A multi-stage semantic risk identification method and system based on a large model

Abstract

The application discloses a kind of multi-stage semantic risk identification method and system based on large model, it is related to data processing technical field.The method includes: obtaining the basic dimension feature of target user's telephone voice message, risk assessment is carried out to basic dimension feature, and first risk coefficient is output;If first risk coefficient is greater than first risk threshold, content analysis is carried out to telephone voice message, and content analysis result is output;The predicted false alarm sensitive coefficient and the predicted missed alarm sensitive coefficient of target user are obtained;Optimization correction is carried out to initial risk judgment threshold, and adaptive risk judgment threshold is generated;The intention risk identification plug-in embedded in content intention recognition mechanism is activated, and the second risk coefficient is obtained by risk identification to content analysis result, if second risk coefficient is greater than adaptive risk judgment threshold, then telephone voice message is intercepted.The application realizes the optimal balance of security protection and user communication experience in the individualization level.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a multi-stage semantic risk identification method and system based on a large model. Background Technology

[0002] With the widespread application of voicemail in finance, customer service, and risk control, the demand for automated risk identification and interception of voicemail content is increasing. Existing risk identification technologies mainly rely on keyword rule matching, traditional machine learning models, and manual review, which can achieve basic risk assessment for structured or fixed-pattern information.

[0003] However, keyword rule-based methods have weak generalization capabilities and are difficult to identify hidden risks; traditional machine learning models are not good at recognizing complex semantic structures, progressive inducement tactics, and multi-round manipulation tactics; at the same time, both methods lack interpretability of risk judgment and use fixed risk thresholds, which cannot adapt to the different tolerances of different users for false alarms and false alarms, resulting in a high false alarm rate and difficulty in balancing security control and users' normal communication needs. Summary of the Invention

[0004] This invention provides a multi-stage semantic risk identification method and system based on a large model, aiming to solve the technical problem that existing technologies struggle to balance security control with users' normal communication needs.

[0005] In view of the above problems, the present invention provides a multi-stage semantic risk identification method and system based on a large model.

[0006] In a first aspect, the present invention provides a multi-stage semantic risk identification method based on a large model, comprising: Obtain the basic dimension features of the target user's telephone voicemail, perform risk assessment on the basic dimension features according to the coarse-grained risk screening mechanism, and output the first risk coefficient; If the first risk coefficient is greater than the first risk threshold, the content of the telephone voice message is parsed according to the content semantic parsing mechanism, and the content parsing result is output. Based on the user dimension information of the target user, the basic dimension features and the content parsing results, false positive sensitivity prediction and false negative sensitivity prediction are performed on the target user respectively, and the false positive sensitivity coefficient and false negative sensitivity coefficient are obtained. Based on the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient, the initial risk judgment threshold in the content intent recognition mechanism is optimized and corrected to generate an adapted risk judgment threshold. The intent risk identification plugin embedded in the content intent identification mechanism is activated, and the content parsing result is used to identify risks to obtain a second risk coefficient. If the second risk coefficient is greater than the adaptation risk judgment threshold, the telephone voice message is intercepted.

[0007] Secondly, this invention provides a multi-stage semantic risk identification system based on a large model, comprising: The feature coarse screening module is used to obtain the basic dimension features of the target user's telephone voicemail, perform risk assessment on the basic dimension features according to the coarse-grained risk screening mechanism, and output the first risk coefficient. The content parsing module is used to parse the telephone voice message according to the content semantic parsing mechanism and output the content parsing result if the first risk coefficient is greater than the first risk threshold. The dual-sensitivity prediction module is used to perform false positive sensitivity prediction and false negative sensitivity prediction for the target user based on the user dimension information of the target user, the basic dimension features and the content parsing results, and to obtain the false positive sensitivity coefficient and the false negative sensitivity coefficient. The threshold optimization module is used to optimize and correct the initial risk judgment threshold in the content intent recognition mechanism based on the predicted false alarm sensitivity coefficient and the predicted false alarm sensitivity coefficient, and generate an adapted risk judgment threshold. The interception decision module is used to activate the intent risk identification plugin embedded in the content intent identification mechanism, perform risk identification on the content parsing result to obtain a second risk coefficient, and if the second risk coefficient is greater than the adaptation risk judgment threshold, then the telephone voice message is intercepted.

[0008] One or more technical solutions provided in this invention have at least the following technical effects or advantages: This invention provides a multi-stage semantic risk identification method and system based on a large model. It rapidly filters low-risk content through coarse-grained risk screening, improving overall identification efficiency and reducing the cost of ineffective in-depth analysis. Relying on a large model for content semantic parsing, it achieves penetrating understanding from surface features to deep intent, strengthening the ability to capture implicit and complex risks. Combining user-dimensional information with multi-dimensional features for dual-sensitivity prediction, it accurately quantifies users' differentiated tolerance for false positives and false negatives, providing a core basis for personalized decision-making. Based on dual-sensitivity coefficients, it dynamically optimizes risk judgment thresholds, breaking through the limitations of traditional fixed thresholds and achieving precise adaptation of risk judgment standards to user scenarios. Through the optimized thresholds, it performs accurate risk identification and interception, ultimately achieving efficient interception of high-risk content such as fraud and harassment while minimizing interference with normal user communication, achieving an optimal balance between security protection and communication experience at the personalized level. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 A flowchart illustrating a multi-stage semantic risk identification method based on a large model, provided for an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a multi-stage semantic risk identification system based on a large model, provided in an embodiment of the present invention. The components represented by each number in the attached diagram are explained below: Feature coarse screening module 11, content parsing module 12, bi-sensitivity prediction module 13, threshold optimization module 14, and interception decision module 15. Detailed Implementation

[0011] This invention provides a multi-stage semantic risk identification method and system based on a large model, which is used to address the technical problem that existing technologies struggle to balance security control with users' normal communication needs.

[0012] Example 1, as Figure 1 As shown, this invention provides a multi-stage semantic risk identification method based on a large model, the method comprising: S100: Obtain the basic dimension features of the target user's telephone voicemail, perform risk assessment on the basic dimension features according to the coarse-grained risk screening mechanism, and output the first risk coefficient.

[0013] In this embodiment of the invention, basic dimensional features of the target user's telephone voicemail are obtained, and a risk assessment is performed on these basic dimensional features according to a coarse-grained risk screening mechanism to output a first risk coefficient. With the surge in risky content such as fraud and harassment in voice communication scenarios, directly performing deep semantic analysis on all telephone voicemail would lead to excessive computational consumption, increased response latency, and wasted resources due to the ineffective analysis of a large number of low-risk messages. However, number features and source features, as fundamental attributes of communication behavior, are easily extracted, quantifiable, and have strong risk correlations, enabling rapid differentiation between obviously low-risk content and highly suspicious content. Therefore, this step, through a coarse-grained risk screening mechanism, first assesses the risk of the basic dimensional features, which can efficiently filter out risk-free content, focus on highly suspicious objects, reduce the burden on subsequent deep semantic analysis, ensure the accuracy of the initial risk judgment, and improve the efficiency of the overall risk identification process.

[0014] Step S100 in the method provided in this embodiment of the invention includes: Obtain the basic dimensional features of the target user's telephone voicemail, wherein the basic dimensional features include number features and source features; Call the preset number risk rule base and preset source risk rule base of the coarse-grained risk screening mechanism; Based on the preset number risk rule base, the number features are matched and analyzed to obtain number risk sub-coefficients; Based on the preset source risk rule base, the source features are matched and analyzed to obtain source risk sub-coefficients; The first risk coefficient is obtained by weighting and fusing the number risk sub-coefficient and the source risk sub-coefficient.

[0015] First, the basic dimensional features of the target user's voicemail are obtained. These basic dimensional features include number features and source features. Basic dimensional features refer to the directly extractable fundamental attributes related to the voicemail, serving as the basis for coarse-grained risk assessment. They include both number features and source features. From the communication network, user terminal, and global database, the caller ID features corresponding to the voicemail received by the target user and the source features of the current communication are extracted to form a structured basic dimensional feature dataset.

[0016] The "number characteristics" refer to attributes directly related to the caller ID that can be assessed for credibility or risk. These include the number's location, type, reputation history, and spoofing risk. Location includes domestic / international and province / city; number type includes mobile, landline, and virtual operator numbers; reputation history includes blacklist / whitelist status and historical complaint records; and spoofing risk refers to whether the number is impersonating an official number. The "source characteristics" refer to the context and channel information of the communication activity, including call time, communication network and protocol information, device fingerprint, and call result. Call time includes the call period and weekday / holiday; communication network and protocol information includes PSTN and VoIP; device fingerprint includes caller anonymization features; and call result includes reasons such as rejection or being transferred to voicemail (e.g., not in service area).

[0017] For example, when a target user receives a voicemail message, the basic dimensional features are as follows: Number characteristics: the calling number is 170xxxx8901 (virtual operator number), the location is a high-fraud-rate region overseas, it has been marked as "fraud" by 35 users in the past, it does not exist in the target user's personal address book (not whitelist), and it is not an impersonation of an official number; Source characteristics: the call time is 1:30 am (non-working hours), it is initiated through a VoIP network, the caller's device fingerprint shows a suspected machine call, and it is transferred to voicemail because the target user rejects the call.

[0018] Secondly, the pre-defined number risk rule base and pre-defined source risk rule base of the coarse-grained risk screening mechanism are invoked. The pre-defined number risk rule base stores the mapping relationship between number characteristics and risk assessment standards, including at least the mapping between number location type and risk weight, the mapping between the frequency of historical complaints and risk level, and the logic for determining number blacklists and whitelists. The pre-defined source risk rule base stores the mapping relationship between source characteristics and risk assessment standards, including at least the mapping between risk classification and weight for message time period, and the mapping between basic risk values ​​corresponding to call network types. After the coarse-grained risk screening mechanism is triggered, the pre-stored pre-defined number risk rule base and pre-defined source risk rule base in the rule engine are automatically invoked, ensuring that the rule mapping relationship is loaded in real time, providing a basis for subsequent feature matching analysis.

[0019] For example, based on the above basic dimension characteristics, a preset number risk rule base is invoked, such as: overseas location risk weight 0.3, historical fraud mark ≥30 times risk weight 0.4, etc.; a preset source risk rule base is invoked, such as: 0:00-6:00 AM is a high-risk period weight 0.3, VoIP network basic risk value 0.5, etc.

[0020] Next, based on the preset number risk rule base, the number features are matched and analyzed to obtain number risk sub-coefficients. The number risk sub-coefficient quantifies the risk level of number features, ranging from 0 to 1, with values ​​closer to 1 indicating higher risk. It is calculated by matching number features with the preset number risk rule base. Each number feature is matched against the rules in the preset number risk rule base, and the risk score corresponding to each feature is calculated according to the rule mapping relationship. Then, a weighted sum is used to obtain the number risk sub-coefficient.

[0021] For example, the number characteristics are matched with a preset number risk rule base: overseas location is matched with the high-risk location rule, and the risk score is 0.3; virtual operator number is matched with the key number type rule, and the risk score is 0.2; historical fraud mark of 35 times is matched with the mark rule of ≥30 times, and the risk score is 0.4; non-whitelist is matched with the no credible endorsement rule, and the risk score is 0.1; no imitation risk, no extra score; number risk sub-coefficient = 0.3 + 0.2 + 0.4 + 0.1 = 1.0.

[0022] Furthermore, based on the preset source risk rule base, the source features are matched and analyzed to obtain source risk sub-coefficients. The source risk sub-coefficient is used to quantify the risk level of a source feature, ranging from 0 to 1, with values ​​closer to 1 indicating higher risk. It is calculated by matching the source feature with the preset source risk rule base. Each source feature is matched against a rule in the preset source risk rule base, and the risk score corresponding to each feature is calculated according to the rule mapping relationship. Then, a weighted sum is used to obtain the source risk sub-coefficient.

[0023] For example, the source characteristics are matched with the preset source risk rule base: 1:30 AM is matched with the high-risk time period rule, and the risk score is 0.3; VoIP network is matched with the high-risk channel rule, and the basic risk value is 0.5; suspected machine call is matched with the abnormal call subject rule, and the risk score is 0.1; user rejection and forwarding to voicemail is matched with the active rejection scenario rule, and the risk score is 0.1; source risk sub-coefficient = 0.3 + 0.5 + 0.1 + 0.1 = 1.0.

[0024] Finally, the number risk sub-coefficient and the source risk sub-coefficient are weighted and fused to obtain the first risk coefficient. The first risk coefficient is a comprehensive indicator of the combined risk of number and source characteristics, ranging from 0 to 1. The closer the value is to 1, the higher the risk, and it is used to determine whether further in-depth analysis is needed. The preset weight of the number risk sub-coefficient is 0.6, and the weight of the source risk sub-coefficient is 0.4. The weights can be dynamically adjusted according to the business scenario. The first risk coefficient = number risk sub-coefficient × 0.6 + source risk sub-coefficient × 0.4, and the final result is output. For example, substituting the number risk sub-coefficient 1.0 and the source risk sub-coefficient 1.0, we get: First risk coefficient = 1.0 × 0.6 + 1.0 × 0.4 = 1.0.

[0025] In this embodiment of the invention, by extracting two basic dimensional features—number and source—and relying on a preset rule base to perform precise matching analysis on each feature, a first risk coefficient is generated through weighted fusion quantification. This achieves standardization and efficiency in coarse-grained risk screening: firstly, it quickly filters out risk-free content such as landline messages during working hours in the user's address book, reducing ineffective computing power consumption and improving the overall process response speed; secondly, through the detailed evaluation and rule matching of multi-dimensional features, it accurately identifies highly suspicious communication objects such as overseas virtual numbers and late-night machine calls, avoiding risk omissions at the basic dimensional level; finally, it defines clear boundaries for subsequent deep semantic analysis and risk identification processes, ensuring that deep processing focuses only on high-value suspicious content, thus guaranteeing the reliability of the coarse screening results and providing a foundation for the overall multi-stage risk identification mechanism to balance efficiency and accuracy.

[0026] S200: If the first risk coefficient is greater than the first risk threshold, perform content parsing on the telephone voice message according to the content semantic parsing mechanism and output the content parsing result.

[0027] In this embodiment of the invention, if the first risk coefficient is greater than the first risk threshold, the telephone voicemail is parsed according to the content semantic parsing mechanism, and the content parsing result is output. Coarse-grained risk screening only completes the identification of highly suspicious objects based on basic dimensional features, but cannot uncover the hidden risks in the voicemail content itself, such as inducement language disguised as official identity or hidden illegal marketing statements. Existing keyword rule methods are difficult to deal with complex semantic structures and progressive inducement logic, while traditional models lack deep semantic understanding capabilities and cannot achieve penetrating analysis from surface speech to deep intent. Therefore, this step transforms unstructured speech content into structured semantic results through a process of speech-to-text conversion, text preprocessing, and deep analysis by a large model, accurately extracting information such as core user intent and key actions, providing semantic basis for subsequent false positive / false negative sensitive prediction and risk threshold optimization, and filling the gap in content risk identification in basic feature screening.

[0028] Step S200 in the method provided in this embodiment of the invention includes: The telephone voicemail is automatically recognized and the voice content is converted into text content to obtain the initial text; The initial text is preprocessed to obtain standard text, wherein the preprocessing includes text cleaning, word segmentation and key entity extraction; The standard text is input into a pre-trained large language model for deep semantic parsing to generate structured content parsing results, wherein the content parsing results include at least the main related objects, core user intents, key actions, and potential risk topic classifications.

[0029] First, the telephone voicemail is subjected to automatic speech recognition to convert the speech content into text content, resulting in initial text. Automatic speech recognition (ASR) is a technology that converts human speech signals into text, accurately capturing vocabulary, tone, and semantic pauses in speech. The initial text refers to the raw text record directly generated after ASR conversion, without any optimization processing, and may contain recognition errors or redundant information. A mature automatic speech recognition engine is then invoked to receive the target user's telephone voicemail audio data. Through the collaborative computation of acoustic and language models, the speech signal is converted into a corresponding text sequence, directly outputting the unprocessed initial text, preserving the original information of the speech content.

[0030] For example, the voice message received by the target user contains the audio content "I am a customer service staff member. Your account is currently at risk of abnormal activity. You need to follow the prompts immediately, otherwise it will affect the normal use of your account." After ASR recognition, the initial text is generated as: "I am a customer service staff member. Your account is currently at risk of abnormal activity. You need to follow the prompts immediately, otherwise it will affect the normal use of your account."

[0031] Next, preprocess the initial text to obtain a standard text, where the preprocessing includes text cleaning, word segmentation, and key entity extraction. Text cleaning refers to the processing of removing redundant information in the text, correcting recognition errors, and unifying format specifications. Word segmentation refers to the process of splitting continuous text into independent word units according to semantic logic, which facilitates subsequent semantic parsing. Key entity extraction refers to identifying and extracting entity information with core semantic value from the text, such as identity, object, event, etc. The standard text refers to a structured text with standardized format, clear semantics and no redundancy after cleaning, word segmentation and key entity extraction, which is suitable for large language model input. First, the initial text is cleaned by deleting modal particles such as "um" and "ah", correcting recognition errors, and unifying punctuation marks; then a word segmentation algorithm such as jieba word segmentation is used to split the cleaned text into a word sequence; finally, key entities are extracted through an entity recognition model such as BERT to form a standard text and an associated entity set.

[0032] For example, the above initial text is preprocessed as follows: Text cleaning: correct "Cao Zuo" to "operation", delete meaningless pause words, and obtain "I am a customer service staff, there is an abnormal risk in your account now, you need to follow the prompts to operate immediately, otherwise the normal use of the account will be affected"; Word segmentation: split into "I / am / customer service staff / now / your / account / has / abnormal risk / need / immediately / follow / prompt / operation / otherwise / will / affect / account / normal use"; Key entity extraction: identify the identity entity "customer service staff", the object entity "account", the event entity "abnormal risk", and the action entity "prompt operation"; finally, the standard text is generated: "I am a customer service staff, there is an abnormal risk in your account now, you need to follow the prompts to operate immediately, otherwise the normal use of the account will be affected", and the key entity set is associated.

[0033] Furthermore, the standard text is input into a pre-trained large language model for deep semantic parsing, generating structured content parsing results. These results include at least the main related objects, core user intent, key actions, and potential risk topic classifications. The pre-trained large language model refers to an artificial intelligence model trained on massive amounts of text data, possessing deep semantic understanding, intent mining, and structured output capabilities, such as the GPT series and LLaMA series. The structured content parsing results refer to a standardized dataset output by the large language model, containing clear semantic dimensions, and at least covering the main related objects, core user intent, key actions, and potential risk topic classifications. Specifically, the main related objects refer to the core interactive objects involved in the text, such as accounts, users, and institutions; the core user intent refers to the speaker's intended purpose through the text, such as inducement or marketing promotion; key actions refer to behavioral expressions supporting the realization of the core intent, such as prompting or providing information; and potential risk topic classifications refer to risk types categorized based on semantic content, such as account inducement, illegal marketing, and fraudulent rhetoric.

[0034] For example, after inputting standard text into a pre-trained large language model, the generated structured parsing results are as follows: Main associated object: user account; Core user intent: inducing the user to perform a specific operation based on the reason of account abnormality; Key action: prompting the user to take immediate action; Potential risk topic classification: account abnormality inducement risk.

[0035] In this embodiment of the invention, unstructured speech content is first converted into structured text. Then, the text quality is optimized and core entities are extracted through preprocessing to provide accurate input for the large language model parsing, avoiding recognition errors and interference from redundant information. Finally, relying on the deep semantic understanding capability of the large language model, the limitations of traditional keyword rules are broken through, accurately mining the core intent and potential risk themes behind the voice messages, and generating standardized structured results. This not only fills the gap in content risk identification of basic feature screening, but also provides semantic support for subsequent false positive / false negative sensitive prediction and risk threshold optimization. This deepens risk identification from basic feature judgment to content intent mining, and improves the ability to capture implicit and complex semantic risks.

[0036] S300: Based on the user dimension information of the target user, the basic dimension features, and the content parsing results, perform false positive sensitivity prediction and false negative sensitivity prediction on the target user, and obtain the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient.

[0037] In this embodiment of the invention, false positive sensitivity prediction and false negative sensitivity prediction are performed on the target user based on the user dimension information, the basic dimension features, and the content parsing results, respectively, to obtain the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient. Traditional risk identification mechanisms use a uniform risk judgment threshold, without considering the differentiated tolerance of individual users for false positives and false negatives. For example, users with high-risk victim experience are more concerned about the risk of false negatives, while risk-averse users, although concerned about risk, may also be concerned about normal content being mistakenly blocked. Ignoring this difference can lead to some users encountering risks due to false negatives, or having their normal communication disrupted due to frequent false positives. Therefore, this step combines user dimension information, basic features, and content parsing results to generate personalized false positive and false negative sensitivity coefficients through sample training and model prediction, providing accurate user preference basis for subsequent threshold optimization, making risk decisions more in line with users' actual needs.

[0038] Step S300 in the method provided in this embodiment of the invention includes: Obtain user dimension information of the target user, wherein the user dimension information includes one or more of age, gender, occupation, registration location and communication device type; A sample training set is collected using the user dimension information as a constraint, and a deep neural network model is trained until convergence to generate a sensitive prediction dual channel. Using the aforementioned sensitive prediction dual-channel, the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient are predicted based on the aforementioned basic dimension features and content parsing results.

[0039] First, the user dimension information of the target user is obtained. This user dimension information includes one or more of the following: age, gender, occupation, registration location, and communication device type. User dimension information refers to basic data that reflects the individual attributes of a user and is the main basis for segmenting user groups and matching similar samples. It includes age, gender, occupation, registration location, and communication device type. The user dimension information of the target user is automatically extracted from user registration information, device terminal data, and the system's user profile database to form a structured set of attributes. For example, the extracted user dimension information for the target user might be: age 28, female, occupation: internet operations, registration location: Shanghai, and communication device type: smartphone.

[0040] Secondly, a sample training set is collected with the user dimension information as a constraint, and a deep neural network model is trained until convergence to generate a sensitive prediction dual channel.

[0041] The process involves collecting a sample training set using the user dimension information as a constraint, training a deep neural network model until convergence, and generating a sensitive prediction dual-channel, including: Using the aforementioned user dimension information as constraints, the historical user behavior database is retrieved, and the sample basic dimension feature set and sample content parsing result set are collected. High-frequency feature clustering is performed on the sample basic dimension feature set and the sample content parsing result set to obtain the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set. Based on the historical user behavior database, the proportion of historical false alarm appeal events and the proportion of historical false alarm appeal events under different scenarios of high-frequency basic dimension features and high-frequency content parsing results of samples are statistically analyzed, and used as the sample false alarm sensitivity coefficient and the sample false alarm sensitivity coefficient, respectively, to obtain the sample false alarm sensitivity coefficient set and the sample false alarm sensitivity coefficient set. Using the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set as input, and using the sample false alarm sensitivity coefficient set as supervision, a deep neural network model is trained until convergence to generate a false alarm sensitivity prediction sub-channel. Using the sample high-frequency basic dimension feature set and sample high-frequency content parsing result set as input, and the sample missed detection sensitivity coefficient set as supervision, a deep neural network model is trained until convergence, generating a missed detection sensitive prediction sub-channel, and a sensitive prediction dual-channel is constructed by combining the false alarm sensitive prediction sub-channel.

[0042] First, using the aforementioned user dimension information as constraints, a historical user behavior database is retrieved to collect a sample basic dimension feature set and a sample content analysis result set. The historical user behavior database refers to a comprehensive database containing historical risk preference tags, risk handling feedback records, historical risk exposure frequencies, as well as user basic dimension features and content analysis results. The sample basic dimension feature set refers to the collection of basic dimension features, content analysis results, and historical risk-related data corresponding to other users in the same dimension as the target user. Using the target user's dimension information as a filtering condition, the historical user behavior database is retrieved, and the basic dimension features and content analysis results corresponding to this group of users are extracted and summarized into the sample basic dimension feature set and the sample content analysis result set, respectively.

[0043] The historical risk preference tags refer to labels assigned by the system based on users' past behavior, including risk-averse, risk-neutral / tolerant, and risk victim experiences. Risk-averse users have repeatedly and actively marked harassing calls and are highly vigilant about suspicious links; risk-neutral / tolerant users have a high tolerance for marketing calls and complain less; users with risk victim experiences have reported being scammed. Risk handling feedback records refer to users' direct feedback on past risk control actions, including false positive rate, false negative rate, and response to security alerts. The false positive rate refers to the frequency with which users file false positive appeals for blocked normal communications; the false negative rate refers to the frequency with which users actively mark unblocked harassing / fraudulent communications; and the response to security alerts refers to the user's behavior after clicking on alerts such as "Suspected risk, answer with caution." Historical risk contact frequency refers to the frequency of various risk calls a user receives within a certain period, reflecting whether the user is a high-risk target.

[0044] For example, users aged 25-30, working in the internet industry, residing in Shanghai, and using smartphones were selected from the historical user behavior database. Basic dimensional features of the samples and corresponding sample content analysis results were collected, resulting in 10,000 sets of basic dimensional features and 10,000 sets of sample content analysis results.

[0045] Secondly, high-frequency feature clustering is performed on the sample basic dimension feature set and the sample content parsing result set to obtain the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set.

[0046] Specifically, high-frequency feature clustering is performed on the sample basic dimension feature set and the sample content parsing result set to obtain the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set, including: The basic dimensional features of the samples and the corresponding sample content parsing results are vectorized and fused with features to form a joint feature vector set of samples. The K-means clustering algorithm was used to perform unsupervised clustering on the joint feature vector set of the samples, resulting in several clustering results; For each clustering result obtained, its centroid is calculated, and the basic dimension feature part and the content parsing result part corresponding to the centroid are separated and parsed. A high-frequency basic dimension feature set of samples is constructed based on the basic dimension features parsed from the centroids of all clustering results, and a high-frequency content parsing result set of samples is constructed based on the content parsing results parsed from the centroids of all clustering results. The high-frequency basic dimension feature set and the high-frequency content parsing result set of samples are then stored together.

[0047] First, the basic dimensional features of the samples and the corresponding sample content analysis results are vectorized and fused to form a joint feature vector set for the samples. Vectorization refers to the process of converting non-numerical data into numerical vectors. Feature fusion refers to the operation of concatenating the sample basic dimensional feature vector, the sample content analysis result vector, and the sample historical risk feature vector into a single joint vector. One-hot encoding is used to convert historical risk preference tags and content analysis results into fixed-length vectors; numerical normalization is used to convert false positive rate, false negative rate, and historical risk exposure frequency into vectors; then all vectors are concatenated according to their dimensions to form a joint feature vector set for the samples.

[0048] For example, virtual operator numbers and late-night calls are encoded as [1,0,0,1], account inducement risks are encoded as [0,1,0], and high-risk victim experiences, false alarm rate of 10%, false negative rate of 85%, and historical risk exposure frequency of 3 times per week are encoded as [1,0,0,0.1,0.85,0.3]. After fusion, a joint feature vector is obtained: [1,0,0,1,0,1,0,1,0,0,0.1,0.85,0.3]. Similarly, all basic dimension features of the samples and the corresponding sample content parsing results are vectorized and fused with features to form a sample joint feature vector set.

[0049] Secondly, the K-means clustering algorithm is used to perform unsupervised clustering on the sample joint feature vector set, resulting in several clustering results. The K-means clustering algorithm calculates the distance between vectors to group similar joint feature vectors into several categories, achieving the aggregation of features from high-frequency risk scenarios. Setting the number of clusters to 5, for example, the sample joint feature vector set is input into the K-means algorithm, which iteratively calculates the distance between each vector and the centroid of the class until the intra-class vector similarity is highest and the inter-class similarity is lowest, outputting the final clustering result. For example, clustering 10,000 sample joint feature vectors into 5 classes yields 5 clustering results, one of which includes vectors representing all virtual operator numbers, late-night calls, account inducement risks, high-risk victim experiences, false positive rates ≤15%, and false negative rates ≥80%.

[0050] Next, for each clustering result, its centroid is calculated, and the basic dimension feature part and content parsing result part corresponding to the centroid are separated and parsed. The centroid is the mean vector of all joint feature vectors in a certain class, representing the core feature of that class. Separation and parsing means splitting the centroid vector into the parts corresponding to the basic dimension feature, content parsing result, and historical risk feature. The mean of all vectors in each clustering result is calculated to obtain the centroid vector of that class; then, according to the dimensional division at the time of vectorization, the basic dimension feature part, content parsing result part, and historical risk feature part corresponding to the centroid are separated.

[0051] For example, the centroid vector of the above cluster is [1,0,0,1,0,1,0,1,0,0,0.12,0.83,0.32], which is divided into the basic dimension feature part [1,0,0,1], the content parsing result part [0,1,0], and the historical risk feature part [1,0,0,0.12,0.83,0.32].

[0052] Furthermore, a high-frequency basic dimension feature set for the samples is constructed based on the basic dimension features parsed from the centroids of all clustering results, and a high-frequency content parsing result set for the samples is constructed based on the content parsing results parsed from the centroids of all clustering results. The high-frequency basic dimension feature set and the high-frequency content parsing result set are then stored together. The basic dimension features and content parsing results of each cluster centroid are summarized to form corresponding high-frequency feature sets; then, the two sets are stored together according to the clustering correspondence. For example, summarizing the five centroid parts yields the high-frequency basic dimension feature set and the high-frequency content parsing result set for the samples, which are then stored together.

[0053] Furthermore, based on the historical user behavior database, the proportions of historical false alarm appeals and false alarm appeals under different scenarios of high-frequency basic dimension features and high-frequency content analysis results are statistically analyzed. These proportions are used as the sample false alarm sensitivity coefficient and the sample false alarm sensitivity coefficient, respectively, resulting in a sample false alarm sensitivity coefficient set and a sample false alarm sensitivity coefficient set. The sample false alarm sensitivity coefficient refers to the false alarm rate of risk response feedback, reflecting the sample user's concern about normal content being misjudged as risky; the sample false alarm sensitivity coefficient refers to the false alarm rate of risk response feedback, reflecting the sample user's concern about risky content being misjudged as normal. Based on the historical user behavior database, the average false alarm rate and false alarm rate of sample users under each high-frequency feature scenario are extracted and used as the sample false alarm sensitivity coefficient and the sample false alarm sensitivity coefficient, respectively, forming corresponding coefficient sets.

[0054] For example, considering scenarios such as virtual operator numbers, late-night calls, account inducement risks, and the experiences of high-risk victims, if the average false alarm rate of sample users in this scenario is 12% and the average false negative rate is 83%, then the sample false alarm sensitivity coefficient is 0.12 and the sample false negative sensitivity coefficient is 0.83.

[0055] Furthermore, using the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set as input, and the sample false alarm sensitivity coefficient set as supervision, a deep neural network model is trained until convergence, generating a false alarm sensitivity prediction sub-channel. The false alarm sensitivity prediction sub-channel refers to a deep neural network model trained with the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set as input and the sample false alarm sensitivity coefficient as supervision, used to output the user's false alarm sensitivity coefficient.

[0056] Specifically, the high-frequency basic dimension feature set of the samples and the high-frequency content parsing result set of the samples are concatenated to form a joint input vector, which is used as the input to the deep neural network model. The false alarm sensitivity coefficient set of the samples is used as the supervision signal for training. The input layer is set to match the dimension of the joint input vector. There are two hidden layers: the first layer has 256 neurons and the second layer has 128 neurons. Both hidden layers use the ReLU activation function. The output layer has one neuron and uses the Sigmoid activation function to constrain the false alarm sensitivity coefficient to the 0-1 range. The Adam optimizer is used for training, with an initial learning rate of 1e-4 and a batch size of 32. The sample data is divided into training and validation sets in an 8:2 ratio. The mean squared error is used as the loss function, and a preset threshold of 1% is set. Training stops when the mean squared error of the validation set is consistently below the preset threshold for five consecutive rounds, thus completing the generation of the false alarm sensitivity prediction sub-channel.

[0057] For example, 10,000 sets of sample data are divided into 8,000 training sets and 2,000 validation sets in an 8:2 ratio. The 8-dimensional high-frequency basic features and 6-dimensional high-frequency content analysis results of the samples are used as inputs to form a 14-dimensional joint input vector. The false alarm sensitivity coefficient is used as a supervision signal, and the above model structure is used for training. The input layer is adapted to the 14-dimensional joint vector, the hidden layer has two layers, and the output layer has one neuron. It uses the Adam optimizer, a batch size of 32, and the mean squared error as the loss function with a preset threshold of 1%. After continuous iterative training, when the mean squared error of the validation set is consistently below 1% for five consecutive rounds, training is stopped, the model parameters are saved, and a false alarm sensitive prediction sub-channel is generated.

[0058] Based on this, using the sample high-frequency basic dimension feature set and sample high-frequency content parsing result set as input, and the sample missed detection sensitivity coefficient set as supervision, a deep neural network model is trained until convergence, generating a missed detection sensitive prediction sub-channel. This is combined with the false positive sensitive prediction sub-channel to construct a dual-channel sensitivity prediction system. The missed detection sensitive prediction sub-channel refers to a deep neural network model trained with the sample high-frequency basic dimension feature set and sample high-frequency content parsing result set as input and the sample missed detection sensitivity coefficients as supervision, used to output the user's missed detection sensitivity coefficients. The dual-channel sensitivity prediction system is a combination of the false positive sensitive prediction sub-channel and the missed detection sensitive prediction sub-channel, capable of simultaneously outputting two types of sensitivity coefficients.

[0059] Specifically, the high-frequency basic dimension feature set of the samples and the high-frequency content parsing result set of the samples are concatenated into a joint input vector, which is used as the input to the deep neural network model. The sample false negative sensitivity coefficient set is used as a supervision signal for training. The model structure is consistent with the false positive sensitivity prediction sub-channel: the input layer matches the joint vector dimension, the hidden layer has two layers, the first layer contains 256 neurons and the second layer contains 128 neurons, both using the ReLU activation function; the output layer has 1 neuron, using the Sigmoid activation function, and the false negative sensitivity coefficient is constrained to the 0-1 interval. The Adam optimizer is used for training, with an initial learning rate of 1e-4 and a batch training size of 32. The sample data is divided into training and validation sets in an 8:2 ratio, and the mean squared error is used as the loss function with a preset threshold of 1%. When the mean squared error of the validation set is consistently below this threshold for 5 consecutive rounds, the model training is considered converged, generating a false negative sensitivity prediction sub-channel. The false negative sensitivity prediction sub-channel is combined with the trained false positive sensitivity prediction sub-channel to construct a complete sensitivity prediction dual-channel.

[0060] For example, 10,000 sets of sample data are divided into 8,000 training sets and 2,000 validation sets in an 8:2 ratio. The 8-dimensional high-frequency basic feature dimension and the 6-dimensional high-frequency content analysis results are used as inputs to form a 14-dimensional joint input vector. The sample false negative sensitivity coefficient is used as the supervision signal, and training is conducted using the same model structure as described above. The input layer adapts to the 14-dimensional joint vector, with two hidden layers and one neuron in the output layer. It uses the Adam optimizer, a batch size of 32, and a mean squared error as the loss function with a preset threshold of 1%. After continuous iterative training, when the mean squared error of the validation set is consistently below 1% for five consecutive rounds, the model converges and saves the parameters, generating a false negative sensitive prediction sub-channel. This sub-channel is then combined with the false positive sensitive prediction sub-channel to complete the construction of a dual-channel sensitive prediction system.

[0061] Finally, using the aforementioned dual-channel sensitivity prediction, the predicted false positive sensitivity coefficient and predicted false negative sensitivity coefficient are predicted based on the basic dimensional features and content analysis results. The predicted false positive sensitivity coefficient reflects the target user's concern about normal content being misjudged as risky; the higher the value, the more averse the user is to false positives. The predicted false negative sensitivity coefficient reflects the target user's concern about risky content being missed as normal; the higher the value, the more concerned the user is about false negatives. The target user's basic dimensional features and content analysis results are input into the dual-channel sensitivity prediction, which outputs the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient, respectively. For example, if the predicted false positive sensitivity coefficient for this target user is 0.1 and the predicted false negative sensitivity coefficient is 0.92, it indicates that the user has a high tolerance for false positives and an extremely low tolerance for false negatives.

[0062] In this embodiment of the invention, a progressive process is adopted, which involves collecting samples based on user dimensions, simplifying input through high-frequency feature clustering, calibrating sensitivity coefficients based on historical appeals, and predicting using a dual-channel model. First, similar samples are screened using the user dimension as an anchor point to ensure the matching of samples with target users. Then, high-frequency features are extracted through clustering, which simplifies the model input while retaining key risk scenario information. Next, sensitivity coefficients are calibrated based on historical appeal data to make the prediction results fit the actual behavioral preferences of users. Finally, personalized false positive and false negative sensitivity coefficients are output through a dual-channel model, which fills the gap in the traditional risk control uniform threshold that ignores user differences, and provides accurate user preference basis for subsequent optimization of risk judgment thresholds.

[0063] S400: Based on the predicted false alarm sensitivity coefficient and the predicted false alarm sensitivity coefficient, the initial risk judgment threshold in the content intent recognition mechanism is optimized and corrected to generate an adapted risk judgment threshold.

[0064] In this embodiment of the invention, the initial risk judgment threshold in the content intent recognition mechanism is optimized and corrected based on the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient to generate an adapted risk judgment threshold. The initial risk judgment threshold uses a fixed value, and the corresponding baseline false positive and false negative sensitivity coefficients are in a default balanced state. However, different users have significantly different sensitivity preferences for false positives and false negatives. For example, a user who is a high-risk victim is more concerned about false negatives; if the initial threshold is used, the probability of false negatives may increase due to the threshold being too high. Other users may be more concerned about false positives, and a fixed threshold cannot accommodate both needs. Therefore, this step combines the predicted false positive sensitivity coefficient and the false negative sensitivity coefficient, and optimizes the initial threshold through correction coefficients and dynamic weights to make the adapted threshold match the user's sensitivity preferences.

[0065] Step S400 in the method provided in this embodiment of the invention includes: Obtain the baseline false alarm sensitivity coefficient and baseline false negative sensitivity coefficient for the initial risk assessment threshold; The ratio of the predicted false alarm sensitivity coefficient to the baseline false alarm sensitivity coefficient is set as the first threshold correction coefficient; The ratio of the baseline underreporting sensitivity coefficient to the predicted underreporting sensitivity coefficient is set as the second threshold correction coefficient; According to the adaptive dynamic weight, the first threshold correction coefficient and the second threshold correction coefficient are weighted and fused to obtain the comprehensive threshold correction coefficient. The product of the comprehensive threshold correction coefficient and the initial risk judgment threshold is used as the adaptive risk judgment threshold.

[0066] First, obtain the baseline false positive sensitivity coefficient and baseline false negative sensitivity coefficient for the initial risk assessment threshold. The initial risk assessment threshold refers to the default risk judgment threshold of the content intent recognition mechanism. The higher the initial risk assessment threshold, the lower the false positive probability and the higher the false negative probability; conversely, the lower the initial risk assessment threshold, the higher the false positive probability and the lower the false negative probability. The baseline false positive sensitivity coefficient refers to the default false positive sensitivity corresponding to the initial threshold, representing the preset user tolerance for false positives. The baseline false negative sensitivity coefficient refers to the default false negative sensitivity corresponding to the initial threshold, representing the preset user tolerance for false negatives. Read the preset initial risk assessment threshold and its corresponding baseline false positive sensitivity coefficient and baseline false negative sensitivity coefficient from the content intent recognition mechanism's configuration library. For example, if the initial risk assessment threshold is 0.6, the corresponding baseline false positive sensitivity coefficient is 0.5, and the baseline false negative sensitivity coefficient is 0.5.

[0067] Next, the ratio of the predicted false alarm sensitivity coefficient to the baseline false alarm sensitivity coefficient is set as the first threshold correction coefficient. The first threshold correction coefficient reflects the degree of deviation of the predicted false alarm sensitivity coefficient from the baseline and is used to match the user's false alarm preference. First correction coefficient = predicted false alarm sensitivity coefficient / baseline false alarm sensitivity coefficient. For example, if the predicted false alarm sensitivity coefficient for the target user is 0.1 in S300, the first threshold correction coefficient is calculated as: 0.1 / 0.5 = 0.2.

[0068] Next, the ratio of the baseline missed detection sensitivity coefficient to the predicted missed detection sensitivity coefficient is set as the second threshold correction coefficient. The second threshold correction coefficient reflects the degree of deviation of the predicted missed detection sensitivity coefficient from the baseline and is used to match user missed detection preferences. Second correction coefficient = Baseline missed detection sensitivity coefficient / Predicted missed detection sensitivity coefficient. For example, if the predicted missed detection sensitivity coefficient for the target user is 0.92 in S300, the second threshold correction coefficient is calculated to be: 0.5 / 0.92 ≈ 0.543.

[0069] The method for setting the adaptive dynamic weights includes: The user risk vulnerability index is determined based on the aforementioned user dimension information. The communication relationship suspicion index is determined based on the aforementioned basic dimension features; Based on the content analysis results, the content risk severity index and the content time urgency index are assessed and determined. The underreporting weight compensation coefficient is determined based on the user risk vulnerability index, communication relationship suspicion index, content risk severity index, and content time urgency index. The underreporting weight compensation coefficient is positively correlated with the user risk vulnerability index, communication relationship suspicion index, content risk severity index, and content time urgency index. The product of the missed detection weight compensation coefficient and the initial missed detection weight is used as the adaptive missed detection weight. The initial missed detection weight is 0.5. If the calculated adaptive missed detection weight is less than 0.35, it is taken as 0.35. If the calculated adaptive missed detection weight is greater than 0.65, it is taken as 0.65. The adaptation false alarm weight is obtained by subtracting the adaptation false alarm weight from 1, and the adaptation false alarm weight and the adaptation false alarm weight are used as the adaptation dynamic weight.

[0070] First, the user risk vulnerability index is determined based on the aforementioned user dimension information. The user risk vulnerability index assesses the degree to which a user is susceptible to risk based on user dimension information; the higher the value, the more likely the user is to suffer losses due to underreporting. The user risk vulnerability index is evaluated in conjunction with the user's historical risk preference tags, with a value ranging from 0 to 1. For example, if the target user is known to have a history of being a high-risk victim, the assessed user risk vulnerability index for that target user is 0.9.

[0071] Secondly, a communication relationship suspicion index is determined based on the aforementioned basic dimension features. The communication relationship suspicion index is the degree of suspicion of the current communication based on the basic dimension features; the higher the value, the stronger the communication risk attribute. The communication relationship suspicion index is assessed by combining the risk level of number characteristics and source characteristics, with a value range of 0-1. For example, based on a virtual operator number and late-night calls, the communication relationship suspicion index of the target user is assessed as 0.8.

[0072] Next, the content risk severity index and content time urgency index are assessed and determined based on the content analysis results. The content risk severity index is the content risk level obtained based on the content analysis results; the higher the value, the greater the risk. The content time urgency index is the degree of urgency of the required action based on the content analysis results; the higher the value, the stronger the urgency. The content risk severity index and content time urgency index are assessed by combining the risk theme and core intent of the content analysis results, with values ​​ranging from 0 to 1. For example, if the content analysis result is "account inducement risk" and requires "immediate action," the assessed content risk severity index is 0.9 and the content time urgency index is 0.8.

[0073] Subsequently, a missed detection weight compensation coefficient is determined based on the user risk vulnerability index, communication relationship suspicion index, content risk severity index, and content time urgency index. This missed detection weight compensation coefficient is positively correlated with these indices. The missed detection weight compensation coefficient is a coefficient positively correlated with these indices and is used to adjust the proportion of missed detections. The average value of these indices is taken as the missed detection weight compensation coefficient. For example, the missed detection weight compensation coefficient = (0.9 + 0.8 + 0.9 + 0.8) / 4 = 0.85.

[0074] Based on this, the product of the missed detection weight compensation coefficient and the initial missed detection weight is used as the adapted missed detection weight. The initial missed detection weight is 0.5. If the calculated adapted missed detection weight is less than 0.35, it is set to 0.35; if the calculated adapted missed detection weight is greater than 0.65, it is set to 0.65. The adapted missed detection weight refers to the weight corresponding to the missed detection sensitivity. The higher the value, the more the threshold adjustment is biased towards reducing missed detections. Adapted missed detection weight = missed detection weight compensation coefficient × initial missed detection weight 0.5. If the result exceeds the range of 0.35-0.65, the boundary value is taken. For example, the adapted missed detection weight = 0.85 × 0.5 = 0.425, which is in the 0.35-0.65 range, so the adapted missed detection weight is set to 0.425.

[0075] Furthermore, the adaptation false positive weight is obtained by subtracting the adaptation missed positive weight from 1. The adaptation missed positive weight and the adaptation false positive weight are then used as the dynamic adaptation weight. The adaptation false positive weight refers to the weight corresponding to the false positive sensitivity; the higher the value, the more the threshold adjustment favors reducing false positives. Adaptation false positive weight = 1 - adaptation missed positive weight. For example, adaptation false positive weight = 1 - 0.425 = 0.575.

[0076] Furthermore, the first threshold correction coefficient and the second threshold correction coefficient are weighted and fused according to the adaptive dynamic weights to obtain the comprehensive threshold correction coefficient. The comprehensive threshold correction coefficient is a combined adjustment coefficient that integrates the first threshold correction coefficient and the second threshold correction coefficient, reflecting the comprehensive impact of the user's dual-sensitivity preference. Comprehensive correction coefficient = first correction coefficient × adapted false positive weight + second correction coefficient × adapted false negative weight. For example, comprehensive threshold correction coefficient = 0.2 × 0.575 + 0.543 × 0.425 ≈ 0.346.

[0077] Finally, the product of the comprehensive threshold correction coefficient and the initial risk assessment threshold is used as the adaptive risk assessment threshold. The adaptive risk assessment threshold refers to the optimized risk judgment threshold, matching the user's false positive / false negative sensitivity preferences with the scenario's risk level. Adaptive risk assessment threshold = Comprehensive threshold correction coefficient × Initial risk assessment threshold. For example, adaptive risk assessment threshold = 0.346 × 0.6 ≈ 0.208.

[0078] In this embodiment of the invention, a targeted threshold adjustment basis is first generated based on the deviation of the user's sensitivity coefficient from the benchmark. Then, the weight ratio of false negatives and false positives is dynamically allocated by combining the user's risk vulnerability, communication suspiciousness, and content risk urgency, so that the adjustment is more in line with the actual scenario risk. The finally generated adaptive risk judgment threshold not only reduces the false negative rate, but also controls the impact of false positives by balancing the false positive weights. This transforms the risk judgment threshold from a fixed default value to a dynamically adapted value that fits the user and the scenario, providing an adaptive judgment standard for subsequent accurate risk identification.

[0079] S500: Activate the intent risk identification plugin embedded in the content intent identification mechanism, perform risk identification on the content parsing result to obtain a second risk coefficient, and if the second risk coefficient is greater than the adaptation risk judgment threshold, then the telephone voice message is intercepted.

[0080] In this embodiment of the invention, the intent risk identification plugin embedded in the content intent recognition mechanism is activated to perform risk identification on the content parsing result to obtain a second risk coefficient. If the second risk coefficient is greater than the adaptive risk judgment threshold, the telephone voicemail is blocked. The preceding steps have generated an adaptive risk judgment threshold that aligns with user preferences, but the risk level of the content parsing result needs to be accurately quantified to obtain the second risk coefficient, which is necessary to support the final blocking decision. Therefore, it is necessary to construct an intent risk identification plugin to achieve automated and accurate identification of content risks, providing a reliable quantitative basis for blocking decisions, while avoiding the high cost and low efficiency of manual review.

[0081] Step S500 in the method provided in this embodiment of the invention includes: Incremental learning is performed on the large model using the sample content parsing result set and the sample second risk coefficient label set to generate an intent risk identification plugin. The sample second risk coefficient labels are obtained based on human expert annotation.

[0082] First, a sample content parsing result set and a sample second risk coefficient label set are collected. The sample content parsing result set refers to the collection of structured content parsing results generated in S200. The sample second risk coefficient label set refers to the sample risk quantification label obtained based on the human expert annotation method, ranging from 0 to 1. Multiple batches of telephone voicemail messages are collected, including structured parsing results such as account inducement risks and marketing promotion content. Senior security auditors score the risk level of each sample according to the risk scoring guidelines, with values ​​ranging from 1 to 5. The sample second risk coefficient label is calculated as (risk level - 1) / 4. For example, a risk level of 5 corresponds to a sample second risk coefficient label of (5 - 1) / 4 = 1. The sample content parsing results are then paired with the corresponding sample second risk coefficient labels to form a training dataset.

[0083] For example, 10,000 sample content parsing results are selected, and a senior reviewer assigns a risk level score of 5 to one of the samples, with a second risk coefficient label of 1. These are then paired and included in the training dataset. Similarly, the second risk coefficient labels for the 10,000 samples corresponding to the 10,000 sample content parsing results are obtained.

[0084] Secondly, incremental learning is performed on the large model using the sample content parsing result set and the sample second risk coefficient label set to generate an intent risk recognition plugin. A lightweight pre-trained language model such as BERT-base is used as the base model. The intent risk recognition plugin is generated through incremental learning: the structured text of the sample content parsing result is used as input, the model output layer is adjusted, and a fully connected layer with one neuron is connected after the pooling output of the pre-trained large model. The Sigmoid activation function is used to constrain the output to the 0-1 interval, corresponding to the range of the second risk coefficient. The sample content parsing result set and the sample second risk coefficient label set are used to form the training data, which is divided into training set and validation set in an 8:2 ratio. Incremental learning adopts parameter fine-tuning method, freezing the low-level parameters of the pre-trained model and training only a small number of top-level parameters and the output layer. The AdamW optimizer is selected, the batch training size is 16, and the mean squared error is used as the loss function to measure the prediction bias. Fine-tuning is stopped when the mean squared error of the validation set is stably below 0.01 for 5 consecutive rounds. The fine-tuned model parameters are saved, thus generating the intent risk recognition plugin.

[0085] For example, for 10,000 sample content parsing results, the data is divided into an 8:2 ratio: 8,000 training samples and 2,000 validation samples. BERT-base is selected as the pre-trained large model, with the parameters of the first 8 layers frozen. Only the last 4 layers and the fully connected layer of the output layer are fine-tuned. The parsed text of the sample content is used as input, and the second risk coefficient label of the sample is used as the supervision signal. Incremental learning is carried out with a batch size of 16 and the AdamW optimizer. The mean squared error of the validation set is consistently below 0.01 for 5 consecutive rounds, satisfying the convergence condition. At this point, the fine-tuned model parameters are saved, and the intent risk recognition plugin is generated.

[0086] Finally, the intent risk identification plugin embedded in the content intent recognition mechanism is activated to perform risk identification on the content parsing result to obtain a second risk coefficient. If the second risk coefficient is greater than the adaptation risk judgment threshold, the telephone voicemail is intercepted. The intent risk identification plugin embedded in the content intent recognition mechanism is activated; the target user content parsing result generated by S200 is input into the plugin to obtain the second risk coefficient; the second risk coefficient is compared with the adaptation risk judgment threshold: if the second risk coefficient is greater than the adaptation risk judgment threshold, the telephone voicemail is intercepted.

[0087] For example, after activating the intent risk identification plugin, the content parsing result of the target user generated by S200 is input, and the intent risk identification plugin outputs a second risk coefficient of 0.95; compared with the adaptation risk judgment threshold of 0.208 generated by S400, since 0.95>0.208, the voicemail message of the call is blocked.

[0088] In this embodiment of the invention, firstly, highly reliable training labels are obtained based on the human expert annotation method shown in the figure, laying the foundation for the recognition accuracy of the intent risk identification plugin; then, through a clear deep learning model structure and training strategy, the automation and accurate quantification of content risk are realized; finally, combined with personalized adaptation thresholds, interception is performed, which not only accurately captures the risk level of high-risk content through the plugin, but also avoids false interference with the user's normal communication by relying on the adaptation thresholds, completing the final closed loop of multi-stage risk identification and achieving the dual goals of accurate security protection and personalized user experience.

[0089] Through the specific implementation methods described above, the embodiments of the present invention achieve the following technical effects: This invention provides a multi-stage semantic risk identification method and system based on a large model. It rapidly filters low-risk content through coarse-grained risk screening, reducing unnecessary computational consumption and focusing on highly suspicious communication targets in subsequent processes. By overcoming the limitations of basic features through content semantic parsing, it achieves penetrating risk mining from surface attributes to deep intents, filling the gap in content risk identification based on basic dimensions. It generates personalized false positive / false negative sensitivity coefficients by combining user dimensions and historical risk data, breaking the limitations of traditional unified judgment in risk control and anchoring to differentiated user preferences. Based on the sensitivity coefficients, it dynamically optimizes risk judgment thresholds, ensuring that judgment standards accurately adapt to user needs and scenario risk levels. Relying on a trained MLP plugin, it completes the quantitative identification and interception of high-risk content. This not only enhances the identification accuracy of high-risk content such as fraud and inducement through multi-stage progressive analysis but also minimizes interference with normal user communication through personalized thresholds. Ultimately, it achieves an optimal balance between security protection accuracy and personalized user communication experience, realizing a leap from traditional static risk control to scenario-adaptive intelligent risk control.

[0090] Example 2, as Figure 2 As shown, this invention provides a multi-stage semantic risk identification system based on a large model, the system comprising: The feature coarse screening module 11 is used to obtain the basic dimension features of the target user's telephone voicemail, perform risk assessment on the basic dimension features according to the coarse-grained risk screening mechanism, and output the first risk coefficient. Content parsing module 12 is used to parse the telephone voice message according to the content semantic parsing mechanism and output the content parsing result if the first risk coefficient is greater than the first risk threshold. The dual-sensitivity prediction module 13 is used to perform false positive sensitivity prediction and false negative sensitivity prediction on the target user based on the user dimension information of the target user, the basic dimension features and the content parsing results, and to obtain the false positive sensitivity coefficient and the false negative sensitivity coefficient. Threshold optimization module 14 is used to optimize and correct the initial risk judgment threshold in the content intent recognition mechanism based on the predicted false alarm sensitivity coefficient and the predicted false alarm sensitivity coefficient, and generate an adapted risk judgment threshold. The interception decision module 15 is used to activate the intent risk identification plugin embedded in the content intent identification mechanism, perform risk identification on the content parsing result to obtain a second risk coefficient, and if the second risk coefficient is greater than the adaptation risk judgment threshold, then the telephone voice message is intercepted.

[0091] In one embodiment, the feature coarse screening module 11 is further configured to: Obtain the basic dimensional features of the target user's telephone voicemail, wherein the basic dimensional features include number features and source features; Call the preset number risk rule base and preset source risk rule base of the coarse-grained risk screening mechanism; Based on the preset number risk rule base, the number features are matched and analyzed to obtain number risk sub-coefficients; Based on the preset source risk rule base, the source features are matched and analyzed to obtain source risk sub-coefficients; The first risk coefficient is obtained by weighting and fusing the number risk sub-coefficient and the source risk sub-coefficient.

[0092] In one embodiment, the content parsing module 12 is further configured to: The telephone voicemail is automatically recognized and the voice content is converted into text content to obtain the initial text; The initial text is preprocessed to obtain standard text, wherein the preprocessing includes text cleaning, word segmentation and key entity extraction; The standard text is input into a pre-trained large language model for deep semantic parsing to generate structured content parsing results, wherein the content parsing results include at least the main related objects, core user intents, key actions, and potential risk topic classifications.

[0093] In one embodiment, the bi-sensory prediction module 13 is further configured to: Obtain user dimension information of the target user, wherein the user dimension information includes one or more of age, gender, occupation, registration location and communication device type; A sample training set is collected using the user dimension information as a constraint, and a deep neural network model is trained until convergence to generate a sensitive prediction dual channel. Using the aforementioned sensitive prediction dual-channel, the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient are predicted based on the aforementioned basic dimension features and content parsing results.

[0094] The process involves collecting a sample training set using the user dimension information as a constraint, training a deep neural network model until convergence, and generating a sensitive prediction dual-channel, including: Using the aforementioned user dimension information as constraints, the historical user behavior database is retrieved, and the sample basic dimension feature set and sample content parsing result set are collected. High-frequency feature clustering is performed on the sample basic dimension feature set and the sample content parsing result set to obtain the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set. Based on the historical user behavior database, the proportion of historical false alarm appeal events and the proportion of historical false alarm appeal events under different scenarios of high-frequency basic dimension features and high-frequency content parsing results of samples are statistically analyzed, and used as the sample false alarm sensitivity coefficient and the sample false alarm sensitivity coefficient, respectively, to obtain the sample false alarm sensitivity coefficient set and the sample false alarm sensitivity coefficient set. Using the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set as input, and using the sample false alarm sensitivity coefficient set as supervision, a deep neural network model is trained until convergence to generate a false alarm sensitivity prediction sub-channel. Using the sample high-frequency basic dimension feature set and sample high-frequency content parsing result set as input, and the sample missed detection sensitivity coefficient set as supervision, a deep neural network model is trained until convergence, generating a missed detection sensitive prediction sub-channel, and a sensitive prediction dual-channel is constructed by combining the false alarm sensitive prediction sub-channel.

[0095] Specifically, high-frequency feature clustering is performed on the sample basic dimension feature set and the sample content parsing result set to obtain the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set, including: The basic dimensional features of the samples and the corresponding sample content parsing results are vectorized and fused with features to form a joint feature vector set of samples. The K-means clustering algorithm was used to perform unsupervised clustering on the joint feature vector set of the samples, resulting in several clustering results; For each clustering result obtained, its centroid is calculated, and the basic dimension feature part and the content parsing result part corresponding to the centroid are separated and parsed. A high-frequency basic dimension feature set of samples is constructed based on the basic dimension features parsed from the centroids of all clustering results, and a high-frequency content parsing result set of samples is constructed based on the content parsing results parsed from the centroids of all clustering results. The high-frequency basic dimension feature set and the high-frequency content parsing result set of samples are then stored together.

[0096] In one embodiment, the threshold optimization module 14 is further configured to: Obtain the baseline false alarm sensitivity coefficient and baseline false negative sensitivity coefficient for the initial risk assessment threshold; The ratio of the predicted false alarm sensitivity coefficient to the baseline false alarm sensitivity coefficient is set as the first threshold correction coefficient; The ratio of the baseline underreporting sensitivity coefficient to the predicted underreporting sensitivity coefficient is set as the second threshold correction coefficient; According to the adaptive dynamic weight, the first threshold correction coefficient and the second threshold correction coefficient are weighted and fused to obtain the comprehensive threshold correction coefficient. The product of the comprehensive threshold correction coefficient and the initial risk judgment threshold is used as the adaptive risk judgment threshold.

[0097] The method for setting the adaptive dynamic weights includes: The user risk vulnerability index is determined based on the aforementioned user dimension information. The communication relationship suspicion index is determined based on the aforementioned basic dimension features; Based on the content analysis results, the content risk severity index and the content time urgency index are assessed and determined. The underreporting weight compensation coefficient is determined based on the user risk vulnerability index, communication relationship suspicion index, content risk severity index, and content time urgency index. The underreporting weight compensation coefficient is positively correlated with the user risk vulnerability index, communication relationship suspicion index, content risk severity index, and content time urgency index. The product of the missed detection weight compensation coefficient and the initial missed detection weight is used as the adaptive missed detection weight. The initial missed detection weight is 0.5. If the calculated adaptive missed detection weight is less than 0.35, it is taken as 0.35. If the calculated adaptive missed detection weight is greater than 0.65, it is taken as 0.65. The adaptation false alarm weight is obtained by subtracting the adaptation false alarm weight from 1, and the adaptation false alarm weight and the adaptation false alarm weight are used as the adaptation dynamic weight.

[0098] In one embodiment, the interception decision module 15 is further configured to: Incremental learning is performed on the large model using the sample content parsing result set and the sample second risk coefficient label set to generate an intent risk identification plugin. The sample second risk coefficient labels are obtained based on human expert annotation.

[0099] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A multi-stage semantic risk identification method based on a large model, characterized in that, The methods include: The basic dimension features of the target user's telephone voicemail are obtained, and the risk assessment of the basic dimension features is performed according to the coarse-grained risk screening mechanism to output the first risk coefficient. Specifically, the basic dimension features of the target user's telephone voicemail are obtained, wherein the basic dimension features include number features and source features. Call the preset number risk rule base and preset source risk rule base of the coarse-grained risk screening mechanism; Based on the preset number risk rule base, the number features are matched and analyzed to obtain number risk sub-coefficients; Based on the preset source risk rule base, the source features are matched and analyzed to obtain source risk sub-coefficients; The first risk coefficient is obtained by weighting and fusing the number risk sub-coefficient and the source risk sub-coefficient. If the first risk coefficient is greater than the first risk threshold, the content of the telephone voice message is parsed according to the content semantic parsing mechanism, and the content parsing result is output. Based on the target user's user dimension information, the basic dimension features, and the content parsing results, false positive sensitivity prediction and false negative sensitivity prediction are performed on the target user, respectively, and the false positive sensitivity coefficient and false negative sensitivity coefficient are obtained. Specifically, the target user's user dimension information is obtained, wherein the user dimension information includes one or more of age, gender, occupation, registration location, and communication device type. A sample training set is collected using the user dimension information as a constraint, and a deep neural network model is trained until convergence to generate a sensitive prediction dual channel. Using the aforementioned dual-channel sensitive prediction, the false positive sensitivity coefficient and the false negative sensitivity coefficient are predicted based on the aforementioned basic dimension features and content parsing results. Based on the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient, the initial risk judgment threshold in the content intent recognition mechanism is optimized and corrected to generate an adapted risk judgment threshold. The intent risk identification plugin embedded in the content intent identification mechanism is activated, and the content parsing result is used to identify risks to obtain a second risk coefficient. If the second risk coefficient is greater than the adaptation risk judgment threshold, the telephone voice message is intercepted.

2. The multi-stage semantic risk identification method based on a large model according to claim 1, characterized in that, The telephone voicemail is parsed according to a content semantic parsing mechanism, and the parsing results are output, including: The telephone voicemail is automatically recognized and the voice content is converted into text content to obtain the initial text; The initial text is preprocessed to obtain standard text, wherein the preprocessing includes text cleaning, word segmentation and key entity extraction; The standard text is input into a pre-trained large language model for deep semantic parsing to generate structured content parsing results, wherein the content parsing results include at least the main related objects, core user intents, key actions, and potential risk topic classifications.

3. The multi-stage semantic risk identification method based on a large model according to claim 1, characterized in that, Using the aforementioned user dimension information as constraints, a sample training set is collected, a deep neural network model is trained until convergence, and a sensitive prediction dual-channel is generated, including: Using the aforementioned user dimension information as constraints, the historical user behavior database is retrieved, and the sample basic dimension feature set and sample content parsing result set are collected. High-frequency feature clustering is performed on the sample basic dimension feature set and the sample content parsing result set to obtain the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set. Based on the historical user behavior database, the proportion of historical false alarm appeal events and the proportion of historical false alarm appeal events under different scenarios of high-frequency basic dimension features and high-frequency content parsing results of samples are statistically analyzed, and used as the sample false alarm sensitivity coefficient and the sample false alarm sensitivity coefficient, respectively, to obtain the sample false alarm sensitivity coefficient set and the sample false alarm sensitivity coefficient set. Using the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set as input, and using the sample false alarm sensitivity coefficient set as supervision, a deep neural network model is trained until convergence to generate a false alarm sensitivity prediction sub-channel. Using the sample high-frequency basic dimension feature set and sample high-frequency content parsing result set as input, and the sample missed detection sensitivity coefficient set as supervision, a deep neural network model is trained until convergence, generating a missed detection sensitive prediction sub-channel, and a sensitive prediction dual-channel is constructed by combining the false alarm sensitive prediction sub-channel.

4. The multi-stage semantic risk identification method based on a large model according to claim 3, characterized in that, High-frequency feature clustering is performed on the sample basic dimension feature set and the sample content parsing result set to obtain the sample high-frequency basic dimension feature set and the sample high-frequency content parsing result set, including: The basic dimensional features of the samples and the corresponding sample content parsing results are vectorized and fused with features to form a joint feature vector set of samples. The K-means clustering algorithm was used to perform unsupervised clustering on the joint feature vector set of the samples, resulting in several clustering results; For each clustering result obtained, its centroid is calculated, and the basic dimension feature part and the content parsing result part corresponding to the centroid are separated and parsed. A high-frequency basic dimension feature set of samples is constructed based on the basic dimension features parsed from the centroids of all clustering results, and a high-frequency content parsing result set of samples is constructed based on the content parsing results parsed from the centroids of all clustering results. The high-frequency basic dimension feature set and the high-frequency content parsing result set of samples are then stored together.

5. The multi-stage semantic risk identification method based on a large model according to claim 1, characterized in that, Based on the predicted false positive sensitivity coefficient and the predicted false negative sensitivity coefficient, the initial risk judgment threshold in the content intent recognition mechanism is optimized and corrected to generate an adapted risk judgment threshold, including: Obtain the baseline false alarm sensitivity coefficient and baseline false negative sensitivity coefficient for the initial risk assessment threshold; The ratio of the predicted false alarm sensitivity coefficient to the baseline false alarm sensitivity coefficient is set as the first threshold correction coefficient; The ratio of the baseline underreporting sensitivity coefficient to the predicted underreporting sensitivity coefficient is set as the second threshold correction coefficient; According to the adaptive dynamic weight, the first threshold correction coefficient and the second threshold correction coefficient are weighted and fused to obtain the comprehensive threshold correction coefficient. The product of the comprehensive threshold correction coefficient and the initial risk judgment threshold is used as the adaptive risk judgment threshold.

6. The multi-stage semantic risk identification method based on a large model according to claim 5, characterized in that, The method for setting the adaptive dynamic weights includes: The user risk vulnerability index is determined based on the aforementioned user dimension information. The communication relationship suspicion index is determined based on the aforementioned basic dimension features; Based on the content analysis results, the content risk severity index and the content time urgency index are assessed and determined. The underreporting weight compensation coefficient is determined based on the user risk vulnerability index, communication relationship suspicion index, content risk severity index, and content time urgency index. The underreporting weight compensation coefficient is positively correlated with the user risk vulnerability index, communication relationship suspicion index, content risk severity index, and content time urgency index. The product of the missed detection weight compensation coefficient and the initial missed detection weight is used as the adaptive missed detection weight. The initial missed detection weight is 0.

5. If the calculated adaptive missed detection weight is less than 0.35, it is taken as 0.

35. If the calculated adaptive missed detection weight is greater than 0.65, it is taken as 0.

65. The adaptation false alarm weight is obtained by subtracting the adaptation false alarm weight from 1, and the adaptation false alarm weight and the adaptation false alarm weight are used as the adaptation dynamic weight.

7. The multi-stage semantic risk identification method based on a large model according to claim 1, characterized in that, Incremental learning is performed on the large model using the sample content parsing result set and the sample second risk coefficient label set to generate an intent risk identification plugin. The sample second risk coefficient labels are obtained based on human expert annotation.

8. A multi-stage semantic risk identification system based on a large model, characterized in that, The system for implementing the multi-stage semantic risk identification method based on a large model as described in any one of claims 1-7 includes: The feature coarse screening module is used to obtain the basic dimension features of the target user's telephone voicemail, perform risk assessment on the basic dimension features according to the coarse-grained risk screening mechanism, and output the first risk coefficient. The content parsing module is used to parse the telephone voice message according to the content semantic parsing mechanism and output the content parsing result if the first risk coefficient is greater than the first risk threshold. The dual-sensitivity prediction module is used to perform false positive sensitivity prediction and false negative sensitivity prediction for the target user based on the user dimension information of the target user, the basic dimension features and the content parsing results, and to obtain the false positive sensitivity coefficient and the false negative sensitivity coefficient. The threshold optimization module is used to optimize and correct the initial risk judgment threshold in the content intent recognition mechanism based on the predicted false alarm sensitivity coefficient and the predicted false alarm sensitivity coefficient, and generate an adapted risk judgment threshold. The interception decision module is used to activate the intent risk identification plugin embedded in the content intent identification mechanism, perform risk identification on the content parsing result to obtain a second risk coefficient, and if the second risk coefficient is greater than the adaptation risk judgment threshold, then the telephone voice message is intercepted.

Images