Junk mail identification method based on multi-modal features and adaptive learning

Abstract

The invention relates to the field of mail recognition, and particularly provides a junk mail recognition method based on multi-modal features and adaptive learning, which comprises the following steps: S1, analyzing an input mail, extracting multi-modal feature vectors in parallel, and constructing a comprehensive feature vector; s2, inputting the extracted multi-modal feature vector into a feature fusion network based on attention to generate a unified mail comprehensive feature representation; s3, inputting the comprehensive feature representation into a classifier to obtain a prediction result and confidence of whether the mail is a junk mail; and S4, continuously operating the system, and driving online optimization of the model by utilizing feedback data. According to the scheme, high-performance and self-evolution intelligent spam filtering is realized.

Description

Technical Field

[0001] This invention relates to the field of email recognition, specifically providing a spam email recognition method based on multimodal features and adaptive learning. Background Technology

[0002] Spam is one of the major security threats facing the internet for a long time. It not only consumes network bandwidth and storage space, but is also frequently used to spread malware, phishing scams, and other malicious information, endangering user information security and privacy. Existing spam filtering technologies can be mainly divided into the following categories: Rule-based filtering relies on rules such as keywords and blacklists developed by experts. The disadvantages of this method are high rule maintenance costs, difficulty in dealing with rapidly changing spam content, and poor flexibility and adaptability.

[0003] Traditional machine learning-based filtering methods employ models such as Bayesian classifiers and support vector machines to extract features like TF-IDF from email text for classification. While these methods are more advanced than rule-based approaches, they rely on limited features, largely depending solely on the textual features of the email body, neglecting valuable multimodal information such as sender behavior, email headers, email structure, embedded images, or links. Furthermore, these methods use static models, meaning the model is fixed once trained and requires periodic manual retraining to adapt to new spam variants, lacking adaptability and online learning capabilities, and struggling to evolve in real-time. Moreover, using a general-purpose model makes it difficult to adapt to the personalized preferences of different users.

[0004] Therefore, existing technologies are unable to effectively cope with increasingly complex and dynamic spam attacks, and there is an urgent need for an intelligent filtering solution that can integrate multi-dimensional information and continuously learn and evolve on its own. Summary of the Invention

[0005] To overcome the above-mentioned shortcomings, this invention provides a spam identification method based on multimodal features and adaptive learning, comprising the following steps: S1: Parse the input email, extract multimodal feature vectors in parallel, and construct a comprehensive feature vector; S2: Input the extracted multimodal feature vectors into an attention-based feature fusion network to generate a unified comprehensive feature representation of emails; S3: Input the comprehensive feature representation into the classifier to obtain the prediction result and confidence level of whether the email is spam; S4: The system runs continuously, using feedback data to drive online optimization of the classifier model; Step S1 includes the following steps: S11: After preprocessing the email subject and body, input them into a pre-trained natural language processing model to obtain text feature vectors; S12: Extract the sender's behavioral feature vector; S13: Analyze the email's HTML structure and extract the email's structural feature vector; S14: Process the image embedded in the email to obtain the image modal feature vector; S15: Analyze embedded links in emails and extract URL link modal feature vectors.

[0006] Furthermore, preprocessing of the email subject and body includes cleaning the email subject and body, removing HTML tags and special characters, and performing standardized encoding.

[0007] Furthermore, the DistilBERT model is used as the core feature extractor. The preprocessed text is input into the pre-trained natural language processing model, and the 768-dimensional floating-point vector corresponding to the CLS tag in the last hidden layer is obtained as the text feature vector of the entire email.

[0008] Furthermore, the sender behavior feature vector includes the sender's domain reputation score, SPF / DKIM / DMARC authentication pass rate, the number of recipients in this email, and the time interval since the last email was sent. The sender's domain reputation score is obtained by querying an external reputation database via API. If no record is found, it is recorded as a neutral score of 0.5. SPF / DKIM / DMARC certification pass rate is obtained by calculating the proportion of emails in the sender's historical emails that have passed SPF, DKIM and DMARC certifications; The number of recipients in this email and the time interval between the sender and the last email sent are logarithmically scaled to smooth the feature distribution. The logarithm scaling is log(1 + count) and log(1 + h) respectively, where count represents the number of recipients in this email and h represents the time interval between the last email sent. After standardizing the processed sender domain reputation score, SPF / DKIM / DMARC authentication pass rate, number of recipients in this email, and logarithmic scaling of the time interval since the last email, a 4-dimensional sender behavior feature vector is obtained.

[0009] Furthermore, the email structure feature vector includes the ratio of HTML code to plain text length, the number of embedded forms in the email, and the number of suspicious tags. The ratio of HTML code to plain text length, the number of embedded forms in the email, and the number of suspicious tags are standardized and concatenated to obtain a 3-dimensional email structure feature vector.

[0010] Furthermore, step S14 includes, First, the embedded image in the email is identified by optical character recognition. The identified text is then fed into a text feature extraction model to obtain a 256-dimensional vector of text features. Then, a convolutional neural network is used to process the embedded image in the email to extract a 2048-dimensional or 1024-dimensional feature vector. This high-dimensional vector is then reduced in dimensionality to obtain a 128-dimensional vector of deep visual features. The text features of the 256-dimensional vector obtained after OCR recognition and the depth visual features of the 128-dimensional vector obtained after CNN model processing are concatenated to form a 384-dimensional image modality feature vector.

[0011] Furthermore, the URL link modal feature vector includes URL character length, domain registration days, number of special characters in the URL, whether it is a short link, whether the path contains suspicious keywords, reputation score, and whether it is on a blacklist. The URL character length url_length is normalized after logarithmic scaling; Domain registration days are directly standardized, and the number of special characters in the URL is directly standardized. Is it a short link that is binarized into 0 or 1? Whether the path contains suspicious keywords is binarized into 0s or 1s; The reputation score is used directly as a continuous value through a comprehensive threat score obtained from the VirusTotal API; Whether to binarize the data into 0s or 1s in the enterprise blacklist; The processed values ​​are concatenated into a 7-dimensional long vector, which is used as the URL link modal feature vector.

[0012] Furthermore, step S2 includes the following steps: S21: Project multimodal feature vectors of different dimensions to the same semantic space dimension through a fully connected layer; S22: Using the mapped text feature vector T text As a query, the sender behavior feature vector, email structure feature vector, image modality feature vector, and URL link modality feature vector (mapped through a fully connected layer) are used as keys and values. The similarity between the query and each key is calculated, and attention weights α are generated using the Softmax function. behavior α structure α image α url ; S23: Use attention weights to perform a weighted summation of the feature values ​​mapped from other feature vectors to obtain the context vector. C = α behavior T behavior+ α structure T structure + α image T image + α url T url , among which, T behavior T represents the behavioral feature vector mapped through the fully connected layer. structure T represents the email structure feature vector mapped through the fully connected layer. image T represents the image modality feature vector mapped through the fully connected layer. url This represents the URL link modal feature vector after mapping through the fully connected layer; S24: Map the text feature vector T text With context vector C The data are then concatenated and fused using a fully connected layer to reduce dimensionality, outputting a comprehensive feature representation of the emails for final classification.

[0013] Furthermore, step S4 includes the following steps: S41: Collect explicit and implicit feedback from users on email classification. Only when the email feedback meets the preset high confidence condition will the email be stored as a new labeled sample in the training pool. S42: Periodically use new labeled samples and stored historical representative samples together for incremental model training; S43: When incremental data accumulates to a preset size or model performance degrades, trigger a full retraining using all data.

[0014] Furthermore, the displayed feedback includes recipients marking normal emails as "non-spam" or spam emails as "spam," while the implicit feedback includes recipients deleting unread suspected emails and reading and replying to normal emails.

[0015] The working principle and beneficial effects of this invention: In implementing the technical solution of this invention, firstly, deep analysis of emails is performed through multimodal feature extraction, and heterogeneous feature vectors of five dimensions—text semantics, sender behavior, email structure, images, and URL links—are obtained in parallel. Then, an attention-based feature fusion network is used to adaptively learn the dynamic importance weights of other modal features for classification decisions using text features as queries, and weighted fusion is performed to generate a highly expressive comprehensive feature representation. Next, a classification model outputs accurate spam identification results. Finally, an adaptive learning module continuously collects high-confidence user feedback, and a replay buffer mechanism is used to perform online incremental learning and automated gray-scale updates of the model.

[0016] Multimodal information fusion significantly improves the accuracy and anti-interference ability of identification. The attention mechanism enables dynamic optimization and combination of features. The introduction of an incremental learning framework enables the system to adapt to new spam patterns in real time without forgetting historical knowledge, thereby effectively addressing the concept drift problem and achieving high-performance, self-evolving intelligent spam filtering. Attached Figure Description

[0017] The disclosure of this invention will become more readily understood with reference to the accompanying drawings. It will be readily understood by those skilled in the art that these drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention. Furthermore, similar numbers in the drawings are used to denote similar components, wherein: Figure 1 This is a schematic diagram of the main steps of a spam identification method based on multimodal features and adaptive learning according to the present invention. Detailed Implementation

[0018] Some embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0019] Example 1

[0020] Figure 1 This is a schematic diagram illustrating the main steps of a spam identification method based on multimodal features and adaptive learning according to the present invention. Figure 1 As shown, the spam identification method based on multimodal features and adaptive learning in this embodiment mainly includes the following steps S1-S4.

[0021] Step S1: Parse the input email, extract multimodal feature vectors in parallel, and construct a comprehensive feature vector.

[0022] S11: After preprocessing the email subject and body, input them into a pre-trained natural language processing model to obtain text feature vectors.

[0023] In one implementation, preprocessing the email subject and body includes cleaning the email subject and body, removing HTML tags and special characters, and performing standardized encoding.

[0024] In one implementation, the DistilBERT model is used as the core feature extractor. While maintaining performance similar to BERT, it is smaller and has a faster inference speed, making it suitable for email filtering scenarios that require real-time processing. The pre-processed text is input into the pre-trained natural language processing model (DistilBERT model), and the 768-dimensional floating-point vector corresponding to the CLS tag in the last hidden layer is obtained as the text feature vector of the entire email.

[0025] S12: Extract the sender's behavioral feature vector, including the sender's domain reputation score, SPF / DKIM / DMARC authentication pass rate, the number of recipients in this email, and the time interval since the last email was sent.

[0026] In one implementation, the sender's domain reputation score is obtained by querying an external reputation database (such as Cisco Talos or Spamhaus) via API. If no record is found, a neutral score of 0.5 is assigned. It should be noted that these external reputation databases (such as Cisco Talos and Spamhaus) are publicly available and legitimate third-party reputation query service providers within the industry, and their data interfaces comply with relevant laws, regulations, and service agreements. When calling the aforementioned API, the relevant terms of service are strictly adhered to, and only publicly available domain reputation information is obtained to improve the accuracy and security of spam identification; this does not involve any illegal data collection or infringement of personal privacy.

[0027] In one implementation, the SPF / DKIM / DMARC authentication pass rate is obtained by calculating the proportion of senders' historical emails that have passed SPF, DKIM, and DMARC authentication.

[0028] In one implementation, the number of recipients in this shipment and the time interval (in seconds) between the sender and the last email sent are logarithmically scaled to smooth the feature distribution. The logarithmically scaled values ​​are log(1 + count) and log(1 + h), respectively, where count represents the number of recipients in this shipment and h represents the time interval between the last email sent.

[0029] In one implementation, a 4-dimensional sender behavior feature vector is obtained by standardizing (Z-score) the processed sender domain reputation score, SPF / DKIM / DMARC authentication pass rate, number of recipients in this email, and logarithmic scaling value of the time interval since the last email, which is then directly used for fusion.

[0030] S13: Analyze the HTML structure of the email and extract the email structure feature vector, including features such as the ratio of HTML code to plain text length, the number of embedded forms in the email, and the number of suspicious tags.

[0031] In this embodiment, an abnormally high ratio of HTML code length to plain text length indicates a large amount of hidden or irrelevant code. Legitimate marketing emails typically do not embed forms; the more forms an email embeds, the less legitimate it is, and the more suspicious the tags (such as...) it contains. <iframe>,<object> The more emails there are, the more abnormal they are.

[0032] In one embodiment, the ratio of HTML code to plain text length, the number of embedded forms in the email, and the number of suspicious tags are all standardized (Z-score) and concatenated to obtain a 3-dimensional email structure feature vector.

[0033] S14: Process the image embedded in the email to obtain the image modal feature vector.

[0034] First, the embedded image in the email is recognized by optical character recognition (OCR). The recognized text is then fed into a text feature extraction model. This text is input into the same pre-trained language model as S11, resulting in a 768-dimensional text feature vector. To control the total dimension of the image modal features and facilitate subsequent fusion, this vector is compressed to 256 dimensions through a fully connected layer, serving as the OCR text feature of the image, resulting in a 256-dimensional text feature vector.

[0035] Then, a convolutional neural network (CNN) is used to process the embedded image in the email to extract a 2048-dimensional or 1024-dimensional feature vector. The high-dimensional vector is then reduced to a 128-dimensional vector for depth visual features, which is used to identify common visual patterns in spam images (such as a large amount of promotional text, buttons of a specific color, etc.).

[0036] The text features of the 256-dimensional vector obtained after OCR recognition and the depth visual features of the 128-dimensional vector obtained after CNN model processing are concatenated to form a 384-dimensional image modality feature vector.

[0037] S15: Analyze the embedded links in the email and extract the URL link modal feature vector. This includes URL character length, domain registration days, number of special characters in the URL, whether it is a short link, whether the path contains suspicious keywords, reputation score, and whether it is on a blacklist.

[0038] In this embodiment, the URL link modal features are a mixture of numerical and categorical features. Specifically, the URL character length (url_length) is standardized after logarithmic scaling; the domain registration days are directly standardized; the number of special characters in the URL is directly standardized; whether it is a short link is binarized into 0 or 1 (1 for short links, 0 for non-short links); whether the path contains suspicious keywords is binarized into 0 or 1 (1 for suspicious keywords, 0 for non-suspicious keywords); the reputation score is obtained from the comprehensive threat score obtained from the VirusTotal API and used directly as a continuous value; and whether it is on a company blacklist is binarized into 0 or 1 (1 for blacklisted companies, 0 for unblacklisted companies). The processed values ​​are concatenated into a 7-dimensional long vector, which serves as the URL link modal feature vector.

[0039] Step S2: Input the extracted multimodal feature vectors into an attention-based feature fusion network to generate a unified comprehensive feature representation of emails.

[0040] In this embodiment, the feature vectors of the five modalities extracted above are input into an attention-based feature fusion network, which outputs a unified and highly expressive email feature representation. An attention-based feature fusion mechanism is used instead of simple concatenation, so that the model can automatically learn the dynamic importance weights of different modal features to the final classification decision.

[0041] The specific steps are as follows: Feature Dimension Unification and Mapping (Projection) S21: Project multimodal feature vectors of different dimensions to the same semantic space dimension, such as 256 dimensions, through a fully connected layer (FC Layer) to facilitate subsequent attention calculation.

[0042] Text feature vector: V text (768 dimensions), mapped to T text (256 dimensions) through FC layer; Behavioral feature vector: V behavior (4-dimensional), mapped to T behavior (256-dimensional) through FC layer; Email structure feature vector: V structure (3D), mapped to T structure (256D) through FC layer; Image modal feature vector: V image (384 dimensions), mapped to T image (256 dimensions) through FC layer; URL link modal feature vector: V url (7 dimensions), mapped to T url (256 dimensions) through FC layer.

[0043] S22: Using the mapped text feature vector T_text as the query, and the mapped sender behavior feature vector, email structure feature vector, image modality feature vector, and URL link modality feature vector as the key and value, calculate the similarity between the query and each key, and generate attention weights α_behavior , α_structure , α_image , and α_url through the Softmax function. These weights reflect the importance of other modality features to the final classification decision.

[0044] In the attention mechanism, the query is used to actively match other information; the key is used to calculate the similarity with the query; and the value is used to carry the information that is actually weighted and fused. The four modal feature vectors serve as both keys and values. They are first used as keys to calculate the similarity with the query (T text ) to obtain attention weights, and then these attention weights are used to perform a weighted summation of the features that serve as values.

[0045] S23: Use attention weights to perform a weighted summation of the feature values ​​mapped from other feature vectors to obtain the context vector C = α behavior. T behavior + α structure T structure + α image T image + α url T url .

[0046] S24: The text feature vector T text is concatenated with the context vector C , and then fused and dimensionality reduced through a fully connected layer to output the comprehensive feature representation of the email for final classification.

[0047] Step S3: Input the comprehensive feature representation into the classifier to obtain the prediction result and confidence level of whether the email is spam.

[0048] Step S4: The system continues to run, using feedback data to drive the online optimization of the classifier model.

[0049] S41: Collect explicit and implicit feedback from users regarding email classification. Explicit feedback includes recipients marking normal emails as "non-spam" or marking spam emails as "spam." Implicit feedback includes recipients deleting unread suspected emails and reading and replying to normal emails. To control data quality and prevent noisy data from polluting the training set, an email is only stored as a new labeled sample in the training pool when the email feedback meets a preset high confidence condition (e.g., it is marked as spam by more than 10 independent users, and the model's current classification confidence is greater than 0.7).

[0050] S42: Periodically use new labeled samples and stored historical representative samples together for incremental model training.

[0051] In this embodiment, online gradient descent or mini-batch gradient descent is used as the core optimization algorithm to enable the model to quickly adapt to the latest spam patterns without forgetting the original knowledge.

[0052] Specifically, a replay buffer mechanism is adopted. The system maintains a fixed-size buffer that stores a small portion of representative samples of historical training data. Each time incremental learning is performed, not only are new labeled samples used, but also a portion of old data is randomly sampled from the replay buffer for training. This ensures that the model does not lose its memory of the old spam patterns while adapting to the new patterns, thereby preventing catastrophic forgetting.

[0053] S43: When incremental data accumulates to a preset scale or model performance (such as accuracy and recall) declines, trigger a full retraining using all data (new labeled samples and buffer historical data).

[0054] After training is completed, the original data will not be replaced immediately. Instead, the old online model will be gradually replaced through a canary release method, such as A / B testing, against the current production environment model. Group A is applied to the original model, and Group B is applied to the new model. If the new model performs better, the traffic allocation will be adjusted to apply more emails to the new model until it is completely replaced, thus achieving seamless model switching.

[0055] Based on the above steps S1-S4, the emails are first deeply analyzed through multimodal feature extraction, and heterogeneous feature vectors of five dimensions—text semantics, sender behavior, email structure, images, and URL links—are obtained in parallel. Then, an attention-based feature fusion network is used to learn the dynamic importance weights of other modal features for classification decisions using text features as queries, and weighted fusion is performed to generate a highly expressive comprehensive feature representation. Next, the classification model outputs accurate spam identification results. Finally, the adaptive learning module continuously collects high-confidence user feedback, and the model is subjected to online incremental learning and automated gray-scale updates in conjunction with a replay buffer mechanism. Multimodal information fusion significantly improves the accuracy and anti-interference ability of identification. The attention mechanism realizes the dynamic optimization combination of features, and the incremental learning framework enables the system to adapt to new spam patterns in real time without forgetting historical knowledge, thereby effectively dealing with the concept drift problem and achieving high-performance, self-evolving intelligent spam filtering.

[0056] It should be noted that although the steps are described in a specific order in the above embodiments, those skilled in the art will understand that in order to achieve the effect of the present invention, different steps do not necessarily have to be executed in such an order. They can be executed simultaneously (in parallel) or in other orders. These variations are all within the protection scope of the present invention.

[0057] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.< / iframe>

Claims

1. A spam email identification method based on multimodal features and adaptive learning, characterized in that, Includes the following steps, S1: Parse the input email, extract multimodal feature vectors in parallel, and construct a comprehensive feature vector; S2: Input the extracted multimodal feature vectors into an attention-based feature fusion network to generate a unified comprehensive feature representation of emails; S3: Input the comprehensive feature representation into the classifier to obtain the prediction result and confidence level of whether the email is spam; S4: The system runs continuously, using feedback data to drive online optimization of the classifier model; Step S1 includes the following steps: S11: After preprocessing the email subject and body, input them into a pre-trained natural language processing model to obtain text feature vectors; S12: Extract the sender's behavioral feature vector; S13: Analyze the email's HTML structure and extract the email's structural feature vector; S14: Process the image embedded in the email to obtain the image modal feature vector; S15: Analyze embedded links in emails and extract URL link modal feature vectors; The sender behavior feature vector includes the sender's domain reputation score, SPF / DKIM / DMARC authentication pass rate, the number of recipients in this email, and the time interval since the last email was sent. The sender's domain reputation score is obtained by querying an external reputation database via API. If no record is found, it is recorded as a neutral score of 0.

5. SPF / DKIM / DMARC certification pass rate is obtained by calculating the proportion of emails in the sender's historical emails that have passed SPF, DKIM and DMARC certifications; The number of recipients in this email and the time interval between the sender and the last email sent are logarithmically scaled to smooth the feature distribution. The logarithm scaling is log(1 + count) and log(1 + h) respectively, where count represents the number of recipients in this email and h represents the time interval between the last email sent. After standardizing the processed sender domain reputation score, SPF / DKIM / DMARC authentication pass rate, number of recipients in this email, and logarithmic scaling of the time interval since the last email, a 4-dimensional sender behavior feature vector is obtained.

2. The spam identification method based on multimodal features and adaptive learning according to claim 1, characterized in that, Preprocessing email subjects and bodies includes cleaning the email subjects and bodies, removing HTML tags and special characters, and standardizing the encoding.

3. The spam identification method based on multimodal features and adaptive learning according to claim 1, characterized in that, Using the DistilBERT model as the core feature extractor, the preprocessed text is input into the pre-trained natural language processing model, and the 768-dimensional floating-point vector corresponding to the CLS tag in the last hidden layer is obtained as the text feature vector of the entire email.

4. The spam identification method based on multimodal features and adaptive learning according to claim 1, characterized in that, The email structure feature vector includes the ratio of HTML code to plain text length, the number of embedded forms in the email, and the number of suspicious tags. The ratio of HTML code to plain text length, the number of embedded forms in the email, and the number of suspicious tags are standardized and concatenated to obtain a 3-dimensional email structure feature vector.

5. The spam identification method based on multimodal features and adaptive learning according to claim 1, characterized in that, Step S14 includes, First, the embedded image in the email is identified by optical character recognition. The identified text is then fed into a text feature extraction model to obtain a 256-dimensional vector of text features. Then, a convolutional neural network is used to process the embedded image in the email to extract a 2048-dimensional or 1024-dimensional feature vector. This high-dimensional vector is then reduced in dimensionality to obtain a 128-dimensional vector of deep visual features. The text features of the 256-dimensional vector obtained after OCR recognition and the depth visual features of the 128-dimensional vector obtained after CNN model processing are concatenated to form a 384-dimensional image modality feature vector.

6. The spam identification method based on multimodal features and adaptive learning according to claim 1, characterized in that, The URL link modal feature vector includes URL character length, domain registration days, number of special characters in the URL, whether it is a short link, whether the path contains suspicious keywords, reputation score, and whether it is on a blacklist. The URL character length url_length is normalized after logarithmic scaling; Domain registration days are directly standardized, and the number of special characters in the URL is directly standardized. Is it a short link that is binarized into 0 or 1? Whether the path contains suspicious keywords is binarized into 0s or 1s; The reputation score is used directly as a continuous value through a comprehensive threat score obtained from the VirusTotal API; Whether to binarize the data into 0s or 1s in the enterprise blacklist; The processed values ​​are concatenated into a 7-dimensional long vector, which is used as the URL link modal feature vector.

7. The spam identification method based on multimodal features and adaptive learning according to claim 1, characterized in that, Step S2 includes the following steps: S21: Project multimodal feature vectors of different dimensions to the same semantic space dimension through a fully connected layer; S22: Using the mapped text feature vector T text As a query, the sender behavior feature vector, email structure feature vector, image modality feature vector, and URL link modality feature vector (mapped through a fully connected layer) are used as keys and values. The similarity between the query and each key is calculated, and attention weights α are generated using the Softmax function. behavior α structure α image α url ; S23: Use attention weights to perform a weighted summation of the feature values ​​mapped from other feature vectors to obtain the context vector. C = α behavior T behavior + α structure T structure + α image T image + α url T url , among which, T behavior T represents the behavioral feature vector mapped through the fully connected layer. structure T represents the email structure feature vector mapped through the fully connected layer. image T represents the image modality feature vector mapped through the fully connected layer. url This represents the URL link modal feature vector after mapping through the fully connected layer; S24: Map the text feature vector T text With context vector C The data are then concatenated and fused using a fully connected layer to reduce dimensionality, outputting a comprehensive feature representation of the emails for final classification.

8. The spam identification method based on multimodal features and adaptive learning according to claim 1, characterized in that, Step S4 Includes the following steps, S41: Collect explicit and implicit feedback from users on email classification. Only when the email feedback meets the preset high confidence condition will the email be stored as a new labeled sample in the training pool. S42: Periodically use new labeled samples and stored historical representative samples together for incremental model training; S43: When incremental data accumulates to a preset size or model performance degrades, trigger a full retraining using all data.

9. The spam identification method based on multimodal features and adaptive learning according to claim 8, characterized in that, Explicit feedback includes the recipient marking legitimate emails as "not spam" or spam emails as "spam," while implicit feedback includes the recipient deleting unread suspected emails or reading and replying to legitimate emails.

Images