessary to trace back its original session thread and extract specific messages that support the violation judgment to form a logically clear chain of evidence. For example, suppose a suspected violation trajectory T_suspect1 is marked as highly similar to the standard path of "leaking trade secrets". The sequence of this suspected violation trajectory is: "inquiring about confidential information" -> "confirming the value of information" -> "providing confidential documents". Go back to the original session thread that generated this trajectory and find the original message corresponding to each intent label in the sequence. Find the message sent by the employee marked "inquiring about confidential information" as the starting point of the violation intent; find the work group reply message marked "confirming the value of information" as the reinforcement of the violation intent; find the message sent by the employee marked "providing confidential documents" as the confirmation of the violation intent. Extract the original text content of these three messages according to their actual chronological order in the session and combine them to form a session context evidence chain E_chain around the core violation intent.

[0074] Step S141: Take out the first suspected violation intent trajectory from the suspected violation intent trajectory set, obtain the target complete session thread corresponding to the first suspected violation intent trajectory, and obtain the time-ordered message list of the target complete session thread.

[0075] The first trajectory T_suspect1 is retrieved from the suspected violation intent trajectory set Set_T. This trajectory is "Inquire about confidential information" -> "Confirm the value of the information" -> "Provide confidential documents". This trajectory itself carries a pointer to the original data, namely the identifier conv_088 of the original session. Using this identifier, the corresponding target complete session thread is located in the stored session data. Then, the time-ordered message list L_msg_088 generated and stored by this thread in step S121 is obtained.

[0076] Step S142: Analyze all intent tags contained in the first suspected violation intent trajectory and their corresponding message position index in the time-ordered message list, and identify the first employee message intent tag that appears in the first suspected violation intent trajectory as the core violation intent starting point.

[0077] Parse the suspected illegal intention track T_suspect1. This suspected illegal intention track consists of three intention tags. When tracing back the process of generating intention tags, each tag was associated with the position index of the original message during generation. Obtain the message corresponding to the index i in the list for the tag "Asking for confidential information", the message corresponding to the index j for "Confirming the value of information", and the message corresponding to the index k for "Providing confidential documents", and i < j < k is satisfied. Since "Asking for confidential information" is the first message intention tag that appears in the sequence and the sender role is an employee, it is identified as the starting point start_point of the core illegal intention of this violation.

[0078] Step S143: According to the message position index corresponding to the starting point of the core illegal intention, locate the message sent by the starting point employee corresponding to the starting point of the core illegal intention from the time-ordered message list, and extract the complete text content of the message sent by the starting point employee as the content of the starting message of the evidence chain.

[0079] According to the message position index i corresponding to the starting point of the core illegal intention start_point, directly locate the i-th message from the time-ordered message list L_msg_088. Obtain the content field of this message. The content of this field is "General Manager Zhang, I heard that the core code of Project X that our company is developing has come out. Can you show it to me for learning?". The text content of this message is completely extracted as the first link of the evidence chain, that is, the content M_start of the starting message of the evidence chain.

[0080] Step S144: Traverse all the work group reply messages in the time-ordered message list that are after the message sent by the starting point employee in chronological order, perform response object analysis on each work group reply message, and identify the first-level work group reply messages that directly reply to the message sent by the starting point employee.

[0081] Start from the index i + 1 of the starting message and traverse all the remaining messages in the time-ordered message list L_msg_088. For each message traversed, check its message type flag msg_type. Only pay attention to those entries where msg_type is group_reply_msg. For each work group reply message, analyze the reply_to_msg_id field in its metadata. If the value of this field is the same as the unique identifier msg_id of the message sent by the starting point employee, then determine that this reply message is the first-level work group reply message directly targeting the starting message.

[0082] Step S145: Select at least one workgroup reply message from the first-level workgroup reply messages that satisfies the semantic reinforcement relationship determination condition with respect to the reply intent tag and the core violation intent starting point, and use it as the intent reinforcement reply message in the evidence chain. Extract the complete text content of the intent reinforcement reply message. The semantic reinforcement relationship determination condition is: calculate the cosine similarity between the intent vector corresponding to the reply intent tag and the intent vector corresponding to the core violation intent starting point. When the cosine similarity exceeds the preset semantic reinforcement threshold, it is determined that there is a semantic reinforcement relationship.

[0083] For all identified direct response start messages in the work group, the group response intent tags generated in step S125 are retrieved one by one. To determine whether there is a semantic reinforcement relationship between the above intent tags and the core violation intent start, a pre-trained semantic relationship discrimination model M_rel is invoked. This semantic relationship discrimination model M_rel internally maintains an intent tag embedding matrix E_intent. The number of rows in this intent tag embedding matrix is ​​equal to the total number of intent tags in the employee intent tag library and the group response intent tag library, and the number of columns is equal to the preset intent embedding dimension D_intent, where D_intent has a value of 256. For the employee message intent tag "inquire about confidential information" corresponding to the core violation intent start, the corresponding intent vector V_intent_start is found in the intent tag embedding matrix E_intent through the index of this intent tag in the employee intent tag library. This intent vector is a dense vector with a dimension of 256. For the response intent tag of the work group reply message to be judged, such as "confirm information value", its index in the group reply intent tag library is used to find its corresponding intent vector V_intent_reply from the same intent tag embedding matrix E_intent, with the same dimension of 256. The semantic relationship discrimination model M_rel calculates the cosine similarity score score_cos between the two intent vectors. A semantic reinforcement threshold th_reinforce is preset, with a value of 0.75. When score_cos is greater than th_reinforce, it is determined that there is a semantic reinforcement relationship between the response intent tag of the work group reply message and the core violation intent starting point. For example, for the pair of intent tags "confirm information value" and "inquire about confidential information", the calculated cosine similarity score is 0.82, which is greater than 0.75, therefore it is determined that there is a semantic reinforcement relationship. Filter out all work group response messages that meet the judgment criteria, and select at least one as the intent-strengthening response message in the evidence chain. Extract its complete text content, for example, "This project is indeed very important, and the code is also a core asset. It's good that you want to learn, but you need to go through the approval process." as the intent-strengthening response message M_reinforce in the evidence chain.

[0084] Step S146: Traverse all employee-sent messages in the time-ordered message list following the intent-enhancing response message in chronological order, perform message content relevance analysis on each employee-sent message, and calculate the semantic similarity between each employee-sent message and the core violation intent starting point.

[0085] After reinforcing the position of the reply message in the list, continue iterating through all remaining messages. Focus only on entries with `msg_type` set to `employee_msg`. For each employee message encountered, calculate the semantic similarity between its text content and the content of the starting message in the evidence chain, `M_start`. A cosine similarity-based calculation model is used. First, the two texts are converted into two 768-dimensional semantic vectors, `V_start` and `V_current`, respectively, using a Sentence-BERT model. Then, the cosine value `cos_sim` of these two vectors is calculated; the closer the cosine value is to 1, the greater the semantic similarity.

[0086] Step S147: Select at least one employee message from the employee messages whose semantic similarity to the core violation intent starting point exceeds a preset relevance threshold, and use it as an intent execution confirmation message in the evidence chain, and extract the complete text content of the intent execution confirmation message.

[0087] A pre-set relevance threshold, th_cos=0.82, is used. The semantic similarity score (cos_sim) of each employee message is compared to this threshold. Messages sent by employees with a cos_sim greater than 0.82 are selected. For example, a message with a semantic similarity score of 0.95, containing the message "Okay, I understand. I've already sent you the approval application via email. Please approve it as soon as possible; I want to start learning quickly.", is selected and used as the intent execution confirmation message M_confirm in the evidence chain; its complete text content is extracted.

[0088] Step S148: Arrange and combine the content of the evidence chain starting message, the complete text content of the intent reinforcement reply message, and the complete text content of the intent execution confirmation message in chronological order of message sending timestamps to form an initial session context evidence chain surrounding the core violation intent.

[0089] The evidence chain starting message M_start, the intent reinforcement response message M_reinforce, and the intent execution confirmation message M_confirm are arranged strictly according to their timestamp order in the original session. The arranged triplets constitute a coherent and logical dialogue fragment, which is the initial session context evidence chain E_chain_init built around the core violation intent.

[0090] Step S149: Perform message integrity detection on the initial session context evidence chain to identify whether there are missing message content or disordered message order in the initial session context evidence chain. When there are missing message content or disordered message order, supplement the missing message or adjust the message order from the time-ordered message list to generate the final session context evidence chain.

[0091] The generated initial evidence chain E_chain_init is validated. The completeness of the content field of each message in the chain is checked. Simultaneously, based on the absolute timestamp attached to each message, the chronological order of the three messages is verified to match the order in the chain. Suppose a reminder message from the group administrator, "Please pay attention to information security," is missing between the starting message and the reinforcement reply message. Based on the timestamp of this message, it is retrieved from the original time-ordered message list and inserted into the correct position between the starting message and the reinforcement reply message in the evidence chain. After supplementation and adjustment, the resulting dialogue fragment containing four messages in the correct order is the final session context evidence chain E_chain_final.

[0092] Step S150: Input the session context evidence chain into a pre-trained message content deep parsing network for multi-level violation feature extraction processing, generate a comprehensive violation confidence score corresponding to the session context evidence chain, and generate a final content review interception instruction based on the comprehensive violation confidence score. The content review interception instruction includes a globally unique identifier of the message to be intercepted and the corresponding violation type code.

[0093] After constructing the final session context evidence chain E_chain_final, it is input into a pre-trained multi-layered network M_deep specifically designed for deep message content analysis. This multi-layered network extracts violation features of different dimensions from different messages in the evidence chain, fuses these features, and finally outputs a quantified comprehensive violation confidence score score_conf. This score is compared with a preset high confidence threshold th_high used to trigger an interception operation. If the score exceeds th_high, the instruction generation logic is triggered. In this embodiment, a content moderation interception instruction C_intercept can be generated for messages that play a key role in the evidence chain. This content moderation interception instruction includes the globally unique identifier msg_id of the message to be intercepted, and the code_violation corresponding to the main violation type determined through analysis.

[0094] Step S151: Input the starting message content of the evidence chain in the session context evidence chain into the first violation feature extraction branch of the pre-trained message content deep parsing network, and perform dual encoding processing at the character level and word level on the starting message content of the evidence chain through the first violation feature extraction branch to generate a local violation semantic feature vector of the starting message.

[0095] The pre-trained message content deep parsing network M_deep consists of multiple parallel and serial sub-networks. First, the starting message content M_start from the evidence chain is input into the network's first branch B1. This first branch focuses on extracting local violation semantic features. Internally, it first constructs character-level and word-level sequences. These two sequences are fed into two independent embedding layers, resulting in character embedding tensors T_char and word embedding tensors T_word. A bidirectional gated recurrent unit network with shared parameters temporally encodes these two tensors to capture local contextual relationships. Finally, a cross-granularity attention mechanism interacts the character-level and word-level encoded features, calculating the attention weight of each character to each word, and weightedly fusing the features at both granularities. The final output is a local violation semantic feature vector V_local that precisely captures potential violation keywords and sentence structures in the starting message. The dimension of this local violation semantic feature vector is set to 1024.

[0096] The training steps of the message content deep parsing network include: Step S151-1: Constructing a multi-level violation feature training dataset for training the message content deep parsing network. The multi-level violation feature training dataset contains R historical session context evidence chains with labeled violation types extracted from the historical reviewed session text set. Each historical session context evidence chain corresponds to a comprehensive violation type label labeled manually. The number of categories of the comprehensive violation type label is T, and the value of T is 20.

[0097] Before pre-training the message content deep parsing network, its training dataset is first constructed. All historical session threads ultimately confirmed as violations are extracted from the historical reviewed session text set. For each violation session thread, its corresponding historical session context evidence chain is constructed according to the method described in step S140 and its sub-steps. Each historical session context evidence chain includes employee-sent messages as the starting point of the violation intent, work group reply messages as reinforcement of the violation intent, and employee-sent messages as confirmation of the execution of the violation intent. A compliance audit expert team is organized to label each historical session context evidence chain with a comprehensive violation type label, selected from a pre-set violation type label library containing 20 categories. This label library covers common violations such as "leakage of trade secrets," "transfer of benefits," "illegal recruitment," "leakage of customer information," "false expense reimbursement," "proxy clocking in," "malicious defamation," "leakage of salary information," and "illegal external document distribution." After labeling, each historical session context evidence chain is associated with a unique comprehensive violation type label. The labeled dataset together constitutes a multi-level violation feature training dataset.

[0098] Step S151-2: Construct the model architecture of the message content deep parsing network, which includes a first violation feature extraction branch, a second violation feature extraction branch, a third violation feature extraction branch, a feature interaction fusion layer, and a fully connected classification layer.

[0099] The specific structure of the deep message content parsing network is constructed. This deep message content parsing network is a multi-branch network structure. The first violation feature extraction branch adopts a dual encoding structure at the character and word levels to extract local violation semantic features of the evidence chain starting message. This branch contains a character embedding layer, a word embedding layer, a shared bidirectional gated recurrent unit network, and a cross-granularity attention fusion module. The second violation feature extraction branch adopts a combination structure of graph convolutional neural network and Transformer to extract syntactic violation pattern features of intent-enhanced response messages. This branch contains a pre-trained dependency parser, a graph convolutional network layer, and a max pooling layer. The third violation feature extraction branch adopts a Transformer-based encoder with an added intent-instruction decoupling module to extract deep intent violation features of intent execution confirmation messages. This branch contains a Transformer encoder and two parallel attention heads to capture intent and instructions, respectively. The feature interaction fusion layer receives the feature vectors output from the three branches and generates an interactively enhanced fused feature tensor through pairwise cross-attention calculation. The fully connected classification layer contains two cascaded fully connected sublayers. The first sublayer maps the fused feature tensor to an intermediate dimension, and the second sublayer maps the intermediate dimension to the number of output nodes. The number of output nodes is equal to the total number of categories T in the violation type label library, and T takes the value of 20. Finally, a T-dimensional violation type probability distribution vector is output through the Softmax function.

[0100] Step S151-3: Train the message content deep parsing network using the multi-level violation feature training dataset. During the training process, use the multi-task joint loss function to calculate the loss value between the predicted violation type distribution and the manually labeled violation type, as well as the orthogonal constraint loss value of each branch feature. Update the network parameters of the message content deep parsing network through the backpropagation algorithm until the multi-task joint loss function value converges to obtain the pre-trained message content deep parsing network.

[0101] The deep message content parsing network constructed in step S151-2 is trained using the multi-level violation feature training dataset constructed in step S151-1. During training, three messages from each historical session context evidence chain are input into the three branches of the network respectively. After forward propagation, the fully connected classification layer outputs a T-dimensional predicted violation type probability distribution vector. The cross-entropy loss function is used to calculate the classification loss L_cls between this predicted distribution and the manually labeled comprehensive violation type. Simultaneously, to ensure the complementarity and independence of the features extracted by the three branches, an orthogonal constraint loss L_orth is introduced in the feature interaction fusion layer. This loss function calculates the sum of squared cosine similarities between each pair of feature vectors output by the three branches, forcing different branches to learn decoupled feature representations. The total loss function is defined as L_total_multi = L_cls + λ × L_orth, where λ is the balancing weight coefficient, and the value of λ is 0.01. The gradient of the total loss function with respect to all network parameters is calculated using the backpropagation algorithm. The Adam optimizer is used to update the parameters with an initial learning rate LR_multi, where LR_multi is 0.00005. Training stops when the classification accuracy on the validation set reaches its maximum and stabilizes. The network parameters are then saved, forming a pre-trained message content deep parsing network.

[0102] Step S152: Input the complete text content of the intent-enhanced reply message in the session context evidence chain into the second violation feature extraction branch of the pre-trained message content deep parsing network. Perform syntactic structure parsing and dependency analysis on the intent-enhanced reply message through the second violation feature extraction branch to generate a syntactic violation pattern feature vector of the enhanced reply message.

[0103] The intended reinforcement message content M_reinforce is input into the second branch B2 of the network. This second branch aims to extract syntactic violation patterns. The input text first passes through a pre-trained parser to generate a dependency syntax tree for the sentence, describing the modification relationships between words in a graph structure. This graph structure is encoded as an adjacency matrix A_dep. Simultaneously, the text itself is converted into a word embedding matrix T_word through an embedding layer. Subsequently, a graph convolutional neural network performs convolution operations on this dependency syntax graph. The graph convolutional layers aggregate the neighbor node information of each node along the edges defined by the adjacency matrix, thereby updating the node's feature representation. After multiple layers of graph convolution, each word node incorporates its contextual information within the syntactic structure. Finally, max pooling is performed on the features of all nodes to obtain a global feature vector containing syntactic structure information, namely the syntactic violation pattern feature vector V_syntax, with a dimension of 1024.

[0104] Step S153: Input the complete text content of the intent execution confirmation message in the session context evidence chain into the third violation feature extraction branch of the pre-trained message content deep parsing network, and perform deep intent mining and implicit instruction recognition on the intent execution confirmation message through the third violation feature extraction branch to generate a deep intent violation feature vector of the execution confirmation message.

[0105] The intent to execute the confirmation message M_confirm is input into the third branch B3 of the network. This third branch aims to uncover the deeper intent and implicit instructions beneath the surface of the message. It employs a Transformer-based encoder, but adds an intent-instruction decoupling module after its standard multi-head self-attention mechanism. This module contains two parallel attention heads: one focused on capturing the intent, and the other on capturing the instructions. These two attention heads perform weighted summations on the feature matrices output by the Transformer, resulting in two independent vectors representing the deep intent and implicit instructions, respectively. These two vectors are concatenated to form a richer feature representation that simultaneously reflects both intent and instructions: the deep intent violation feature vector V_deep, with a dimension of 1024.

[0106] Step S154: Call the feature interaction fusion layer of the pre-trained message content deep parsing network, and perform pairwise interaction attention calculation on the local violation semantic feature vector of the starting message, the syntactic violation pattern feature vector of the enhanced reply message, and the deep intent violation feature vector of the execution confirmation message to generate an interaction-enhanced fusion feature tensor.

[0107] After each of the three branches generates three 1024-dimensional feature vectors V_local, V_syntax, and V_deep, they are fed into the network's core fusion module—the feature interaction fusion layer F_fuse. This feature interaction fusion layer simulates the mutual influence between messages in the evidence chain by calculating pairwise cross-attention. Using V_local as the query and V_syntax as the key and value, cross-attention is calculated to obtain the enhanced representation V_syntax of V_local, V_local_enhanced. Similarly, the enhanced representation V_local of V_deep, V_deep_enhanced, and the enhanced representation V_syntax of V_deep, V_deep_enhanced2, are calculated. These three sets of cross-attention-enhanced vectors are concatenated along the feature dimensions to form a fused feature tensor T_fused with a shape of 3 rows and 1024 columns, i.e., a total dimension of 3072.

[0108] Step S155: Input the interaction-enhanced fusion feature tensor into the fully connected classification layer of the pre-trained message content deep parsing network, and perform nonlinear mapping and dimensionality compression on the interaction-enhanced fusion feature tensor through the fully connected classification layer to generate an initial violation confidence score vector.

[0109] The 3072-dimensional fused feature tensor T_fused is input into the final part of the network, namely the fully connected classification layer FC. This fully connected classification layer consists of two cascaded fully connected sublayers. The first fully connected sublayer maps the 3072-dimensional input to 1024 dimensions and introduces non-linearity using the ReLU activation function. The second fully connected sublayer then maps this 1024-dimensional intermediate vector to the output layer, whose dimension is equal to the preset total number of violation types N_violation = 20. These 20 nodes output 20 probability values ​​normalized by the Softmax function, each value between 0 and 1, representing the confidence that the input evidence chain belongs to the corresponding violation type. The vector composed of the above 20 probability values ​​is the initial violation confidence score vector V_conf_init.

[0110] Step S156: Analyze each dimension value in the initial violation confidence score vector. Each dimension value corresponds to a confidence score for a preset violation type. Extract the maximum value in the initial violation confidence score vector as the first candidate comprehensive violation confidence score.

[0111] Analyze the 20-dimensional initial violation confidence score vector V_conf_init. The first dimension value in the vector, index 0, corresponds to the confidence score for "transfer of benefits," index 1 corresponds to the confidence score for "disclosure of trade secrets," and so on. Iterate through these 20 scores and find the maximum value; assuming the value at index 1 is 0.95, this maximum value of 0.95 is extracted as the first candidate comprehensive violation confidence score, score_cand1.

[0112] Step S157: Perform a weighted summation operation on all dimension values ​​in the initial violation confidence score vector to obtain the second candidate comprehensive violation confidence score. The weight coefficients of the weighted summation operation are preset according to the historical occurrence frequency of each preset violation type.

[0113] The initial violation confidence score vector V_conf_init is weighted and summed from all 20 scores. The weight coefficient vector W_weight is predefined based on the frequency of each violation type in historical audit data. The sum of all 20 weight coefficients is 1. Each score in the vector is multiplied by its corresponding weight coefficient, and all products are summed to obtain a single value. Assuming the weighted sum is 0.65, this value is the second candidate comprehensive violation confidence score score_cand2.

[0114] Step S158: Perform maximum value selection on the first candidate comprehensive violation confidence score and the second candidate comprehensive violation confidence score, and take the larger value as the final comprehensive violation confidence score corresponding to the session context evidence chain.

[0115] Compare the first candidate score (score_cand1 = 0.95) and the second candidate score (score_cand2 = 0.65). Use the maximum value function to select the larger of the two. Since 0.95 is greater than 0.65, 0.95 is determined as the final comprehensive violation confidence score (score_final) corresponding to this session context evidence chain.

[0116] Step S159: Compare the overall violation confidence score with the preset high-risk violation confidence threshold. When the overall violation confidence score is greater than the preset high-risk violation confidence threshold, determine that a content review blocking instruction needs to be generated.

[0117] Get the preset high-risk violation confidence threshold th_high=0.9. Compare the final comprehensive violation confidence score score_final=0.95 with this threshold. Since 0.95 is greater than 0.9, the comparison result is true. Therefore, it is determined that the behavior of this session is very likely to constitute a high-risk violation, and an immediate interception operation is required, triggering the content review interception instruction generation process.

[0118] Step S1510: Extract the globally unique identifier of all messages from the session context evidence chain. The globally unique identifier includes the message number of each message in the enterprise instant messaging system and the corresponding sending timestamp combination.

[0119] From the final session context evidence chain E_chain_final, traverse each message and extract the globally unique identifier msg_id from its metadata. For the starting message in the evidence chain, extract its msg_id_1, which is composed of the message number msg_no and the sending timestamp, for example, msg_no_001_t1698116460. For intent-strengthening reply messages and execution confirmation messages, similarly extract their respective globally unique identifiers msg_id_2 and msg_id_3.

[0120] Step S1511: Sort each message in the session context evidence chain according to its role in the evidence chain, set the priority of the evidence chain starting message to the highest level, set the priority of the intent to strengthen reply message to the second highest level, and set the priority of the intent to execute confirmation message to the normal level.

[0121] Based on the role each message plays in the formation of the violation, their interception priority is ranked. The message at the start of the evidence chain, i.e., the message that directly initiates the violation request, is the source of the violation and its interception priority is set to `priority_high`. The message with the intent to reinforce the response, which provides positive feedback to the violation request and amplifies it, is set to `priority_medium`. The message with the intent to execute the confirmation message, which is the final implementation of the violation, is set to `priority_low`.

[0122] Step S1512: Based on the priority sorting result, select the evidence chain starting message with the highest priority from the session context evidence chain as the primary interception target message, and extract the globally unique identifier of the primary interception target message as the first globally unique identifier of the message to be intercepted.

[0123] Based on the priority ranking, messages with priority_high are selected from the evidence chain, which is the starting message of the evidence chain. The globally unique identifier (msg_id_1) of this message is obtained. This globally unique identifier will be used as the first globally unique identifier (id_target1) in this interception command.

[0124] Step S1513: Parse the dimension index corresponding to the maximum value from the initial violation confidence score vector, query the preset violation type code mapping table according to the dimension index, and obtain the violation type code corresponding to the dimension index as the first violation type code.

[0125] The initial violation confidence score vector V_conf_init is parsed again. The dimension index idx_max=1 corresponding to the maximum value of 0.95 is found. The pre-defined violation type code mapping table Map_code is queried. This violation type code mapping table is a key-value pair storage structure, where the key is the dimension index and the value is the corresponding violation type code. The code corresponding to index 1 is queried, let's say code_bl_02, which represents "leakage of trade secrets". This code code_bl_02 is thus determined to be the first violation type code code_violation1 for this interception.

[0126] Step S1514: Combine and encapsulate the globally unique identifier of the primary interception target message and the first violation type code to generate a first content review interception sub-instruction for the evidence chain starting point message.

[0127] The globally unique identifier id_target1 and the violation type code code_violation1 are combined. This combination is achieved by constructing a JSON-formatted data object: {"message_id":"msg_id_1", "violation_code":"code_bl_02", "priority":"high"}. This structured data object is the first content review interception sub-instruction C_sub1 for the message at the starting point of the evidence chain.

[0128] Step S1515: Based on the priority sorting result, select the intent enhancement response message with the second highest priority from the session context evidence chain as the secondary interception target message, and extract the globally unique identifier of the secondary interception target message as the second globally unique identifier of the message to be intercepted.

[0129] Next, process the next highest priority messages. Messages with a priority of `priority_medium` are selected from the evidence chain; these are the messages intended to reinforce the response. The globally unique identifier `msg_id_2` of this message is obtained as the second globally unique identifier `id_target2`.

[0130] Step S1516: Parse the dimension index corresponding to the second largest value from the initial violation confidence score vector, query the preset violation type code mapping table according to the dimension index corresponding to the second largest value, and obtain the violation type code corresponding to the dimension index of the second largest value as the second violation type code.

[0131] The initial violation confidence score vector V_conf_init is parsed again to find the second largest value in the vector and its corresponding dimension index. Assume the second largest value is 0.60, corresponding to dimension index idx_sec=5. The violation type code mapping table Map_code is queried to find the code corresponding to index 5, let's say code_hr_01, which represents "illegal recruitment". This code is determined to be the second violation type code code_violation2.

[0132] Step S1517: Combine and encapsulate the globally unique identifier of the secondary interception target message and the second violation type code to generate a second content review interception sub-instruction for the intent to strengthen the reply message.

[0133] The globally unique identifier id_target2 and the violation type code code_violation2 are combined and encapsulated to construct a second JSON object: {"message_id":"msg_id_2", "violation_code":"code_hr_01", "priority":"medium"}. This object is the second content moderation interception sub-instruction C_sub2.

[0134] Step S1518: Merge and encapsulate the first content review interception sub-instruction and the second content review interception sub-instruction to generate a content review interception instruction containing at least two message identifiers to be intercepted.

[0135] The two generated intercept sub-commands are merged and encapsulated into a single overall command structure. A JSON object containing a list is constructed: {"intercept_commands":[{"message_id":"msg_id_1","violation_code":"code_bl_02","priority":"high"},{"message_id":"msg_id_2","violation_code":"code_hr_01","priority":"medium"}]}. The resulting structured command, containing the identifiers of the two messages to be intercepted and their processing methods, is the content moderation intercept command C_intercept_final. This content moderation intercept command will be sent to the message distribution center for execution.

[0136] Step S210: Obtain the set of historical reviewed conversation texts in the enterprise instant messaging system. The set of historical reviewed conversation texts includes multiple historical conversation threads that have been marked as violations and multiple historical conversation threads that have been marked as normal.

[0137] To train the various models used in the preceding steps, a large-scale, labeled historical dataset is first required. From the historical archive database of the enterprise instant messaging system, all conversation threads that have been manually reviewed and definitively characterized by the compliance audit department within the past year are retrieved. These threads are then aggregated into a set, Set_hist. Of these, 5000 threads are marked as violations in the audit records, with specific violation type labels; the remaining 95000 threads are marked as normal. These threads and their corresponding labels together constitute the historical reviewed conversation text set, Set_hist.

[0138] Step S220: Perform message intent evolution trajectory modeling for each historical session thread, generate a historical intent evolution state transition sequence for each historical session thread, and attach a corresponding violation label or normal label to each historical intent evolution state transition sequence.

[0139] For each session thread in the historical audited session text set Set_hist, the message intent evolution trajectory modeling process described in steps S121 to S129 is completely repeated. A corresponding historical intent evolution state transition sequence S_hist is generated for each historical thread. For example, for a thread marked "Violation - Leakage of Trade Secrets," the sequence is: "Inquire about project progress" -> "Confirm project involves confidentiality" -> "Request design documents." While generating each sequence, the historical audit label of the original thread is added as supplementary information and associated with the generated sequence for storage. This results in a paired dataset Set_paired consisting of intent evolution state transition sequences and their labels.

[0140] Step S230: Extract all occurrences of intent label types from all historical intent evolution state transition sequences, and construct a complete intent label vocabulary containing all intent label types.

[0141] A global scan is performed on all generated historical intent evolution state transition sequences. Each sequence is traversed, and every unique intent label appearing in the sequence is extracted. During the scan, a total of 120 different intent labels may be collected, such as "Initiate informal working contact," "Automatic system notification," "Inquire about project details," and "Inquire about confidential information." These deduplicated intent labels are then compiled into a list, `List_label`. This list is the complete intent label vocabulary, `Voca_label`. Each intent label in the vocabulary is assigned a unique index number; for example, index 0 corresponds to "Initiate informal working contact," index 1 corresponds to "Automatic system notification," and so on.

[0142] Step S240: Perform sequence vectorization representation processing on each historical intent evolution state transition sequence according to the complete intent tag vocabulary, map each intent tag to the corresponding one-hot encoded vector, and convert each historical intent evolution state transition sequence into a fixed-length intent sequence vector.

[0143] To input the textual intent sequence into the neural network, it needs to be numerically represented. The vocabulary size is determined to be V = 120. For any intent sequence, such as "Request confidential information" -> "Confirm information value" -> "Provide confidential documents," the index corresponding to each label is looked up in the vocabulary. Assume the index for "Request confidential information" is 10, the index for "Confirm information value" is 25, and the index for "Provide confidential documents" is 88. For each position in the sequence, a one-hot encoded vector of length V is created. For the label at index 10, its one-hot vector has a value of 1 at the 10th position and 0 at the remaining 119 positions. Finally, a sequence of length L is transformed into a matrix M_seq_vector of shape [L, V].

[0144] Step S250: Using the intent sequence vector as input features and the corresponding violation label or normal label as supervision signals, construct a training dataset for training the violation intent state transition path recognition model.

[0145] The intention sequence vector M_seq_vector is used as the input feature X of the model, and the associated, numerically processed labels are used as the supervision signal Y. For violating samples, the supervision signal Y can be a vector of the form [1, 0], where the first position 1 indicates a violation and the second position 0 indicates normal operation; for normal samples, it corresponds to [0, 1]. All (X, Y) data pairs are combined to form a structured dataset Set_train.

[0146] Step S260: Invoke the preset recurrent neural network structure, input the intention sequence vectors in the training dataset into the recurrent neural network in sequence, and capture the temporal dependencies in the intention evolution process through the hidden layer state update mechanism of the recurrent neural network.

[0147] Construct a recurrent neural network (RNN_seq) for sequence modeling. This RNN employs a multi-layered, bidirectional long short-term memory (LSTM) network architecture. Initialize the hidden state h0 of the network as a zero vector. Take a batch of data from the training dataset Set_train. For each sequence in the batch, input its one-hot vector x_t at time steps t=1, 2, ..., L sequentially into the LSM network units. At each time step t, the network unit receives the input vector x_t of the current time step and the hidden state h_{t-1} passed from the previous time step, and calculates the hidden state h_t of the current time step through its internal gating mechanism. The bidirectional LSM network also has a back-to-forward propagation process, ultimately concatenating the hidden states from both directions to form the final representation h_t_final for each time step.

[0148] Step S270: The hidden state at each time step is mapped through the output layer of the recurrent neural network to generate the intention label prediction probability distribution corresponding to each time step, and the first loss function value is calculated based on the difference between the intention label prediction probability distribution and the real intention label.

[0149] For each time step t in the sequence, the bidirectional hidden state vector h_t_final is input to a fully connected output layer. The number of nodes in this fully connected output layer is equal to the size of the intent label vocabulary, V = 120. The output layer uses the Softmax function to transform the hidden state vector into a 120-dimensional probability distribution p_t, representing the probability that the intent label for the next time step is each word in the vocabulary in the current context. The true intent label is transformed into a one-hot vector y_t. The cross-entropy loss between the model-predicted probability distribution p_t and the true distribution y_t is calculated. The cross-entropy losses of all time steps are summed to obtain the total loss for the sequence modeling part, i.e., the first loss function value L_seq.

[0150] Step S280: Input the hidden state of the last time step of the recurrent neural network into the fully connected classification layer to generate the violation probability prediction value for each historical session thread, and calculate the second loss function value based on the difference between the violation probability prediction value and the actual violation label.

[0151] Extract the hidden state h_L at the last time step t=L after the recurrent neural network has processed the entire sequence. Input h_L into a separate fully connected classification layer FC_cls, which outputs a 2-dimensional vector. Pass this vector through a softmax function to obtain a 2-dimensional probability distribution, where the first dimension p_v is the predicted violation probability of the sequence. Compare the model's predicted violation probability p_v with the true label Y, calculate the cross-entropy loss between them, and obtain the second loss function value L_cls.

[0152] Step S290: Calculate the first loss function value and the second loss function value. Update the network parameters of the recurrent neural network according to the first loss function value through the backpropagation algorithm. Update the network parameters of the fully connected classification layer according to the second loss function value through the backpropagation algorithm. Sum the first loss function value and the second loss function value with weights to obtain the total training loss value for monitoring the training process.

[0153] To simultaneously optimize both sequence modeling and violation classification tasks, L_seq and L_cls are combined. Based on L_seq, the gradient of the loss function with respect to all weight parameters within the recurrent neural network is calculated using backpropagation, and these parameters are updated using the Adam optimizer. Based on L_cls, the gradient of the loss function with respect to the parameters of the fully connected classification layer is calculated using backpropagation, and these parameters are updated. The total training loss value L_total = α × L_seq + β × L_cls is calculated, where α and β are preset weight coefficients used to balance the importance of the two tasks. After each training iteration, the value of L_total is recorded to observe whether the model has converged.

[0154] Step S2100: Iteratively execute the training steps until the total training loss value converges, save the parameters of the recurrent neural network and the fully connected classification layer after training, and form a pre-trained intention evolution trajectory recognition model for identifying suspected illegal intention trajectories.

[0155] The training process described in steps S260 to S290 is iterated repeatedly for multiple training epochs on the entire training dataset Set_train. The value of L_total on the validation set is continuously monitored. When L_total stops decreasing in several consecutive epochs, it indicates that the model has converged. Training is stopped, and all parameters of the recurrent neural network and the fully connected classification layer at the current time step are saved to the model file to form the pre-trained intention evolution trajectory recognition model M_trace.

[0156] Step S2110: Randomly select a portion of historical intent evolution state transition sequences from the training dataset as positive examples. Randomly shuffle the order of intent labels in each positive example to generate corresponding negative examples. Set the violation label of the negative examples to a normal label.

[0157] To enhance the model's robustness, data augmentation is performed. A batch of intention evolution state transition sequences that were originally marked as violations are randomly selected from the training dataset `Set_train` as positive examples. For each selected positive example, such as "Ask for confidential information" -> "Confirm information value" -> "Provide confidential documents", a random shuffling algorithm is used to completely shuffle its internal label order, potentially generating "Confirm information value" -> "Provide confidential documents" -> "Ask for confidential information". The label of this newly generated sequence is forcibly changed from violation to normal; this new sequence is called a negative example.

[0158] Step S2120: Add the generated negative samples to the training dataset to form an enhanced training dataset with balanced positive and negative samples.

[0159] All generated negative samples, along with their assigned normal labels, are added to the original training dataset. Since the number of negative samples can be comparable to that of positive samples, this effectively balances the ratio of violating to normal samples in the dataset. This expanded set, containing the original data and the newly generated negative samples, is the augmented training dataset Set_train_aug.

[0160] Step S2130: Perform sequence length statistics on each historical intention evolution state transition sequence in the enhanced training dataset, and calculate the maximum and minimum sequence lengths of all historical intention evolution state transition sequences.

[0161] To uniformly input sequences of different lengths into the neural network, sequence length processing is required. Iterate through each intention evolution state transition sequence in the augmented training dataset Set_train_aug, recording the length L_seq_len of each sequence. Count all length values ​​and find the maximum value L_max=15 and the minimum value L_min=1.

[0162] Step S2140: Perform sequence padding on each historical intention evolution state transition sequence according to the maximum sequence length, and add a preset padding intention label at the end of the sequence so that the length of all historical intention evolution state transition sequences is uniformly the maximum sequence length.

[0163] Based on a maximum sequence length L_max=15, each sequence in the dataset is processed. For sequences shorter than 15, a special pre-defined padding intention label is added to the end. For example, an original sequence with a length of 2 becomes, after padding, an original label -> ... -> a total of 13 padding labels, reaching a total length of 15. Sequences with a length equal to 15 are not processed. After this step, the length of all intention evolution state transition sequences in the dataset is unified to L_max=15.

[0164] Step S2150: Perform embedding representation learning on each intent label in each historical intent evolution state transition sequence, and initialize an intent label embedding matrix. The number of rows in the intent label embedding matrix is ​​equal to the size of the complete intent label vocabulary, and the number of columns is equal to the preset embedding dimension.

[0165] To transform discrete intent labels into dense, semantically expressive vectors, embedding representation learning is performed. An embedding matrix E_embed is initialized. The number of rows in matrix E_embed is equal to the size of the complete intent label vocabulary, V=120, plus a special position for padding, actually 121. The number of columns in matrix E_embed, i.e., the embedding dimension, is preset to d=256. Each value in matrix E_embed is a randomly initialized decimal at the start of training and will be continuously updated and optimized as a learnable parameter through backpropagation during model training.

[0166] Step S2160: Convert the one-hot encoded vector of each intent tag in each historical intent evolution state transition sequence into a dense intent embedding vector using the intent tag embedding matrix, forming an intent embedding vector sequence corresponding to each historical intent evolution state transition sequence.

[0167] During forward propagation of the model, for an input padded intent sequence, the label at each position t is first represented as a one-hot encoded vector of length 121, `one_hot_t`. Then, matrix multiplication is performed: `embedding_t = one_hot_t × E_embed`. Since only one position in `one_hot_t` is 1, the result of this multiplication is actually the row vector corresponding to the label index in the embedding matrix `E_embed`, which is a dense vector of length 256. This operation is performed for each position t in the sequence, and the original label sequence of length 15 becomes a matrix `M_embed_seq` of shape [15, 256], i.e., the intent embedding vector sequence.

[0168] Step S2170: Perform sequence masking on the intent embedding vector sequence corresponding to each historical intent evolution state transition sequence to generate a mask vector with the same length as the intent embedding vector sequence. The position value corresponding to the real intent label in the mask vector is a first value, and the position value corresponding to the filling intent label is a second value.

[0169] Since the sequence contains padding labels, these labels should not be included in the loss and attention calculations. Generate a corresponding mask vector `mask` for each input sequence. The length of `mask` is the same as the sequence length, 15. Iterate through each position `t` in the sequence. If the intent label at that position is real, set the value of the corresponding position `t` in the mask to 1; if the intent label at that position is a padding label, set the value of the corresponding position `t` in the mask to 0. This results in a mask vector consisting of 1s and 0s.

[0170] Step S2180: The intention embedding vector sequence and the corresponding mask vector are used together as the input of the recurrent neural network, so that the recurrent neural network ignores the filling position corresponding to the second value in the mask vector during the calculation process.

[0171] When the intention embedding vector sequence M_embed_seq of shape [15, 256] is input into the recurrent neural network, the mask vector mask is also passed in. During the computation of the recurrent neural network, for each time step t, the value of the mask vector mask[t] is referenced when calculating the hidden state update, attention weights, or loss function. If mask[t] is 0, the model will block the computation of that time step, ensuring that the model only focuses on and processes the effective information part of the sequence.

[0172] Step S2190: Obtain the real-time generated unapproved conversation text stream from the enterprise-level instant messaging system, and input each complete conversation thread in the unapproved conversation text stream into the saved pre-trained intent evolution trajectory recognition model.

[0173] After the model is trained and saved, it is deployed to an online real-time review service. This online real-time review service continuously subscribes to and retrieves new session data streams that have not yet undergone any review from the message bus of the enterprise-level instant messaging system, i.e., the unreviewed session text stream Stream_real. For each newly generated complete session thread in the stream, such as a new thread conv_201, step S120 and its sub-steps are first executed to convert it into the corresponding intent evolution state transition sequence S_real. Then, the intent evolution state transition sequence is preprocessed through steps S2140 to S2170 to convert it into an input format acceptable to the model and sent to the pre-trained intent evolution trajectory recognition model M_trace, which has been loaded with model parameters.

[0174] Step S2200: Perform forward propagation calculation on each complete session thread using the pre-trained intent evolution trajectory recognition model to generate a real-time violation probability prediction value corresponding to each complete session thread.

[0175] The pre-trained intent evolution trajectory recognition model M_trace performs forward propagation computation on the pre-processed input intent sequence. The data flows through an embedding layer and a multi-layer bidirectional long short-term memory network, finally outputting a 2D vector at the classification layer. After passing through the softmax function, the first value of this 2D vector, p_real, represents the probability that the model determines the session thread corresponding to the input sequence belongs to the violation category. This p_real is the real-time violation probability prediction value for that thread. For example, for thread conv_201, the model calculates and outputs a real-time violation probability prediction value of p_real = 0.92.

[0176] Step S2210: Compare the real-time violation probability prediction value with the preset real-time interception probability threshold. When the real-time violation probability prediction value is greater than the preset real-time interception probability threshold, mark the complete session thread as a real-time high-risk session thread.

[0177] A default decision threshold, th_real = 0.85, is set for real-time interception. The predicted real-time violation probability, p_real = 0.92, is compared with th_real. Since 0.92 is greater than 0.85, the trigger condition is met, and the currently processing full session thread, conv_201, is immediately marked as a real-time high-risk session thread, T_high_risk.

[0178] Step S2220: Extract the real-time intent evolution state transition sequence corresponding to the real-time high-risk session thread, and perform real-time path similarity comparison processing between the real-time intent evolution state transition sequence and each standard illegal intent state transition path in the preset illegal business intent state transition graph library.

[0179] For conv_201, which is marked as a high-risk session thread, obtain the real-time intent evolution state transition sequence S_real generated for it, assuming it is "Inquire about project progress" -> "Confirm project confidentiality" -> "Request design documents". Immediately trigger the path similarity comparison process described in step S130 and its sub-steps S131 to S138, and compare the real-time sequence S_real with each standard path P_std in the violation business intent state transition graph library Lib_path one by one, and calculate its comprehensive path similarity score sim_real with each standard path.

[0180] Step S2230: When the real-time similarity score between the real-time intent evolution state transition sequence and any standard violation intent state transition path exceeds the preset real-time similarity threshold, the immediate interception process for the real-time high-risk session thread is triggered.

[0181] A threshold of th_path = 0.80 is preset for real-time similarity assessment. Assume that during the comparison process, the comprehensive path similarity score calculated between the real-time sequence S_real and the standard path "leaking trade secrets" sequence in the image library is sim_real = 0.85. Since 0.85 is greater than 0.80, the trigger condition is met. Therefore, an immediate interception process is immediately initiated for this high-risk session thread conv_201.

[0182] Step S2240: In the real-time interception process, based on the distribution of intent tags in the real-time high-risk session thread, locate the intent evolution starting point message and intent enhancement response message, and construct a real-time session context evidence chain.

[0183] After initiating the immediate interception process, the real-time session context evidence chain for the current high-risk thread conv_201 is constructed strictly according to the methods described in steps S140 and its sub-steps S141 to S149. Tracing back to the thread's original message list, based on the position index of the intent tag, the following messages are located and extracted: the employee message "I heard Project X is a core secret, can you reveal some progress?" which serves as the starting point of the violation intent; the group reply message "The technical details of this project are indeed confidential" which reinforces the violation intent; and the employee message "Understood, I'll send you my email address, and you send me the design documents." which confirms the execution of the intent. After integrity checks, the final real-time session context evidence chain E_chain_real is formed.

[0184] Step S2250: Input the real-time session context evidence chain into the pre-trained message content deep parsing network for real-time violation feature extraction processing, generate a real-time comprehensive violation confidence score, and generate a real-time content review and interception instruction based on the real-time comprehensive violation confidence score.

[0185] The real-time session context evidence chain E_chain_real is input into the pre-trained message content deep parsing network M_deep, which is the same as that used in steps S150 and its sub-steps S151 to S158. After forward propagation, the network outputs a real-time comprehensive violation confidence score of the evidence chain, score_real = 0.98. Following the logic of steps S159 to S1518, this score is compared with the real-time interception high-risk threshold th_high = 0.90 to confirm that interception is necessary. The globally unique identifier of the key message in the evidence chain is extracted, and the corresponding violation type code is parsed from the initial violation confidence score vector output by the network. Finally, a real-time content review and interception instruction C_intercept_real containing the specific message identifier and violation type code is generated and immediately issued for execution.

[0186] For example, in step S310: the content review and interception instruction is sent to the message distribution center of the enterprise instant messaging system, triggering the message distribution center to locate the corresponding original message storage location based on the globally unique identifier of the message to be intercepted in the content review and interception instruction.

[0187] The final generated content moderation interception command, C_intercept_final, is sent as a high-priority control message to the message distribution center, D_center, a core component of the enterprise-level instant messaging system. Upon receiving the command, the message distribution center parses its content and extracts the first globally unique identifier, msg_id_1, from the first interception sub-command. Internally, the message distribution center maintains a message index table, Table_index, which uses the message identifier msg_id as its primary key and records the physical storage location of each message within the distributed message storage cluster. Using this identifier msg_id_1, the storage node and specific file path of the message can be quickly retrieved.

[0188] Step S320: Read the complete message content of the message to be intercepted from the original message storage location, and temporarily store the complete message content of the message to be intercepted in the isolation review buffer, while preventing the message to be intercepted from being delivered normally to the original receiving end.

[0189] Based on the located storage location, the message distribution center reads the complete data of the message from the disk, including the message content, attachment metadata, and a list of all recipients. After reading, it copies the entire message and moves it to a dedicated, restricted storage area called the Buffer_quarantine. Simultaneously, the message distribution center marks the status of the message identifier msg_id_1 as intercepted_pending in the in-memory routing table Route_table and clears its original pending delivery queue, preventing the message from being delivered normally to the original receiver.

[0190] Step S330: Parse the violation type code in the content review and interception instruction, query the preset violation handling strategy library according to the violation type code, and obtain the handling action type and notification template content corresponding to the violation type code.

[0191] After completing message isolation, the message distribution center continues to parse the content review and interception command C_intercept_final, extracting the violation type code code_violation1=code_bl_02. Using this code as the query key, it accesses a pre-configured violation handling policy library Lib_policy. It queries the policy corresponding to code_bl_02, obtaining the action type action_type=manual_review, and notifies the template content template_content="Your message ${message_content} has been intercepted by the system and submitted for manual review due to involving trade secrets. Please wait for the review result."

[0192] Step S340: Determine the final disposal method for the message to be intercepted based on the processing action type. When the processing action type is permanent deletion, completely remove the complete message content of the message to be intercepted from the isolation review buffer and send a message sending failure notification to the message sender.

[0193] The corresponding branch logic is executed based on the obtained action type (action_type). If the action type is permanent_delete, the message distribution center directly sends an instruction to the storage system to physically delete the message data file in the isolation Buffer_quarantine and clear all related index records. After deletion, a standard message sending failure notification is generated and asynchronously sent to the original message sender through the system notification channel.

[0194] Step S350: When the processing action type is manual review, the complete message content of the message to be intercepted and the corresponding violation type code are packaged to generate a manual review task work order, and the manual review task work order is pushed to the reviewer's work queue.

[0195] If the action type is `manual_review`, the process proceeds to manual intervention. The system encapsulates the complete message content in the isolation review buffer, its context information in the evidence chain, the final comprehensive violation confidence score (`score_final`), and the violation type code (`code_violation1`) into a structured data object, forming a manual review task order (`T_manual`). A unique task identifier (`task_id`) is generated for this task, and its priority is set to `high`. The task is then pushed to the reviewer work queue (`Queue_review`) prepared for the compliance review team.

[0196] Step S360: Receive the review operation result of the reviewer on the manual review task work order. When the review operation result is confirmed as a violation, perform complete message content clearing and send a warning notification to the sender. When the review operation result is a misjudgment, release the message to be intercepted from the isolation review buffer and restore normal delivery to the original receiver.

[0197] The reviewer's client will display the complete dialogue from the manual review task work order T_manual and the system's criteria for determining the violation. After reviewing, the reviewer clicks the "Confirm Violation" or "False Judgment" button, and the client sends the result back to the message distribution center. If the result is "confirm_violation," the message distribution center performs a cleanup operation similar to step S340, completely deleting the message and sending a warning-type violation notification to the sender. If the result is "false_positive," the message distribution center updates the message's status in the memory routing table Route_table to "normal_pending," moves the message content from the isolation review buffer Buffer_quarantine back to the normal pending queue, and triggers the message delivery process.

[0198] Step S370: Record the interception processing log for each message to be intercepted. The interception processing log includes a globally unique identifier for the message, an interception timestamp, a violation type code, and the final handling result. The interception processing log is then stored in the audit history database.

[0199] Regardless of whether the final outcome is permanent deletion or confirmation of violation or misjudgment after manual review, a structured interception log (Log_intercept) will be generated upon process termination. This log records the globally unique identifier of the intercepted message (msg_id), the timestamp that triggered the interception, the violation type code (code_violation) determined by the system, the final comprehensive violation confidence score (score_final), the final outcome (result_final), and the reviewer's identifier (reviewer_id) and review time (review_time) during the manual review. This log is persistently written to a dedicated audit history database (DB_history).

[0200] For example, step S410: Extract multiple violation session threads that have been marked as violations in different historical time periods from the enterprise-level instant messaging system, perform propagation influence topology analysis on each violation session thread, and construct a violation information propagation topology map corresponding to each violation session thread. The violation information propagation topology map includes an initial sending node as the source of violation information, multiple intermediate forwarding nodes as the relay of violation information, and a terminal receiving node as the final recipient of violation information.

[0201] To build a more complex library of violation patterns, deeper analysis of historical violation data was conducted. All confirmed violation sessions from the past year were extracted from the audit history database DB_history. Taking a thread involving the spread of information within a group as an example, this thread was triggered by an initial violation message, which was subsequently forwarded and commented on by multiple group members. For all messages in this thread, a directed graph Graph_prop was constructed based on their reply-forwarding relationship chain. In the graph, the employee account that sent the initial violation message was designated as the initial sending node node_init. Any other employee accounts that directly forwarded or referenced the initial message were designated as intermediate forwarding nodes node_relay. The employee accounts that ultimately received and read these forwarded messages but did not forward them further were designated as terminal receiving nodes node_terminal. The directed edges between nodes represent the direction of information flow, constructing a violation information propagation topology graph G_prop.

[0202] Step S420: Divide all nodes in the topology of each illegal information propagation into layers according to the information reception time order. Divide the initial sending node into the first propagation layer, the intermediate forwarding nodes that directly receive and forward the message from the initial sending node into the second propagation layer, and the terminal receiving nodes that receive the forwarded message from the second propagation layer into the third propagation layer.

[0203] The propagation topology graph G_prop is labeled hierarchically. Based on the timeline of information propagation, starting from the initial sending node node_init, whose information reception time is t0, this node is defined as the first propagation layer L1. All nodes that receive messages directly from nodes in the first propagation layer after timestamp t0, and forward or comment on the messages at a later timestamp t1, are defined as the second propagation layer L2. All nodes that receive forwarded messages from nodes in the second propagation layer after timestamp t1, and whose behavior is limited to receiving, are defined as the third propagation layer L3.

[0204] Step S430: Extract the text content of the first violation message corresponding to the initial sending node in the first propagation layer, extract the text content of the second violation comment attached by each intermediate forwarding node in the second propagation layer when forwarding, and extract the text content of the third violation response fed back by each terminal receiving node in the third propagation layer.

[0205] Based on the hierarchical division, key text information corresponding to each level is extracted from the original message data. The original violation message content `content_init` sent by the initial sending node `node_init` in the first propagation level L1 is extracted and called the first violation message text content `T1`. All nodes in the second propagation level L2 are traversed, and for each node, the comment text or reply text attached when forwarding the initial message is extracted; this set of texts is called the second violation comment text content `Set_T2`. All nodes in the third propagation level L3 are traversed, and for each node, any form of feedback it sends after receiving the forwarded message is extracted; this set of texts is called the third violation response text content `Set_T3`.

[0206] Step S440: Arrange and combine the first violation message text content, the second violation comment text content, and the third violation response text content according to the propagation hierarchy to construct a hierarchical violation content propagation chain corresponding to each violation session thread.

[0207] The extracted text content from the three levels is combined in a fixed order of first level, second level, and third level to form a structured data object Chain_content={"level1":T1, "level2":Set_T2, "level3":Set_T3}. This data object completely describes the entire process of illegal information spreading from its source, through secondary processing at intermediate nodes, to its final impact on the end audience, i.e., the hierarchical illegal content propagation chain C_content.

[0208] Step S450: Perform cross-level semantic influence transmission analysis on the hierarchical illegal content propagation chain, calculate the first semantic influence weight of the first illegal message text content on the second illegal comment text content, and calculate the second semantic influence weight of the second illegal comment text content on the third illegal response text content.

[0209] To quantify the changing influence of information during dissemination, a cross-level semantic influence analysis is conducted. For each dissemination chain, a pre-trained semantic similarity model M_sim is used. The semantic similarity between the first-level content T1 and each comment in the second level is calculated, resulting in a similarity score. The average of these scores is used as the first semantic influence weight w_influence1. The average semantic vector V_avg_t2 of all comments in the second level is calculated, and then the semantic similarity between this average vector and each feedback content in the third level is calculated to obtain the second semantic influence weight w_influence2.

[0210] Step S460: Construct a cross-level semantic influence transmission matrix based on the first semantic influence weight and the second semantic influence weight. The row index of the cross-level semantic influence transmission matrix corresponds to the propagation level number, and the column index corresponds to the different node numbers within the same propagation level.

[0211] The calculated weight values ​​are organized into a matrix M_influence. The rows of the matrix represent the propagation levels; the first row represents the influence from the first level to the second level, and the second row represents the influence from the second level to the third level. The columns of the matrix correspond to different nodes within the same level. Assuming the second propagation level has m nodes, the first row of the matrix will have m elements, each element representing the semantic influence weight of the first level content on the i-th second-level node. Assuming the third propagation level has n nodes, the second row of the matrix will have n elements, each element representing the semantic influence weight of the second level as a whole on the j-th third-level node. This matrix, with a shape of [2, max(m, n)] padded with zeros, is the cross-level semantic influence propagation matrix M_influence.

[0212] Step S470: Call the pre-trained propagation influence deep parsing network to perform deep feature mining on the cross-level semantic influence transmission matrix, and generate a propagation influence deep feature vector corresponding to each violating session thread. The propagation influence deep feature vector contains the decay rate parameter and mutation direction parameter of the violation information between different propagation levels.

[0213] A deep analytical network M_prop based on graph neural networks is constructed. The cross-level semantic influence transfer matrix M_influence and the adjacency matrix A_adj of the propagation topology graph G_prop are used as inputs to this network. The network first aggregates the features of each node's neighbors along the propagation topology using graph convolutional layers, and then captures the dynamic patterns of influence changing with each level through a temporal convolutional network along the propagation hierarchy. The last layer of the network is a fully connected layer, outputting a fixed-length vector V_prop with 128 dimensions. Decomposing V_prop reveals specific dimensions, such as the first 16 dimensions representing the decay rate of influence with each level (decay_rate), and the next 16 dimensions representing the semantic variation direction of content during propagation (shift_dir).

[0214] Step S480: Perform cluster analysis on the propagation impact depth feature vectors corresponding to all violating session threads, identify multiple violating session threads with similar propagation impact patterns as similar propagation pattern clusters, and assign a unique propagation pattern identifier to each similar propagation pattern cluster.

[0215] Collect the 128-dimensional propagation influence depth feature vectors V_prop corresponding to all historical violation session threads to form a vector set Set_V. Apply the unsupervised clustering algorithm K-Means++ to this set. The algorithm divides the feature vectors into several clusters based on the Euclidean distance between the vectors. Vectors within the same cluster are close to each other in 128-dimensional space, meaning that their corresponding violation session threads have similar propagation influence patterns. Define each cluster as a cluster of similar propagation patterns Cluster_pattern, and generate a unique identifier pattern_id for each cluster, such as pattern_001.

[0216] Step S490: Merge the hierarchical violation content propagation chains corresponding to all violation session threads within each cluster of the same propagation pattern to generate a standard hierarchical violation propagation template corresponding to each propagation pattern identifier. The standard hierarchical violation propagation template includes a fixed number of propagation levels, standard message content features of each level, and standard semantic influence weight range between levels.

[0217] For each propagation pattern cluster (Cluster_pattern), all hierarchical violation propagation chains (C_content) within it are merged to generate a representative template (T_pattern). The number of levels in all propagation chains within the cluster is counted, and the mode is taken as the fixed number of propagation levels (L_num) for the template. The common core intent and keyword set of all first-level content within the cluster are extracted using a text summarization model, serving as the standard message content feature (Feat_level1) for that level. The same extraction process is applied to the second and third levels. The distribution range of the first semantic influence weight (w_influence1) and the second semantic influence weight (w_influence2) of all propagation chains within the cluster is statistically analyzed. The average and standard deviation of the weights are calculated to obtain the reasonable fluctuation range of the influence weight between each level, i.e., the standard semantic influence weight range (range_weight). All the above information is integrated to form the standard hierarchical violation propagation template (T_pattern) corresponding to that propagation pattern cluster.

[0218] Step S4100: Store the standard hierarchical violation propagation template into a preset violation business intent state transition graph library as supplementary structural information for the newly added standard violation intent state transition path, which is used for path similarity comparison processing in the subsequent process of identifying suspected violation intent trajectories of real-time session threads.

[0219] After the generated standard hierarchical violation propagation template T_pattern is serialized, it is added to the preset violation business intent state transition graph library Lib_path. In subsequent steps S130 or S2220, when performing path similarity comparison, the comparison algorithm will not only compare the similarity of intent sequences, but also utilize this supplementary structural information to more accurately identify and match sessions with similar propagation patterns.

[0220] Step S4110: Extract the forwarding timestamp corresponding to each intermediate forwarding node in the second propagation layer of each violation information propagation topology diagram, calculate the first time difference between the forwarding timestamp of each intermediate forwarding node and the message sending timestamp of the initial sending node, and generate the first response delay feature value of each intermediate forwarding node based on the first time difference.

[0221] For each intermediate forwarding node `node_relay_i` in the second propagation layer as defined in step S420, extract its precise timestamp `t_fwd_i` when performing the forwarding operation. Extract the message sending timestamp `t_init` of the initial sending node `node_init` in the first propagation layer. For each intermediate forwarding node `i`, calculate the time difference `delta_t1_i = t_fwd_i - t_init`, in seconds. This time difference `delta_t1_i` is the first response delay characteristic value of that node.

[0222] Step S4120: Extract the feedback timestamp corresponding to each terminal receiving node in the third propagation layer of each violation information propagation topology diagram, calculate the second time difference between the feedback timestamp of each terminal receiving node and the forwarding timestamp of the corresponding intermediate forwarding node, and generate the second response delay feature value of each terminal receiving node based on the second time difference.

[0223] For each terminal receiving node `node_terminal_j` in the third propagation layer, extract the timestamp `t_resp_j` that generated the feedback. Determine which intermediate forwarding node `node_relay_k` the terminal node received the information from, and extract the forwarding timestamp `t_fwd_k` of that intermediate forwarding node. For each terminal node `j`, calculate the time difference `delta_t2_j = t_resp_j - t_fwd_k`. This time difference `delta_t2_j` is the second response delay characteristic value of that node.

[0224] Step S4130: Combine the first response delay feature value and the second response delay feature value according to the propagation level correspondence to construct the propagation delay feature vector corresponding to each violating session thread.

[0225] All calculated delay feature values ​​are organized according to their structure in the propagation topology. For a thread with m second-level nodes and n third-level nodes, the propagation delay feature vector V_delay can be constructed as a vector of length (m+n). The first m positions of the vector sequentially store the first response delay feature values ​​delta_t1_1 to delta_t1_m of the m second-level nodes, and the last n positions of the vector sequentially store the second response delay feature values ​​delta_t2_1 to delta_t2_n of the n third-level nodes. If the number of nodes is not uniform, zero values ​​are padded to ensure the consistency of the vector length, resulting in the propagation delay feature vector V_delay.

[0226] Step S4140: Perform a discreteness analysis on the propagation delay feature vector corresponding to each violating session thread, calculate the variance of the response delay feature values ​​of different nodes within the same propagation level as the first-level delay discreteness, and calculate the difference of the average response delay feature values ​​between different propagation levels as the cross-level delay change gradient.

[0227] Statistical analysis is performed on the propagation delay feature vector V_delay. The values ​​delta_t1_1 to delta_t1_m belonging to the second propagation level are extracted separately, and their variance var_d1 is calculated. var_d1 is defined as the first-level delay dispersion. The average delay feature values ​​of all nodes in the second propagation level, mean_d1, and the average delay feature values ​​of all nodes in the third propagation level, mean_d2, are calculated. The difference between these two averages, grad_d = mean_d2 - mean_d1, is defined as the cross-level delay variation gradient.

[0228] Step S4150: Compare the first-level delay dispersion with a preset first-level delay dispersion threshold, and compare the cross-level delay change gradient with a preset cross-level delay change gradient threshold.

[0229] Two thresholds are preset for detecting anomalies in the time dimension: the first-level delay dispersion threshold th_var and the cross-level delay change gradient threshold th_grad. The calculated first-level delay dispersion var_d1 and cross-level delay change gradient grad_d are compared with these two thresholds respectively.

[0230] Step S4160: When the first-level delay dispersion exceeds the preset first-level delay dispersion threshold, or the cross-level delay change gradient exceeds the preset cross-level delay change gradient threshold, the violating session thread is marked as an abnormal propagation mode session thread with time dimension propagation anomaly.

[0231] If the comparison result is var_d1 > th_var, or grad_d > th_grad, or both are true, then the currently analyzed violation session thread is determined to have a significant anomaly in the propagation time dimension. Once determined to be an anomaly, the thread is marked with a new label, called the abnormal propagation mode session thread T_abnormal.

[0232] Step S4170: Extract all hierarchical violation content propagation chains corresponding to session threads marked as abnormal propagation patterns, perform content mutation point detection on the hierarchical violation content propagation chains, and identify the mutation propagation nodes in each abnormal propagation pattern session thread that have undergone significant content changes compared with the standard hierarchical violation propagation template in the same propagation pattern cluster.

[0233] For all samples marked as session threads with the abnormal propagation pattern T_abnormal, obtain their corresponding hierarchical violation propagation chain C_content. Find the cluster_pattern of the same propagation pattern to which these abnormal threads belong, and obtain the standard hierarchical violation propagation template T_pattern corresponding to this cluster. Compare the propagation chain C_content of the abnormal thread with the standard template T_pattern level by level and node by node. By calculating the semantic difference diff_semantic between the text content of each node and the corresponding hierarchical standard content features in the template, if the semantic difference of a node exceeds the preset mutation threshold th_var_sem, then the node is identified as a mutated propagation node node_variant.

[0234] Step S4180: Generate a mutation node identifier for each mutation propagation node, and associate the mutation node identifier with the corresponding mutation content feature and store it in the abnormal propagation pattern database.

[0235] For each identified variant propagation node (node_variant), a globally unique identifier (variant_id) is generated. The node's original identifier (sender_id), its position in the propagation chain, its text content's semantic difference vector (V_diff_sem) compared to the standard template, and its calculated difference score (score_diff) are all associated with this information. Finally, this information is stored as records in a dedicated database (DB_variant) for analyzing novel or variant violation patterns.

[0236] Figure 2This illustration shows a deep learning-based intelligent review system 100 for communication information content, including a processor 1001, a memory 1003, and program code stored in the memory 1003. The processor 1001 executes the program code to implement the steps of a deep learning-based intelligent review method for communication information content. The processor 1001 and the memory 1003 are connected, for example, via a bus 1002. Optionally, the deep learning-based intelligent review system 100 may further include a transceiver 1004, which can be used for data interaction between the deep learning-based intelligent review system and other deep learning-based intelligent review systems, such as sending and / or receiving data. It should be noted that in actual scheduling, the transceiver 1004 is not limited to one, and the structure of this deep learning-based intelligent review system 100 does not constitute a limitation on the embodiments of this application. The memory 1003 stores the program code for executing the embodiments of this application and is controlled by the processor 1001. The processor 1001 is used to execute program code stored in the memory 1003 to implement the steps shown in the foregoing method embodiments.

[0237] This application provides a computer-readable storage medium storing program code, which, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0238] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application, without departing from the technical concept of this application, also fall within the protection scope of the embodiments of this application.

Claims

1. A method for intelligent review of communication information content based on deep learning, characterized in that, The method includes: Obtain the pending session text stream from the enterprise instant messaging system. The pending session text stream contains multiple complete session threads sorted by session initiation timestamp. Each complete session thread consists of at least one message sent by an employee and at least one corresponding work group reply message. For each complete session thread, a message intent evolution trajectory modeling process is performed. The message intent tags of each employee's message and the reply intent tags of each work group reply message in the complete session thread are extracted. The message intent tags and reply intent tags are then concatenated into an intent evolution state transition sequence according to the message sending time order. The intent evolution state transition sequence is compared with each standard illegal intent state transition path in the preset illegal business intent state transition map library. The intent evolution state transition sequence with a similarity exceeding the preset similarity threshold with the standard illegal intent state transition path is identified as a suspected illegal intent trajectory. Based on the employee-sent messages and work group reply messages in the complete session thread corresponding to the suspected violation intent trajectory, a session context evidence chain is constructed around the core violation intent. The session context evidence chain includes at least one employee-sent message as the starting point of the violation intent, at least one work group reply message as the reinforcement of the violation intent, and at least one employee-sent message as the confirmation of the execution of the violation intent. The session context evidence chain is input into a pre-trained message content deep parsing network for multi-level violation feature extraction processing, generating a comprehensive violation confidence score corresponding to the session context evidence chain, and generating a final content review interception instruction based on the comprehensive violation confidence score. The content review interception instruction includes a globally unique identifier of the message to be intercepted and the corresponding violation type code.

2. The intelligent review method for communication information content based on deep learning according to claim 1, characterized in that, The process of modeling the message intent evolution trajectory for each complete session thread involves extracting the message intent tag for each employee-sent message and the reply intent tag for each work group reply message within that complete session thread. The message intent tags and reply intent tags are then concatenated into an intent evolution state transition sequence based on the message sending time order, including: The first complete session thread is obtained from the enterprise-level instant messaging system. The message sending timestamps of all messages in the first complete session thread are parsed. All messages in the first complete session thread are sorted according to the order of their message sending timestamps to generate a time-ordered message list for the first complete session thread. Traverse the first message in the time-ordered message list of the first complete session thread, identify the sender role attribute of the first message, and when the sender role attribute of the first message is employee, mark the first message as a message sent by an employee and input the first message into a pre-trained employee intent classifier; The pre-trained employee intent classifier performs deep semantic analysis on the text content of the first message, extracts the core employee demand keywords hidden in the first message, and matches the core employee demand keywords with a preset employee intent tag library to generate the first employee message intent tag corresponding to the first message. Continue traversing the second message in the time-ordered message list of the first complete session thread, identify the sender role attribute of the second message, and mark the second message as a work group reply message when the sender role attribute of the second message is a work group robot or a work group administrator. The second message is input into a pre-trained group reply intent classifier. The group reply intent classifier performs response pattern analysis on the text content of the second message, extracts the response type of the second message to the first message, and matches the response type with a preset group reply intent tag library to generate the first group reply intent tag corresponding to the second message. According to the order of the message sending timestamps, the first employee message intent tag and the first group reply intent tag are arranged in sequence to form the initial intent evolution fragment of the first complete session thread; Continue to traverse each remaining message in the time-ordered message list of the first complete session thread, and repeatedly perform sender role attribute identification processing, corresponding intent classifier call processing, and intent tag generation processing for each message to obtain the message intent tag or reply intent tag corresponding to each message; All message intent tags and reply intent tags generated between the first message and the last message in the time-ordered message list are concatenated and spliced ​​in chronological order of message sending timestamps to generate the complete intent evolution state transition sequence corresponding to the first complete session thread. The above steps, from parsing the message sending timestamp to generating a complete intent evolution state transition sequence, are repeatedly executed for each complete session thread in the enterprise-level instant messaging system to obtain the intent evolution state transition sequence corresponding to each complete session thread, forming an intent evolution state transition sequence set.

3. The intelligent review method for communication information content based on deep learning according to claim 1, characterized in that, The step of comparing the intent evolution state transition sequence with each standard illegal intent state transition path in a preset illegal business intent state transition graph library, and identifying intent evolution state transition sequences whose similarity to the standard illegal intent state transition paths exceeds a preset similarity threshold as suspected illegal intent trajectories, includes: Take the first intention evolution state transition sequence to be compared from the set of intention evolution state transition sequences, and extract all intention label types contained in the first intention evolution state transition sequence to be compared and the order position index of each intention label type in the sequence; The first standard violation intent state transition path is read from the preset violation intent state transition graph library. The first standard violation intent state transition path consists of multiple standard violation intent nodes arranged in a fixed order, and each standard violation intent node corresponds to a specific violation intent tag. Calculate the length of the longest common subsequence between the first intent evolution state transition sequence to be compared and the first standard violation intent state transition path. The length of the longest common subsequence is used to measure the maximum number of intent tags that can be matched between the two sequences while keeping the element order unchanged. Divide the length of the longest common subsequence by the total number of standard violation intent nodes contained in the first standard violation intent state transition path to obtain the first path coverage ratio of the first intent evolution state transition sequence to be compared relative to the first standard violation intent state transition path. Calculate the edit distance between the first intent evolution state transition sequence to be compared and the first standard violation intent state transition path. The edit distance is used to measure the minimum number of operations required to transform one sequence into another through insertion, deletion, or replacement operations. A weighted summation operation is performed based on the first path coverage ratio and the edit distance to generate a comprehensive path similarity score between the first intent evolution state transition sequence to be compared and the first standard violation intent state transition path; The comprehensive path similarity score is compared with a preset similarity threshold. When the comprehensive path similarity score is greater than the preset similarity threshold, the first intent evolution state transition sequence to be compared is marked as a suspected illegal intent trajectory that matches the first standard illegal intent state transition path. Read the next standard illegal intent state transition path from the preset illegal business intent state transition graph library, and repeatedly perform the longest common subsequence length calculation, path coverage ratio calculation, edit distance calculation, and comprehensive path similarity score calculation until all standard illegal intent state transition paths in the preset illegal business intent state transition graph library have been traversed. All intent evolution state transition sequences to be compared that have a comprehensive path similarity score exceeding a preset similarity threshold with at least one standard illegal intent state transition path are aggregated to form a set of suspected illegal intent trajectories.

4. The intelligent review method for communication information content based on deep learning according to claim 1, characterized in that, The step of constructing a session context evidence chain around the core violation intent based on employee-sent messages and work group reply messages in the complete session thread corresponding to the suspected violation intent trajectory includes: Take the first suspected violation intent trajectory from the set of suspected violation intent trajectories, obtain the target complete session thread corresponding to the first suspected violation intent trajectory, and obtain the time-ordered message list of the target complete session thread; Analyze all intent tags contained in the first suspected violation intent trajectory and their corresponding message position indexes in the time-ordered message list, and identify the first employee message intent tag that appears in the first suspected violation intent trajectory as the core violation intent starting point; Based on the message location index corresponding to the core violation intent starting point, locate the message sent by the starting employee corresponding to the core violation intent starting point from the time-ordered message list, and extract the complete text content of the message sent by the starting employee as the starting message content of the evidence chain. Traverse the time-ordered message list in chronological order of all work group reply messages following the message sent by the starting employee, perform response object analysis on each work group reply message, and identify the first-level work group reply message that directly replies to the message sent by the starting employee. From the first-level work group reply messages, at least one work group reply message whose reply intent tag and the core violation intent starting point satisfy the semantic reinforcement relationship determination condition are selected as the intent reinforcement reply message in the evidence chain, and the complete text content of the intent reinforcement reply message is extracted. The semantic reinforcement relationship determination condition is: calculate the cosine similarity between the intent vector corresponding to the reply intent tag and the intent vector corresponding to the core violation intent starting point. When the cosine similarity exceeds the preset semantic reinforcement threshold, it is determined that there is a semantic reinforcement relationship. In chronological order, all employee messages sent after the intent-enhancing response message are traversed in the time-ordered message list. For each employee message, a message content relevance analysis is performed, and the semantic similarity between each employee message and the core violation intent starting point is calculated. Filter out at least one employee message from the employee messages whose semantic similarity to the core violation intent starting point exceeds a preset relevance threshold, and use it as the intent execution confirmation message in the evidence chain, and extract the complete text content of the intent execution confirmation message; The evidence chain starting message content, the complete text content of the intent reinforcement reply message, and the complete text content of the intent execution confirmation message are arranged and combined in chronological order of message sending timestamps to form an initial session context evidence chain surrounding the core violation intent. The initial session context evidence chain is subjected to message integrity detection to identify whether there are missing message content or disordered message order in the initial session context evidence chain. When there are missing message content or disordered message order, the missing message is supplemented from the time-ordered message list or the message order is adjusted to generate the final session context evidence chain.

5. The intelligent review method for communication information content based on deep learning according to claim 1, characterized in that, The step of inputting the session context evidence chain into a pre-trained message content deep parsing network for multi-level violation feature extraction processing, and generating a comprehensive violation confidence score corresponding to the session context evidence chain, includes: The message content of the starting point of the evidence chain in the session context evidence chain is input into the first violation feature extraction branch of the pre-trained message content deep parsing network. The message content of the starting point of the evidence chain is subjected to dual encoding processing at the character level and word level through the first violation feature extraction branch to generate a local violation semantic feature vector of the starting message. The complete text content of the intent-enhanced reply message in the conversation context evidence chain is input into the second violation feature extraction branch of the pre-trained message content deep parsing network. The second violation feature extraction branch performs syntactic structure parsing and dependency analysis on the intent-enhanced reply message to generate a syntactic violation pattern feature vector of the enhanced reply message. The complete text content of the intent execution confirmation message in the session context evidence chain is input into the third violation feature extraction branch of the pre-trained message content deep parsing network. The intent execution confirmation message is then subjected to deep intent mining and implicit instruction recognition through the third violation feature extraction branch to generate a deep intent violation feature vector of the execution confirmation message. The feature interaction fusion layer of the pre-trained message content deep parsing network is invoked to perform pairwise interaction attention calculation on the local violation semantic feature vector of the starting message, the syntactic violation pattern feature vector of the enhanced reply message, and the deep intent violation feature vector of the execution confirmation message to generate an interaction-enhanced fusion feature tensor. The interaction-enhanced fusion feature tensor is input into the fully connected classification layer of the pre-trained message content deep parsing network. The fully connected classification layer performs non-linear mapping and dimensionality compression on the interaction-enhanced fusion feature tensor to generate an initial violation confidence score vector. Analyze each dimension value in the initial violation confidence score vector. Each dimension value corresponds to a confidence score for a preset violation type. Extract the maximum value in the initial violation confidence score vector as the first candidate comprehensive violation confidence score. The weighted summation of all dimension values ​​in the initial violation confidence score vector is performed to obtain the second candidate comprehensive violation confidence score. The weight coefficients of the weighted summation are preset according to the historical occurrence frequency of each preset violation type. The maximum value of the first candidate comprehensive violation confidence score and the second candidate comprehensive violation confidence score is selected, and the larger of the two values ​​is taken as the final comprehensive violation confidence score corresponding to the session context evidence chain.

6. The intelligent review method for communication information content based on deep learning according to claim 5, characterized in that, The step of generating the final content review and blocking instruction based on the comprehensive violation confidence score includes: The overall violation confidence score is compared with a preset high-risk violation confidence threshold. When the overall violation confidence score is greater than the preset high-risk violation confidence threshold, it is determined that a content review blocking instruction needs to be generated. Extract the globally unique identifier of all messages from the session context evidence chain. The globally unique identifier includes the message number of each message in the enterprise instant messaging system and the corresponding sending timestamp combination. Each message in the session context evidence chain is prioritized according to its role in the evidence chain. The priority of the starting message of the evidence chain is set to the highest level, the priority of the intent to strengthen the reply message is set to the second highest level, and the priority of the intent to execute confirmation message is set to the normal level. Based on the priority ranking result, the message starting from the evidence chain with the highest priority is selected from the session context evidence chain as the primary interception target message, and the globally unique identifier of the primary interception target message is extracted as the first globally unique identifier of the message to be intercepted. Parse the dimension index corresponding to the maximum value from the initial violation confidence score vector, query the preset violation type code mapping table according to the dimension index, and obtain the violation type code corresponding to the dimension index as the first violation type code; The globally unique identifier of the primary interception target message and the first violation type code are combined and encapsulated to generate a first content review interception sub-instruction for the evidence chain starting point message; Based on the priority sorting result, intent-enhancing response messages with the second-highest priority are selected from the session context evidence chain as secondary interception target messages, and the globally unique identifier of the secondary interception target messages is extracted as the second globally unique identifier of the message to be intercepted. Parse the dimension index corresponding to the second largest value from the initial violation confidence score vector, query the preset violation type code mapping table according to the dimension index corresponding to the second largest value, and obtain the violation type code corresponding to the dimension index of the second largest value as the second violation type code; The globally unique identifier of the secondary interception target message and the second violation type code are combined and encapsulated to generate a second content review interception sub-instruction for the intent to strengthen the reply message; The first content review interception sub-instruction and the second content review interception sub-instruction are merged and encapsulated to generate a content review interception instruction containing at least two message identifiers to be intercepted.

7. The intelligent review method for communication information content based on deep learning according to claim 1, characterized in that, The method further includes: Obtain a set of historically reviewed conversation texts from an enterprise-level instant messaging system. The set of historically reviewed conversation texts includes multiple historical conversation threads that have been marked as violations and multiple historical conversation threads that have been marked as normal. For each historical session thread, a message intent evolution trajectory model is performed to generate a historical intent evolution state transition sequence corresponding to each historical session thread, and a corresponding violation label or normal label is attached to each historical intent evolution state transition sequence. Extract all occurrences of intent label types from all historical intent evolution state transition sequences, and construct a complete intent label vocabulary containing all intent label types; Based on the complete intent tag vocabulary, each historical intent evolution state transition sequence is processed into a sequence vectorization representation, mapping each intent tag to a corresponding one-hot encoded vector, and converting each historical intent evolution state transition sequence into a fixed-length intent sequence vector. Using the intent sequence vector as input features and the corresponding violation label or normal label as supervision signal, a training dataset is constructed for training the violation intent state transition path recognition model. The pre-defined recurrent neural network structure is invoked, and the intention sequence vectors in the training dataset are sequentially input into the recurrent neural network. The temporal dependencies in the intention evolution process are captured through the hidden layer state update mechanism of the recurrent neural network. The hidden state at each time step is mapped through the output layer of the recurrent neural network to generate the intention label prediction probability distribution corresponding to each time step, and the first loss function value is calculated based on the difference between the intention label prediction probability distribution and the real intention label. The hidden state of the last time step of the recurrent neural network is input into the fully connected classification layer to generate a violation probability prediction value for each historical session thread, and a second loss function value is calculated based on the difference between the violation probability prediction value and the actual violation label. Calculate the first loss function value and the second loss function value. Update the network parameters of the recurrent neural network using the backpropagation algorithm based on the first loss function value. Update the network parameters of the fully connected classification layer using the backpropagation algorithm based on the second loss function value. Sum the first loss function value and the second loss function value with weights to obtain the total training loss value for monitoring the training process. The training steps are iteratively executed until the total training loss value converges. The parameters of the recurrent neural network and the fully connected classification layer after training are saved to form a pre-trained intention evolution trajectory recognition model for identifying suspected illegal intention trajectories.

8. The intelligent review method for communication information content based on deep learning according to claim 7, characterized in that, After constructing the training dataset for training the violation intent state transition path recognition model, the method further includes: A portion of historical intent evolution state transition sequences are randomly selected from the training dataset as positive examples. The order of intent labels in each positive example is randomly shuffled to generate corresponding negative examples. The violation labels of the negative examples are set as normal labels. The generated negative samples are added to the training dataset to form an enhanced training dataset with balanced positive and negative samples. For each historical intent evolution state transition sequence in the enhanced training dataset, the sequence length is statistically analyzed, and the maximum and minimum sequence lengths of all historical intent evolution state transition sequences are calculated. Each historical intention evolution state transition sequence is padded according to the maximum sequence length, and a preset padding intention label is added to the end of the sequence so that the length of all historical intention evolution state transition sequences is uniformly the maximum sequence length. Embedded representation learning is performed on each intent label in each historical intent evolution state transition sequence. An intent label embedding matrix is ​​initialized, wherein the number of rows of the intent label embedding matrix is ​​equal to the size of the complete intent label vocabulary, and the number of columns is equal to the preset embedding dimension. The intent tag embedding matrix is ​​used to convert the one-hot encoded vector of each intent tag in each historical intent evolution state transition sequence into a dense intent embedding vector, forming an intent embedding vector sequence corresponding to each historical intent evolution state transition sequence. For each historical intent evolution state transition sequence, the intent embedding vector sequence is processed by sequence masking to generate a mask vector with the same length as the intent embedding vector sequence. The mask vector has a first value corresponding to the position of the real intent label and a second value corresponding to the position of the filled intent label. The intention embedding vector sequence and the corresponding mask vector are used together as input to the recurrent neural network, so that the recurrent neural network ignores the filling position corresponding to the second value in the mask vector during the calculation process.

9. The intelligent review method for communication information content based on deep learning according to claim 7, characterized in that, After iteratively executing the training steps until the total training loss value converges, and saving the parameters of the recurrent neural network and the fully connected classification layer after training, the method further includes: The system obtains unapproved conversation text streams generated in real time from an enterprise-level instant messaging system, and inputs each complete conversation thread in the unapproved conversation text stream into a pre-trained intent evolution trajectory recognition model. The pre-trained intent evolution trajectory recognition model is used to perform forward propagation calculations on each complete session thread to generate a real-time violation probability prediction value for each complete session thread. The real-time violation probability prediction value is compared with a preset real-time interception probability threshold. When the real-time violation probability prediction value is greater than the preset real-time interception probability threshold, the complete session thread is marked as a real-time high-risk session thread. Extract the real-time intent evolution state transition sequence corresponding to the real-time high-risk session thread, and perform real-time path similarity comparison processing between the real-time intent evolution state transition sequence and each standard illegal intent state transition path in the preset illegal business intent state transition graph library; When the real-time similarity score between the real-time intent evolution state transition sequence and any standard violation intent state transition path exceeds a preset real-time similarity threshold, an immediate interception process for the real-time high-risk session thread is triggered. In the real-time interception process, based on the distribution of intent tags in the real-time high-risk session thread, the intent evolution starting point message and intent enhancement response message are located, and a real-time session context evidence chain is constructed. The real-time session context evidence chain is input into a pre-trained message content deep parsing network for real-time violation feature extraction, generating a real-time comprehensive violation confidence score, and generating a real-time content review and interception instruction based on the real-time comprehensive violation confidence score.

10. A deep learning-based intelligent content review system for communication information, characterized in that, The method includes a processor and a computer-readable storage medium storing machine-executable instructions, which, when executed by the processor, implement the intelligent review method for communication information content based on deep learning as described in any one of claims 1-9.

Images