Multi-mode-based 5G message anti-fraud method and related equipment

Abstract

The invention provides a 5G message anti-fraud method and related equipment based on multiple modalities, and the method comprises the steps: capturing an initial 5G message of an authorized user, and preprocessing the initial 5G message to obtain a target 5G message, the target 5G message comprising text content, an embedded link, a multimedia image and sender information; extracting semantic features of the text content, extracting link risk features of the embedded link, extracting counterfeit content features of the multimedia image, performing historical behavior association on sender information, and generating map features; performing dynamic weight fusion on the semantic features, the link risk features, the counterfeit content features and the map features to generate a comprehensive fraud probability; and performing risk grading on the 5G message according to the comprehensive fraud probability, and when the risk grade of the target 5G message is a high risk, intercepting user plane data corresponding to the initial 5G message at the 5G edge computing node. Therefore, the fraud risk of the 5G message is comprehensively and accurately evaluated, and the detection precision is remarkably improved.

Description

Technical Field

[0001] This application relates to the field of mobile communication technology, and in particular to a 5G message anti-fraud method and related equipment based on multimodality. Background Technology

[0002] With the continuous improvement of 5G infrastructure and the ongoing upgrade of basic communication services, 5G messaging is gradually replacing traditional text messages, providing users with rich media information presentation. Users can complete services such as searching, discovering, interacting, and making payments within the message window, greatly improving the user experience. However, the rich media features and convenient interaction of 5G messaging have also made it a new target for fraudsters, with a large amount of fraudulent information accompanying the convenient messaging service.

[0003] Current 5G message fraud prevention methods mainly rely on keyword filtering, sender blacklists and whitelists, and static rule engines. However, these methods have significant shortcomings in practical applications. Keyword filtering depends on manually maintained rules, making it unable to cope with the dynamic evolution and variations of fraudulent language; blacklists and whitelists struggle to identify fake base stations or impersonating official numbers; static rule engines lack adaptability, have a high false positive rate, and cannot identify new fraud techniques such as AI-generated personalized phishing content. Furthermore, existing solutions mostly employ cloud-based detection, resulting in high latency and an inability to intercept messages before they reach the user, meaning users may still receive fraudulent messages. Therefore, existing 5G message fraud prevention methods suffer from detection accuracy issues. Summary of the Invention

[0004] The purpose of this application is to address at least one of the aforementioned technical deficiencies, particularly the technical deficiency in the detection accuracy of existing 5G message fraud prevention methods.

[0005] Firstly, this application provides a multimodal 5G messaging fraud prevention method, the method comprising:

[0006] Capture the initial 5G message of the authorized user and preprocess the initial 5G message to obtain the target 5G message, which contains text content, embedded links, multimedia images and sender information;

[0007] Extract semantic features from text content, extract link risk features from embedded links, extract forged content features from multimedia images, and correlate historical behavior of sender information to generate graph features;

[0008] After optimizing semantic features, link risk features, and forged content features based on graph features, an adaptive attention mechanism is used for dynamic weighted fusion to generate a comprehensive fraud probability.

[0009] 5G messages are classified into risk levels based on the overall fraud probability, and when the risk level of the target 5G message is high, the user plane data corresponding to the initial 5G message is intercepted at the 5G edge computing node.

[0010] In one embodiment, the step of capturing the initial 5G message of an authorized user and preprocessing the initial 5G message to obtain the target 5G message includes:

[0011] By using user plane function bypass mirroring technology, the user plane data of authorized users is copied to obtain the initial 5G message;

[0012] The user plane data GTP-U tunnel is decapsulated and the protocol is deeply parsed to extract the original data packets. The rich media content transmitted in the fragmented data packets is reassembled into media streams based on RTP and RTCP protocols to obtain encrypted 5G messages.

[0013] After decrypting and restoring the encrypted 5G message, the target 5G message is obtained through validity screening and standardization.

[0014] In one embodiment, the step of extracting semantic features from text content includes:

[0015] The pre-trained BERT-5G model is used to perform word segmentation and deep semantic analysis on the text content;

[0016] The BERT-5G model is obtained by performing domain-adaptive pre-training and knowledge distillation compression on the BERT-base model. The domain-adaptive pre-training uses a 5G message-specific corpus, which contains fraudulent language expressions in the financial and government sectors. Knowledge distillation compression is used to generate a lightweight model adapted to the deployment of 5G edge computing nodes. The BERT-5G model is used to calculate the fraud sensitivity score of each word at the word level, identify high-risk collocation patterns through dependency parsing at the phrase level, and represent the overall semantic tendency through classification vectors at the discourse level.

[0017] Based on the results of deep semantic analysis, risk keywords are matched using a dynamically updated fraud keyword map, and semantic features are generated by identifying urgency and manipulative sentiments in the text.

[0018] In one embodiment, the step of extracting the link risk features of embedded links includes:

[0019] By using a dynamic sandbox to render and access embedded links in real time, the multi-level jump paths of embedded links and the dynamic behavior characteristics of each jump page are captured, and the final domain name that the embedded link points to after the jump is determined.

[0020] Based on WHOIS registration information, DNS resolution records, and SSL certificate status, the final domain name is analyzed from multiple dimensions to generate a reputation score.

[0021] Based on a pre-set brand domain name knowledge base, visual similarity calculation and voice confusion detection are performed on the final domain name to generate the counterfeit identification result of the final domain name;

[0022] Based on multi-level redirection paths, dynamic behavior characteristics, reputation scores, and counterfeit identification results, link risk characteristics are generated.

[0023] In one embodiment, the step of extracting forged content features from a multimedia image includes:

[0024] The system locates and identifies brand logos in multimedia images, compares the identified brand logos with a pre-set official logo database for similarity, and outputs the logo forgery confidence score.

[0025] The system locates and decodes the QR code region in a multimedia image, extracts the link address pointed to by the QR code, verifies the consistency between the link address and the context content in the multimedia image, and outputs a QR code risk score.

[0026] Perform frequency domain analysis and spatial domain feature extraction on multimedia images to identify traces of AI generation or tampering in the images and output the deep forgery confidence score;

[0027] By integrating the confidence level of logo forgery, the risk score of QR code, and the confidence level of deep forgery, the characteristics of forged content are obtained.

[0028] In one embodiment, the step of associating historical behavior with sender information to generate spectral features includes:

[0029] The sender number, IP address, and device fingerprint contained in the sender information are used as nodes, and the association edges between each node are constructed. Among them, the association edges include the association between multiple numbers used by the same device, the association between multiple devices associated with the same IP address, and the association between each node and historical malicious nodes in the preset malicious entity database.

[0030] A graph neural network is used to learn the embedding representation of each node and its associated edges to obtain the embedding vector of each node. The embedding vector is used to reflect the association strength between its corresponding node and historical malicious nodes.

[0031] Based on the embedding vector of each node, the fraud gang community to which each node belongs is identified, and the fraud gang identification results are obtained.

[0032] Based on each node and its associated edges, and combined with the results of fraud gang identification, a graph feature is generated.

[0033] In one embodiment, when the risk level of the target 5G message is high risk, the step of intercepting the initial 5G message at the 5G edge computing node includes:

[0034] When the overall fraud probability is greater than or equal to a preset first threshold, the risk level of the target 5G message is determined to be high risk. Then, a lightweight multimodal model deployed on 5G edge computing nodes is used to block the user plane data corresponding to the initial 5G message in real time to prevent the user plane data from being sent to the user's terminal.

[0035] Secondly, this application provides a multimodal 5G message anti-fraud device, the device comprising:

[0036] The target 5G message determination module is used to capture the initial 5G message of an authorized user and preprocess the initial 5G message to obtain the target 5G message. The target 5G message contains text content, embedded links, multimedia images and sender information.

[0037] The multimodal feature extraction module is used to extract semantic features of text content, extract link risk features of embedded links, extract forged content features of multimedia images, and associate historical behavior with sender information to generate graph features.

[0038] The comprehensive fraud probability generation module is used to optimize semantic features, link risk features and forged content features based on graph features, and then dynamically weighted and fused them using an adaptive attention mechanism to generate a comprehensive fraud probability.

[0039] The 5G message interception module is used to classify the risk of 5G messages based on the overall fraud probability, and when the risk level of the target 5G message is high, it intercepts the user plane data corresponding to the initial 5G message at the 5G edge computing node.

[0040] Thirdly, this application provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of any of the multimodal 5G message anti-fraud methods described in the above embodiments.

[0041] Fourthly, this application provides a computer device, including: one or more processors, and a memory;

[0042] The memory stores computer-readable instructions, which, when executed by one or more processors, perform the steps of any of the multimodal 5G message anti-fraud methods described in the above embodiments.

[0043] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0044] The multimodal 5G message fraud prevention method and related equipment provided in this application captures and preprocesses the initial 5G messages of authorized users to obtain target 5G messages containing text content, embedded links, multimedia images, and sender information. Then, semantic features of the text content, link risk features of the embedded links, and forged content features of the multimedia images are extracted. Historical behavior associations are performed on the sender information to generate a graph feature, enabling comprehensive mining of fraud-related clues from multimodal data. An adaptive attention mechanism is then used to dynamically weight and fuse the aforementioned semantic features, link risk features, forged content features, and graph features to generate a comprehensive fraud probability. This mechanism automatically adjusts the weights based on the contribution of each feature to the current fraud determination, effectively overcoming the shortcomings of insufficient or mutually interfering feature information utilization. Finally, the 5G messages are risk-classified according to the comprehensive fraud probability, and when the risk level of the target 5G message is high, the user plane data of the initial 5G message is intercepted at the 5G edge computing node. Therefore, this application comprehensively and accurately assesses the fraud risk of 5G messages through multimodal feature extraction and adaptive weighted fusion, significantly improving detection accuracy and reducing false alarm and false negative rates. At the same time, it achieves rapid interception by leveraging edge computing nodes, enhancing the real-time protection capability of 5G message services. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 A flowchart illustrating the 5G message anti-fraud method based on multimodality provided in this application embodiment;

[0047] Figure 2 A schematic diagram of the structure of a multimodal 5G message anti-fraud device provided in an embodiment of this application;

[0048] Figure 3 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] This application provides a multimodal 5G message fraud prevention method. The following embodiments illustrate this method applied to a computer device. It is understood that the computer device can be any device with data processing capabilities, including but not limited to a single server and server clusters. Figure 1 As shown, the method may include the following steps:

[0051] S101: Capture the initial 5G message of the authorized user and preprocess the initial 5G message to obtain the target 5G message, which contains text content, embedded links, multimedia images and sender information.

[0052] In this embodiment, an authorized user refers to a user who, in accordance with relevant privacy policies or user agreements, has agreed in advance to have their 5G messages flagged for fraud prevention. This authorization is typically completed through terminal settings or network subscriptions. The initial 5G message is raw message data captured from the 5G communication network. Its format follows 3GPP standards or operator-defined protocols and may contain encrypted or encoded information. Preprocessing is a series of operations that decode, parse, clean, and structure the initial 5G message, aiming to remove redundancy, restore plaintext, and extract key elements. The target 5G message is a standardized data structure obtained after preprocessing. It includes at least text content, embedded links, multimedia images, and sender information. The text content refers to the natural language text portion of the message, the embedded links refer to the Uniform Resource Locators (URLs) contained in the message, the multimedia images refer to the pictures or image files carried in the message, and the sender information refers to attribute data identifying the message initiator, such as a mobile phone number, application identifier, or network address.

[0053] In the specific implementation process, firstly, initial 5G messages from authorized users are captured in real-time or near real-time through data acquisition interfaces deployed on 5G edge computing nodes or the core network side. The identification information of these authorized users is pre-stored in a license list, and the acquisition interface only captures messages matching this list to ensure compliance. The captured initial 5G messages typically exist in binary stream or text form, such as message data encapsulated using the Session Initiation Protocol (SIP). Next, the initial 5G messages undergo preprocessing. The first step of preprocessing is protocol parsing of the message, determining its encoding method and encryption status based on fields in the message header. For encrypted content, a decryption key associated with the user is used to decrypt it, thus obtaining the plaintext message body. Then, through message structure analysis, the message body is split into different components. For example, MIME types are used to identify text portions and multimedia attachments; all hyperlinks are extracted from the text as embedded links using regular expressions or URL matching algorithms; and image attachments are decoded into a common image format. Simultaneously, sender information, including the sender's MSISDN number, IP address, or application identifier, is extracted from the message header or signaling information. To improve the data quality for subsequent processing, preprocessing also includes cleaning steps, such as removing HTML tags, ad tracking codes, or irrelevant characters from the text, filtering out malformed links, and normalizing or converting the image size to ensure the image data is complete and usable. After these series of operations, a structured target 5G message is finally obtained, which contains clear text content, an embedded list of links, multimedia image data, and sender information.

[0054] It should be noted that by capturing the initial 5G messages of authorized users, fraud detection can be ensured with the user's knowledge and consent, strictly complying with data privacy protection regulations and fundamentally avoiding the legal risks of unauthorized processing of user information. Preprocessing the initial 5G messages yields structured target 5G messages, which include text content, embedded links, multimedia images, and sender information. The comprehensive extraction of these multimodal fraud features provides a rich data foundation, avoiding detection blind spots caused by relying on a single information source, thereby significantly improving the comprehensiveness and accuracy of fraud detection.

[0055] S102: Extract semantic features of text content, extract link risk features of embedded links, extract forged content features of multimedia images, and associate historical behavior of sender information to generate graph features.

[0056] In this embodiment, text content refers to complete sentences or paragraphs composed of natural language text in 5G messages. Semantic features are high-dimensional vector representations extracted after lexical, syntactic, and contextual analysis of the text content to characterize its deeper meaning. Embedded links are clickable Uniform Resource Locators (URLs) embedded within the 5G message text. Link risk features are multi-dimensional attributes generated based on the link's domain registration information, server location, certificate status, and matching results with known malicious link libraries to assess its security. Multimedia images are static visual files carried in 5G messages. Forged content features are discriminative features extracted from images using image forensics algorithms to detect splicing, copy-pasting, or generative tampering traces. Sender information includes the sender's phone number, network address, or application identifier. Historical behavior association is obtained by querying a historical record database indexed by sender information to obtain the sender's past message sending records, complaint history, number of reports, and interaction relationships with other risky entities. Graph features are vector representations constructed based on historical behavior association results, containing sender behavior patterns, relationship strength, and historical risk tendencies.

[0057] To extract semantic features from text content, a pre-trained natural language processing model is first invoked. This model, pre-trained on a massive corpus, maps the input text content into a fixed-dimensional semantic vector. Specifically, the text content in the target 5G message is segmented and word-embedded, then contextual modeling is performed using a multi-layer Transformer encoder, ultimately outputting a semantic feature vector of the entire text. This vector contains the text's thematic tendency, intent, and combination patterns of potential fraudulent keywords. When extracting link risk features from embedded links, the embedded links are parsed to obtain their domain name, path, and parameters. The domain name system is then queried to obtain the domain's registration time, registrar, and expiration time. The SSL certificate validity of the link is verified using a digital certificate store, and a global malicious URL database is accessed to match whether the link has been marked as a phishing or malicious site. Simultaneously, the link length, the proportion of special characters, and the number of redirects are calculated. All results are normalized and concatenated into a link risk feature vector. When extracting forged content features from multimedia images, pixel-level analysis is performed on the multimedia images. First, image noise analysis algorithms are used to extract the local noise distribution pattern of the image. Possible splicing areas are detected by comparing the noise consistency of different regions. Then, edge detection and frequency domain analysis are used to identify whether there are abnormal edges or high-frequency components in the image. Finally, noise features, edge features, and color distribution features are combined to form a forged content feature vector.

[0058] The process involves associating historical behavior data with sender information and generating graph features. First, using the phone number or application identifier in the sender information as the query key, all records associated with that sender are retrieved from a historical behavior database deployed locally or in the cloud. These records include summaries of all 5G messages sent by the sender within a specific time period, the number of times each message was reported by recipients, tags indicating the sender was marked as spam or fraudulent by other users, and associations between the sender and known fraudulent numbers or high-risk accounts. After acquiring this historical data, the sender is treated as a node, with its sent messages, report records, and associated high-risk entities as connected nodes, constructing a local behavioral network centered on the sender. Next, a structured analysis is performed on this local behavioral network, statistically analyzing the sender's message sending frequency, report rate, average message length trends, and the length and number of connection paths with high-risk nodes. Simultaneously, a network embedding algorithm is used to convert the structural features of the entire local network into a fixed-length graph feature vector. This graph feature vector comprehensively characterizes the sender's historical behavioral patterns and its position and influence within the risk network, reflecting its long-term behavioral credibility and potential risk propensity.

[0059] It's important to note that extracting semantic features from text content aims to uncover fraudulent intent from the deeper meaning of language. Scam messages often influence user judgment through carefully crafted, manipulative language, urgent threats, or false promises. Traditional keyword matching is prone to failure due to synonym substitution or sentence structure variations, while semantic features can understand the true intent and contextual relationships of the text, effectively identifying seemingly normal but deceptively trap-filled messages. Extracting risk features from embedded links is crucial for technically verifying the authenticity and security of links. Scams often aim to redirect users to malicious websites. Even with highly realistic text, analyzing domain registration information, certificate status, and whether a link is listed in a malware database can independently reveal potential risks, compensating for the limitations of pure text analysis. Extracting forged content features from multimedia images helps identify scams using visual content. Forged documents, fake product images, or altered screenshots are common tools for fraud. Noise analysis, edge detection, and consistency checks of images can reveal traces of human tampering, thus blocking scams relying on visual deception. Associating sender information with historical behavior and generating graph features allows for the evaluation of current messages within the sender's long-term behavioral context. Since fraudulent activities are often persistent or organized, a single sender may have multiple suspicious sending records or be associated with reported accounts. Graph features aggregate this historical information, reflecting the sender's credibility and behavioral patterns, enabling timely identification of senders whose initial message content is normal but whose historical behavior is abnormal. By simultaneously extracting features from these four dimensions, a comprehensive perception of fraud risk can be formed from four aspects: text semantics, link security, image authenticity, and sender credibility. Each feature reveals the possibility of fraud from different angles, complementing and corroborating each other, significantly improving the detection accuracy and robustness against complex and ever-changing fraud methods.

[0060] S103: After optimizing semantic features, link risk features, and forged content features based on graph features, an adaptive attention mechanism is used for dynamic weighted fusion to generate a comprehensive fraud probability.

[0061] In this embodiment, the adaptive attention mechanism is a learnable weight allocation algorithm based on neural networks. It can dynamically calculate the importance coefficient of each feature to the current task according to the attributes of the input features and the interrelationships between features. Dynamic weighted fusion refers to the operation of vector concatenation or summation after applying different weight coefficients to different feature vectors under the control of the adaptive attention mechanism. The comprehensive fraud probability is a scalar value between 0 and 1, which is used to represent the likelihood that the current 5G message is a fraudulent message.

[0062] Dynamic optimization of semantic features, link risk features, and forged content features is performed based on graph features. Graph features are generated by associating sender information with historical behaviors, containing the sender's historical behavioral patterns and relationships, providing important background information for assessing the risk of the current message. Graph features can be interactively calculated with semantic features, link risk features, and forged content features to generate optimization coefficients for each modality. These optimization coefficients reflect the degree to which the sender's historical behavior affects the credibility or importance of the current content features. Applying the optimization coefficients to the corresponding feature vectors recalibrates the feature space, resulting in optimized semantic features, link risk features, and forged content features. Alternatively, graph features can be input into a gating network to generate gating signals for semantic features, link risk features, and forged content features. The gating signal is a vector between 0 and 1, representing the degree to which each dimension of each modality feature should be preserved or suppressed. Multiplying the gating signal element-wise with the corresponding feature vector achieves selective enhancement or attenuation of features, resulting in optimized modality features. This approach allows graph features to softly gate the information flow of other features, preserving feature dimensions consistent with historical behavior patterns and suppressing potentially irrelevant noise. Semantic features, link risk features, and forged content features can also be appended as node attributes to relevant nodes in the graph structure corresponding to the graph features. Utilizing the message propagation mechanism of graph neural networks, several rounds of iterative updates are performed on the graph containing historical and current nodes. After the update, each modality feature aggregates relevant information from adjacent historical nodes, thus incorporating the sender's historical behavioral context and obtaining an optimized feature representation. In this approach, the graph features themselves, as part of the graph structure, also participate in message propagation, but the optimized features retain their independent dimensions and are used together with the updated graph features for subsequent fusion.

[0063] To dynamically weight and fuse semantic features, link risk features, forged content features, and graph features using an adaptive attention mechanism to generate a comprehensive fraud probability, the first step is to align all feature vectors to ensure they can be input into the same attention computation network. Specifically, semantic features, link risk features, forged content features, and graph features are each mapped to the same dimensional space through a fully connected layer, resulting in a unified feature representation. Then, an attention scoring network, implemented using a multilayer perceptron, is constructed, taking the four unified-dimensional feature vectors as input and calculating a raw attention score for each feature. These raw attention scores reflect the relative importance of different modal features in determining fraud within the current message context. Next, the raw attention scores are normalized using a softmax function, resulting in four attention weight coefficients that sum to 1, corresponding to the weights of the semantic features, link risk features, forged content features, and graph features, respectively. Each feature vector is then multiplied by its corresponding attention weight to obtain a weighted feature vector. Finally, the four weighted feature vectors are summed element-wise or concatenated along the feature dimensions to form a comprehensive feature vector that integrates multi-dimensional information. Finally, the comprehensive feature vector is input into a classifier, which consists of a fully connected layer and a sigmoid activation function. The classifier outputs a comprehensive fraud probability between 0 and 1. The closer the probability value is to 1, the higher the probability that the current 5G message is a fraudulent message.

[0064] By employing a dynamic optimization and adaptive attention mechanism based on graph features to dynamically weight and fuse semantic features, link risk features, forged content features, and graph features, the contribution of each feature can be flexibly adjusted according to the characteristics of different fraud methods. For example, when a message contains highly suspicious links but the text content is relatively normal, the attention mechanism automatically assigns higher weight to the link risk feature, allowing link information to play a dominant role in the final judgment. When a message's text content has strongly suggestive language but the links and images appear normal, the attention mechanism increases the weight of semantic features, ensuring that the fraudulent intent in the text is not masked by other features. The optimization effect of graph features is reflected in its proactive injection of the sender's historical behavioral background into other modal features, so that these features already carry the sender's historical risk information before entering the attention fusion process. For example, when the sender has historically belonged to a high-risk fraud gang, graph features will enhance the dimension of semantic features related to the gang's commonly used rhetoric, while also increasing the sensitivity of link risk features to specific domain name patterns, enabling the subsequent attention mechanism to more accurately focus on truly discriminative information. The dynamic weighted fusion approach overcomes the limitation of static feature importance, enabling the model to adaptively focus on the most discriminative features when faced with complex, varied, and unevenly distributed fraudulent messages, thus more accurately calculating the overall fraud probability. Simultaneously, by organically fusing features across four dimensions before classification, it avoids misjudgments that might arise from a single feature, achieving mutual complementarity and verification between multimodal information. In particular, through proactive optimization of graph features, the sender's historical behavioral information is deeply coupled with current content features, allowing the model to identify messages that appear normal on their own but possess high risk when considered in context. This significantly improves the accuracy and robustness of fraud detection, providing a reliable probabilistic basis for subsequent risk classification and interception decisions.

[0065] S104: Classify the risk of 5G messages based on the overall fraud probability, and when the risk level of the target 5G message is high, intercept the user plane data corresponding to the initial 5G message at the 5G edge computing node.

[0066] In this embodiment, the comprehensive fraud probability refers to a value between 0 and 1 calculated based on multimodal feature fusion, used to quantify the likelihood that the current 5G message is a fraudulent message; risk classification refers to mapping the comprehensive fraud probability to different risk level categories according to a preset threshold range, such as low risk, medium risk, and high risk levels; high risk level is the highest level in risk classification, representing that the current 5G message has an extremely high suspicion of fraud and requires the strictest handling measures; 5G edge computing node refers to a computing platform deployed at the edge of the 5G network, close to the user access side, with data forwarding, policy execution, and real-time computing capabilities; user plane data refers to the service data stream carrying the original 5G message content, which can be identified and manipulated at the 5G edge computing node; interception refers to performing discard, blocking, or redirection operations on user plane data at the 5G edge computing node to prevent it from continuing to be transmitted to the user terminal.

[0067] For risk classification of 5G messages based on the overall fraud probability, the overall fraud probability output by the classifier after fusion using an adaptive attention mechanism is first obtained. This probability value reflects the overall degree of fraud suspicion of the current target 5G message. Then, a pre-configured risk classification strategy is read. This strategy defines the correspondence between several probability threshold intervals and risk levels. For example, a comprehensive fraud probability less than 0.3 is classified as low risk, a comprehensive fraud probability greater than or equal to 0.3 and less than 0.7 is classified as medium risk, and a comprehensive fraud probability greater than or equal to 0.7 is classified as high risk. Based on the specific interval of the comprehensive fraud probability, the current target 5G message is marked with the corresponding risk level. After classification, the risk level label is associated with the identification information of the target 5G message and stored for subsequent handling decisions and statistical analysis. Messages classified as low-risk or medium-risk can be allowed to be forwarded normally to the user terminal, and risk warning information can optionally be attached to the message or recorded in the log system for subsequent auditing.

[0068] When a target 5G message is deemed high-risk, an interception process is immediately triggered. First, the session identifier and user plane data stream identifier of the message in the 5G network are extracted from the message's metadata. These identifiers uniquely determine the forwarding path of the data packets carrying the message. Then, an interception command containing these identifiers is sent to a 5G edge computing node deployed on the user access side. This node monitors all passing user plane data streams in real time. Upon receiving the interception command, the 5G edge computing node adds the data stream characteristics corresponding to the message to a dynamic interception list. When a user plane data packet matching these characteristics arrives, it is immediately discarded, preventing further transmission to the user terminal. Simultaneously, the 5G edge computing node can send a session modification request to the core network elements to prematurely terminate the message's transmission session and release network resources. After interception, a system notification can be returned to the sender or receiver, informing them that the message was intercepted due to security policies, without disclosing specific fraud detection details, thus balancing security protection and user experience.

[0069] By classifying 5G messages according to their overall fraud probability, differentiated processing is achieved for different levels of fraud risk. Low-risk and medium-risk messages are delivered normally with accompanying alerts, avoiding excessive interception that could interfere with normal communication. High-risk messages, on the other hand, trigger the strictest handling measures to ensure that fraudulent activities are blocked in a timely manner. When the target 5G message is classified as high-risk, the user plane data corresponding to the initial 5G message is intercepted at the 5G edge computing node. Leveraging the proximity of the edge computing node to the user, the interception can be completed before the data reaches the user terminal, significantly shortening the response time and preventing actual losses caused by users viewing fraudulent content. Simultaneously, the distributed deployment architecture of the edge computing node ensures that the interception operation does not place additional load on the core network, guaranteeing the overall network operating efficiency. This method of real-time interception of high-risk messages at the edge not only meets the low-latency requirements of fraud detection but also achieves precise control over fraudulent traffic, effectively improving the security protection capabilities of 5G messaging services.

[0070] In the above embodiments, by capturing and preprocessing the initial 5G messages of authorized users, a target 5G message containing text content, embedded links, multimedia images, and sender information is obtained. Then, semantic features of the text content, link risk features of the embedded links, and forged content features of the multimedia images are extracted. Historical behavior associations are performed on the sender information to generate graph features, realizing comprehensive mining of fraud-related clues from multimodal data. Then, an adaptive attention mechanism is used to dynamically weight and fuse the above semantic features, link risk features, forged content features, and graph features to generate a comprehensive fraud probability. The weights can be automatically adjusted according to the contribution of each feature to the current fraud determination, effectively overcoming the defects of insufficient utilization of feature information or mutual interference. Finally, the 5G message is risk-classified according to the comprehensive fraud probability, and when the risk level of the target 5G message is high-risk, the initial 5G message is intercepted at the 5G edge computing node. Therefore, this application comprehensively and accurately assesses the fraud risk of 5G messages through multimodal feature extraction and adaptive weighted fusion, significantly improving detection accuracy and reducing false alarm and false negative rates. At the same time, it achieves rapid interception by leveraging edge computing nodes, enhancing the real-time protection capability of 5G message services.

[0071] In one embodiment, the step of capturing the initial 5G message of an authorized user and preprocessing the initial 5G message to obtain the target 5G message includes:

[0072] By using user plane function bypass mirroring technology, the user plane data of authorized users is copied to obtain the initial 5G message;

[0073] The user plane data GTP-U tunnel is decapsulated and the protocol is deeply parsed to extract the original data packets. The rich media content transmitted in the fragmented data packets is reassembled into media streams based on RTP and RTCP protocols to obtain encrypted 5G messages.

[0074] After decrypting and restoring the encrypted 5G message, the target 5G message is obtained through validity screening and standardization.

[0075] In this embodiment, user plane function bypass mirroring technology refers to using port mirroring or a splitter on the user plane function network element of the 5G core network to completely copy the data stream of a specified user and send it to the detection system without affecting the forwarding of the original data stream; GTP-U tunneling is a tunneling protocol used to transmit user data packets between 5G network nodes, which achieves encapsulation by adding a GTP-U header to the outer layer of the data packet; decapsulation is the process of removing the GTP-U tunnel header to restore the original data packet inside; protocol deep parsing is the layer-by-layer analysis of the original data packet to identify and extract application layer protocol data units; the original data packet is the complete network data packet containing the IP header, transport layer header, and application layer payload after removing the tunnel encapsulation; fragmented transmission of rich media content refers to multimedia data such as images, videos, or audio that are split into multiple data packets for transmission due to data packet size limitations; RTP The protocol is a real-time transmission protocol used to transmit real-time data such as audio and video over IP networks; the RTCP protocol is a real-time transmission control protocol that works with RTP to provide data transmission statistics and control functions; media stream reassembly is the sequential assembly of RTP payloads from multiple data packets based on RTP sequence numbers and RTCP timestamp information to recover complete rich media content; encrypted 5G messages are complete message data obtained after media stream reassembly but whose content is still encrypted; decryption and restoration is the decryption of encrypted 5G messages using a decryption key associated with the user to recover plaintext message content; validity screening is the format and integrity verification of decrypted messages, removing damaged or non-compliant messages; standardization processing is the conversion of filtered messages into a unified internal data format, including text encoding conversion, image format normalization, and metadata extraction.

[0076] During implementation, a bypass mirroring policy based on a list of authorized user identifiers is first configured on the 5G core network user plane functional elements. This policy replicates only the uplink or downlink user plane data of users on the list. While forwarding data streams normally, the user plane functional elements send an exact copy of the data stream to a preprocessing server through the mirror port. The server captures these original network packets in real time and temporarily stores them in a high-speed buffer queue. Subsequently, the captured user plane data is parsed packet by packet, the outer GTP-U tunnel header is identified and stripped, the original IP data packets carried internally are recovered, and multiple packets belonging to the same tunnel are sorted and reassembled according to the tunnel endpoint identifier and sequence number information in the GTP-U header to ensure the integrity of subsequent parsing.

[0077] Next, deep protocol analysis is performed on the reassembled original data packets, peeling off the Ethernet header, IP header, and transport layer header layer by layer to identify the application layer protocols. For 5G messages carrying rich media content, RTP data packets are detected and the payload is extracted. During the media stream reassembly phase, the RTP payloads from multiple data packets are sequentially concatenated based on the RTP header sequence number and timestamp. Packet loss statistics and synchronization information in the RTCP data packets are used to compensate for out-of-order or lost packets, thus restoring the complete rich media content file. For non-real-time transmission parts, complete application layer protocol data units are directly extracted from the TCP or UDP payload, ultimately yielding an encrypted 5G message containing rich media content and text data.

[0078] Since user plane data may be encrypted, encrypted 5G messages need to be decrypted and restored. The session key associated with the user and decryption algorithm parameters are obtained from the unified data management network element through a secure interface. This key is used to decrypt the encrypted 5G message and recover the plaintext message content. After decryption, the plaintext message is filtered for validity, checking whether the format conforms to the 5G message specification and verifying the integrity checksum, eliminating corrupted or formatted messages. Finally, the filtered messages are standardized, converting the text content to UTF-8 encoding, scaling or converting images of different formats to a preset standardized format, extracting metadata such as the sender's number and timestamp from the message header, combining them into a structured target 5G message, and storing it in a preprocessing queue for subsequent fraud detection.

[0079] By replicating authorized user data through user plane function bypass mirroring technology, original message copies can be obtained without affecting normal business forwarding, avoiding the performance overhead and compliance risks associated with deploying detection proxies on user terminals, and achieving seamless data collection on the network side. GTP-U tunnels are decapsulated and subjected to deep protocol analysis to restore the true data encapsulation layer, allowing subsequent analysis to directly target the original application layer content and eliminate network transmission interference. Fragmented rich media content is reassembled using RTP and RTCP-based media stream reconstruction to solve the multi-packet splitting problem, ensuring complete recovery of large files and avoiding detection blind spots or misjudgments caused by data fragmentation. Encrypted 5G messages are decrypted and restored, providing a processable plaintext data foundation for subsequent semantic analysis, link detection, and image forensics. Through validity screening and standardization, damaged or incorrectly formatted data is removed, unifying data format and quality, ensuring the consistency and reliability of inputs in subsequent fraud detection stages, and significantly improving the accuracy and processing efficiency of anti-fraud methods.

[0080] In one embodiment, the step of extracting semantic features from text content includes:

[0081] The pre-trained BERT-5G model is used to perform word segmentation and deep semantic analysis on the text content;

[0082] The BERT-5G model is obtained by performing domain-adaptive pre-training and knowledge distillation compression on the BERT-base model. The domain-adaptive pre-training uses a 5G message-specific corpus, which contains fraudulent language expressions in the financial and government sectors. Knowledge distillation compression is used to generate a lightweight model adapted to the deployment of 5G edge computing nodes. The BERT-5G model is used to calculate the fraud sensitivity score of each word at the word level, identify high-risk collocation patterns through dependency parsing at the phrase level, and represent the overall semantic tendency through classification vectors at the discourse level.

[0083] Based on the results of deep semantic analysis, risk keywords are matched using a dynamically updated fraud keyword map, and semantic features are generated by identifying urgency and manipulative sentiments in the text.

[0084] In this embodiment, the BERT-5G model is a pre-trained language model based on the Transformer architecture. It is obtained by performing domain-adaptive pre-training and knowledge distillation compression on top of BERT-base, and is used for deep semantic understanding of 5G message text. Domain-adaptive pre-training refers to secondary training of the general model using a specific domain corpus to adapt the model parameters to the language distribution of the target domain. The 5G message corpus is a large-scale text dataset containing fraudulent language in fields such as finance and government affairs. Knowledge distillation compression is a model lightweighting technique that reduces the number of parameters and computational complexity by having the student model learn the output behavior of the teacher model while maintaining accuracy. At the lexical level, words or subwords are used as processing units, and the fraud sensitivity score is the score of the model's output for each lexical word that is relevant to the fraudulent intent. At the phrase level... The system uses phrases composed of multiple lexical units as units. Dependency parsing is used to identify grammatical dependencies between words. High-risk collocation patterns are specific word combinations and grammatical relationships in fraudulent messages discovered through dependency parsing. At the discourse level, the entire text is considered as a unit, and the classification vector is a high-dimensional vector output by the model that represents the semantic tendency of the entire text. The deep semantic parsing result is a set of semantic information output by the model at the lexical, phrase, and discourse levels. The dynamically updated fraud keyword graph is a continuously maintained graph structure knowledge base, where nodes represent fraudulent keywords or phrases, and edges represent co-occurrence relationships or logical connections between keywords. Risk keyword matching compares the text with graph nodes to identify the hit location and frequency. Urgency sentiment refers to the urging, urgent, and other emotional tones in the text, while inducement sentiment refers to the emotional tones aimed at guiding user behavior, such as enticement, sympathy, and intimidation.

[0085] In the implementation process, the BERT-5G model was first built and deployed. A 5G-specific corpus containing fraudulent language from the financial and government sectors was used as training data to perform domain-adaptive pre-training on the BERT-base model, resulting in a teacher model with higher comprehension capabilities. Subsequently, knowledge distillation compression technology was used to design a student model architecture with fewer parameters and lower computational complexity. The student model learned the output behavior of the teacher model, and distillation training was completed by minimizing the difference between the two outputs, resulting in a lightweight BERT-5G model, which was then deployed on 5G edge computing nodes to process text content in real time.

[0086] When performing text content analysis, the target 5G message text is input into the BERT-5G model. The model performs word segmentation through a multi-layer Transformer encoder and captures contextual dependencies between words through a self-attention mechanism. At the word level, a fraud sensitivity score is output for each word, reflecting its importance in identifying fraudulent intent in the current context. At the phrase level, dependency parsing is used to analyze sentence structure, identify grammatical dependencies such as subject-verb and verb-object relationships, and discover high-risk collocation patterns such as "immediate transfer" and "suspected money laundering." At the discourse level, all word context representations are aggregated to generate classification vectors, which represent the overall semantic tendency of the text.

[0087] After obtaining the deep semantic analysis results, they are combined with a dynamically updated fraud keyword map for analysis. All words and phrases in the text are queried in the map for nodes with the same or similar meanings, and the hit location, frequency, and associated paths are recorded. Simultaneously, sentiment analysis is performed based on the analysis results. Urgency-related words such as "immediately" and "right away" are extracted from the word-level sensitivity scores to calculate density intensity and generate urgency-related sentiment scores. Leading phrases such as "Congratulations on obtaining" and "Click to claim" are identified from the dependency parsing results to generate leading-edge sentiment scores. Finally, the word-level fraud sensitivity score vector, phrase-level high-risk collocation pattern identifiers, text-level classification vector, risk keyword matching results, urgency-related and leading-edge sentiment scores are concatenated and fused to generate the final semantic feature vector, comprehensively characterizing the fraud risk features of the text across multiple dimensions.

[0088] The BERT-5G model is used for word segmentation and deep semantic analysis because general models lack specific understanding of fraudulent rhetoric in the financial and government sectors within 5G messaging scenarios. Domain-adaptive pre-training enables the model to learn domain-specific expression patterns, significantly improving its ability to recognize technical terms and complex fraudulent phrases. Simultaneously, knowledge distillation and compression generate a lightweight model, allowing it to run in real-time on resource-constrained 5G edge computing nodes, meeting low-latency detection requirements. At the word level, fraud sensitivity scores are calculated to accurately locate high-risk keywords; at the phrase level, high-risk collocation patterns are identified to uncover fraudulent phrases composed of word combinations; and at the text level, classification vectors provide a global understanding of textual intent. These three levels complement each other to form a comprehensive perception. A dynamically updated fraud keyword graph is used for risk keyword matching, leveraging the graph's association capabilities to identify complex situations where individual words are not inherently sensitive but combine to form fraudulent intent. Dynamic graph updates ensure timely responses to new rhetoric. Identifying urgency and manipulative emotional tendencies directly targets common psychological manipulation techniques used in fraudulent messages, capturing the essential characteristics of fraudulent rhetoric. By comprehensively analyzing the generated semantic features from multiple levels and perspectives, we can fully and meticulously characterize the risks of text fraud, providing high-quality input for subsequent multimodal fusion and significantly improving the detection accuracy and robustness of anti-fraud methods.

[0089] In one embodiment, the step of extracting the link risk features of embedded links includes:

[0090] By using a dynamic sandbox to render and access embedded links in real time, the multi-level jump paths of embedded links and the dynamic behavior characteristics of each jump page are captured, and the final domain name that the embedded link points to after the jump is determined.

[0091] Based on WHOIS registration information, DNS resolution records, and SSL certificate status, the final domain name is analyzed from multiple dimensions to generate a reputation score.

[0092] Based on a pre-set brand domain name knowledge base, visual similarity calculation and voice confusion detection are performed on the final domain name to generate the counterfeit identification result of the final domain name;

[0093] Based on multi-level redirection paths, dynamic behavior characteristics, reputation scores, and counterfeit identification results, link risk characteristics are generated.

[0094] In this embodiment, the dynamic sandbox is an isolated virtual execution environment used to simulate user clicks and access behaviors under controlled conditions to observe the actual performance of embedded links without harming the real system. The multi-level redirection path of the embedded link is a chain formed by a series of intermediate URLs that arrive sequentially after multiple HTTP redirects or script jumps from the original link. The dynamic behavior characteristics of each redirected page are observable indicators captured in the sandbox, such as browser events, script execution records, file download attempts, pop-up behavior, and suspicious network requests. The final domain name is the main domain name corresponding to the webpage finally reached after multi-level redirection. WHOIS registration information is a publicly available record obtained from the domain name registry, including the domain owner, registration date, expiration date, and registrar. DNS resolution records are returned by the Domain Name System. The system retrieves the IP address, CNAME record, and MX record resolution results; the SSL certificate status verifies the validity, issuing authority, expiration date, and revocation status of the domain's digital certificate; the reputation score is a quantitative value calculated based on multi-dimensional information to quantify the final trustworthiness of the domain; the pre-set brand domain knowledge base is a database containing official domain names of major well-known brands and their variant rules; visual similarity calculation compares the visual similarity between the target webpage and the brand's official webpage through image matching or DOM structure analysis; speech confusion detection analyzes the pronunciation and spelling of the domain name text to identify confused domain names that sound similar to the brand name but are spelled differently; and the counterfeit identification result is a conclusion drawn from the combined visual similarity and speech confusion detection to determine whether the target domain name is a counterfeit brand.

[0095] During implementation, embedded links are first extracted from target 5G messages and input into a dynamic sandbox. The sandbox uses a virtualized browser kernel to simulate real user click behavior, records the initial URL, and progressively tracks each HTTP redirect and JavaScript dynamic jump, forming a multi-level list of redirect paths. Simultaneously, the dynamic behavior of each redirected page is continuously monitored, including external script loading, pop-up triggering, covert network requests, file download attempts, and form structures that steal input, quantifying these behaviors as Boolean values ​​or counting features.

[0096] After capturing the multi-level redirection path and determining the final domain name, a multi-dimensional analysis is immediately initiated. Domain registration information is queried via the WHOIS protocol interface to obtain registration time, expiration time, registrar, and registrant's country, calculating the domain's existence duration and expiration urgency. DNS resolution queries are performed to obtain A records, CNAME records, and NS records, checking for the presence of known malicious IPs or dynamic DNS service providers. SSL certificate verification is initiated to check the certificate signature chain, issuing authority credibility, validity period, and consistency of organization name. All information is input into a pre-trained reputation scoring model, outputting a reputation score between 0 and 100, with lower scores indicating higher risk.

[0097] For the final domain name counterfeiting identification, it is first compared with a pre-set brand domain name knowledge base. Visual similarity calculation is then initiated for candidate domain names matching the brand. Simulated visits are used to obtain the DOM tree structure and visual rendering snapshots of the target webpage and the brand's official webpage, calculating similarity scores for page layout, key image positions, and the logo area. Simultaneously, speech obfuscation detection is performed, converting the domain name text into a phonetic representation and fuzzily matching it with the brand's standard pronunciation to identify obfuscated domain names formed by letter substitutions. The counterfeiting identification result is output by combining the visual similarity and speech obfuscation detection results.

[0098] Finally, all analysis results are merged to generate link risk features: multi-level jump paths are encoded as variable-length sequence vectors, dynamic behavior features are aggregated into fixed-length behavior vectors, reputation scores are scalar features, and counterfeiting identification results are one-hot encoded vectors or confidence scores. After concatenation and normalization, a unified link risk feature vector is formed, which fully depicts the comprehensive risk information of embedded links from jump behavior to target attributes to counterfeiting suspicion.

[0099] By rendering embedded links in real-time through a dynamic sandbox, it is possible to proactively trigger and observe hidden malicious behavior behind the links, avoiding the limitations of static URL analysis in failing to uncover the true intent after redirection. This makes phishing links that hide their destination through multiple redirects nowhere to hide. Multi-dimensional analysis of the final domain name using WHOIS, DNS, and SSL certificates comprehensively assesses reputation from the perspectives of lifecycle, infrastructure, and trust credentials. This is more comprehensive and accurate than blacklist matching, effectively identifying newly registered malicious domains and phishing sites with abnormal certificates. Visual similarity calculation and voice obfuscation detection based on a brand domain knowledge base directly target brand imitation fraud methods, detecting page appearance imitation and letter substitution obfuscation domains, fundamentally curbing imitation fraud. Multi-level redirection paths, dynamic behavioral characteristics, reputation scores, and imitation identification results are combined to generate link risk features, achieving a multi-dimensional comprehensive representation of link risk. This provides rich complementary information for subsequent judgments, significantly improving the detection capability against embedded link fraud.

[0100] In one embodiment, the step of extracting forged content features from a multimedia image includes:

[0101] The system locates and identifies brand logos in multimedia images, compares the identified brand logos with a pre-set official logo database for similarity, and outputs the logo forgery confidence score.

[0102] The system locates and decodes the QR code region in a multimedia image, extracts the link address pointed to by the QR code, verifies the consistency between the link address and the context content in the multimedia image, and outputs a QR code risk score.

[0103] Perform frequency domain analysis and spatial domain feature extraction on multimedia images to identify traces of AI generation or tampering in the images and output the deep forgery confidence score;

[0104] By integrating the confidence level of logo forgery, the risk score of QR code, and the confidence level of deep forgery, the characteristics of forged content are obtained.

[0105] In this embodiment, brand identity refers to the logo, icon, or text mark used to represent a company or organization in the image; the preset official logo library stores the official logo images and their feature vectors of major financial institutions, government platforms, and well-known enterprises; logo forgery confidence is a quantitative indicator, representing the degree of similarity between the identified brand identity and the official logo, and the higher the confidence, the greater the possibility of forgery; the QR code area is the pixel area where the QR code or other two-dimensional barcode is located in the image; the link address pointed to by the QR code is the URL obtained after decoding the QR code; the consistency of the context content refers to the degree of logical matching between the link address and the text, brand identity, and message context in the image; the QR code risk score is a numerical value that comprehensively assesses the risk of the link pointed to by the QR code; frequency domain analysis is a technique that converts the image to the frequency domain to reveal abnormal distributions; spatial domain feature extraction is the analysis of features such as texture, edge, and noise in pixel space; traces of AI generation or tampering are pixel-level anomalies caused by the use of generative models or image editing; deep forgery confidence is an indicator representing the possibility that the image has been generated by AI or maliciously tampered with.

[0106] In the implementation process, multimedia images are first extracted from the target 5G messages and input into the analysis pipeline. Object detection models such as YOLO or Faster R-CNN are used to locate candidate regions in the images that may contain brand logos. Visual features are extracted using convolutional neural networks and compared with logo features in a pre-set official logo library using cosine similarity or Euclidean distance. The highest matching score and the number of matching brands are combined to output a logo forgery confidence score; the higher the score, the greater the difference between the logo and the official logo, or the stronger the suspicion of counterfeiting.

[0107] For the QR code area in the image, an object detection model is used to locate and crop the QR code image block, and a decoding library is called to extract the linked address. Subsequently, optical character recognition is used to extract the text content in the image, verify whether the link domain name matches the mentioned brand, analyze whether the link path and parameters have logical contradictions with the image's promotional theme, and combine the overall semantics of the message to judge the rationality of the QR code. Finally, a QR code risk score is generated, with a higher score indicating a greater link risk.

[0108] Frequency domain analysis and spatial domain feature extraction are performed on multimedia images to identify deepfake traces. Frequency domain analysis observes the distribution patterns of high-frequency and low-frequency components through discrete Fourier transform or discrete cosine transform; AI-generated images often exhibit frequency domain artifacts or energy anomalies. Spatial domain feature extraction uses algorithms such as local binary mode and gradient histogram to obtain texture features, and noise analysis is used to detect inconsistencies in noise levels across different regions, which are typical traces of image splicing or tampering. Simultaneously, a pre-trained deepfake detection network based on EfficientNet is introduced, combining frequency domain anomaly scores, spatial domain inconsistency scores, and network output to generate a deepfake confidence score, quantifying the likelihood that the image has been generated or tampered with by AI.

[0109] Finally, the confidence scores for logo forgery, QR code risk scores, and deep forgery are fused together using vector concatenation or weighted summation to generate a comprehensive feature vector of forged content. This vector fully reflects the anomalies of the image in the three dimensions of brand imitation, QR code risk, and deep forgery, providing key visual input for subsequent multimodal fusion.

[0110] By locating and identifying brand logos in multimedia images and comparing them with an official logo database, fraudulent activities involving counterfeit official logos can be effectively detected. Locating and decoding QR code areas and verifying the consistency of links with the context can identify methods of hiding malicious links within QR codes to bypass text detection. Frequency and spatial domain analysis of images can identify traces of AI generation or tampering, effectively combating fake content created by deepfake technology. Integrating these three methods yields characteristics of counterfeit content, achieving a comprehensive assessment of image forgery risks. These complementary dimensions significantly enhance the detection capability of multimedia image fraud methods.

[0111] In one embodiment, the step of associating historical behavior with sender information to generate spectral features includes:

[0112] The sender number, IP address, and device fingerprint contained in the sender information are used as nodes, and the association edges between each node are constructed. Among them, the association edges include the association between multiple numbers used by the same device, the association between multiple devices associated with the same IP address, and the association between each node and historical malicious nodes in the preset malicious entity database.

[0113] A graph neural network is used to learn the embedding representation of each node and its associated edges to obtain the embedding vector of each node. The embedding vector is used to reflect the association strength between its corresponding node and historical malicious nodes.

[0114] Based on the embedding vector of each node, the fraud gang community to which each node belongs is identified, and the fraud gang identification results are obtained.

[0115] Based on each node and its associated edges, and combined with the results of fraud gang identification, a graph feature is generated.

[0116] In this embodiment, the sender number refers to the sender's mobile phone number or application identifier; the IP address is the network layer address of the sender's terminal; the device fingerprint is a unique device identifier generated by analyzing the terminal hardware, operating system, and browser configuration; a node is an independent vertex of a graph structure, including number nodes, IP address nodes, and device fingerprint nodes; an association edge is a line segment connecting different nodes, used to represent the association relationship between entities; the association between multiple numbers used by the same device is through edges connecting different number nodes with the same device fingerprint; the association between multiple devices associated with the same IP address is through edges connecting different device fingerprints or number nodes with the same IP address; a preset malicious entity... The entity database stores historical malicious numbers, IP addresses, device fingerprints, and their associated information; historical malicious nodes are nodes corresponding to entities marked as malicious in the malicious entity database; graph neural networks are deep learning models that process graph-structured data, learning node vector representations by aggregating neighbor node information; embedding representation learning is the process of mapping each node to a low-dimensional dense vector through graph neural networks; the embedding vector is the vector representation of a node after embedding learning, containing the node's own attributes and its association strength with historical malicious nodes; the fraud gang community is a densely connected subgraph composed of multiple nodes discovered through graph structure analysis; the fraud gang identification result is the fraud gang identifier or community label to which each node belongs.

[0117] During implementation, three core entities—sender number, IP address, and device fingerprint—are first extracted from the sender information of the target 5G message. Each entity is treated as an independent node; if an entity has not appeared in historical data, a new node is created. After node creation, three types of association edges are constructed: the first type is based on multiple numbers used by the same device; when the same device fingerprint node is associated with multiple number nodes, an edge is established between these number nodes. The second type is based on multiple devices associated with the same IP address; when multiple device fingerprints or number nodes share the same IP address node, an edge is established between these nodes. The third type matches the current node with historical malicious nodes in a preset malicious entity database; if identical entities exist, an edge is directly established; otherwise, an indirect association edge is established through co-occurrence relationships.

[0118] After constructing the nodes and edges, the graph structure data, including the current sender node, historical malicious nodes, and their relationships, is input into the graph neural network for embedding representation learning. The graph neural network employs a graph attention network or graph convolutional network architecture, updating the node representation by iteratively aggregating the neighbor node information of each node across multiple layers. In each layer, each node collects features from its directly connected neighbors, calculates the importance weights of different neighbors through an attention mechanism, and fuses the weighted aggregated neighbor information with the node's own features to obtain a new node representation. After multiple aggregations, the embedding vector of each node contains the association strength and path information with all historical malicious nodes in the graph; nodes closer to historical malicious nodes and with more associated paths have a higher risk component.

[0119] Fraud gang community identification is performed based on the embedding vector of each node. Clustering algorithms such as DBSCAN or Louvain are used to perform cluster analysis on the embedding vectors of all nodes. Nodes with similar embedding vectors and close connections in the graph structure are grouped into the same community. These nodes often have similar attribute patterns and behavioral patterns. Each identified community is assigned a community identifier, which is attached to each node as part of the fraud gang identification result.

[0120] Finally, based on the nodes and their associated edges in the constructed graph structure, and combined with the fraud gang identification results, graph features are generated. These graph features include multiple dimensions: extracting the embedding vector of the current sender node itself; calculating the proportion of malicious nodes among the one-hop neighbors directly connected to the current sender node; calculating the distance between the current sender node and each fraud gang community; and incorporating structural features such as the total number of nodes, edge density, and clustering coefficient of the local subgraph into the feature vector. All information is then concatenated and fused to form a high-dimensional graph feature vector, comprehensively characterizing the role of the current sender's information in the historical behavior network, the strength of its association with malicious nodes, and the overall risk level of the fraud gang it belongs to.

[0121] By using phone numbers, IP addresses, and device fingerprints from sender information as nodes and constructing associated edges, isolated and discrete sender information is transformed into a knowledge graph rich in relationships, revealing gang-related and clustered characteristics that cannot be reflected by individual entities. Associating the same device with multiple phone numbers can detect the behavior of multi-SIM multi-standby devices sending fraudulent messages in bulk; associating the same IP with multiple devices can identify multiple devices from the same fraud ring; and associations with historical malicious nodes enable risk transmission across time and entities. Employing graph neural networks for embedding representation learning, the system automatically learns the structural role and risk transmission strength of nodes in the graph by aggregating neighbor information. The embedding vector directly reflects the association strength between a node and historical malicious nodes, providing high-quality input for gang identification and risk quantification. Based on embedding vector identification of fraud gang communities, scattered malicious behaviors can be summarized into organized gang activities, identifying fraud networks where individual behaviors are insignificant but the overall effect is threatening from a higher dimension. Based on the graph features generated from the identification results of nodes, related edges, and fraud gangs, the system integrates node attributes, neighbor risk distribution, gang affiliation, and subgraph structure information to form a comprehensive representation of the sender's risk. This enables subsequent multimodal fusion and fraud probability calculation to fully utilize historical behavioral correlations and gang intelligence, significantly improving the detection capability for cross-time period, cross-account, and organized fraud methods.

[0122] In one embodiment, when the risk level of the target 5G message is high risk, the step of intercepting the initial 5G message at the 5G edge computing node includes:

[0123] When the overall fraud probability is greater than or equal to a preset first threshold, the risk level of the target 5G message is determined to be high risk. Then, a lightweight multimodal model deployed on 5G edge computing nodes is used to block the user plane data corresponding to the initial 5G message in real time to prevent the user plane data from being sent to the user's terminal.

[0124] During implementation, the overall fraud probability output by the fused classifier is first compared with a pre-configured first threshold, the specific value of which is set based on the historical fraud sample distribution and the operator's security policy. When the overall fraud probability is greater than or equal to this threshold, the risk level of the current target 5G message is determined to be high risk. Session identifiers and user plane data stream identifiers are extracted from the metadata of the target 5G message, and a blocking command containing these identifiers is sent to the 5G edge computing node deployed on the user access side. This edge computing node is pre-loaded with a lightweight multimodal model, capable of real-time parsing and matching of passing user plane data. Once a key field of the data packet successfully matches the identifier in the blocking command, a discard operation is immediately performed to prevent the data packet from being forwarded to the user terminal. Simultaneously, a session modification request is sent to the core network elements to release network resources. By setting a preset first threshold as the boundary for high-risk judgment, precise quantitative classification of fraud risk is achieved. Only messages with extremely high suspicion will trigger the most stringent blocking measures, avoiding excessive blocking from interfering with normal communication. Real-time blocking at 5G edge computing nodes leverages the location advantage of edge nodes being close to the user side, completing the blocking before the data reaches the user terminal, greatly shortening the response time and preventing losses caused by users viewing fraudulent content. At the same time, the deployment of the lightweight model at edge nodes allows blocking decisions and execution to be completed in a closed loop at the same location, reducing both the core network load and end-to-end latency, achieving precise control over fraudulent traffic, and effectively improving the security protection capabilities of 5G messaging services.

[0125] The following describes the 5G message anti-fraud device based on multimodal communication provided in the embodiments of this application. The 5G message anti-fraud device based on multimodal communication described below can be referred to in correspondence with the 5G message anti-fraud method based on multimodal communication described above. Figure 2 As shown, this application provides a 5G message anti-fraud device based on multimodality, the device comprising:

[0126] The target 5G message determination module 201 is used to capture the initial 5G message of an authorized user and preprocess the initial 5G message to obtain the target 5G message. The target 5G message includes text content, embedded links, multimedia images and sender information.

[0127] The multimodal feature extraction module 202 is used to extract semantic features of text content, extract link risk features of embedded links, extract forged content features of multimedia images, and associate historical behavior with sender information to generate graph features.

[0128] The comprehensive fraud probability generation module 203 is used to optimize semantic features, link risk features and forged content features based on graph features, and then dynamically weighted and fused them using an adaptive attention mechanism to generate a comprehensive fraud probability.

[0129] The 5G message interception module 204 is used to classify the risk of 5G messages based on the comprehensive fraud probability, and when the risk level of the target 5G message is high risk, it intercepts the user plane data corresponding to the initial 5G message at the 5G edge computing node.

[0130] In one embodiment, the target 5G message determination module 201 includes:

[0131] The initial 5G message determination unit is used to copy the user plane data of the authorized user through user plane function bypass mirroring technology to obtain the initial 5G message;

[0132] The encrypted 5G message determination unit is used to decapsulate and perform deep protocol analysis on the GTP-U tunnel of user plane data, extract the original data packets, and reassemble the media stream based on RTP and RTCP protocols for the rich media content transmitted in the fragmented data packets to obtain encrypted 5G messages.

[0133] The target 5G message determination unit is used to decrypt and restore the encrypted 5G message, and then obtain the target 5G message through validity screening and standardization.

[0134] In one embodiment, the multimodal feature extraction module 202 includes:

[0135] The deep semantic parsing unit is used to perform word segmentation and deep semantic parsing of text content using a pre-trained BERT-5G model;

[0136] The BERT-5G model is obtained by performing domain-adaptive pre-training and knowledge distillation compression on the BERT-base model. The domain-adaptive pre-training uses a 5G message-specific corpus, which contains fraudulent language expressions in the financial and government sectors. Knowledge distillation compression is used to generate a lightweight model adapted to the deployment of 5G edge computing nodes. The BERT-5G model is used to calculate the fraud sensitivity score of each word at the word level, identify high-risk collocation patterns through dependency parsing at the phrase level, and represent the overall semantic tendency through classification vectors at the discourse level.

[0137] The semantic feature generation unit is used to match risk keywords based on the results of deep semantic analysis and a dynamically updated fraud keyword map, and to generate semantic features by identifying the urgency and manipulative sentiment tendencies in the text.

[0138] In one embodiment, the multimodal feature extraction module 202 includes:

[0139] The final domain name determination unit is used to perform real-time rendering access to embedded links through a dynamic sandbox, capture the multi-level jump path of the embedded links and the dynamic behavior characteristics of each jump page, and determine the final domain name that the embedded links point to after the jump.

[0140] The reputation score generation unit is used to perform multi-dimensional analysis on the final domain name based on WHOIS registration information, DNS resolution records, and SSL certificate status, and generate the final domain name's reputation score.

[0141] The counterfeit identification result generation unit is used to perform visual similarity calculation and voice confusion detection on the final domain name based on a preset brand domain name knowledge base, and generate the counterfeit identification result of the final domain name;

[0142] The connection risk feature generation unit is used to generate link risk features based on multi-level redirection paths, dynamic behavior features, reputation scores, and counterfeit identification results.

[0143] In one embodiment, the multimodal feature extraction module 202 includes:

[0144] The LOGO forgery confidence determination unit is used to locate and identify brand logos in multimedia images, compare the identified brand logos with the preset official LOGO library for similarity, and output the LOGO forgery confidence score.

[0145] The QR code risk scoring unit is used to locate and decode the QR code area in the multimedia image, extract the link address pointed to by the QR code, verify the consistency between the link address and the context content in the multimedia image, and output the QR code risk score.

[0146] The deep forgery confidence determination unit is used to perform frequency domain analysis and spatial domain feature extraction on multimedia images, identify traces of AI generation or tampering in the images, and output the deep forgery confidence score.

[0147] The forgery content feature determination unit is used to integrate the LOGO forgery confidence score, QR code risk score and deep forgery confidence score to obtain forgery content features.

[0148] In one embodiment, the multimodal feature extraction module 202 includes:

[0149] The association edge construction unit is used to take the sender number, IP address and device fingerprint contained in the sender information as nodes and construct the association edges between each node; wherein, the association edges include the association between multiple numbers used by the same device, the association between multiple devices associated with the same IP address, and the association between each node and historical malicious nodes in the preset malicious entity database.

[0150] The embedding vector determination unit is used to learn the embedding representation of each node and its associated edges using a graph neural network to obtain the embedding vector of each node. The embedding vector is used to reflect the association strength between its corresponding node and historical malicious nodes.

[0151] The fraud gang identification result determination unit is used to identify the fraud gang community to which each node belongs based on the embedding vector of each node, and obtain the fraud gang identification result;

[0152] The graph feature generation unit is used to generate graph features based on each node and its associated edges, combined with the results of fraud gang identification.

[0153] In one embodiment, the 5G message interception module 204 includes:

[0154] The 5G message interception unit is used to determine the risk level of the target 5G message as high risk when the overall fraud probability is greater than or equal to a preset first threshold. It then uses a lightweight multimodal model deployed on 5G edge computing nodes to block the user plane data corresponding to the initial 5G message in real time, thereby preventing the user plane data from being sent to the user's terminal.

[0155] In one embodiment, this application also provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the multimodal 5G message anti-fraud method as described in any of the above embodiments.

[0156] In one embodiment, this application also provides a computer device storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the multimodal 5G message anti-fraud method as described in any of the above embodiments.

[0157] Indicatively, such as Figure 3 As shown, Figure 3 This is a schematic diagram of the internal structure of a computer device 300 provided in an embodiment of this application. The computer device 300 can be provided as a server. (Refer to...) Figure 3 The computer device 300 includes a processing component 302, which further includes one or more processors, and memory resources represented by memory 301 for storing instructions, such as applications, that can be executed by the processing component 302. The applications stored in memory 301 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 302 is configured to execute instructions to perform the multimodal 5G message anti-fraud method of any of the above embodiments.

[0158] The computer device 300 may also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate on an operating system stored in memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0159] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0160] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. In this document, "a," "an," "the," "the," and "its" may also include plural forms unless the context clearly indicates otherwise. "Multiple" refers to at least two, such as 2, 3, 5, or 8, etc. "And / or" includes any and all combinations of the related listed items.

[0161] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0162] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A 5G message fraud prevention method based on multimodal communication, characterized in that, The method includes: The initial 5G message of an authorized user is captured and preprocessed to obtain a target 5G message, which includes text content, embedded links, multimedia images and sender information. Extract semantic features from the text content, extract link risk features from the embedded links, extract forged content features from the multimedia images, and perform historical behavior association on the sender information to generate graph features; After optimizing the semantic features, the link risk features, and the forged content features based on the graph features, an adaptive attention mechanism is used for dynamic weighted fusion to generate a comprehensive fraud probability. The 5G message is classified into risk levels based on the comprehensive fraud probability, and when the risk level of the target 5G message is high, the user plane data corresponding to the initial 5G message is intercepted at the 5G edge computing node.

2. The 5G message anti-fraud method based on multimodal communication according to claim 1, characterized in that, The step of capturing the initial 5G message of an authorized user and preprocessing the initial 5G message to obtain the target 5G message includes: The user plane data of the authorized user is copied using user plane function bypass mirroring technology to obtain the initial 5G message; The user plane data GTP-U tunnel is decapsulated and the protocol is deeply parsed to extract the original data packets. The rich media content transmitted in the fragmented original data packets is reassembled into media streams based on RTP and RTCP protocols to obtain encrypted 5G messages. After decrypting and restoring the encrypted 5G message, the target 5G message is obtained through validity screening and standardization.

3. The 5G message anti-fraud method based on multimodal communication according to claim 1, characterized in that, The step of extracting the semantic features of the text content includes: The text content was segmented and subjected to deep semantic analysis using a pre-trained BERT-5G model. The BERT-5G model is obtained by performing domain-adaptive pre-training and knowledge distillation compression on the BERT-base model. The domain-adaptive pre-training uses a 5G message-specific corpus, which contains fraudulent language expressions in the financial and government sectors. The knowledge distillation compression is used to generate a lightweight model adapted to 5G edge computing node deployment. The BERT-5G model is used to calculate the fraud sensitivity score of each word at the word level, identify high-risk collocation patterns through dependency parsing at the phrase level, and represent the overall semantic tendency through classification vectors at the discourse level. Based on the deep semantic analysis results, risk keywords are matched using a dynamically updated fraud keyword map, and the semantic features are generated by identifying the urgency and manipulative sentiment tendencies in the text.

4. The 5G message anti-fraud method based on multimodal communication according to claim 1, characterized in that, The step of extracting the link risk features of the embedded links includes: The embedded link is rendered and accessed in real time through a dynamic sandbox, capturing the multi-level jump path of the embedded link and the dynamic behavior characteristics of each jump page, and determining the final domain name that the embedded link points to after the jump. Based on WHOIS registration information, DNS resolution records, and SSL certificate status, the final domain name is analyzed from multiple dimensions to generate a reputation score for the final domain name. Based on a pre-set brand domain name knowledge base, visual similarity calculation and voice confusion detection are performed on the final domain name to generate the counterfeit identification result of the final domain name; The link risk characteristics are generated based on the multi-level redirection path, the dynamic behavior characteristics, the reputation score, and the counterfeit identification results.

5. The 5G message anti-fraud method based on multimodal communication according to claim 1, characterized in that, The step of extracting the forged content features of the multimedia image includes: The brand logo in the multimedia image is located and identified, and the identified brand logo is compared with the preset official logo library to output the logo forgery confidence level. The QR code area in the multimedia image is located and decoded, the link address pointed to by the QR code is extracted, and the consistency between the link address and the context content in the multimedia image is verified, and a QR code risk score is output. The multimedia image is subjected to frequency domain analysis and spatial domain feature extraction to identify traces of AI generation or tampering in the image and output the deep forgery confidence score. The forged content features are obtained by fusing the LOGO forgery confidence score, the QR code risk score, and the deep forgery confidence score.

6. The 5G message anti-fraud method based on multimodal communication according to claim 1, characterized in that, The step of associating the sender information with historical behaviors to generate spectral features includes: The sender number, IP address, and device fingerprint contained in the sender information are used as nodes, and association edges are constructed between each node; wherein, the association edges include the association between multiple numbers used by the same device, the association between multiple devices associated with the same IP address, and the association between each node and historical malicious nodes in a preset malicious entity database; An embedding representation learning is performed on each node and its associated edges using a graph neural network to obtain an embedding vector for each node. The embedding vector is used to reflect the association strength between its corresponding node and the historical malicious node. Based on the embedding vector of each node, the fraud gang community to which each node belongs is identified, and the fraud gang identification result is obtained; Based on each node and its associated edges, and combined with the identification results of the fraud gang, the graph features are generated.

7. The 5G message anti-fraud method based on multimodality according to any one of claims 1 to 6, characterized in that, The step of intercepting the initial 5G message at the 5G edge computing node when the risk level of the target 5G message is high risk includes: When the overall fraud probability is greater than or equal to a preset first threshold, the risk level of the target 5G message is determined to be high risk, and the user plane data corresponding to the initial 5G message is blocked in real time by a lightweight multimodal model deployed on a 5G edge computing node to prevent the user plane data from being sent to the user's terminal.

8. A 5G message anti-fraud device based on multimodal communication, characterized in that, The device includes: The target 5G message determination module is used to capture the initial 5G message of an authorized user and preprocess the initial 5G message to obtain the target 5G message, which includes text content, embedded links, multimedia images and sender information. The multimodal feature extraction module is used to extract semantic features of the text content, extract link risk features of the embedded links, extract forged content features of the multimedia images, and perform historical behavior association on the sender information to generate graph features; The comprehensive fraud probability generation module is used to optimize the semantic features, the link risk features, and the forged content features based on the graph features, and then use an adaptive attention mechanism to perform dynamic weighted fusion to generate a comprehensive fraud probability. The 5G message interception module is used to classify the risk of the 5G message according to the comprehensive fraud probability, and when the risk level of the target 5G message is high risk, to intercept the user plane data corresponding to the initial 5G message at the 5G edge computing node.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the multimodal 5G message anti-fraud method as described in any one of claims 1 to 7.

10. A computer device, characterized in that, include: One or more processors, and memory; The memory stores computer-readable instructions, which, when executed by the one or more processors, perform the steps of the multimodal 5G message anti-fraud method as described in any one of claims 1 to 7.

Images