A large model driven cross-platform fraud intelligence sharing and interception system and method

Abstract

This invention discloses a large-model-driven cross-platform fraud intelligence sharing and interception system and method, belonging to the field of communication security technology. It includes a business access layer, a local AI anti-fraud agent, and a consortium intelligence cloud platform. The local AI anti-fraud agent mainly comprises a preprocessing and parsing module, a multi-dimensional deep detection engine, and a risk decision-making and de-identification module. The risk decision-making and de-identification module includes a fusion scoring unit and a structured intelligence generation unit. The fusion scoring unit adopts a weighted fusion strategy, fusing the rule engine score with the large-model semantic confidence score to output a quantitative risk score and risk level. The structured intelligence generation unit converts fraud information into de-identified structured intelligence records. This invention significantly improves the identification accuracy and confidence level against new variants of fraud. It strengthens the cross-platform collaborative defense mechanism, greatly shortens response time, significantly reduces anti-fraud operating costs, and improves review efficiency.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, specifically to a large-scale model-driven cross-platform fraud intelligence sharing and interception system and method. Background Technology

[0002] With the rapid development of mobile internet and communication technologies, telecommunications fraud has evolved into a global problem threatening public property security. Currently, defense technologies against telecommunications fraud are mainly implemented independently by telecommunications operators, internet social platforms, and financial payment institutions. Existing mainstream technologies typically employ a passive defense model of "rule matching + blacklist database," where each platform maintains a local database containing fraudulent phone numbers, malicious IP addresses, phishing URLs, and high-risk keywords. When communication traffic or user behavior triggers specific rules, it intercepts or issues warnings. In practice, common technical measures include matching text features using regular expressions, verifying domain registration time by querying WHOIS information, and frequency control based on fixed thresholds.

[0003] However, existing technologies have significant limitations when facing new and complex fraud methods: (1) The traditional “rules + blacklist” model is slow to react to newly emerging fraudulent tactics. Fraudsters frequently change their “aliases” using technical means, and evade keyword detection by means of domain name disguise (such as multi-level URL redirection), homophone replacement, semantic hints and other methods; and the iteration speed of fraudulent tactics far exceeds the update speed of the rule base.

[0004] (2) The phenomenon of "intelligence fragmentation" across platforms is serious. A complete fraud chain often spans multiple platforms (such as SMS traffic generation, social media brainwashing, and bank APP transfer). Due to the lack of a unified coordination mechanism, data is not shared among various anti-fraud entities such as operators, social media platforms, and banks. Fraudsters often commit crimes across platforms (such as SMS traffic generation -> social media brainwashing -> bank transfer). Due to the lack of coordination, abnormal SMS data intercepted by operators cannot be synchronized with banks or social media platforms in real time, resulting in a serious lag in defense response and the inability to achieve full-chain blocking in the early stages of fraud.

[0005] (3) There is a contradiction between data privacy protection and intelligence sharing. Because users' original communication content (such as SMS messages and chat logs) is highly sensitive and private, direct transmission between different companies is strictly prohibited. This prevents platforms from easily aggregating raw data to jointly train models or analyze cases, creating data silos in anti-fraud efforts. Furthermore, existing systems often rely heavily on manual review for judging suspicious information, which is not only costly to operate but also fails to meet the real-time requirements of massive amounts of data.

[0006] (4) Lack of explainability. Traditional blocking only tells users that they have been blocked without explaining why. Users do not know why they have been blocked, which can easily lead to misunderstandings or even complaints. They also cannot learn anti-fraud knowledge through specific risk warnings.

[0007] Based on this, the present invention designs a large-scale model-driven cross-platform fraud intelligence sharing and interception system and method to solve the above problems. By deeply constructing a collaborative anti-fraud closed loop of "local analysis - de-identification sharing - strategy linkage", it realizes collaborative detection of fraud information, intelligence sharing and dynamic interception strategy distribution among multiple alliance members (such as operators, banks, social platforms, Internet application service providers, etc.). Summary of the Invention

[0008] In view of the above-mentioned shortcomings of the existing technology, the present invention provides a large model-driven cross-platform fraud intelligence sharing and interception system and method.

[0009] To achieve the above objectives, the present invention provides the following technical solution: A large-scale model-driven cross-platform fraud intelligence sharing and interception system, comprising a business access layer, a local AI anti-fraud agent, and an alliance intelligence cloud platform; Business access layer: used to connect with the existing business systems of alliance members, obtain the raw data to be detected, and forward the raw data to the local AI anti-fraud agent; Local AI Anti-Fraud Agent: This layer is deployed in the local private environment of each alliance member; the local AI anti-fraud agent mainly includes a preprocessing and parsing module, a multi-dimensional deep detection engine, and a risk decision and de-identification module; The preprocessing and parsing module is used to clean, standardize, and extract elements from the raw data input from the business access layer. Multi-dimensional deep detection engine: used to comprehensively analyze suspected fraudulent targets from multiple dimensions, including URL, content semantics, and script behavior; The risk decision-making and desensitization module includes a fusion scoring unit and a structured intelligence generation unit. The fusion scoring unit adopts a weighted fusion strategy to fuse the rule engine score with the semantic confidence score of the large model, and outputs a quantitative risk score and risk level. The structured intelligence generation unit converts fraud information into desensitized structured intelligence records. Alliance Intelligence Cloud Platform: This layer is deployed in a cloud environment and is used to aggregate, correlate and analyze structured intelligence from different alliance members and generate dynamic defense strategies. The Alliance Intelligence Cloud Platform only processes anonymized structured intelligence and does not store the original business data.

[0010] Furthermore, the service access layer includes a multimodal access unit, which includes, but is not limited to, an SMS gateway interface, an instant messaging private message interface, and a social platform comment or post collection interface.

[0011] Furthermore, the element extraction refers to extracting key elements through regular expression matching and semantic parsing, including but not limited to: suspected fraudulent URLs, communication account identifiers, terminal identifiers, device fingerprints, and redirection link characteristics.

[0012] Furthermore, the multi-dimensional deep detection engine includes a URL feature analysis unit, a content semantic analysis unit, and a script behavior detection unit; The URL feature analysis unit is used to perform domain name resolution and IP tracing, conduct WHOIS information verification, determine IP geographical location or risk area, and calculate domain name similarity based on edit distance to identify counterfeit domain names and phishing links. The content semantic analysis unit has a built-in lightweight large language model, is configured with prompt word templates for fraudulent rhetoric, identifies intent, and extracts sensitive form features from the page. The script behavior detection unit is used to perform static analysis on webpage source code or page scripts to detect obfuscated or abnormal behavior characteristics.

[0013] Furthermore, the intelligence field set includes, but is not limited to: fraud type tags, data hash values, anonymized communication account / terminal identifier / device fingerprints, URL normalized fingerprints, domain attributes, risk scores, and model confidence levels.

[0014] Furthermore, the alliance intelligence cloud platform includes an intelligence aggregation and correlation analysis module, a dynamic strategy generation module, and a strategy distribution and synchronization module; Among them, the intelligence aggregation and correlation analysis module is used to receive structured intelligence uploaded by various local AI anti-fraud agents and form a fraud intelligence database by associating multi-source clues; The dynamic strategy generation module generates or updates interception strategies based on the aggregated fraud intelligence database, using a search-enhanced generation method. The strategy distribution and synchronization module distributes the latest strategies, feature fingerprints, and model update information to the local AI anti-fraud agents of alliance members through an encrypted channel.

[0015] To better achieve the objectives of this invention, this invention also provides a large-model-driven cross-platform fraud intelligence sharing and interception method, the steps of which are as follows: S1. The local AI anti-fraud agent deployed on the alliance member side performs a full-dimensional risk assessment of the data to be detected on a single platform, specifically including the following steps: S1.1 The local AI anti-fraud agent captures the number of data to be detected through the business access layer of alliance members. according to It then calls a preset toolchain to extract key elements: using regular expression matching and semantic template matching to extract... The text content in the text is used as a text element. ;extract The corresponding sender's platform account has a unique identifier, denoted as the account identifier. ;extract The suspected fraudulent Uniform Resource Locator contained within is denoted as a URL link. ; S1.2, Perform multidimensional parallel analysis logic, including: S1.2.1, URL Feature Analysis Unit Netloc extraction was performed to obtain the domain name. Alternatively, it uses IP addresses; it calculates domain similarity based on edit distance; simultaneously, it calls the API to query IP address location, WHOIS information, and historical risk records. S1.2.2, Parse the HTML source code of the URL to be tested; extract form feature vectors. and script behavior characteristics ; S1.2.3, Large-scale model semantic intent inference, outputting the inferred fraudulent intent. ; S1.3 The fusion scoring unit generates the final risk score through a weighted fusion algorithm. : That middle, and For weighting factors; For semantic analysis risk assessment function; To match the risk assessment function to the rules, For registration age, To assess the similarity of counterfeits; Criteria for determining fraud: If Then determine For fraudulent messages, perform local real-time interception and generate an explainable report; To preset a threshold for determining fraud risk; S2, the local AI anti-fraud agent encapsulates the fraud determination results into structured intelligence. Desensitization processing is performed during the packaging process; S3, each local AI anti-fraud agent will de-identify the structured intelligence. Uploaded to the Alliance Intelligence Cloud Platform; the Alliance Intelligence Cloud Platform uses graph database technology to correlate intelligence from multiple sources; S4, the Alliance Intelligence Cloud Platform, uses the RAG engine to generate real-time defense strategies against new variant scams based on aggregated global intelligence. ; S5 and the Alliance Intelligence Cloud Platform transmit policies via encrypted channels. It is pushed back to the local AI anti-fraud intelligence agents of all members of the alliance.

[0016] Furthermore, extract the form feature vector. The method is as follows: First, use a web page parsing engine to construct the DOM tree from the HTML source code of the URL to be tested. By traversing the DOM tree, accurately locate all... <form>Tags and their nested interactive components; for each located form element, deep probing of its key attributes, sequentially performing type recognition, intent recognition, and text enhancement recognition; mapping the detected discrete features into a fixed-length feature vector, i.e., the form feature vector. : in, , =1 indicates the presence of a password input field. =0 indicates that there is no password input field; , =1 indicates the presence of financially sensitive fields such as bank card numbers and credit card security codes. =0 indicates that there are no financially sensitive fields such as bank card numbers and credit card security codes; , =1 indicates the presence of contact privacy fields such as phone number, ID card number, or email address. =0 indicates that there are no contact privacy fields such as phone number, ID card number, or email address; , =1 indicates that the form submission URL points to a suspicious external domain or is a cross-domain submission. =0 indicates that the form submission address does not point to suspicious external domains or cross-domain submissions; Indicate the submission method; =1 indicates a secure submission method. =0 indicates that sensitive data was submitted using the insecure GET method; Extracting script behavior feature vectors The method is as follows: (1) Abnormal behavior monitoring items detection: confusion avoidance monitoring, automatic jump monitoring, dynamic content injection monitoring; (2) Vectorized modeling: Constructing script behavior feature vectors : in, These represent the frequency or Boolean values ​​of obfuscation avoidance, automatic redirection, and dynamic content injection behaviors on the page, respectively.

[0017] Furthermore, step S1.2.3, large-scale model semantic intent inference, includes the following steps: [The text to be inferred is missing here, likely due to an error in the original text.] white Links to URLs The corresponding webpage text content is used as input and passed to a local private large model deployed based on the Transformer architecture. Intent inference is achieved through RAG technology, and similar cases matching the input content are retrieved from the local fraud script knowledge base using RAG technology. Large model infers fraudulent intent ,Will Automatically mapped to a preset telecom fraud threat framework; .

[0018] Furthermore, the desensitization process uses the SHA-256 hash algorithm to... Encryption is performed using the device fingerprint to obtain an encrypted identifier. Structured intelligence Includes: fraud type tags, URL normalized fingerprints, and final risk score. Criteria for determining fraud.

[0019] Compared to existing technologies, this invention offers the following advantages: 1. It significantly improves the accuracy and confidence level of identifying novel variant scams. This invention utilizes the deep semantic understanding and intent inference capabilities of Large Language Models (LLMs), overcoming the limitations of traditional "keyword filtering" or "fixed rule matching" methods in identifying semantic variants (such as homophones or coded language). Combined with multi-dimensional URL detection technologies (including domain name resolution, similarity algorithms, and webpage script behavior detection), it enables comprehensive analysis of dynamically disguised links and phishing pages, resulting in a qualitative leap in the accuracy of identifying novel scams compared to traditional regular expression matching methods. Furthermore, the inference confidence level generated by the large model is extremely high, providing a solid decision-making basis for subsequent automatic interception.

[0020] 2. Enhanced cross-platform collaborative defense mechanism, significantly shortening response time. This invention, through a "distributed analysis + centralized collaboration" model, effectively solves the long-standing pain point of intelligence fragmentation among telecom operators, social platforms, and financial institutions, achieving a closed-loop anti-fraud system across the entire chain. Based on the intelligence aggregation and real-time distribution functions of the alliance intelligence cloud platform, it enables rapid defense across the entire alliance upon detecting fraud at one point, drastically reducing the interception response time for new fraud variants from the traditional hours to minutes.

[0021] 3. Significantly reduced anti-fraud operational costs and improved review efficiency. This invention achieves a high-proportion accurate initial screening of massive amounts of suspicious information and automated generation of risk control rules through automated algorithms, significantly alleviating the reliance on repetitive manual judgment and greatly reducing the maintenance cost of the rule base. Compared with the traditional purely manual review mode, this solution utilizes the concurrent processing capabilities of a large model to achieve a leapfrog improvement in review efficiency. By advancing and automating the initial screening process, it maximizes the optimization of human resource allocation, enabling enterprises to achieve significant cost reduction and efficiency improvement in complex anti-fraud environments.

[0022] 4. Achieves high standards of privacy compliance and interpretability. This invention adopts a design of "local calculation of raw data and cloud sharing of structured intelligence." The cloud only receives anonymized risk fingerprints and scores, fully complying with privacy protection requirements and avoiding the leakage of sensitive data. Simultaneously, the system utilizes a large model to generate easy-to-understand risk analysis reports, providing users with clear explanations of the causes of risks and fraud prevention suggestions. This not only enhances the system's credibility and protection effectiveness but also serves as a form of fraud prevention education. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0024] Figure 1 This is an architecture diagram of a large-model-driven cross-platform fraud intelligence sharing and interception system according to the present invention. Figure 2 This is a flowchart of a large-model-driven cross-platform fraud intelligence sharing and interception method according to the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0026] Example 1: Please refer to the accompanying drawings in the instruction manual. Figure 1 A large-scale model-driven cross-platform fraud intelligence sharing and interception system, comprising a business access layer, a local AI anti-fraud agent, and an alliance intelligence cloud platform.

[0027] 1. Business Access Layer: This layer serves as the data perception front end of the system, used to connect with the existing business systems of alliance members, obtain the raw data to be detected, and forward the raw data to the local AI anti-fraud intelligent agent.

[0028] The service access layer includes a multimodal access unit, which includes, but is not limited to: 1-1. SMS Gateway Interface: This interface allows you to access SMS text, short links / URLs, sender identifiers, etc. 1-2. Instant Messaging (IM) Private Messaging Interface: Integrates chat text, account identifiers, session metadata, etc.; 1-3. Social media platform comment / post collection interface: Integrate comment or post text, links, image verification codes, or image materials, etc.

[0029] The aforementioned raw data can be unstructured or semi-structured and transmitted to the local AI anti-fraud agent using a standardized protocol.

[0030] 2. Local AI Anti-Fraud Agent: This layer is deployed in the local private environment (private server or controlled cloud) of each alliance member (such as operators, banks, and social platforms), and is the core implementation part of the "data not leaving the domain" principle of this invention. The local AI anti-fraud agent mainly includes a preprocessing and parsing module, a multi-dimensional deep detection engine, and a risk decision and de-identification module.

[0031] 2-1. Preprocessing and parsing module: used to clean, standardize and extract elements from the raw data input by the business access layer.

[0032] After normalizing suspected fraudulent links by denoising, restoring, and standardizing them, a unique digital fingerprint, namely the URL normalization fingerprint, is generated for them.

[0033] Preferably, element extraction refers to extracting key elements through regular expression matching and semantic parsing, including but not limited to: suspected fraudulent URLs, communication account identifiers, terminal identifiers, device fingerprints, and redirection link characteristics.

[0034] 2-2. Multi-dimensional deep detection engine: used to comprehensively analyze suspected fraudulent targets from multiple dimensions such as URL, content semantics and script behavior to form multi-source evidence; the multi-dimensional deep detection engine includes a URL feature analysis unit, a content semantic analysis unit and a script behavior detection unit; 2-2-1. The URL feature analysis unit is used to perform domain name resolution and IP tracing, conduct WHOIS information verification (such as registration duration / abnormal registration information), determine IP geographical location or risk area, and complete domain name similarity calculation based on edit distance (LevenshteinDistance) to identify counterfeit domain names and phishing links; 2-2-2. Content Semantic Analysis Unit: Built-in lightweight large language model (LLM) and configured with prompt word templates (Prompt) for fraudulent scripts, it performs semantic understanding on web page content, SMS text, etc., identifies intentions such as "inducing transfers", "fake investment", "impersonating customer service", and can extract sensitive form features on the page (such as password / card number input boxes). 2-2-3. Script behavior detection unit, used to perform static analysis on web page source code or page scripts, detect obfuscated or abnormal behavior features, and can identify suspicious calls such as eval() and document.write, as well as abnormal jumps and redirection link features.

[0035] 2-3. Risk Decision-Making and De-identification Module: This module integrates multi-dimensional detection results and outputs a risk level, while simultaneously generating shareable de-identified structured intelligence. The Risk Decision-Making and De-identification module includes a fusion scoring unit and a structured intelligence generation unit.

[0036] 2-3-1. The fusion scoring unit adopts a weighted fusion strategy to fuse the rule engine score (URL / IP / script features, etc.) with the semantic confidence score of the large model, and outputs a quantitative risk score and risk level (high / medium / low risk). 2-3-2. The structured intelligence generation unit converts fraudulent information into de-identified structured intelligence records. The intelligence field set includes, but is not limited to: fraud type tags, data hash values, de-identified communication account / terminal identifier / device fingerprint, URL normalized fingerprint, domain attributes, risk score, and model confidence level; and removes or irreversibly de-identifies all original dialogue content and business text involving user privacy. The model confidence level refers to the deterministic score generated by the large language model based on semantic similarity and internal model weights after identifying intent and mapping the threat framework. It reflects the credibility of the judgment conclusion, assists the alliance intelligence cloud platform in intelligence aggregation and risk assessment, and provides quantitative defense reference for the entire alliance. This ensures that while the intelligence possesses high-value detection attributes, it does not contain any reproducible original sensitive personal information.

[0037] Through the above design, the local AI anti-fraud agent achieves a closed loop of "local detection - local judgment - local desensitization", and only reports the desensitized structured intelligence to the alliance intelligence cloud platform.

[0038] 3. Alliance Intelligence Cloud Platform: This layer is deployed in a cloud environment and is used to aggregate, correlate, and analyze structured intelligence from different alliance members to generate dynamic defense strategies. Raw data is processed only on the local AI anti-fraud agents of member units; the Alliance Intelligence Cloud Platform only processes anonymized structured intelligence and does not store raw business data. The Alliance Intelligence Cloud Platform includes an intelligence aggregation and correlation analysis module, a dynamic strategy generation module (RAG engine), and a strategy distribution and synchronization module.

[0039] 3-1. The intelligence aggregation and correlation analysis module is used to receive structured intelligence uploaded by various local AI anti-fraud agents. Using graph computing / correlation analysis technology, it links multi-source clues (such as the propagation trajectory of the same phishing URL on different platforms, and cross-platform crime records of the same device fingerprint) to form a fraud intelligence database to identify cross-platform fraud gangs or fraud variants.

[0040] 3-2. Dynamic Strategy Generation Module (RAG Engine): Based on the aggregated fraud intelligence database, it generates or updates interception strategies using the search-enhanced generation (RAG) method. It prioritizes outputting blacklists (IP / domain / account / device fingerprint digests, etc.), interception rules, standard warning texts, and parameters or prompt templates that can be used for incremental optimization of local models.

[0041] 3-3. The policy distribution and synchronization module distributes the latest policies, feature fingerprints, and optional model update information to the local AI anti-fraud agents of alliance members through an encrypted channel, enabling real-time updates and synchronization of cross-platform defense rules.

[0042] Example 2: Please refer to the accompanying drawings in the instruction manual. Figure 2 This embodiment takes a typical cross-platform "investment inducement" fraud scenario as an example to illustrate in detail the cross-platform fraud intelligence sharing and interception method driven by a large model. The steps are as follows: S1. The local AI anti-fraud agent deployed on the side of alliance members (such as social platforms) performs a full-dimensional risk assessment of the data to be detected on a single platform, specifically including the following steps: S1.1 Raw Data Capture and Feature Extraction: The local AI anti-fraud agent captures the data to be detected through the business access layer of alliance members. according to ( (This includes text and link content received / sent by users within the platform). The preprocessing and parsing module of the local AI anti-fraud agent calls a preset toolchain to extract key elements: using regular expression matching and semantic template matching to extract... The text content in the text is used as a text element. ;extract The corresponding sender's platform account has a unique identifier, denoted as the account identifier. ;extract The suspected fraudulent Uniform Resource Locator contained within is denoted as a URL link. .

[0043] S1.2, Perform multidimensional parallel analysis logic, including: S1.2.1, URL Feature Analysis Unit Netloc extraction was performed to obtain the domain name. Alternatively, it can use IP addresses; it calculates domain similarity based on the Levenshtein Distance; and simultaneously calls the API to query the IP address's location, WHOIS information, and historical risk records.

[0044] Netloc Extraction: It is broken down into protocol, network location, path, etc. Netloc is the obtained domain name. Or IP address.

[0045] Calculate domain name Registration age : Obtain the domain name by calling a third-party domain information query API The registration time is calculated as "the number of days between the current time and the registration time". The value of .

[0046] Counterfeit similarity Calculation method: Based on the edit distance algorithm, using well-known domains of legitimate financial categories pre-stored in the local AI anti-fraud agent. For reference, the calculation formula is as follows: in, for and The Levenshtein distance between them (i.e., the number of character edits). , They are respectively and The length of the characters; The value range is [0,1], and the higher the score, the higher the degree of domain name counterfeiting.

[0047] S1.2.2 Content and Behavioral Feature Recognition: Parse the HTML source code of the URL to be tested; extract form feature vectors. (Detect whether it contains sensitive input fields type="password" and card_number) and script behavior characteristics. (Check for abnormal jumps such as eval() and window.location).

[0048] Among them, extracting form feature vectors The method is as follows: (1) HTML Structured Parsing and Form Location: The system first uses a web page parsing engine (such as BeautifulSoup) to construct a DOM tree from the HTML source code of the URL to be tested. By traversing the DOM tree, it accurately locates all tags and their nested interactive components, and collects data containing... <input> , <textarea>、< / textarea> <select>All input or submittable elements.

[0049] (2) Input field attribute detection and sensitive word matching: For each form element located, the system deeply detects its key attributes such as type, name, id and placeholder, and performs type recognition, intent recognition and text enhancement recognition in sequence.

[0050] Type recognition: Directly retrieve the type attribute. If type="password", it is immediately determined to involve password collection.

[0051] Intent recognition: For input boxes with type="text" or no explicit type, the system performs fuzzy matching on the name and id fields through a preset regular expression library.

[0052] Bank card / financial features: Match keywords such as card_number, bank, credit, cvv, account, etc.

[0053] Identity privacy features: Match keywords such as phone, tel, email, id_card, real_name, etc.

[0054] Text enhancement recognition: Analyze the natural language description in the placeholder attribute (such as "Please enter bank card number") as a supplementary judgment basis for attribute matching.

[0055] (3) Feature vector modeling: The system maps the detected discrete features into a fixed-length feature vector, i.e., the form feature vector: where, , =1 indicates the existence of a password input field, and =0 indicates the absence of a password input field. , =1 indicates the existence of financially sensitive fields such as bank card number and credit card security code, and =0 indicates the absence of financially sensitive fields such as bank card number and credit card security code. , =1 indicates the existence of contact privacy fields such as mobile phone number, ID card number or email address, and =0 indicates the absence of contact privacy fields such as mobile phone number, ID card number or email address. , =1 indicates that the form submission address points to an external suspicious domain or cross-domain submission, and =0 indicates that the form submission address does not point to an external suspicious domain or cross-domain submission. , represents the submission method. =1 is a secure submission method, and =0 is a non-secure GET method for submitting sensitive data.

[0056] Wherein, for the webpage <script>标签内容及内联事件脚本，系统通过正则表达式模式匹配及静态代码分析技术提取脚本行为特征向量，具体包括以下步骤：（1）异常行为监测项检测：混淆规避监测：检测是否包含eval()函数，该函数常用于执行加密或混淆后的恶意代码以规避静态特征扫描。

[0057] 自动跳转监测：检测是否包含对window.location或location.href的非用户触发式赋值，识别潜在的自动重定向风险。

[0058] 动态内容注入监测：监测document.write()行为，识别网页是否在运行时动态插入钓鱼表单或外部脚本。

[0059] （2）向量化建模：构建脚本行为特征向量：其中，每一个分量代表对应异常模式在页面中出现的频次或布尔标记。

[0060] S1.2.3、大模型语义意图推断：将文本要素与URL链接对应的网页文本内容作为输入，传入基于Transformer架构部署的本地私有化大模型，通过RAG（检索增强生成）技术实现意图推断，利用RAG技术从本地诈骗话术知识库（预先构建，包含"诱导投资”类历史诈骗文本、话术特征标签）中检索与输入内容匹配的相似案例。具体包括以下步骤：

[0061] （1）本地诈骗话术知识库的构建与向量化：预先构建一个本地私有化的诈骗话术知识库，其内容涵盖：历史诈骗样本：包括"诱导投资”、"虚假理财”、"冒充官方客服”等高频类别的历史文本语料。为每个样本标注诈骗手法标签、话术特征指纹及对应的威胁模型阶段。利用语义向量模型将知识库中的文本转化为高维向量，并存储于本地向量数据库中。

[0062] （2）基于RAG技术的上下文检索：系统接收待处理的文本要素与URL对应的网页内容，将其融合为查询文本；利用向量编码器将查询文本编码为查询向量，并在本地向量库中通过余弦相似度算法检索与其最匹配的前个相似案例样本：其中，为检索出的关联上下文，包含相似的历史诈骗文本及对应的情报标签。

[0063] （3）意图推断与威胁框架映射：意图推断：系统自动构建针对Transformer架构的大模型优化的指令模板（Prompt），将输入内容与检索到的相似案例进行拼接：指令部分：要求模型识别输入内容属于哪类诈骗。参考部分：提供作为判别依据。约束部分：要求输出标准化的分类结果（含诈骗类型标签）。大模型（包括但不限于DeepSeek、Qwen、GLM、ChatGPT、Gemini、Llama或其他具有同等处理能力的预训练大模型）在本地完成推理计算，输出推断出的诈骗意图：

[0064] 。

[0065] 威胁框架映射：将（如"虚假理财引流”）自动映射至预设的电信诈骗威胁框架（如"信息发布阶段”、"诱导洗脑阶段”）。

[0066] S1.3、融合评分单元通过加权融合算法生成最终风险分值：其中，和为权值因子，满足、且，权值因子可根据不同诈骗场景下语义风险与规则风险的实际占比动态调整。为语义分析风险评估函数：以为输入，输出语义维度风险分值（取值范围[0,1]），分值与诈骗意图的危险程度正相关；为规则匹配风险评估函数：以注册年龄仿冒相似度为输入，对各规则特征进行加权求和，输出规则维度风险分值（取值范围[0,1]）。

[0067] 诈骗判定条件：为预设诈骗风险判定阈值（取值范围[0,1]，可根据场景误拦截率需求设定）。若，本地AI反诈智能体则判定为诈骗信息，执行本地实时拦截，并生成可解释性报告，所述报告包含"高仿域名”"含敏感表单”等风险因子标签及各维度风险的判定依据。

[0068] S2、情报结构化与脱敏处理：本地AI反诈智能体将诈骗判定结果封装为符合联盟规范的结构化情报；在封装结构化情报时，本地智能体提取大模型输出字段中的confidence_score。若该分值大于预设的高置信阈值，则将该条情报标记为高可信级别，以缩短全联盟的响应链条，实现分钟级拦截。

[0069] 封装过程中执行脱敏处理：采用SHA-256哈希算法对及设备指纹进行加密，得到加密标识；结构化情报包含：诈骗类型标签、URL归一化指纹、最终风险分值、诈骗判定条件，不包含用户原始通信内容。

[0070] S3、情报上传与云端关联分析：各本地AI反诈智能体将脱敏后的结构化情报上传至联盟情报云平台。联盟情报云平台利用图数据库技术对多源情报进行关联，识别跨平台团伙。例如，若来自不同平台的多个包含相同的或的归一化指纹，则判定为同一团伙的协同作案链条。

[0071] S4、智能策略更新：联盟情报云平台根据聚合后的全局情报，利用RAG引擎实时生成针对新型变种骗术的防御策略。防御策略包含更新后的诈骗域名 / URL黑名单特征库、新型话术语义向量及跨平台诈骗预警标准模板。

[0072] S5、分发与实时闭环：联盟情报云平台通过加密信道将策略反向推送到全联盟所有成员的本地AI反诈智能体；当本地AI反诈智能体在处理新的待检测数据时，即使该特定变体尚未在本地库中出现，也能依据云端下发的策略在分钟级内实现前瞻性拦截，若匹配防御策略中的特征（如新型话术语义向量、更新后的黑名单特征），则本地AI反诈智能体可直接判定为诈骗信息并执行拦截，实现对新型变种骗术的分钟级前瞻性拦截。

[0073] 以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不会使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。< / script> < / select> < / form>

Claims

1. A large-scale model-driven cross-platform fraud intelligence sharing and interception system, characterized in that, This includes a business access layer, a local AI anti-fraud agent, and an alliance intelligence cloud platform; Business access layer: used to connect with the existing business systems of alliance members, obtain the raw data to be detected, and forward the raw data to the local AI anti-fraud agent; Local AI Anti-Fraud Agent: This layer is deployed in the local private environment of each alliance member; the local AI anti-fraud agent mainly includes a preprocessing and parsing module, a multi-dimensional deep detection engine, and a risk decision and desensitization module; The preprocessing and parsing module is used to clean, standardize, and extract elements from the raw data input from the business access layer. Multi-dimensional deep detection engine: used to comprehensively analyze suspected fraudulent targets from multiple dimensions, including URL, content semantics, and script behavior; The risk decision-making and desensitization module includes a fusion scoring unit and a structured intelligence generation unit. The fusion scoring unit adopts a weighted fusion strategy to fuse the rule engine score with the semantic confidence score of the large model, and outputs a quantitative risk score and risk level. The structured intelligence generation unit converts fraud information into desensitized structured intelligence records. Alliance Intelligence Cloud Platform: This layer is deployed in a cloud environment and is used to aggregate, correlate and analyze structured intelligence from different alliance members and generate dynamic defense strategies. The Alliance Intelligence Cloud Platform only processes anonymized structured intelligence and does not store original business data.

2. The large-model-driven cross-platform fraud intelligence sharing and interception system according to claim 1, characterized in that, The service access layer includes a multimodal access unit, which includes, but is not limited to, an SMS gateway interface, an instant messaging private message interface, and a social platform comment or post collection interface.

3. The large-model-driven cross-platform fraud intelligence sharing and interception system according to claim 1, characterized in that, The element extraction refers to extracting key elements through regular expression matching and semantic parsing, including but not limited to: suspected fraudulent URLs, communication account identifiers, terminal identifiers, device fingerprints, and redirection link characteristics.

4. The large-model-driven cross-platform fraud intelligence sharing and interception system according to claim 1, characterized in that, The multidimensional deep detection engine includes a URL feature analysis unit, a content semantic analysis unit, and a script behavior detection unit; The URL feature analysis unit is used to perform domain name resolution and IP tracing, conduct WHOIS information verification, determine IP geographical location or risk area, and calculate domain name similarity based on edit distance to identify counterfeit domain names and phishing links. The content semantic analysis unit has a built-in lightweight large language model, is configured with prompt word templates for fraudulent rhetoric, identifies intent, and extracts sensitive form features from the page. The script behavior detection unit is used to perform static analysis on webpage source code or page scripts to detect obfuscated or abnormal behavior characteristics.

5. The large-model-driven cross-platform fraud intelligence sharing and interception system according to claim 1, characterized in that, The intelligence field set includes, but is not limited to: fraud type tags, data hash values, anonymized communication account / terminal identifier / device fingerprints, URL normalized fingerprints, domain attributes, risk scores, and model confidence levels.

6. The large-model-driven cross-platform fraud intelligence sharing and interception system according to claim 1, characterized in that, The alliance intelligence cloud platform includes an intelligence aggregation and correlation analysis module, a dynamic strategy generation module, and a strategy distribution and synchronization module. Among them, the intelligence aggregation and correlation analysis module is used to receive structured intelligence uploaded by various local AI anti-fraud agents and form a fraud intelligence database by associating multi-source clues; The dynamic strategy generation module generates or updates interception strategies based on the aggregated fraud intelligence database, using a search-enhanced generation method. The strategy distribution and synchronization module distributes the latest strategies, feature fingerprints, and model update information to the local AI anti-fraud agents of alliance members through an encrypted channel.

7. A large-model-driven cross-platform fraud intelligence sharing and interception method, utilizing the large-model-driven cross-platform fraud intelligence sharing and interception system described in claim 6, characterized in that, The steps are as follows: S1. The local AI anti-fraud agent deployed on the alliance member side performs a full-dimensional risk assessment of the data to be detected on a single platform, specifically including the following steps: S1.1 The local AI anti-fraud agent captures the number of data to be detected through the business access layer of alliance members. according to It then calls a preset toolchain to extract key elements: using regular expression matching and semantic template matching to extract... The text content in the text is used as a text element. ;extract The corresponding sender's platform account has a unique identifier, denoted as the account identifier. ;extract The suspected fraudulent Uniform Resource Locator contained within is denoted as a URL link. ; S1.2, Perform multidimensional parallel analysis logic, including: S1.2.1, URL Feature Analysis Unit Netloc extraction was performed to obtain the domain name. Alternatively, it uses IP addresses; it calculates domain similarity based on edit distance; simultaneously, it calls the API to query IP address location, WHOIS information, and historical risk records. S1.2.2, Parse the HTML source code of the URL to be tested; extract form feature vectors. and script behavior characteristics ; S1.2.3, Large-scale model semantic intent inference, outputting the inferred fraudulent intent. ; S1.3 The fusion scoring unit generates the final risk score through a weighted fusion algorithm. : That middle, and For weighting factors; For semantic analysis risk assessment function; To match the risk assessment function to the rules, For registration age, To assess the similarity of counterfeits; Criteria for determining fraud: If Then determine For fraudulent messages, perform local real-time interception and generate an explainable report; To preset a threshold for determining fraud risk; S2, the local AI anti-fraud agent encapsulates the fraud determination results into structured intelligence. Desensitization processing is performed during the packaging process; S3, each local AI anti-fraud agent will de-identify the structured intelligence. Uploaded to the Alliance Intelligence Cloud Platform; the Alliance Intelligence Cloud Platform uses graph database technology to correlate intelligence from multiple sources; S4, the Alliance Intelligence Cloud Platform, uses the RAG engine to generate real-time defense strategies against new variant scams based on aggregated global intelligence. ; S5 and the Alliance Intelligence Cloud Platform transmit policies via encrypted channels. It is pushed back to the local AI anti-fraud intelligence agents of all members of the alliance.

8. The large-model-driven cross-platform fraud intelligence sharing and interception method according to claim 7, characterized in that, Extracting form feature vectors The method is as follows: First, use a web page parsing engine to construct the DOM tree from the HTML source code of the URL to be tested. By traversing the DOM tree, accurately locate all... <form>Tags and their nested interactive components; for each located form element, deep probing of its key attributes, sequentially performing type recognition, intent recognition, and text enhancement recognition; mapping the detected discrete features into a fixed-length feature vector, i.e., the form feature vector. :< / form> in, , =1 indicates the presence of a password input field. =0 indicates that there is no password input field; , =1 indicates the presence of financially sensitive fields such as bank card numbers and credit card security codes. =0 indicates that there are no financially sensitive fields such as bank card numbers and credit card security codes; , =1 indicates the presence of contact privacy fields such as phone number, ID card number, or email address. =0 indicates that there are no contact privacy fields such as phone number, ID card number, or email address; , =1 indicates that the form submission URL points to a suspicious external domain or is a cross-domain submission. =0 indicates that the form submission address does not point to suspicious external domains or cross-domain submissions; Indicate the submission method; =1 indicates a secure submission method. =0 indicates that sensitive data was submitted using the insecure GET method; Extracting script behavior feature vectors The method is as follows: (1) Abnormal behavior monitoring items detection: confusion avoidance monitoring, automatic jump monitoring, dynamic content injection monitoring; (2) Vectorized modeling: Constructing script behavior feature vectors : in, These represent the frequency or Boolean values ​​of obfuscation avoidance, automatic redirection, and dynamic content injection behaviors on the page, respectively.

9. The large-model-driven cross-platform fraud intelligence sharing and interception method according to claim 7, characterized in that, S1.2.3, Large-scale model semantic intent inference, including the following steps: inferring the semantic intent of the text... white Links to URLs The corresponding webpage text content is used as input and fed into a locally deployed private large-scale model based on the Transformer architecture. Intent inference is achieved through RAG technology, which retrieves similar cases matching the input content from a local fraud script knowledge base. The large-scale model outputs the inferred fraud intent. ,Will Automatically mapped to a preset telecom fraud threat framework; 。 10. The large-model-driven cross-platform fraud intelligence sharing and interception method according to claim 7, characterized in that, The desensitization process uses the SHA-256 hash algorithm to... Encryption is performed using the device fingerprint to obtain an encrypted identifier. Structured intelligence Includes: fraud type tags, URL normalized fingerprints, and final risk score. Criteria for determining fraud.

Images