A deep learning driven method for intercepting variant fraud short messages

Abstract

The present application relates to the technical field of fraud short message interception, in particular to a kind of variant fraud short message interception method driven by deep learning.The present application first matches the word segmentation array based on the latest rule base, determines whether to intercept;Further, according to the semantic correlation between the word segmentation in the word segmentation array, the intention normality is obtained;Based on the intention normality, it is determined whether to intercept;Further, if the short message to be analyzed contains a link or a two-dimensional code, upload and simulate, statistical analysis and correlation analysis of the behavior of all newly created processes in the simulation environment, combined with the similarity between the webpage opened after the link or the two-dimensional code and the short message content, obtain the system-level behavior normal coefficient;Finally, the network-level behavior, memory-level behavior and system-level behavior normal coefficient are input into the pre-trained neural network to determine whether to intercept, which enhances the recognition ability of homophonic substitution, semantic reconstruction and other hidden techniques, improves the variant fraud short message interception accuracy and reduces the false positive rate.

Description

Technical Field

[0001] This invention relates to the field of fraudulent SMS interception technology, specifically to a deep learning-driven variant of fraudulent SMS interception method. Background Technology

[0002] Variant fraudulent text messages are an upgraded version of traditional fraudulent text messages, characterized by more precise targeting, more realistic disguises, and stronger deceptiveness. These variants utilize various technical means to achieve stealth attacks. Criminals often use fake base stations or number spoofing techniques to impersonate telecom operators, banks, and other institutions, coupled with text messages disguised as delivery or insurance services, to lure victims into clicking links or providing personal information. Simultaneously, malicious program variants spread through text messages, stealing text messages and contact lists, and implanting Trojans to achieve automatic billing or remote control of the phone.

[0003] Traditional rule bases rely on manual keyword annotation, but fraudsters evade detection through homophonic substitution and semantic reconstruction. Existing variant fraudulent text messages have a certain degree of evasion against the detection of preset rule bases, resulting in inaccurate interception of variant fraudulent text messages. Furthermore, for links or QR codes attached to text messages, traditional solutions cannot simulate the system behavior after the user clicks (such as malicious process creation, file tampering, etc.), creating security blind spots. Summary of the Invention

[0004] To address the shortcomings of existing rule-based methods in semantic understanding and their insufficient ability to analyze dynamic link behavior, which leads to low accuracy and high false positive rates in intercepting fraudulent SMS messages, this invention aims to provide a deep learning-driven method for intercepting fraudulent SMS messages. The specific technical solution adopted is as follows: Obtain the word segmentation array of the current SMS to be analyzed, match the word segmentation array based on the latest rule library, and determine whether to block it; If the system is not blocked after matching the rule base, the normality of intent is obtained based on the semantic relevance between the words in the word segmentation array; whether to block is determined based on the normality of intent. If the SMS message to be analyzed contains a link or QR code, it is uploaded to a cloud-based intelligent sandbox. The sandbox simulates clicks and monitors system-level, network-level, and memory-level behaviors. It performs statistical and correlation analysis on the behavior of all newly created processes in the simulated environment to obtain the overall process execution effectiveness coefficient. Based on the similarity between the webpage opened by the link or QR code and the SMS content, combined with the execution effectiveness coefficient, it obtains the system-level behavior normality coefficient. The network-level behavior normality coefficient and memory-level behavior normality coefficient are obtained and input together with the system-level behavior normality coefficient into a pre-trained neural network to determine whether to block the message.

[0005] Furthermore, the method for obtaining the normality of intent includes: Using a pre-trained BERT model, the average pooling vector of all token vectors for each word in the word segmentation array is obtained; the word segmentation vectors are stacked to construct a feature matrix, and the feature matrix is ​​clustered to obtain word segmentation clusters; Based on the semantic relevance between the word segmentation clusters, obtain the logical correlation degree between each word segmentation cluster and other word segmentation clusters; based on the difference between the number of clusters divided and the preset reasonable number, and combined with the proportion of the number of words in the main cluster with the most words, obtain the clustering reasonable coefficient; By combining the clustering rationality coefficients and all the logical correlation degrees, the intent normality is obtained.

[0006] Furthermore, the method for obtaining the logical correlation degree includes: The average of the vectors of all words in the word segmentation cluster is taken as the center vector; the corresponding logical correlation is obtained based on the cosine similarity of the center vectors between different clusters.

[0007] Furthermore, the method for obtaining the clustering rationality coefficient includes: The difference between the number of clusters divided and the preset reasonable number is mapped by the ReLU function, and the reciprocal of the sum of the constant 1 is used as the first factor. The proportion of the number of words in the main cluster to the total number of words in the word segmentation array is used as the second factor. The product of the first factor and the second factor is used as the clustering reasonable coefficient.

[0008] Furthermore, the method for obtaining the operational efficiency coefficient includes: The process information for system-level behavior includes all newly created processes during the monitoring process, recording the process name, file operation data, and runtime of each process; Match all the process names with the latest malicious process signature database to determine whether to block them; If the process is not blocked after matching the malicious process signature database, the runtime anomaly is obtained based on the difference between the runtime of each process and the preset maximum runtime; the file operation anomaly is obtained based on the correlation between the directories of the files operated on during the runtime of each process and the number of files operated on. By combining the runtime anomaly rate and the file operation anomaly rate of each process, a process normality coefficient is obtained and normal processes are marked; based on the proportion of normal processes and the process normality coefficient of all processes, an effective execution coefficient is obtained.

[0009] Furthermore, the method for obtaining the file operation anomaly degree includes: For each process, if an operation file does not have a hierarchical relationship with any other file in the directory hierarchy, it is marked as an abnormal operation file; The sum of the number of files operated on per unit time and the total number of files with abnormal operations is linearly normalized, and the normalization result is used as the file operation abnormality degree.

[0010] Furthermore, the method for obtaining the process normality coefficient includes: After performing a negative correlation mapping on the product of the runtime anomaly degree and the file operation anomaly degree of each process, the mapping result is used as the process normality coefficient of the corresponding process.

[0011] Furthermore, the method for obtaining the operational efficiency coefficient based on the proportion of normal processes and the process normality coefficient of all processes includes: The effective running coefficient is obtained by combining the proportion of normal processes to the total number of processes and the average of the normal process coefficients of all processes.

[0012] Furthermore, the method for obtaining the system-level behavior normality coefficient includes: Extract keywords from the opened webpage to construct a webpage keyword set; obtain the hyponym set of the word segmentation array; when the word segmentation in the hyponym set is the same as the word segmentation in the webpage keyword set, determine that the corresponding word segmentation in the word segmentation array is a matching word segmentation; By combining the proportion of the matched word segment in the word segmentation array to the total number of words in the word segmentation array, and the effective operation coefficient, a system-level normal behavior coefficient is obtained.

[0013] Furthermore, when the cloud-based intelligent sandbox analyzes a link or QR code for the first time, it stores the interception judgment result in the interception information database; when the cloud-based intelligent sandbox receives a request to be analyzed for the first time, it directly outputs the interception judgment result from the interception information database.

[0014] The present invention has the following beneficial effects: This invention first matches the word segmentation array based on the latest rule base to determine whether to block, avoiding in-depth analysis of each SMS message. It then further determines whether to block based on the semantic correlation between words within the segmentation array, identifying variant fraudulent SMS messages that are not matched by the rules but have abnormal semantic structures. Next, it uploads and simulates SMS messages containing links and QR codes, statistically analyzing the behavior of all newly created processes in the simulated environment to obtain the overall process's operational effectiveness coefficient, quantifying the process's operational effectiveness. Then, it analyzes the similarity between the webpage opened by the link or QR code and the SMS content to obtain the consistency between the SMS theme and the webpage theme, obtaining a system-level behavior normality coefficient, providing a basis for the final sandbox monitoring decision on whether to block. Finally, it inputs the normality coefficients of network-level behavior, memory-level behavior, and system-level behavior into a pre-trained neural network to determine whether to block. This solution uses a rule base for rapid initial screening, followed by in-depth judgment based on word segmentation semantic correlation. For SMS messages containing links or QR codes, it uses a cloud-based sandbox simulation and in-depth judgment for blocking, enhancing the ability to identify covert methods, improving the accuracy of blocking variant fraudulent SMS messages, and reducing the false alarm rate. Attached Figure Description

[0015] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A flowchart illustrating a deep learning-driven variant of a fraudulent SMS interception method provided in one embodiment of the present invention; Figure 2 A flowchart illustrating a method for obtaining intent normality according to an embodiment of the present invention; Figure 3 This is a flowchart of a method for obtaining an effective coefficient of operation, provided as an embodiment of the present invention. Detailed Implementation

[0017] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a deep learning-driven variant of the fraudulent SMS interception method proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0019] The following description, in conjunction with the accompanying drawings, details a specific scheme for a deep learning-driven variant of the fraudulent SMS interception method provided by this invention.

[0020] Please see Figure 1 The diagram illustrates a flowchart of a deep learning-driven variant of a fraudulent SMS interception method provided by an embodiment of the present invention, specifically including: Step S1: Obtain the word segmentation array of the current SMS to be analyzed, match the word segmentation array based on the latest rule library, and determine whether to block it.

[0021] First, the current SMS message to be analyzed is segmented into words to obtain a segmentation array. In a preferred embodiment of the present invention, the Jieba segmentation tool is used for segmentation processing.

[0022] First, the traditional rule-based interception method is adopted, which matches the word segmentation array with the latest rule base. If a known high-risk keyword is matched, it is directly intercepted. This avoids the need to start time-consuming deep semantic analysis and sandbox simulation for each SMS, which greatly saves system computing resources and reduces the overall response latency.

[0023] It should be noted that for SMS blocking, the variant of the fraudulent SMS blocking function can be directly built into the system's SMS application. Users authorize the activation of the blocking function, and only SMS messages deemed "safe" will be passed to the upper-level application (such as the SMS app) and notified to the user. SMS messages deemed malicious will be directly placed in the "Block Box" or "Spam Box," and will not be notified to the user's default SMS inbox, thus being blocked before being received. It can also be built into a third-party security app, which can be set to monitor in the background after user authorization and pop up a warning window when blocking; it can also be set to allow users to actively paste text message content and block it after receiving it; among them, text content is only analyzed locally, and links or QR codes are anonymized and encrypted during transmission to ensure that user text message content is not misused and to protect user privacy; the app needs to update the required rule library regularly.

[0024] Implementers can also make adjustments according to actual needs. The method of obtaining SMS messages is not the focus of this solution and will not be elaborated further.

[0025] Step S2: If the matching rule base is not blocked, obtain the intent normality based on the semantic correlation between words in the word segmentation array; determine whether to block based on the intent normality.

[0026] Because fraudsters evade detection through homophonic substitution and semantic reconstruction, traditional rule-based interception methods may be bypassed, but this leads to shifts in character / word-based features and pre-trained semantic vectors. Semantic reconstruction disrupts the original contextual co-occurrence relationships and semantic dependencies by inserting, replacing, or rearranging word order. Therefore, after a rapid initial judgment based on rule-based matching, the normality of intent is obtained based on the semantic correlation between words in the word segmentation array. Whether to block is determined based on the normality of intent. This can identify variant fraudulent text messages that are not matched by the rules but have abnormal semantic structures, thereby improving recall and reducing false negatives.

[0027] Preferably, in one embodiment of the present invention, please refer to Figure 2 The flowchart illustrates a method for obtaining intent normality according to an embodiment of the present invention, specifically including: Step S201: Using a pre-trained BERT model, obtain the average pooling vector of all token vectors for each word in the word segmentation array; stack the word segmentation vectors to construct a feature matrix, and cluster the feature matrix to obtain word segmentation clusters.

[0028] BERT typically uses sub-word segmentation for Chinese, and the same "segmentation" may correspond to multiple tokens. Average pooling of these token vectors yields a fixed-dimensional semantic vector for the segmented word, serving as its semantic representation. This provides a unified and robust representation of the actual word's semantics, preserving contextual semantic information while eliminating inconsistencies caused by sub-word segmentation. It also serves as the basis for analyzing semantic relevance between segments, providing stable input for subsequent clustering and similarity calculations. The vectors of each word in the text message are stacked into a matrix as rows (or columns). These vectors are then clustered based on the similarity of the vector space (such as K-means, spectral clustering, hierarchical clustering, etc.). Segments that are semantically similar are clustered together to facilitate the measurement of the "semantic composition" of the text message from a structural level. This method is particularly sensitive to detecting semantic breaks or abnormal distributions (variant methods).

[0029] As an example, the silhouette coefficient method is used to determine the optimal number of clusters M, and the K-means algorithm is used for clustering.

[0030] Among them, the pre-trained BERT model is a well-known deep bidirectional Transformer language model in the field, and the silhouette coefficient method and K-means clustering algorithm are also well-known techniques, which will not be elaborated here.

[0031] Step S202: Based on the semantic relevance between word segmentation clusters, obtain the logical correlation between each word segmentation cluster and other word segmentation clusters; based on the difference between the number of divided clusters and the preset reasonable number, and combined with the proportion of the number of words in the main cluster with the most words, obtain the clustering reasonable coefficient.

[0032] Analyzing the semantic relationships between clusters can reflect the strength of the connection between themes or semantic units within a text message. Therefore, obtaining the logical relevance can capture whether a reasonable semantic chain is formed between semantic modules in the text message (e.g., "bank → balance → please log in" forms a strong logical relationship). However, variant techniques (reconstruction or word insertion) can weaken or distort these reasonable relationships. Thus, the logical relevance can serve as an important signal for identifying abnormal intent. Furthermore, considering that SMS messages generally contain several thematic units, the proportion of the cluster with the most word segments is used to evaluate whether the cluster distribution is reasonable. If there are too many clusters and no obvious main cluster, it indicates that the semantics have been alienated / fragmented. Therefore, a clustering reasonableness coefficient is obtained to distinguish between normal SMS messages that are "semantically clear and have a main theme" and suspicious SMS messages that have been replaced by homophones, inserted noise, or rearranged, resulting in semantic fragmentation. This reduces misjudgments / missed judgments based solely on the number of clusters or solely on similarity.

[0033] As an example, the average of the vectors of all words in a word segmentation cluster is taken as the center vector, which serves as the representative vector of the semantic cluster, facilitating inter-cluster comparisons and subsequent calculations of logical relevance. Considering that the higher the cosine similarity between vectors, the higher the similarity, the logical association degree is obtained based on the cosine similarity of the center vectors between different clusters. The cosine similarity is used to measure the similarity in the direction of the center vectors of two clusters. The larger the value, the more consistent the two clusters are in the semantic space direction.

[0034] In this process, cosine similarity is linearly normalized in the corresponding data dimension to adjust the range of logical correlation.

[0035] Considering that a larger number of clusters indicates severe semantic fragmentation and a smaller clustering rationality coefficient, the difference between the number of clusters and the preset reasonable number is mapped by the ReLU function, and the reciprocal of the sum of the constant 1 is used as the first factor to gradually penalize the number of clusters that exceeds the reasonable range, but no penalty is imposed on the number of clusters that is less than or equal to the reasonable number (the factor remains at 1). The proportion of the number of words in the main cluster to the total number of words in the word segmentation array is used as the second factor. The higher the proportion, the more obvious the main semantic content of the text message. The product of the first factor and the second factor is used as the clustering rationality coefficient.

[0036] The preset reasonable number is taken as an empirical value of 2. In other embodiments of the present invention, the implementer can adaptively adjust the preset reasonable number according to the number of characters. For example, every 40 characters may contain a topic. The implementer can adjust it by dividing the number of SMS characters by 40 and rounding the quotient up as the preset reasonable number.

[0037] Step S203: Combine the clustering rationality coefficient and all logical correlations to obtain the intent normality.

[0038] As an example, the product of the average of all logical correlations and the clustering rationality coefficients is then linearly normalized in the corresponding data dimension, and the normalization result is used as the intent normality, thus realizing a multi-dimensional and comprehensive evaluation of the SMS intent normality.

[0039] The normality threshold is set to 0.3. When the normality of the intent is less than the normality threshold, the new SMS message is considered to have a high degree of intent abnormality and is therefore blocked. The normality threshold can be adjusted according to actual needs. The higher the normality threshold, the stricter the blocking.

[0040] In another embodiment of the invention, the method can be further configured such that: when the intent normality is less than the normality threshold, if the new SMS message does not contain a link or QR code information, the new SMS message is blocked. If the new SMS message contains a link or QR code information, then a simulated operation process needs to be performed in a smart sandbox.

[0041] Step S3: If the SMS message to be analyzed contains a link or QR code, it is uploaded to the cloud-based intelligent sandbox. The intelligent sandbox simulates clicks and monitors system-level, network-level, and memory-level behaviors. It performs statistical and correlation analysis on the behavior of all newly created processes in the simulated environment to obtain the overall process's operational effectiveness coefficient. Based on the similarity between the webpage opened by the link or QR code and the SMS content, combined with the operational effectiveness coefficient, it obtains the system-level behavior normal coefficient. It obtains the network-level behavior normal coefficient and the memory-level behavior normal coefficient, and inputs them, along with the system-level behavior normal coefficient, into a pre-trained neural network to determine whether to block the message.

[0042] Variant fraudulent text messages may also contain links or QR codes. Semantic analysis and traditional rule bases cannot identify the risks within these messages. Therefore, if a text message contains links or QR codes, it is uploaded to a cloud-based intelligent sandbox. This sandbox uses hardware virtualization or operating system-level containers to simulate multiple operating system and browser environments, generating an independent runtime space for each link to ensure malicious code cannot escape. Dynamic behavior monitoring is then performed during the simulated operation. This monitoring includes system-level, network-level, and memory-level behaviors, providing a basis for determining whether a link or QR code is malicious.

[0043] In one embodiment of the present invention, the specific data obtained includes at least: System-level behavior: Records information such as process creation, registry modification, and file operation during the simulation operation.

[0044] Network-level behavior: Records URL requests, DNS resolutions, and data transmission information.

[0045] Memory-level behavior: Records information on operations such as shellcode injection and dynamic code loading in memory.

[0046] It should be noted that since the intelligent sandbox is deployed on a cloud server and is responsible for performing heavyweight, resource-intensive deep behavioral analysis, this is already a well-known technology and will not be elaborated further.

[0047] Considering that malicious links / QR codes may evade static signatures and behavior detection by disguising process names, delaying execution, loading in stages, or performing file operations in atypical directories, it is necessary to conduct statistical and correlation analysis on the behavior of all newly created processes in the simulated environment, obtain the overall process execution effectiveness coefficient, quantify the process execution effectiveness, provide a basis for obtaining the system-level behavior normal coefficient, and ultimately determine whether to block them.

[0048] Preferably, in one embodiment of the present invention, please refer to Figure 3 The flowchart illustrates a method for obtaining operational efficiency coefficients according to an embodiment of the present invention, specifically including: Considering that malicious processes often disguise themselves by using system / browser child process names, employing delayed execution or phased loading of malicious modules to conceal their true intentions, and appearing normal on the surface but triggering abnormal behavior after running for a certain period of time or under specific conditions, the process information for system-level behavior also includes all newly created processes during the monitoring process, recording the process name, runtime file operation data, and runtime of each process; among which the runtime file operation data and runtime correspond to the process behavior statistics.

[0049] Step S301: Match all process names with the latest malicious process signature database to determine whether to block them.

[0050] If a newly created process name matches the latest known malicious process signature database, it can be directly identified as malicious and intercepted, saving resources for subsequent in-depth analysis and reducing response latency.

[0051] Step S302: If the malicious process is not intercepted after matching the malicious process signature database, obtain the runtime anomaly degree based on the difference between the runtime of each process and the preset maximum runtime; obtain the file operation anomaly degree based on the correlation between the directories of the files operated on during the runtime of each process and the number of files operated on.

[0052] Considering that the actual runtime is compared with the "normal maximum runtime" set by experience / strategy, the longer the timeout, the more likely it is to be a malicious behavior that is delayed in triggering or persists for a long time (such as a backdoor waiting for a condition to be triggered, or a ransomware that occupies resources for a long time), it is considered more abnormal, and the runtime abnormality is quantified. As an example, the difference between the running time of each process and the preset maximum running time is used as the independent variable. After mapping through the exponential function exp(x) with the natural constant e as the base, it is then linearly normalized in the corresponding data dimension. The normalization result is used as the running time anomaly.

[0053] It should be noted that, for the preset maximum runtime, first collect a large number (e.g., 5000) of behaviors triggered by legitimate and common SMS links (e.g., links to e-commerce pages, news app downloads, bank website logins, video playback, etc.); then, in a controlled sandbox environment, automatically execute these legitimate links and record the complete runtime of each created process (from startup to exit, or until it enters a background dormant state); the preset maximum runtime is taken as the 95th percentile; implementers can also set fixed empirical values, which will not be elaborated further.

[0054] Furthermore, statistics are collected on the access / modification of files by processes within a unit of time, and it is checked whether these file paths exhibit normal directory hierarchy relationships (parent-child directory relationships or commonly used directories of the same program). If a large number of files being operated on have no hierarchical relationship or do not belong to common program directories, the probability of abnormal file operations is higher, and the degree of abnormality of file operations is quantified.

[0055] As an example, for each process, if an operation file does not have a directory hierarchy with any other file, it is marked as an abnormal operation file; The sum of the number of files operated on per unit time and the total number of files with abnormal operations is linearly normalized, and the normalization result is used as the file operation abnormality degree.

[0056] The files being operated on include the number of files read and written during the process's runtime, as well as files whose hash values ​​have changed; the determination of the hierarchy of file directories is a well-known technique; the analysis process is consistent for each process and will not be elaborated further.

[0057] Step S303: Combine the runtime anomaly and file operation anomaly of each process to obtain the process normality coefficient and mark normal processes; based on the proportion of normal processes and the process normality coefficient of all processes, obtain the runtime effectiveness coefficient.

[0058] The abnormality of process runtime and the abnormality of file operation reflect the degree of abnormality of a process from the perspectives of runtime and file operation, respectively. Therefore, combining the two can quantify the normality of a process and mark normal processes.

[0059] As an example, after negatively mapping the product of the runtime anomaly and file operation anomaly of each process, the mapping result is used as the process normality coefficient of the corresponding process.

[0060] Specifically, negative correlation mapping is performed by taking the reciprocal of the product, and the linear normalization result of the reciprocal of the product in the corresponding data dimension is used as the process normal coefficient. Before taking the reciprocal, a preset positive parameter, such as 0.01, is added to the product.

[0061] The preset normal threshold for a process is set to 0.3. When the normal coefficient of a process is less than the preset normal threshold, it is marked as an abnormal process; otherwise, it is marked as a normal process.

[0062] The preset normal process threshold can also be obtained by pre-collecting a large number (e.g., 5000) of legitimate processes and a portion (e.g., 1000) of malicious processes, obtaining the normal process coefficient of each process, then statistically analyzing the distribution of the normal process coefficients of legitimate and malicious processes, determining the threshold boundary based on the intersection of the two distributions, and obtaining the preset normal process threshold.

[0063] Considering that a higher proportion of normal processes indicates a more stable overall system operation and a lower risk of malicious process penetration; and a higher process normality coefficient for all processes indicates that the running time and file operation behavior of each process are within a reasonable range and the system-level behavior is healthier, the effective operation coefficient can be obtained by considering the proportion of normal processes and the process normality coefficient for all processes. This can comprehensively reflect the overall operational security and process behavior stability of the system under the current sandbox simulation.

[0064] As an example, the effective coefficient of operation is obtained by combining the proportion of normal processes to the total number of processes and the average of the normal coefficients of all processes.

[0065] Specifically, the effective coefficient is the product of the proportion of normal processes to the total number of processes and the mean of the normal coefficient of all processes.

[0066] In other embodiments of the present invention, the implementer may also use a weighted summation method for fusion, which will not be elaborated further.

[0067] Considering the similarity between the webpage opened by the link or QR code and the SMS content, reflecting the consistency between the SMS theme and the webpage theme, for normal SMS links, their purpose is usually clear, and the content opened by the link matches the SMS content relatively well. Therefore, based on the similarity between the webpage opened by the link or QR code and the SMS content, combined with the operational effectiveness coefficient, a system-level behavior normality coefficient is obtained, providing a basis for the final sandbox monitoring to determine whether to block.

[0068] Preferably, in one embodiment of the present invention, the existing TF-IDF algorithm or TextRank algorithm is used to select high-weight keywords from the web page text by calculating word frequency and inverse document frequency or word importance score based on graph model, and form a web page keyword set; Considering that SMS content is often disguised through variations, such as replacing keywords, homophones, or semantically equivalent words to evade interception, resulting in semantic misalignment between the SMS surface word segmentation and the webpage theme, and that these replaced words usually belong to the subordinate semantic category of the original keywords, we adopt a semantic expansion approach for the SMS word segmentation array. By querying a semantic dictionary or using vector similarity retrieval based on a pre-trained language model, we obtain the subordinate word set for each word segment to improve the ability to identify semantically disguised SMS messages. When the word segment in the context word set is the same as the word segment in the webpage keyword set, the corresponding word segment in the word segmentation array is determined to be the matching word segment; Considering that a higher matching word segmentation ratio indicates stronger semantic consistency between SMS and webpage, and more credible link content; and a higher operational effectiveness coefficient indicates stable system operation and no obvious malicious behavior detected in the sandbox simulation environment, the ratio of matching words in the word segmentation array to the total number of words in the word segmentation array is combined with the operational effectiveness coefficient to obtain the system-level behavior normal coefficient.

[0069] As an example, the product of the proportion of matching words in the segmentation array to the total number of words in the segmentation array and the effective coefficient is used as the system-level behavior normal coefficient.

[0070] The proportion of matching words in the word segmentation array to the total number of words in the word segmentation array reflects the similarity between the webpage and the SMS content. The larger the proportion, the higher the similarity.

[0071] In other embodiments of the present invention, the implementer may also use a weighted summation method for fusion, which will not be elaborated further.

[0072] Further obtain network-level and memory-level behavior normality coefficients to provide more decision-making basis.

[0073] In one embodiment of the present invention, a) calculation of the normality of network-level behavior: IP / Domain Reputation Detection: The domain name and IP address in the network request are compared with a malicious IP / domain reputation database synchronized in the cloud. If the domain / IP is on the blacklist, the sub-score is 0; if it is an unknown domain / IP, it is 0.5; if both are on the trusted whitelist, it is 1.

[0074] Port anomaly detection: Calculate the proportion of all network connections whose target port is a non-standard port (e.g., not 80, 443, 8080, 8443). Port normality = 1 - proportion of non-standard port connections.

[0075] The overall network-level behavior normality is calculated by weighting the above two results. For example: network normality = 0.7 × (IP / domain reputation score) + 0.3 × (port normality).

[0076] b) Calculation of the normality of memory-level behavior: Monitor the call sequences of all processes to sensitive APIs and match them against a predefined malicious behavior signature library (such as a typical code injection sequence: VirtualAlloc->WriteProcessMemory->CreateRemoteThread).

[0077] If a complete malicious API call sequence is detected, the memory normality level is recorded as 0; if only scattered sensitive API calls are detected, it is recorded as 0.3; if no related calls are detected, it is recorded as 1.

[0078] Finally, the network-level, memory-level, and system-level behavioral normality coefficients are input into the pre-trained neural network to obtain the final new SMS interception level value. If this value is greater than the interception level threshold of 0.7, the new SMS is intercepted.

[0079] The pre-trained neural network adopts a multilayer perceptron (MLP) structure. The input layer corresponds to the normality coefficients of system-level, network-level, and memory-level behavior. The number of hidden layers can be 2 to 3, each containing 32 to 128 neurons, and using the ReLU activation function. The output layer uses the Sigmoid function to output the interception degree value between 0 and 1.

[0080] During the model training phase, historical sandbox analysis samples were collected, including manually verified normal and malicious links, labeled as 0 and 1 respectively. System-level, network-level, and memory-level behavioral normality coefficients were used as feature inputs, and the model was trained using the cross-entropy loss function.

[0081] After training, the neural network can learn the nonlinear mapping relationship between the three types of behavioral coefficients and malicious risk, thereby quickly outputting the interception level value during the online inference phase.

[0082] It should be noted that the methods used for training neural networks and obtaining network-level and memory-level behavioral normality coefficients are existing technologies. The interception threshold can be adjusted by the implementer and will not be elaborated further.

[0083] It should be noted that when the cloud-based intelligent sandbox analyzes a link or QR code for the first time, it stores the interception judgment result in the interception information database. When the cloud-based intelligent sandbox receives a request to be analyzed for the first time, it directly outputs the interception judgment result from the interception information database, saving computing resources and reducing analysis latency.

[0084] In summary, to address the shortcomings of existing rule-based methods in semantic understanding and the inadequacy of their ability to analyze dynamic link behavior, which leads to low accuracy and high false positive rates in intercepting fraudulent SMS messages, this invention provides a deep learning-driven method for intercepting fraudulent SMS messages. This invention first matches a segmented word array based on the latest rule base to determine whether to intercept. Next, it obtains the intent normality score based on the semantic correlation between segments within the segmented word array. Based on the intent normality score, it determines whether to intercept. If the SMS message to be analyzed contains links or QR codes, it is uploaded and simulated. Behavioral statistics and correlation analysis of all newly created processes in the simulated environment are performed. The similarity between the webpage opened by the link or QR code and the SMS content is combined to obtain a system-level behavioral normality coefficient. Finally, the normality coefficients of network-level behavior, memory-level behavior, and system-level behavior are input into a pre-trained neural network to determine whether to intercept. This solution uses a rule base for rapid initial screening, followed by in-depth judgment based on the semantic correlation of segmented words. For SMS messages containing links or QR codes, a cloud sandbox is used to simulate and monitor system-level, network-level, and memory-level behavior for in-depth judgment and interception, improving the accuracy of intercepting fraudulent SMS messages and reducing the false positive rate.

[0085] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0086] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A variant of a deep learning-driven method for intercepting fraudulent text messages, characterized in that: The method includes: Obtain the word segmentation array of the current SMS to be analyzed, match the word segmentation array based on the latest rule library, and determine whether to block it; If the match rule is not blocked, the semantic correlation between the words in the word segmentation array is used to obtain the intent normality; and the block is determined based on the intent normality. If the SMS message to be analyzed contains a link or QR code, it is uploaded to a cloud-based intelligent sandbox. The intelligent sandbox simulates clicks and monitors system-level, network-level, and memory-level behaviors. It performs statistical and correlation analysis on the behavior of all newly created processes within the simulated environment to obtain the overall process execution effectiveness coefficient. Based on the similarity between the webpage opened by the link or QR code and the SMS content, combined with the execution effectiveness coefficient, it obtains a system-level behavior normality coefficient. The network-level behavior normality coefficient and memory-level behavior normality coefficient, along with the system-level behavior normality coefficient, are input into a pre-trained neural network to determine whether to block the request.

2. The deep learning-driven variant fraud SMS interception method according to claim 1, characterized in that, The method for obtaining the normality of intent includes: Using a pre-trained BERT model, the average pooling vector of all token vectors for each word in the word segmentation array is obtained; the word segmentation vectors are stacked to construct a feature matrix, and the feature matrix is ​​clustered to obtain word segmentation clusters; Based on the semantic relevance between the word segmentation clusters, obtain the logical correlation degree between each word segmentation cluster and other word segmentation clusters; based on the difference between the number of clusters divided and the preset reasonable number, and combined with the proportion of the number of words in the main cluster with the most words, obtain the clustering reasonable coefficient; By combining the clustering rationality coefficients and all the logical correlation degrees, the intent normality is obtained.

3. A variant fraud SMS interception method driven by deep learning according to claim 2, characterized in that, The method for obtaining the logical correlation degree includes: The average of the vectors of all words in the word segmentation cluster is taken as the center vector; the corresponding logical correlation is obtained based on the cosine similarity of the center vectors between different clusters.

4. A variant fraud SMS interception method driven by deep learning according to claim 2, characterized in that, The method for obtaining the clustering rationality coefficient includes: The difference between the number of clusters divided and the preset reasonable number is mapped by the ReLU function, and the reciprocal of the sum of the constant 1 is used as the first factor. The proportion of the number of words in the main cluster to the total number of words in the word segmentation array is used as the second factor. The product of the first factor and the second factor is used as the clustering reasonable coefficient.

5. A variant fraud SMS interception method driven by deep learning according to claim 1, characterized in that, The method for obtaining the operational efficiency coefficient includes: The process information for system-level behavior includes all newly created processes during the monitoring process, recording the process name, file operation data, and runtime of each process; Match all the process names with the latest malicious process signature database to determine whether to block them; If the process is not blocked after matching the malicious process signature database, the runtime anomaly is obtained based on the difference between the runtime of each process and the preset maximum runtime; the file operation anomaly is obtained based on the correlation between the directories of the files operated on during the runtime of each process and the number of files operated on. By combining the runtime anomaly rate and the file operation anomaly rate of each process, a process normality coefficient is obtained and normal processes are marked; based on the proportion of normal processes and the process normality coefficient of all processes, an effective execution coefficient is obtained.

6. A variant fraud SMS interception method driven by deep learning according to claim 5, characterized in that, The method for obtaining the file operation anomaly degree includes: For each process, if an operation file does not have a hierarchical relationship with any other file in the directory hierarchy, it is marked as an abnormal operation file; The sum of the number of files operated on per unit time and the total number of files with abnormal operations is linearly normalized, and the normalization result is used as the file operation abnormality degree.

7. A deep learning-driven variant of the fraudulent SMS interception method according to claim 5, characterized in that, The method for obtaining the process normality coefficient includes: After performing a negative correlation mapping on the product of the runtime anomaly degree and the file operation anomaly degree of each process, the mapping result is used as the process normality coefficient of the corresponding process.

8. A variant fraud SMS interception method driven by deep learning according to claim 5, characterized in that, The method for obtaining the operational efficiency coefficient based on the proportion of normal processes and the normality coefficient of all processes includes: The effective running coefficient is obtained by combining the proportion of normal processes to the total number of processes and the average of the normal process coefficients of all processes.

9. A variant fraud SMS interception method driven by deep learning according to claim 1, characterized in that, The method for obtaining the system-level behavior normality coefficient includes: Extract keywords from the opened webpage to construct a webpage keyword set; obtain the hyponym set of the word segmentation array; when the word segmentation in the hyponym set is the same as the word segmentation in the webpage keyword set, determine that the corresponding word segmentation in the word segmentation array is a matching word segmentation; By combining the proportion of the matched word segment in the word segmentation array to the total number of words in the word segmentation array, and the effective operation coefficient, a system-level normal behavior coefficient is obtained.

10. A deep learning-driven variant of the fraudulent SMS interception method according to claim 1, characterized in that, When the cloud-based intelligent sandbox analyzes a link or QR code for the first time, it stores the interception judgment result in the interception information database; when the cloud-based intelligent sandbox receives a request to be analyzed for the first time, it directly outputs the interception judgment result from the interception information database.

Images