A method and system for real-time detection and cleaning of malicious traffic of an SMS gateway

Abstract

The application provides a short message gateway malicious traffic real-time detection and cleaning method and system, and relates to the technical field of mobile communication security, wherein the method comprises the following steps: collecting signaling plane and user plane data of short message traffic; analyzing short message text from the user plane data and generating abnormal feature data, and processing the signaling plane data to extract a signaling parameter set and construct a time sequence spectrum graph; inputting the time sequence spectrum graph into a convolutional neural network model for analysis, identifying a target abnormal mode, and generating a traffic detection result containing a threat level and a traffic source identifier; then, based on the abnormal feature data and the threat level information, a sequence recognition model is used to generate a malicious traffic judgment result; finally, a cleaning instruction is generated according to the judgment result and the traffic source identifier information to instruct the execution of a cleaning operation on the short message traffic at a corresponding network access location. The application improves the identification accuracy of malicious short message traffic and the timeliness of source cleaning.

Description

Technical Field

[0001] This application relates to the field of mobile communication security technology, and in particular to a method and system for real-time detection and cleaning of malicious traffic on SMS gateways. Background Technology

[0002] Malicious traffic detection and cleaning of SMS gateways is a key technology in the field of mobile communication network security. It aims to ensure the normal order of communication services and the security of user information and has a wide range of application needs. With the evolution of mass messaging technology, new avoidance methods have made malicious traffic detection a challenge.

[0003] In existing technologies, detection methods for this type of malicious traffic are mainly divided into two categories: content analysis and behavior analysis. Content analysis technology focuses on keyword matching or regular character statistics of SMS text to identify anomalies; behavior analysis technology judges anomalies by monitoring traffic rate or signaling frequency thresholds, such as setting traffic peak alarms on the gateway side.

[0004] In practical applications, content analysis techniques have limited effectiveness in recognizing text that has undergone character obfuscation, while behavioral analysis techniques are not accurate enough in responding to short-term, low-volume distributed attacks. Furthermore, the independent operation of these two types of techniques leads to delays in identifying hybrid attacks. Therefore, existing technologies suffer from insufficient accuracy and delayed response in detecting malicious traffic employing complex evasion techniques. Summary of the Invention

[0005] This application provides a method and system for real-time detection and cleaning of malicious traffic on SMS gateways, in order to solve the problems of low accuracy in identifying malicious SMS traffic and poor timeliness in source cleaning in the prior art.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a method for real-time detection and cleaning of malicious traffic on an SMS gateway, comprising: Collect signaling plane and user plane data of the SMS traffic to be processed; The SMS text content is parsed from the user plane data, and abnormal feature data is generated based on the SMS text content; The signaling plane data is processed to extract the signaling parameter set, and a time-series spectrum is constructed based on the signaling parameter set; The time-series spectrogram is input into a convolutional neural network model, which analyzes the time-series spectrogram to identify target anomaly patterns. Based on the target anomaly patterns, traffic detection results are generated. The traffic detection results include threat level information and traffic source identification information. The traffic source identification information is used to uniquely identify the upstream enterprise account or channel that initiated the SMS traffic. Based on the abnormal feature data and the threat level information, a malicious traffic determination result is generated using a sequence recognition model. Based on the malicious traffic determination result and the traffic source identification information, a corresponding cleaning instruction is generated. The cleaning instruction is used to instruct the network access location corresponding to the traffic source identification information to perform a corresponding cleaning operation on the SMS traffic to be processed.

[0007] Secondly, this application provides a real-time detection and cleaning system for malicious traffic on SMS gateways, comprising: The data acquisition module is used to collect signaling plane data and user plane data of the SMS traffic to be processed. The parsing module is used to parse the SMS text content from the user plane data and generate abnormal feature data based on the SMS text content; The processing module is used to process the signaling plane data to extract the signaling parameter set, and construct a time-series spectrum based on the signaling parameter set; The identification module is used to input the time series spectrum into the convolutional neural network model, analyze the time series spectrum through the convolutional neural network model to identify the target abnormal pattern, and generate traffic detection results based on the target abnormal pattern. The traffic detection results include threat level information and traffic source identification information. The traffic source identification information is used to uniquely identify the upstream enterprise account or channel that initiated the SMS traffic. The generation module is used to generate a malicious traffic determination result based on the abnormal feature data and the threat level information using a sequence recognition model; The cleaning module is used to generate a corresponding cleaning instruction based on the malicious traffic determination result and the traffic source identification information. The cleaning instruction is used to instruct the network access location corresponding to the traffic source identification information to perform a corresponding cleaning operation on the SMS traffic to be processed.

[0008] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the steps of the SMS gateway malicious traffic real-time detection and cleaning method as described in the first aspect above.

[0009] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the SMS gateway malicious traffic real-time detection and cleaning method described in the first aspect above.

[0010] The technical solution provided in this application has the following beneficial effects: This application provides a comprehensive data foundation for subsequent analysis by simultaneously collecting signaling plane and user plane data. Parsing text from user plane data and generating abnormal feature data effectively identifies evasive anomalies in text content. Simultaneously, processing signaling plane data and constructing a time-series spectrogram allows for the visualization of time-series patterns in signaling behavior. Analyzing the time-series spectrogram using a convolutional neural network automatically identifies abnormal signaling patterns related to malicious traffic activity and outputs detection results with threat levels and specific traffic source identifiers. Then, based on text anomaly features and traffic threat levels, a sequence recognition model is used for fusion judgment, enhancing the comprehensiveness and accuracy of malicious traffic identification. Finally, based on the judgment results and traffic source identifiers, a cleaning command is generated, achieving precise location and real-time interception of malicious traffic at the network access source.

[0011] Furthermore, this method converts detection features of different dimensions into vectors and fuses them, then uses a sequence recognition model to generate a comprehensive representation, and finally makes a judgment through threshold comparison. This process achieves a comprehensive balance between text content anomalies and network signaling anomalies, thereby improving the reliability and stability of the final malicious traffic judgment.

[0012] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart illustrating a method for real-time detection and cleaning of malicious traffic from an SMS gateway, as provided in this application embodiment; Figure 2 This is a schematic diagram illustrating a specific implementation of a method for real-time detection and cleaning of malicious traffic on a SMS gateway, as provided in an embodiment of this application. Figure 3 This is a schematic diagram of the structure of a real-time detection and cleaning system for malicious traffic of an SMS gateway, provided in an embodiment of this application. Detailed Implementation

[0015] To address the challenges faced by existing malicious traffic detection technologies, content analysis technology has limited ability to recognize SMS text with obfuscated characters, while behavioral analysis technology suffers from delays in responding to distributed attacks. The independent operation of these two types of technologies also leads to insufficient comprehensiveness in the judgment process for hybrid attacks, which affects the accuracy and timeliness of the detection results overall.

[0016] To address the aforementioned issues, this application proposes a real-time detection and cleaning method for malicious traffic on SMS gateways. The core idea of ​​this method is as follows: First, simultaneously collect signaling plane data and user plane data of SMS traffic, and extract signaling behavior time-series spectrograms and text anomaly features from them respectively; then, analyze the signaling spectrograms using a convolutional neural network model to identify abnormal patterns and locate the source of threatening traffic, such as stolen enterprise accounts; simultaneously, input the text anomaly features and the identified traffic threat level into a sequence recognition model for fusion and judgment; finally, generate cleaning instructions based on the judgment results and traffic source identifiers, and perform precise cleaning on the gateway side.

[0017] Therefore, this solution achieves collaborative detection of evasive text and abnormal signaling patterns by integrating text content analysis and signaling behavior analysis. This improves the accuracy of malicious traffic identification while enhancing the timeliness of response and the precision of location in complex attack scenarios, effectively solving the problems of insufficient detection accuracy and delayed response in existing technologies.

[0018] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] The core of this application is to provide a method for real-time detection and cleaning of malicious traffic on SMS gateways, and a flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes: Step 101: Collect signaling plane data and user plane data of the SMS traffic to be processed.

[0020] In step 101, SMS traffic refers to the set of SMS data transmitted through the mobile communication network; signaling plane data is network instruction information that controls the SMS transmission process, such as request records used to establish a connection or update location; user plane data is the actual payload information of the SMS, which contains the text content to be sent.

[0021] In this embodiment, probe devices are deployed at SMS gateways or other core network monitoring points to intercept SMS service data packets flowing through the network node in real time; then the captured data packets are parsed and separated into signaling plane data for control processes and user plane data carrying SMS content, thereby providing complete data input for subsequent separate processing.

[0022] Step 102: Parse the SMS text content from the user plane data and generate abnormal feature data based on the SMS text content.

[0023] Among them, the SMS text content refers to a string sequence composed of Chinese characters, numeric characters, and symbol characters parsed from the user plane data and carrying specific SMS information; the abnormal feature data is a numerical set used to quantitatively characterize the degree to which the SMS text content deviates from the normal language usage habit, and this data set is obtained by analyzing the character composition and arrangement structure of the SMS text content.

[0024] In this embodiment, step 102 includes the following processes: Step 1021: Determine multiple character categories in the SMS text content, and the multiple character categories include numeric character categories, first symbol character categories, and second symbol character categories.

[0025] In step 1021, the first symbol character category may refer to a specific symbol set commonly used for anti-character detection, such as " " and "#", etc.; the second symbol character category may refer to other commonly used symbols except the first symbol character category, such as punctuation marks, etc.; the numeric character category includes Arabic numerals 0 to 9; the Chinese character category may refer to Chinese characters.

[0026] In the embodiment of the present application, first, according to the predefined character encoding range, each character in the SMS text content is classified into its corresponding character category, and these categories include Chinese character categories, numeric character categories, first symbol character categories, and second symbol character categories.

[0027] In practical applications, there is an SMS text content of "Your points have been credited. Please check! 1086". This text contains Chinese characters "Your points have been credited. Please check", numeric characters "1", "0", "8", "6", the first symbol character " ", and the second symbol character "!"; then according to the predefined encoding rules, these characters are respectively classified into the corresponding categories.

[0028] Step 1022: Count the first character quantity belonging to the first symbol character category, the second character quantity belonging to the second symbol character category, and the third character quantity belonging to the numeric character category in the SMS text content.

[0029] In step 1022, the first character quantity is the number of symbols belonging to the first symbol character category in the SMS text content, the second character quantity is the number of symbols belonging to the second symbol character category in the SMS text content, and the third character quantity is the number of numbers belonging to the numeric character category in the SMS text content.

[0030] In this embodiment of the application, the characters that have been classified in step 1021 are counted to obtain the number of the first character, the number of the second character, and the number of the third character.

[0031] In practical applications, let's continue with the example of the SMS text "Your points have been credited to your account 1086, please check!" Since this text does not contain the first symbol character, i.e., "..." The first character has 0 characters, including " and "#". The second symbol character "!" has 1 character, so the second character has 1 character. The numeric characters "1", "0", "8", and "6" have 4 characters, so the third character has 4 characters.

[0032] Step 1023: Calculate the first ratio, second ratio, and third ratio of the number of the first character, the number of the second character, and the number of the third character to the total number of characters in the SMS text content, respectively.

[0033] In step 1023, the total number of characters in the SMS text content is the sum of all characters in the SMS message. The first ratio is the ratio of the number of first characters to the total number of characters, the second ratio is the ratio of the number of second characters to the total number of characters, and the third ratio is the ratio of the number of third characters to the total number of characters.

[0034] In this embodiment of the application, the first number of characters, the second number of characters, and the third number of characters obtained in step 1022 are divided by the total number of characters in the SMS text content, thereby calculating the first ratio, the second ratio, and the third ratio.

[0035] In practical application, continuing the previous example, the SMS message "Your points have been credited to your account 1086, please check!" has a total of 15 characters, including 10 Chinese characters, 4 numbers, 1 second symbol, and 0 first symbols. The first ratio is calculated by dividing the number of first characters (0) by the total number of characters (15), resulting in 0; the second ratio is calculated by dividing the number of second characters (1) by the total number of characters (15), resulting in approximately 0.07; and the third ratio is calculated by dividing the number of third characters (4) by the total number of characters (15), resulting in approximately 0.27.

[0036] Step 1024: Identify Chinese characters in the SMS text content that belong to a preset set of uncommon characters, and record the position index of each Chinese character in the SMS text content to form a position index sequence.

[0037] In step 1024, the preset rare character set is a predefined set of Chinese characters that appear with a relatively low frequency in normal text message communications. This set is constructed based on statistical analysis of a large-scale historical normal text message corpus. The preset rare character set specifically includes rare Chinese characters whose occurrence frequencies, statistically obtained from the large-scale historical normal text message corpus, are lower than a preset threshold. For example, Chinese characters such as "乜" and "仝" that rarely appear in daily text message communications. And the content in this set is not limited in the embodiments of this application; the position index refers to the sequential number of a certain character starting from the beginning position in the text message content string, and the starting number is usually 1.

[0038] In the embodiments of this application, first, each Chinese character in the text message content is checked one by one to determine whether it exists in the preset rare character set; then, if a certain Chinese character exists in this set, the position index of this character in the entire text message string is recorded; finally, all the recorded position indexes are arranged in the order in which the characters appear in the text to form a position index sequence.

[0039] In practical applications, assume that the preset rare character set includes uncommon Chinese characters such as "乜" and "仝". For the text message "Please check and receive the welfare on the '仝' day", the Chinese character "仝" in it exists in this set, and the position of this character in the text message string is the 5th character. Assume that "请" is the 1st character, then the position index 5 is recorded; if there is only one rare character in the text message, the formed position index sequence is [5].

[0040] Step 1025: Generate abnormal feature data based on the first ratio, the second ratio, the third ratio, and the position index sequence.

[0041] In the embodiments of this application, the first ratio, the second ratio, and the third ratio calculated in step 1023, and the position index sequence formed in step 1024 are combined and integrated to generate a piece of abnormal feature data that ultimately represents the abnormal degree of the text message. This integration process usually directly arranges these four elements in sequence to form a multi-dimensional vector.

[0042] In practical applications, for a text message, its first ratio is 0, the second ratio is approximately 0.07, the third ratio is approximately 0.27, and the position index sequence is [5]; combining these data can generate an abnormal feature data vector. For example, this vector is represented as [0, 0.07, 0.27, [5]].

[0043] This application generates quantified abnormal feature data by analyzing the proportional distribution of specific characters and the position of uncommon words in SMS text content. This provides an objective and calculable data basis for subsequent judgment of whether SMS content is abnormal, and improves the precision of content-level anomaly identification.

[0044] Step 103: Process the signaling plane data to extract the signaling parameter set, and construct a time-series spectrum based on the signaling parameter set.

[0045] Among them, the signaling parameter set is a set of values ​​calculated and extracted from the signaling plane data to characterize the signaling behavior; the time-series spectrogram is a two-dimensional graph that arranges the parameter values ​​in the signaling parameter set in chronological order and displays them graphically, with the horizontal axis representing time and the vertical axis representing parameter values.

[0046] In this embodiment, step 103 includes the following process: Step 1031: Extract multiple signaling records from the same traffic source identification information within a specified time window from the signaling plane data.

[0047] In step 1031, the specified time window is a preset continuous time length, such as 10 seconds or 1 minute; the traffic source identification information is an identifier used to uniquely identify the upstream enterprise account or channel that initiates the SMS traffic; the signaling record refers to a single data entry in the signaling plane data that carries fields such as signaling type, timestamp, and source base station identifier.

[0048] In this embodiment, firstly, a fixed time window length is set; then, all signaling plane data is traversed, and it is determined whether each data falls within the specified time window based on the timestamp in each data, and at the same time, it is determined whether it comes from the same traffic source based on its traffic source identifier; finally, all signaling records that meet the above two conditions are filtered out to form a set of multiple signaling records belonging to the traffic source within the time window.

[0049] In practical applications, assuming the specified time window is 60 seconds before the current time, and the target traffic source is identified as "Enterprise Account A", all data entries with timestamps within the past 60 seconds and traffic source identified as "Enterprise Account A" are filtered from the signaling plane data. For example, a total of 15 signaling records are filtered out.

[0050] Step 1032: Count the number of first-type signaling requests, the number of second-type signaling requests, and the number of third-type signaling occurrences of the multiple signaling records within a unit time period to form a subset of the first parameters.

[0051] In step 1032, the unit time is a preset time unit used for statistical frequency, such as 1 second; The first type of signaling request refers to requests used to establish SMS transmission connections, such as attach requests or service requests; the second type of signaling request refers to requests used to update the terminal location, such as location update requests or routing area update requests; the third type of signaling refers to specific signaling types that may appear abnormally in malicious mass messaging scenarios, other than the first and second types, such as authentication failure responses or resource release requests. The first parameter subset is a set of values ​​consisting of the statistical frequencies of the three types of signaling mentioned above.

[0052] In this embodiment of the application, firstly, for the multiple signaling records obtained in step 1031, each record is classified into the first, second, or third type of signaling according to the preset signaling type classification rules; then, the number of times each type of signaling occurs within a unit time is counted, and these counts are the number of first type signaling requests, the number of second type signaling requests, and the number of third type signaling occurrences; finally, these three counts are combined to form the first parameter subset.

[0053] In practical application, continuing the previous example, among the 15 selected records, after classification, 8 business requests, 4 location update requests, and 3 abnormal authentication failure responses were found. Assuming the unit of time is 1 second, and these 15 records are evenly distributed within 60 seconds, then the average number of first-type signaling requests per second is 8 / 60≈0.133 times, the number of second-type signaling requests is 4 / 60≈0.067 times, and the number of third-type signaling requests is 3 / 60=0.05 times; the resulting first parameter subset is [0.133, 0.067, 0.05].

[0054] Step 1033: Parse the length information of the signaling messages and the encoding order information of the signaling types in the multiple signaling records to form a second parameter subset.

[0055] In step 1033, the length information of the signaling message refers to the number of bytes of the data payload carried by a single signaling record; the encoding order information of the signaling type refers to the sequence formed by arranging the signaling type codes according to the timestamp order of the signaling records; the second parameter subset is a data set composed of the length information and the encoding order information.

[0056] In this embodiment of the application, firstly, the length field value of the signaling message is extracted from each signaling record obtained in step 1031; at the same time, the signaling type code is extracted sequentially according to the timestamps of these records in ascending order; then, a statistical feature is calculated for all length values, and the signaling type code sequence itself or its feature is used as the encoding order information; finally, the length statistical feature and the encoding order information are combined to form the second parameter subset.

[0057] In practical applications, continuing the previous example, among 15 signaling records, the length values ​​of each record are [120, 118, 115, 122, 119, 121, 117, 120, 123, 116, 118, 122, 119, 120, 121], in bytes. The average length is then calculated by dividing the sum by 15, where the sum is approximately 1791 bytes and the average length is approximately 119.4 bytes. Simultaneously, the signaling types are arranged in chronological order. The encoded sequence may be [10, 10, 10, 10, 10, 20, 20, 20, 30, 30, 10, 10, 20, 30, 10], where 10 represents the first type of signaling, 20 represents the second type of signaling, and 30 represents the third type of signaling. Then, the "longest consecutive occurrence of 10" can be extracted as a feature of the encoding order information. In this example, it is 5 times. The final second parameter subset can include an average length of 119.4 and the longest consecutive occurrence of 5.

[0058] Step 1034: Combine the first parameter subset with the second parameter subset to obtain the signaling parameter set.

[0059] In practical applications, the signaling parameter set can be generated by combining the average length of 119.4 contained in the first parameter subset [0.133, 0.067, 0.05] and the second parameter subset with the longest consecutive number of 5. For example, this set can be represented as [0.133, 0.067, 0.05, 119.4, 5].

[0060] Step 1035: Plot a time-series spectrum with time as the horizontal axis and each parameter in the signaling parameter set as the vertical axis.

[0061] In step 1035, plotting refers to marking the value of each parameter at its corresponding time point or time interval in a two-dimensional coordinate system in the form of points, lines, or bar charts.

[0062] In this embodiment of the application, firstly, the range and scale of the time axis are determined, which corresponds to the time window specified in step 1031; then, the coordinate position of each parameter value in the signaling parameter set is determined in the coordinate system according to the time point or time interval corresponding to its statistical analysis; finally, the values ​​of the same parameter at different time points are connected by line segments, or the values ​​of all parameters at the same time point are plotted in a stacked manner, thereby forming a time series spectrum that can reflect the trend of parameter changes over time.

[0063] In practical applications, assuming that the signaling parameter set [0.133, 0.067, 0.05, 119.4, 5] is data collected from the center time "T0" of a 60-second time window, this application can use T0 as the time reference point to plot the parameter set into a spectrum with 5 vertical axes. The height of each vertical axis at the horizontal coordinate T0 corresponds to its parameter value. If it is necessary to display the spectrum of multiple consecutive time windows, the signaling parameter sets at different times can be plotted side by side to form multiple data strips extending along the time axis.

[0064] This application transforms abstract signaling interaction behavior into a visual, easily pattern-analyzable spatiotemporal data form by performing multi-dimensional statistics and feature extraction on signaling from specific traffic sources within a specified time period, and then correlating these features with time to form a spectrogram. This provides a structured input for subsequent deep learning-based anomaly pattern recognition.

[0065] Step 104: Input the time series spectrum into the convolutional neural network model, analyze the time series spectrum through the convolutional neural network model to identify the target abnormal pattern, and generate traffic detection results based on the target abnormal pattern. The traffic detection results include threat level information and traffic source identification information. The traffic source identification information is used to uniquely identify the upstream enterprise account or channel that initiated the SMS traffic.

[0066] The exemplary structural design of the convolutional neural network model includes: Two consecutive convolutional layers, each followed by a max pooling layer, where the first convolutional layer uses 16 5x5 convolutional kernels to extract basic spatiotemporal features, and the second convolutional layer uses 32 3x3 convolutional kernels to learn more complex patterns. A flattening layer transforms the feature map into a one-dimensional vector; a fully connected layer with 256 neurons is used for high-level feature integration. A matching layer is essentially another fully connected layer with 128 neurons, whose output is generated by the Softmax function to determine the matching probability with each pattern in a preset set of abnormal patterns. A parsing layer that receives features from the previous network through a small fully connected layer with a linear activation function and directly outputs a vector corresponding to the traffic source identifier encoding dimension in the input spectrogram metadata; An output layer concatenates the probability vector output by the matching layer with the traffic source identifier vector output by the parsing layer to form the final traffic detection result data structure.

[0067] It should be noted that this embodiment does not limit the structural design of the convolutional neural network model, the parameter design of each layer, or the training process, and can be set accordingly based on the actual situation.

[0068] The target anomaly pattern can refer to the spatiotemporal distribution pattern of signaling associated with "SMS bombing" or high-frequency malicious mass issuance behavior, such as the dense burst pattern of signaling request sequences originating from the same traffic source within a very short period of time; threat level information is used to quantify the severity of the malicious behavior corresponding to the anomaly pattern, such as "high risk" or "medium risk"; traffic detection results are the analytical conclusions output by this step, used to indicate the potential source of malicious traffic and the degree of risk.

[0069] In this embodiment, step 104 includes the following process: Step 1041: Input the time-series spectrogram into the convolutional neural network model, and perform feature learning on the time-series spectrogram through multiple convolutional layers of the convolutional neural network model to obtain spatiotemporal correlation features.

[0070] In step 1041, the spatiotemporal correlation feature refers to the abstract pattern learned by the model that can simultaneously characterize the trend of signaling parameters evolving over time and the abnormal changes in coordination between different parameters, such as the composite feature of "the number of connection establishment requests and the number of location update requests surging synchronously within a unit of time".

[0071] In this embodiment, the time-series spectrogram representing signaling activity from a specific traffic source is first fed into the model. Then, multiple convolutional layers of the model are processed in order from local to global. Shallow convolutional kernels are responsible for capturing small abrupt changes in individual parameters within a short time window, while deep convolutional kernels combine this local information to identify coordinated anomalous changes among multiple parameters over a larger time span. For example, they can identify burst patterns where the frequency of connection requests and the number of anomalous signaling occurrences highly overlap in time. Finally, after processing by all layers, the model outputs a feature vector that condenses such spatiotemporal correlation patterns.

[0072] In practical applications, for example, a spectrum describing five signaling parameters of enterprise account A within 60 seconds is input into the model. One shallow convolutional kernel in the model may detect a spike in the connection request rate parameter at the 10th second, while another convolutional kernel may find an increase in abnormal signaling parameters around the same second. Subsequently, in deeper network layers, the model will associate these two temporally adjacent local anomalies and determine that they conform to a "burst connection accompanied by abnormal signaling" pattern. The final output spatiotemporal correlation feature vector encodes this composite pattern information.

[0073] Step 1042: Through the fully connected layer of the convolutional neural network model, a preset set of abnormal patterns is matched based on the spatiotemporal correlation features. When the matching result is that the spatiotemporal correlation features match at least one pattern in the set of abnormal patterns, the target abnormal pattern is identified.

[0074] In step 1042, the preset abnormal pattern set can refer to a signaling feature template library of various typical SMS malicious mass sending behaviors obtained by training through historical malicious traffic samples, such as the "device fast power on / off mass sending" template or the "distributed low-rate penetration" template.

[0075] In this embodiment, firstly, the fully connected layer receives the spatiotemporal correlation feature vector extracted by the convolutional layer. Then, through a series of linear and nonlinear calculations, the feature vector is projected into a classification probability space, where each output neuron corresponds to a specific pattern prototype in the abnormal pattern set. Then, the matching degree between the feature vector and each pattern prototype is calculated. Finally, when the highest probability value exceeds the set judgment threshold, the current signaling behavior is considered to match the pattern prototype corresponding to the high probability, thereby determining and identifying the pattern prototype as the target abnormal pattern.

[0076] In practical applications, firstly, the fully connected layer of the model receives the spatiotemporal correlation feature vector output in step 1041; then, the fully connected layer calculates the similarity between this vector and multiple internally stored "standard" anomaly pattern feature vectors one by one. For example, the cosine similarity with "standard pattern 1" is calculated to be 0.92, while the similarity with "standard pattern 2" is 0.45; next, the system compares these two similarity values ​​with a preset judgment threshold of 0.85; since 0.92 is greater than 0.85, the system determines that the current signaling behavior is consistent with "standard pattern 1"; finally, the identified target anomaly pattern is determined to be "standard pattern 1".

[0077] Step 1043: Determine the threat level information that matches the target anomaly pattern through the matching layer of the convolutional neural network model.

[0078] In step 1043, the matching layer refers to the fully connected layer and the subsequent Softmax activation function layer in the convolutional neural network used to match the extracted spatiotemporal correlation features with the preset abnormal pattern set. Its internal implementation logic is as follows: the fully connected layer maps the spatiotemporal correlation feature vector into a matching score vector with the same dimension as the number of abnormal patterns, and the Softmax layer converts the vector into a probability distribution, where each probability value represents the confidence that the input time series spectrogram belongs to the corresponding abnormal pattern.

[0079] In this embodiment of the application, after the target abnormal pattern is identified, the matching layer determines its threat level according to a preset mapping rule. This rule usually takes into account the potential harm caused by different attack patterns to the SMS gateway and users. For example, it maps the "intensive" attack pattern that leads to resource exhaustion to the "high" level, while mapping the tentative "low-rate" attack to the "low" level.

[0080] In practical applications, according to preset rules, "Attack Prototype B" is defined as an attack method that may exhaust gateway signaling resources, so its corresponding threat level is "high". After identifying the target abnormal pattern as "Attack Prototype B", the matching layer outputs the threat level information as "high".

[0081] It should be noted that this embodiment does not limit the specific content of the mapping rules, and can be set accordingly according to the actual situation.

[0082] Step 1044: Parse the traffic source identification information from the data source corresponding to the target anomaly pattern in the time series spectrum using the parsing layer of the convolutional neural network model.

[0083] In step 1044, the parsing layer refers to the linear fully connected layer (without activation function or using linear activation) in the convolutional neural network used to extract traffic source identification information from temporal spectrogram metadata. Its internal implementation logic is as follows: the linear layer receives the output features from the front-end convolutional network, directly outputs a real-valued vector corresponding to the traffic source identification encoding dimension through linear transformation, and then maps it to specific traffic source identification information through maximum value index or nearest neighbor search.

[0084] The data source refers to the upstream enterprise account or channel corresponding to the original signaling plane data on which the time series spectrum is based. Since the time series spectrum is associated with a specific traffic source identification information when it is constructed, the data source is not parsed from the image content of the spectrum, but is traced through the metadata fields recorded synchronously when the spectrum is generated.

[0085] In this embodiment, since the time-series spectrogram is generated based on signaling data from a specific traffic source, it is associated with a unique traffic source identifier upon creation. After the model completes analysis and confirms an anomaly, the parsing layer reads the corresponding traffic source identifier information from the spectrogram's metadata or generation log by accessing this binding relationship. The specific implementation process is as follows: First, when constructing the time-series spectrogram, the traffic source identifier information corresponding to the signaling plane data used to generate the spectrogram is stored or associated with the spectrogram file in metadata form. Then, when the convolutional neural network model identifies the target anomaly pattern, the parsing layer reads the metadata fields associated with the spectrogram and extracts the pre-stored traffic source identifier information. Finally, the extracted identifier information is output as the parsing result, thus completing the entire process of parsing the traffic source identifier information from the data source.

[0086] In practical applications, the processing log for generating time series spectrograms explicitly records "Data source: Enterprise account A". When the model determines that the spectrogram has a target abnormal pattern, the parsing layer queries the log to extract the identifier "Enterprise account A" as the traffic source identifier information.

[0087] Step 1045: Output the traffic detection result through the output layer of the convolutional neural network model, based on the threat level information and the traffic source identification information.

[0088] In this embodiment, the output layer assembles the threat level information determined by the matching layer and the traffic source identification information obtained by the parsing layer, supplements the necessary timestamp information, and finally encapsulates it into a structured data object for output.

[0089] In practical applications, the output layer generates a traffic detection result with the following content: traffic source identifier "Enterprise Account A", threat level "high", detection time "2023-10-01, 10:30:00". This result clearly indicates that at the specified time, Enterprise Account A was detected to have high-risk malicious signaling behavior.

[0090] This application utilizes a convolutional neural network specifically designed for signaling malicious pattern recognition to perform deep analysis of time-series spectra, enabling automatic and accurate identification of abnormal behavior patterns related to malicious mass SMS sending at the signaling level. It also assesses the risk level and locates the source of traffic, thus providing crucial gateway-side detection basis for subsequent precise cleaning.

[0091] Step 105: Based on the abnormal feature data and the threat level information, generate a malicious traffic determination result using a sequence recognition model.

[0092] The sequence recognition model can be a deep learning model that integrates a bidirectional recurrent neural network layer and a multi-head attention layer. This model is trained with paired data containing normal SMS messages and known malicious SMS messages. Its function is to learn the complex correlation patterns between abnormal text content and abnormal traffic signaling, and make a comprehensive judgment on whether the traffic is malicious. The malicious traffic judgment result is a binary or multi-class classification conclusion output by the model regarding whether the current SMS traffic is malicious.

[0093] In this embodiment, step 105 includes the following process, such as... Figure 2 As shown: Step 1051: Convert the abnormal feature data into a first feature vector and convert the threat level information into a second feature vector.

[0094] In step 1051, the first feature vector is a mathematical vector representation with a fixed length and numerical range, which is obtained by converting the abnormal feature data containing multiple ratios and position sequences generated in step 102 through an embedding layer or a linear transformation layer, so as to facilitate the processing by a neural network; the second feature vector is a numerical vector obtained by converting the threat level information, which is usually a discrete rank label, output in step 104 through one-hot encoding or a learnable embedding representation.

[0095] In the embodiment of the present application, first, the abnormal feature data is input into a fully connected layer or an embedding layer, and is mapped into a dense vector with a fixed dimension as the first feature vector; at the same time, the threat level information is converted into another vector with the same or compatible dimension through a preset mapping table or an embedding layer as the second feature vector, so as to align the two heterogeneous data in the vector space.

[0096] In practical applications, assume that the abnormal feature data is [0.27, 0.07, 0.27, [5]]. After passing through a linear transformation layer, it is converted into a first feature vector with a length of 8. For example, the vector is [0.1, -0.2, 0.3, 0.05, -0.1, 0.4, 0.0, 0.15]; at the same time, the threat level information "medium" is mapped into a three-dimensional vector [0, 1, 0] through one-hot encoding, and this vector is the second feature vector.

[0097] Step 1052: Concatenate the first feature vector and the second feature vector to form a combined feature vector.

[0098] In step 1052, the combined feature vector is a longer new vector formed by connecting the first feature vector and the second feature vector end to end in the dimension direction. This vector contains information on both text content anomalies and traffic signaling threats.

[0099] In practical applications, the first feature vector [0.1, -0.2, 0.3, 0.05, -0.1, 0.4, 0.0, 0.15] is concatenated with the second feature vector [0, 1, 0] to obtain the combined feature vector [0.1, -0.2, 0.3, 0.05, -0.1, 0.4, 0.0, 0.15, 0, 1, 0].

[0100] Step 1053: Input the combined feature vector into the sequence recognition model, and generate a comprehensive representation vector through the sequence recognition model.

[0101] Among them, the comprehensive representation vector is a discriminative feature vector output after the sequence recognition model deeply encodes and fuses the input combined feature vector, and can comprehensively reflect the correlation strength between text and signaling anomalies.

[0102] Step 1053 may specifically include the following steps: A1: The combined feature vector is encoded by the bidirectional recurrent neural network layer to obtain the encoded feature vector.

[0103] In step A1, the bidirectional recurrent neural network layer can simultaneously consider the forward and backward information of the feature sequence to capture the contextual dependency between text anomaly features and signaling threat features, so that the anomaly judgment in any dimension can refer to the state in another dimension; the encoded feature vector is the feature representation output by this layer that incorporates contextual information.

[0104] It should be noted that this embodiment does not limit the specific structural design of the bidirectional recurrent neural network layer, and can be set accordingly based on the actual situation.

[0105] In this embodiment, the combined feature vector is regarded as a feature sequence input to a bidirectional recurrent neural network layer. The layer first processes the sequence from the forward and backward directions respectively to obtain the forward hidden state and the backward hidden state at each position. Then, the forward and backward hidden states corresponding to each position are concatenated or summed to form the final encoded feature vector.

[0106] In practical applications, assuming the combined feature vector has a length of 11, it is used as a sequence input into a bidirectional recurrent neural network layer with 16 hidden units. After the network performs forward and backward computations, it generates a forward 16-dimensional vector and a backward 16-dimensional vector for each feature in the sequence. The two are concatenated to obtain a 32-dimensional vector at each position. The final output encoded feature vector is the sequence of this 32-dimensional vector, or the vector at the last time step can be taken as the encoded feature vector of the entire sequence.

[0107] A2: Through the multi-head attention layer, attention weight coefficients are assigned to each feature dimension of the encoded feature vector corresponding to the first feature vector and the second feature vector, and the encoded feature vector is adjusted based on the weight coefficients to generate a comprehensive representation vector.

[0108] In step A2, the multi-head attention layer in this application is used to model the dynamic interaction importance between text anomaly features and signaling threat features, that is, to determine whether, in the current context, text content anomalies are more suspicious or the threat level of traffic signaling is more decisive; the weight coefficients reflect this importance allocation. Adjustment refers to weighted fusion or transformation of the encoded feature vector according to the calculated weights; the comprehensive representation vector refers to the fixed-dimensional feature vector output by the sequence recognition model after deep encoding and fusion of the combined feature vectors, which reflects the correlation strength between text anomalies and signaling anomalies. Its dimension is determined by the output dimension of the fully connected layer of the model, for example, 64 dimensions, with values ​​in the real number domain. Usually, after normalization, the values ​​of each dimension are in the range of [-1, 1] or [0, 1].

[0109] In this embodiment, the encoded feature vector is first input as the query, key, and value into a multi-head attention layer. The attention mechanism calculates the similarity between the query and the key and assigns different attention weight coefficients to different parts of the encoded feature vector, including the parts corresponding to the first and second feature vectors. Then, the value vector is weighted and summed according to these weight coefficients to obtain a new vector representation that focuses on key information. Finally, the outputs from multiple attention heads are concatenated and linearly transformed to generate the final comprehensive representation vector.

[0110] In practical applications, the encoded feature vector is input into a multi-head attention layer with four attention heads. Each attention head independently calculates a set of weight coefficients. For example, the weight coefficients calculated by one head show that the encoded features that have the greatest impact on the final judgment mainly come from the original first feature vector, while the weights of another head show that the signaling threat features are more critical. The outputs of the four heads are concatenated and passed through a linear layer to finally generate a 64-dimensional comprehensive representation vector.

[0111] Step 1054: Compare the comprehensive representation vector with the preset judgment threshold, and generate a malicious traffic judgment result based on the comparison result.

[0112] In step 1054, the preset judgment threshold is a scalar value determined by performance optimization on the validation set (such as maximizing the F1 score) during the model training phase. Its value range is consistent with the output range of the comprehensive representation vector after mapping through a fully connected layer. For example, after mapping by the Sigmoid function, it is in the interval [0, 1]. The comparison method with the comprehensive representation vector is to first map the comprehensive representation vector into a single scalar score through a fully connected layer, and then compare the score with the threshold scalar value. In this embodiment, the value of the preset judgment threshold is not specifically limited, and can be set according to the actual situation.

[0113] In this embodiment, the comprehensive representation vector is first mapped to a scalar score or a probability value through a fully connected layer; then, the score or probability value is compared with a preset judgment threshold; if the score is higher than the threshold, a judgment result of "malicious traffic" is generated, otherwise a judgment result of "non-malicious traffic" is generated.

[0114] In practical applications, the comprehensive representation vector is converted into a probability value between 0 and 1, such as 0.89, through a fully connected layer and a sigmoid activation function. With a preset judgment threshold of 0.5, since 0.89 is greater than 0.5, the result of generating a malicious traffic judgment is "yes".

[0115] This application utilizes a sequence recognition model to deeply fuse and correlate textual anomaly features with traffic signaling threat information, enabling a dynamic balance of the importance of two different dimensions of evidence. This results in a more accurate and robust final determination of malicious traffic, reducing the possibility of misjudgment or missed judgment that may result from single-dimensional detection.

[0116] Step 106: Based on the malicious traffic determination result and the traffic source identification information, generate a corresponding cleaning instruction. The cleaning instruction is used to instruct the network access location corresponding to the traffic source identification information to perform a corresponding cleaning operation on the SMS traffic to be processed.

[0117] Among them, the cleaning instruction can be a structured control command used to instruct specific network elements on the gateway side to apply predetermined access control or filtering policies to SMS traffic from a specific source; the network access location refers to the logical or physical interface through which the traffic source (such as an enterprise account) accesses the SMS gateway.

[0118] In this embodiment, step 106 includes the following process: Step 1061: When the malicious traffic determination result indicates that the SMS traffic to be processed is malicious traffic, the traffic source to be cleaned is determined according to the traffic source identification information and a cleaning instruction is generated. The cleaning instruction includes the cleaning start time, cleaning stop time and traffic filtering conditions for the traffic source.

[0119] In step 1061, the traffic source to be cleaned refers to the upstream enterprise account or channel that is identified as a malicious traffic source and requires traffic control. Its identifier is directly derived from the traffic source identifier information output in step 1054. The cleaning start time refers to the absolute or relative time at which the traffic cleaning operation begins, the cleaning stop time refers to the absolute or relative time at which the cleaning operation ends, and the traffic filtering conditions refer to the specific filtering and processing rules applied to the SMS traffic sent by the traffic source to be cleaned.

[0120] In this embodiment of the application, the malicious traffic determination result is first checked. If the determination result is "it is malicious traffic", the traffic source identification information accompanying the determination result is extracted, and the traffic source corresponding to the identification is determined as the traffic source to be cleaned. Then, based on a preset strategy or real-time calculation, a cleaning instruction is generated for the traffic source to be cleaned, which includes three core fields: cleaning start time, cleaning stop time, and traffic filtering conditions. The cleaning start time is usually set to the current time or a very short delay time, while the cleaning stop time is set according to the duration of historical attack patterns or the results of dynamic risk assessment. The traffic filtering conditions may include "blocking all SMS signaling" or "limiting the number of SMS messages sent per unit time".

[0121] In practical application, if the malicious traffic determination result is "yes", the traffic source identification information is "enterprise account A", and the preset cleaning strategy is: perform a 5-minute policy cleaning on high-risk accounts, with the filtering condition being "the maximum number of SMS messages allowed per minute is 10", then the specific content of the generated cleaning instruction is: the source of the traffic to be cleaned is "enterprise account A", the cleaning start time is "2023-10-01, 10:35:00", the cleaning stop time is "2023-10-01, 10:40:00", and the traffic filtering condition is "rate limit: 10 messages / minute".

[0122] Step 1062: Send the cleaning instruction to the gateway control device corresponding to the traffic source identification information. The gateway control device processes the SMS traffic from the traffic source using the traffic filtering conditions within a specified time interval according to the cleaning start time and the cleaning stop time.

[0123] In step 1062, the gateway control device refers to a physical or virtual network element deployed in the SMS gateway that is capable of performing policy control and management on the access enterprise traffic, such as a dedicated policy enforcement point or gateway interface controller.

[0124] In this embodiment, the cleaning instruction generated in step 1061 is first sent to the gateway control device responsible for managing the traffic source through a preset communication interface or signaling channel. Then, after receiving the instruction, the gateway control device parses each field and sets a time window for the policy to take effect based on the cleaning start time and cleaning stop time. Finally, within the time window, the gateway control device checks all SMS traffic from the traffic source to be cleaned in real time and applies the rules defined in the traffic filtering conditions to perform discarding, rate limiting, or redirection operations on SMS messages that meet the filtering conditions.

[0125] In practical applications, the cleaning command is sent to the gateway controller responsible for managing enterprise account A through a dedicated interface. After receiving the command, the controller parses the start time "10:35:00" and stop time "10:40:00", as well as the filtering condition "10 messages / minute". Then, starting from 10:35:00, the controller counts the SMS messages from enterprise account A. When the number of SMS messages from base station X exceeds 10 within one minute, the controller discards the excess SMS data packets until the time window ends at 10:40:00, at which point the filtering policy automatically expires.

[0126] This application combines accurate malicious traffic determination results with source traffic identifiers to generate cleaning instructions with clear objectives, time ranges, and operational strategies, and issues them to the gateway-side control device for execution. This achieves accurate, timely, and bounded source suppression of malicious SMS traffic, thereby minimizing the impact on normal business operations while cleaning up malicious traffic.

[0127] Figure 3 This is a schematic diagram of the structure of a real-time detection and cleaning system for malicious traffic from an SMS gateway, as provided in an embodiment of this application. Figure 3 As shown, the system includes: The acquisition module 31 is used to acquire signaling plane data and user plane data of the SMS traffic to be processed.

[0128] The parsing module 32 is used to parse the SMS text content from the user plane data and generate abnormal feature data based on the SMS text content.

[0129] The processing module 33 is used to process the signaling plane data to extract the signaling parameter set, and construct a time-series spectrum based on the signaling parameter set.

[0130] The identification module 34 is used to input the time series spectrum into the convolutional neural network model, analyze the time series spectrum through the convolutional neural network model to identify the target abnormal pattern, and generate traffic detection results based on the target abnormal pattern. The traffic detection results include threat level information and traffic source identification information. The traffic source identification information is used to uniquely identify the upstream enterprise account or channel that initiated the SMS traffic.

[0131] The generation module 35 is used to generate a malicious traffic determination result based on the abnormal feature data and the threat level information using a sequence recognition model.

[0132] The cleaning module 36 is used to generate a corresponding cleaning instruction based on the malicious traffic determination result and the traffic source identification information. The cleaning instruction is used to instruct the network access location corresponding to the traffic source identification information to perform a corresponding cleaning operation on the SMS traffic to be processed.

[0133] The SMS gateway malicious traffic real-time detection and cleaning system of this application embodiment is used to implement the aforementioned SMS gateway malicious traffic real-time detection and cleaning method. Therefore, the specific implementation of the SMS gateway malicious traffic real-time detection and cleaning system can be found in the embodiment section of the SMS gateway malicious traffic real-time detection and cleaning method above. The specific implementation can be referred to the description of the corresponding embodiment, and will not be repeated here.

[0134] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of the SMS gateway malicious traffic real-time detection and cleaning method described above.

[0135] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described methods for real-time detection and cleaning of malicious traffic from a SMS gateway.

[0136] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0137] The embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the embodiments of the real-time detection and cleaning method for malicious traffic of SMS gateways described above.

[0138] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0139] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0140] The above provides a detailed description of a method and system for real-time detection and cleaning of malicious traffic on a SMS gateway, as provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for real-time detection and cleaning of malicious traffic on an SMS gateway, characterized in that, include: Collect signaling plane and user plane data of the SMS traffic to be processed; The SMS text content is parsed from the user plane data, and abnormal feature data is generated based on the SMS text content; The signaling plane data is processed to extract the signaling parameter set, and a time-series spectrum is constructed based on the signaling parameter set; The time-series spectrogram is input into a convolutional neural network model, which analyzes the time-series spectrogram to identify target anomaly patterns. Based on the target anomaly patterns, traffic detection results are generated. The traffic detection results include threat level information and traffic source identification information. The traffic source identification information is used to uniquely identify the upstream enterprise account or channel that initiated the SMS traffic. Based on the abnormal feature data and the threat level information, a malicious traffic determination result is generated using a sequence recognition model. Based on the malicious traffic determination result and the traffic source identification information, a corresponding cleaning instruction is generated. The cleaning instruction is used to instruct the network access location corresponding to the traffic source identification information to perform a corresponding cleaning operation on the SMS traffic to be processed.

2. The method according to claim 1, characterized in that, The step of generating a malicious traffic determination result using a sequence recognition model based on the abnormal feature data and the threat level information includes: The abnormal feature data is converted into a first feature vector, and the threat level information is converted into a second feature vector; The first feature vector and the second feature vector are concatenated to form a combined feature vector; The combined feature vector is input into the sequence recognition model, and a comprehensive representation vector is generated through the sequence recognition model. The comprehensive representation vector is compared with a preset judgment threshold, and a malicious traffic judgment result is generated based on the comparison result.

3. The method according to claim 2, characterized in that, The sequence recognition model includes a bidirectional recurrent neural network layer and a multi-head attention layer; The step of generating a comprehensive representation vector through the sequence recognition model includes: The combined feature vector is encoded by the bidirectional recurrent neural network layer to obtain the encoded feature vector; Through the multi-head attention layer, attention weight coefficients are assigned to each feature dimension of the encoded feature vector corresponding to the first feature vector and the second feature vector, and the encoded feature vector is adjusted based on the weight coefficients to generate a comprehensive representation vector.

4. The method according to claim 1, characterized in that, The step of inputting the time-series spectrogram into a convolutional neural network model, analyzing the time-series spectrogram through the convolutional neural network model to identify target anomaly patterns, and generating traffic detection results based on the target anomaly patterns includes: The temporal spectrogram is input into a convolutional neural network model, and features are learned from the temporal spectrogram through multiple convolutional layers of the convolutional neural network model to obtain spatiotemporal correlation features. Through the fully connected layer of the convolutional neural network model, a preset set of abnormal patterns is matched based on the spatiotemporal correlation features. When the matching result is that the spatiotemporal correlation features match at least one pattern in the set of abnormal patterns, the target abnormal pattern is identified. The threat level information matching the target anomaly pattern is determined through the matching layer of the convolutional neural network model. The traffic source identification information is extracted from the data source corresponding to the target anomaly pattern in the time series spectrum through the parsing layer of the convolutional neural network model. Based on the threat level information and the traffic source identification information, the output layer of the convolutional neural network model outputs the traffic detection result.

5. The method according to claim 1, characterized in that, The generation of abnormal feature data based on the SMS text content includes: Determine multiple character categories in the SMS text content, including numeric character categories, a first symbol character category, and a second symbol character category; Count the number of first characters belonging to the first symbol character category, the number of second characters belonging to the second symbol character category, and the number of third characters belonging to the number character category in the text message content; Calculate the first ratio, second ratio, and third ratio of the number of the first character, the second character, and the third character to the total number of characters in the SMS text content, respectively; Identify Chinese characters belonging to a preset set of uncommon characters in the text message content, and record the position index of each Chinese character in the text message content to form a position index sequence; Based on the first ratio, the second ratio, the third ratio, and the location index sequence, abnormal feature data is generated.

6. The method according to claim 1, characterized in that, The process of processing the signaling plane data to extract a signaling parameter set, and constructing a time-series spectrogram based on the signaling parameter set, includes: Extract multiple signaling records from the same traffic source identification information within a specified time window from the signaling plane data; The number of first-type signaling requests, the number of second-type signaling requests, and the number of third-type signaling occurrences of the multiple signaling records within a unit of time are counted to form a subset of the first parameter. The length information of the signaling messages and the encoding order information of the signaling types in the multiple signaling records are parsed to form a subset of the second parameters; The first subset of parameters is combined with the second subset of parameters to obtain the signaling parameter set; A time-series spectrum is plotted with time on the horizontal axis and each parameter in the signaling parameter set on the vertical axis.

7. The method according to claim 1, characterized in that, Based on the malicious traffic determination result and the traffic source identification information, a corresponding cleaning instruction is generated. The cleaning instruction is used to instruct the network access location corresponding to the traffic source identification information to perform a corresponding cleaning operation on the SMS traffic to be processed, including: When the malicious traffic determination result indicates that the SMS traffic to be processed is malicious traffic, the traffic source to be cleaned is determined according to the traffic source identification information and a cleaning instruction is generated. The cleaning instruction includes the cleaning start time, cleaning stop time and traffic filtering conditions of the traffic source to be cleaned. The cleaning instruction is sent to the gateway control device corresponding to the traffic source identification information. The gateway control device processes the SMS traffic from the traffic source to be cleaned within a specified time interval according to the cleaning start time and the cleaning stop time, applying the traffic filtering conditions.

8. A real-time detection and cleaning system for malicious traffic on SMS gateways, characterized in that, include: The data acquisition module is used to collect signaling plane data and user plane data of the SMS traffic to be processed. The parsing module is used to parse the SMS text content from the user plane data and generate abnormal feature data based on the SMS text content; The processing module is used to process the signaling plane data to extract the signaling parameter set, and construct a time-series spectrum based on the signaling parameter set; The identification module is used to input the time series spectrum into the convolutional neural network model, analyze the time series spectrum through the convolutional neural network model to identify the target abnormal pattern, and generate traffic detection results based on the target abnormal pattern. The traffic detection results include threat level information and traffic source identification information. The traffic source identification information is used to uniquely identify the upstream enterprise account or channel that initiated the SMS traffic. The generation module is used to generate a malicious traffic determination result based on the abnormal feature data and the threat level information using a sequence recognition model; The cleaning module is used to generate a corresponding cleaning instruction based on the malicious traffic determination result and the traffic source identification information. The cleaning instruction is used to instruct the network access location corresponding to the traffic source identification information to perform a corresponding cleaning operation on the SMS traffic to be processed.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the steps of the SMS gateway malicious traffic real-time detection and cleaning method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the real-time detection and cleaning method for malicious traffic from a SMS gateway as described in any one of claims 1 to 7.

Images