A chat security detection method, system, device and program product

Abstract

The application provides a chat security detection method, system, device and program product. The method comprises the following steps: performing message filtering and conversion processing on a received chat message event stream to obtain chat content; performing semantic vectorization and account clustering processing on the chat content sent by multiple chat accounts based on a sliding time window to obtain a chat account set; performing multi-dimensional feature analysis and collaboration degree calculation on the chat account set to obtain a collaboration attack score; and determining a risk detection result based on the collaboration attack score to perform risk processing. The method can improve the detection efficiency of chat security and can be widely applied to the fields of family entertainment product software, digital cultural product manufacturing software, digital cultural creative software and the like in the digital creative industry.

Description

Technical Field

[0001] This application relates to the field of natural language processing technology, and in particular to a chat security detection method, system, device, and program product. Background Technology

[0002] In chat security detection, relevant technologies commonly employ keyword filtering, regular expression matching, and machine learning classification models for individual messages to review chat content. However, the sending of inappropriate content has evolved from single-point attacks to clustered, automated, and collaborative attacks. Since these technologies only analyze individual messages and cannot identify abnormal group activity, they negatively impact the efficiency of chat security detection. Summary of the Invention

[0003] This application aims to address at least one of the technical problems existing in the prior art. To this end, this application proposes a chat security detection method, system, device, and program product, which can improve the efficiency of chat security detection.

[0004] To achieve the above objectives, one aspect of this application proposes a chat security detection method, including: The received chat message event stream is filtered and transformed to obtain the chat content; Based on a sliding time window, the chat content sent by multiple chat accounts is semantically vectorized and clustered to obtain a set of chat accounts; Multidimensional feature analysis and collaboration degree calculation are performed on the chat account set to obtain the collaborative attack score; Risk detection results are determined based on the collaborative attack score, and risk handling is carried out accordingly.

[0005] According to some embodiments of this application, the step of performing message filtering and transformation processing on the received chat message event stream to obtain chat content includes: The system messages in the chat message event stream are filtered to obtain the target message stream; The interference symbols in the target message stream are removed to obtain the target content; The chat content is obtained by restoring the special words in the target content based on the mapping dictionary.

[0006] According to some embodiments of this application, the step of performing semantic vectorization and account clustering processing on the chat content sent by multiple chat accounts based on a sliding time window to obtain a chat account set includes: Based on the sliding time window, the chat content sent by multiple chat accounts is input into the sentence embedding model to generate multiple sentence semantic vectors; The semantic similarity of the sentence semantic vector is calculated, and the chat accounts are clustered based on the calculated similarity to obtain the chat account set.

[0007] According to some embodiments of this application, the step of performing multi-dimensional feature analysis and collaboration degree calculation on the chat account set to obtain a collaborative attack score includes: Based on the set of chat accounts, the account identifier and message timestamp are extracted; The speaking time compactness is obtained by calculating the speaking interval time of similar semantic content based on the message timestamp; Based on the account identifier, the information entropy of the chat account in different account dimensions is calculated to obtain the account dispersion. Based on the account identifier, the set of chat accounts is deduplicated to obtain the target account set, and the account ratio information in the target account set is analyzed to obtain the new account ratio and the simultaneous login ratio of accounts; The collaborative attack score is obtained by calculating the speaking time compactness, account dispersion, new account ratio, and simultaneous login ratio of accounts based on the collaborative degree calculation formula.

[0008] According to some embodiments of this application, the step of calculating the information entropy of the chat account across different account dimensions based on the account identifier to obtain the account dispersion includes: Based on the account identifier, the account features of the chat account are extracted to obtain multi-dimensional feature information; Based on the multi-dimensional feature information, the information entropy of different account dimensions is calculated, and the information entropy is comprehensively calculated to obtain the account dispersion.

[0009] According to some embodiments of this application, the step of deduplicating the chat account set based on the account identifier to obtain a target account set, and analyzing the account ratio information in the target account set to obtain the new account ratio and the simultaneous login ratio of accounts, includes: Based on the account identifier, the set of chat accounts is deduplicated to obtain the target account set, and the number of accounts in the target account set is calculated. Based on the target account set, the registration time and login time of each chat account are extracted; New accounts are determined based on the registration time, and the proportion of new accounts is obtained by statistically analyzing the number of accounts. The accounts that log in simultaneously are determined based on the login time, and the simultaneous login ratio of the accounts is obtained by statistically analyzing the number of accounts.

[0010] According to some embodiments of this application, the risk processing based on the risk detection result determined by the collaborative attack score includes: Obtain a collaborative attack threshold. When the collaborative attack score is greater than or equal to the collaborative attack threshold, the accounts in the chat account set that send similar semantic content are identified as risky accounts. Based on the risky account, risky devices and risky Internet Protocol addresses are identified, and risk control is implemented for all accounts under the risky device and the risky Internet Protocol address.

[0011] To achieve the above objectives, another aspect of this application proposes a chat security detection system, applied to the chat security detection method described above, comprising: The content extraction module is configured to filter and transform the received chat message event stream to obtain the chat content; The semantic clustering module is configured to perform semantic vectorization and account clustering processing on the chat content sent by multiple chat accounts based on a sliding time window to obtain a set of chat accounts; The collaborative computing module is configured to perform multi-dimensional feature analysis and collaborative degree calculation on the set of chat accounts to obtain a collaborative attack score. The risk processing module is configured to determine the risk detection result based on the collaborative attack score and then perform risk processing.

[0012] To achieve the above objectives, another aspect of this application provides an electronic device, including at least one control processor and a memory for communicatively connecting to the at least one control processor; the memory stores instructions executable by the at least one control processor, which, when executed by the at least one control processor, enables the at least one control processor to perform the chat security detection method as described above.

[0013] To achieve the above objectives, another aspect of this application provides a computer-readable storage medium storing computer-executable instructions for performing the chat security detection method as described above.

[0014] To achieve the above objectives, another aspect of this application provides a computer program product storing computer-executable instructions for performing the chat security detection method as described above.

[0015] One of the above technical solutions has the following advantages or beneficial effects: This application provides a chat security detection method, system, device, and program product. This solution obtains chat content by filtering and transforming the received chat message event stream, which can extract chat content from the information stream, reduce interference from system messages or special symbols, and improve the robustness of chat content recognition. Furthermore, this solution performs semantic vectorization and clustering processing on the chat content of multiple chat accounts based on a sliding time window to obtain a set of chat accounts. It can cluster chat content within the same time period to obtain a set of accounts that send similar content, improving the detection efficiency of coordinated attacks. In addition, this solution performs multi-dimensional feature analysis and coordination degree calculation on the chat account set to obtain a coordinated attack score, and determines the risk detection result based on the coordinated attack score for risk handling. It can identify coordinated attacks and perform risk management, reducing the false positive rate and improving the efficiency of chat security detection and risk handling. Attached Figure Description

[0016] Figure 1 This is a flowchart of a chat security detection method provided in one embodiment of this application; Figure 2 yes Figure 1 Flowchart of step S101; Figure 3 yes Figure 1 Flowchart of step S102; Figure 4 yes Figure 1 Flowchart of step S103; Figure 5 yes Figure 4 Flowchart of step S403; Figure 6 yes Figure 4 Flowchart of step S404; Figure 7 yes Figure 1 Flowchart of step S104; Figure 8 This is a flowchart illustrating the execution of chat security detection according to an embodiment of this application; Figure 9 This is a schematic diagram of the structure of a chat security detection system provided in one embodiment of this application; Figure 10 This is a structural diagram of an electronic device provided in another embodiment of this application. Detailed Implementation

[0017] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0018] In the description of this application, it should be understood that the orientation descriptions, such as up, down, front, back, left, right, etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0019] In the description of this application, "several" means one or more, "more than" means two or more, "greater than," "less than," and "exceeding" are understood to exclude the stated number, while "above," "below," and "within" are understood to include the stated number. The use of "first" and "second" in the description is merely for distinguishing technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the order of the indicated technical features.

[0020] In the description of this application, unless otherwise expressly defined, terms such as "setup," "installation," and "connection" should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in this application in conjunction with the specific content of the technical solution.

[0021] Before providing a detailed description of the embodiments of this application, some of the nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0022] 1) Natural Language Processing (NLP) is a core technology field formed by the intersection of artificial intelligence and linguistics. It aims to enable computers to understand, parse, generate, and manipulate natural language used by humans in daily life.

[0023] 2) Chat security detection refers to the process of scanning and recognizing text, images, voice or video messages generated in scenarios such as instant messaging, social media, and online games in real time or offline, using a variety of technical means such as a pre-set sensitive word database, machine learning classification model, semantic understanding engine and user behavior analysis.

[0024] 3) Collaborative attacks refer to coordinated attacks in which multiple accounts publish illegal statements in a short period of time.

[0025] In the process of security detection of chat content, relevant technologies generally employ keyword filtering, regular expression matching, and machine learning classification models for single messages for chat content review. For example, by establishing a sensitive word library containing prohibited words, sensitive terms, or variations of special symbols, the system uses an efficient string matching algorithm to quickly scan and compare each user-input message with the word library when processing text. However, attacks that send prohibited content have evolved from single-point attacks to clustered, automated, and collaborative attacks. For example, a large number of newly registered accounts send semantically highly similar but slightly different textual messages within the same time period to bypass static rules and isolated text detection. Related technologies only analyze single messages and cannot identify abnormal groups of multiple accounts simultaneously sending similar content. Furthermore, they do not consider the concentrated timing of message sending, making it difficult to distinguish between normal user discussions and the spamming of prohibited information.

[0026] Therefore, this application provides a chat security detection method, system, device, and program product, which can be applied to the technical fields of natural language processing, application software development, animation and game production engine software and development systems, digital cultural product production software, and digital cultural creative software. This application performs message filtering and transformation processing on received chat message event streams to obtain chat content. It obtains chat message event streams from applications or software systems such as instant messaging, social platforms, and online games, and filters and transforms system messages and interference symbols in the chat message event streams to obtain the chat content sent by the user. This application performs semantic vectorization and clustering processing on the chat content of multiple chat accounts based on a sliding time window, enabling the aggregation of accounts sending similar content to obtain a chat account set. This application calculates a collaborative attack score by performing multi-dimensional feature analysis and collaboration degree calculation on the chat accounts in the chat account set. This collaborative attack score refers to the collaboration degree score of multiple chat accounts in the chat account set collaboratively sending illegal content. This application can determine whether there are multiple chat accounts collaborating to send illegal content in a set of chat accounts by using the collaborative attack score, thereby detecting the risk and triggering risk handling strategies based on the risk detection results. It can integrate semantic similarity, time synchronization and account behavior characteristics to detect real-time collaborative attacks in chat content, maintain the health of the content ecosystem of software or platform and the security of the network environment, make the communication environment of users in application products safer, and improve the efficiency of chat security detection.

[0027] This application provides a chat security detection method, system, device, and program product, which will be described in detail in the following embodiments.

[0028] The chat security detection method provided in this application covers chat scenarios in most application software or digital cultural products, and is applicable to the fields of natural language processing, animation and game production engine software and development systems, game and animation software, etc. It can automatically identify and block chat content containing illegal content in instant messaging, online games, and other scenarios, thus maintaining network security. Simultaneously, this application improves the robustness of subsequent chat security detection by filtering system messages in the chat message event stream, removing interference symbols, and converting special symbols into normal symbols. Specifically, in multi-person social scenarios of chat software, a pre-set automated script on the client can extract chat message events from the current chat channel or chat window. By filtering and converting the chat message event stream, chat content from multiple chat accounts is extracted and transmitted to the server. Upon receiving the chat content, the server performs semantic vectorization and clustering processing on the chat content based on a pre-set sliding time window, thereby aggregating a set of chat accounts that sent the same or similar semantic content. By performing multi-dimensional feature analysis and coordination degree calculation on these chat account sets, a coordinated attack score can be calculated. This score represents the risk of multiple chat accounts in the set collaborating to send inappropriate content. Therefore, risk analysis based on the coordinated attack score yields risk detection results, allowing for appropriate risk management measures such as banning or removing risky accounts. This improves the efficiency of detecting coordinated attacks on chat content and enhances the security of the chat environment.

[0029] The chat security detection method provided in this application can be applied to the interaction between a client and a server, or it can be software or an application running on the server side for content detection of a target application. The terminal, as a client, can run a specified target application software or application, and the server performs chat security detection and other processing on the target application. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the chat security detection method, but is not limited to the above forms.

[0030] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0031] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0032] Reference Figure 1 , Figure 1 This is a flowchart of a chat security detection method provided in an embodiment of this application. The chat security detection method includes, but is not limited to, steps S101 to S104: Step S101: Filter and transform the received chat message event stream to obtain the chat content; Step S102: Based on the sliding time window, perform semantic vectorization and account clustering processing on the chat content sent by multiple chat accounts to obtain a set of chat accounts; Step S103: Perform multi-dimensional feature analysis and collaboration degree calculation on the chat account set to obtain the collaborative attack score; Step S104: Based on the collaborative attack score, determine the risk detection result and perform risk processing.

[0033] This application embodiment can be applied to the interaction scenario between client 105 and server 106. The client can be a computer device such as a mobile terminal or personal computer. The server performs security detection processing on the chat content sent by the client, and can obtain the risk detection results of the chat content and adopt different risk processing strategies to process the risks of the client. For example, the chat account of the application in the client can be muted, thereby improving the detection capability of chat security and the security of the chat environment.

[0034] Specifically, embodiments of this application can perform security detection on chat scenarios deployed in client applications by deploying automated processes on the server or backend, and determine collaborative attacks by analyzing the chat content of multiple chat accounts within a certain time period. Alternatively, it can collect chat content sent by chat accounts logged into the client application to obtain a chat message event stream. Embodiments of this application obtain chat content by filtering and transforming the chat message event stream, filtering system messages, whitelist messages, etc., and removing interference symbols from the chat messages, thereby obtaining chat content sent by multiple chat accounts. Embodiments of this application perform semantic vectorization and clustering processing on the chat content of multiple chat accounts based on a sliding time window, enabling the vectorization and semantic clustering of chat content, thereby clustering multiple chat accounts sending similar chat content to obtain a set of chat accounts sending similar content. Embodiments of this application analyze multiple chat accounts in the chat account set by performing multi-dimensional feature analysis and collaboration degree calculation, thereby analyzing multiple chat accounts in the chat account set and determining the score of collaborative attacks by multiple accounts. This application embodiment determines risk detection results and performs risk processing by using collaborative attack scores. It can analyze the risk detection results of the chat account set based on the collaborative attack scores, and manage the chat accounts obtained from the chat account set through the risk detection results. It can effectively identify variant collaborative attacks that cannot be detected by keyword filtering, improve the security detection efficiency of chat content, and is applicable to application fields such as natural language processing, animation and game production engine software and development systems, game and animation software, animation, and game digital content services.

[0035] Please see Figure 2 In step S101 of some embodiments, the step of filtering and transforming the received chat message event stream to obtain chat content includes: Step S201: Filter the system messages in the chat message event stream to obtain the target message stream; Step S202: Remove interference symbols from the target message stream to obtain the target content; Step S203: Based on the mapping dictionary, the special words in the target content are restored to obtain the chat content.

[0036] Specifically, a chat message event flow refers to the entire process within a chat session, from the moment a user sends a message or the system triggers a specific state, to the receipt, processing, and subsequent responses and interactions on the interface or system. This chat message event flow typically occurs continuously in a streaming, asynchronous manner, including user message input, real-time transmission, server-side logic processing, state updates, and finally, pushing the generated reply or system event to the chat interface. This sequence of data and actions, occurring chronologically and with a clear trigger-response relationship, constitutes the complete chat message event flow. Chat content refers to the chat messages sent, displayed, or interacted with by users in instant messaging or online conversation scenarios. These messages can include text content or text extracted from images and audio.

[0037] In practical applications, this embodiment can set up automated scripts on the server side. When a client logs into the application's chat account, the automated scripts can obtain chat messages sent by the current chat account. By inferring chat messages in the chat window or chat session within the application, a chat message event stream can be received. This embodiment can also obtain user-sent chat messages by receiving the chat message event stream from the client and filtering out system messages in the chat message event stream. For example, filtering messages with system identifiers can yield user-sent chat messages. This embodiment can also set up whitelists or blacklists in the application to filter messages and obtain the chat messages to be analyzed, thereby extracting the specific text content from these chat messages. By filtering and transforming the received chat message event stream to obtain chat content, this embodiment can provide a data foundation for subsequent analysis of whether chat accounts exhibit clustered violations.

[0038] In step S201 of some embodiments, system messages in the chat message event stream are filtered to obtain the target message stream; System messages are messages automatically generated and pushed by the system or platform in chat, collaboration, or application environments, rather than content actively entered by chat participants. They are primarily used to convey status changes, operation results, notifications, or instructions, such as notifications of users joining or leaving chat rooms, feedback on successful or failed file uploads, application update notifications, and permission change reminders. System messages typically have a distinctive visual style to differentiate them from regular user messages, and regular users generally cannot directly send or modify these messages. The target message stream consists of user-sent chat messages obtained after filtering system messages.

[0039] For example, embodiments of this application can filter system messages in the chat message event stream by identifying identifiers in system messages. These system messages may include server announcements, achievement notifications, task prompts, and other similar messages. Embodiments of this application can also create a system account list, adding official information senders identified by system notifications, system assistants, group administrators, game administrators, test accounts, etc., to the list. This allows filtering of chat messages from the list within the chat message event stream to obtain the target message stream sent by the user's chat account.

[0040] In step S202 of some embodiments, interference symbols in the target message stream are removed to obtain the target content; Interference symbols refer to symbols that are irrelevant to or unnecessary for the semantic content, including special symbols, control characters, consecutive punctuation marks, and graphic symbols represented by Unicode encoding. These interference symbols increase visual noise in the message, thereby reducing information clarity and communication efficiency. Target content refers to the specific text content after removing interference symbols. This application embodiment identifies interference symbols in the target message stream, and then removes the identified interference symbols to obtain the target content.

[0041] For example, embodiments of this application can use automated scripts to identify interfering symbols in a target message stream. This can be achieved by defining regular expressions or character categories to mark interfering symbols, identifying consecutively appearing punctuation marks, control characters, emoticons, etc. After identifying these interfering symbols, they are cleared. This can be done by directly deleting the symbols or by standardizing them. For instance, meaningless special symbols and control characters can be directly deleted, while consecutively repeated punctuation marks can be compressed. Embodiments of this application can also determine whether a symbol is an interfering symbol based on the context. For example, by determining whether removing the symbol changes the core semantics of the sentence, symbols with altered semantics are considered interfering symbols. Embodiments of this application can also pre-set a whitelist, adding Chinese or English symbols to the whitelist and clearing symbols outside the whitelist, such as currency symbols, bullet points, arrows, etc. Embodiments of this application can also process whitespace characters, for example, converting newline characters or tabs to single spaces, merging consecutive spaces, and removing leading and trailing spaces. In addition, the embodiments of this application can also unify the format of symbols, such as converting full-width symbols to half-width symbols and converting English symbols to lowercase characters, so as to facilitate subsequent matching processing.

[0042] In step S203 of some embodiments, the special words in the target content are restored based on the mapping dictionary to obtain the chat content; The mapping dictionary refers to a data structure used for data transformation or text mapping. It establishes a one-to-one key-value pair relationship between source and target values, enabling rapid and deterministic mapping from one form of expression to another. Special words refer to vocabulary that does not conform to conventional writing rules but is conventionally used by a specific group or community to convey specific semantics. These can include homophones, pinyin abbreviations, numerical homophones, traditional Chinese words, and split character forms. This application's embodiments record the mapping relationship between special words and conventional words through a mapping dictionary. By identifying special words in the target content, they can be converted into normally expressed words to obtain the chat content.

[0043] For example, embodiments of this application can pre-construct a mapping dictionary by collecting raw corpora from real chat data in the target domain, such as collecting high-frequency internet slang from open-source communities. Then, standard definitions are manually provided for each raw corpus entry, or candidate explanations are generated using a pre-trained language model and manually reviewed and corrected. Embodiments of this application obtain a mapping dictionary by constructing a bidirectional mapping structure between the raw corpus and its corresponding definitions. This mapping dictionary can identify and restore special words in chat content and possesses good maintainability and scalability.

[0044] Specifically, in the embodiments of the present application, special words in the chat content are identified through a mapping dictionary. Specifically, by traversing each position of the chat content, the index of the special words in the constructed mapping dictionary is used to quickly determine whether the substring starting from this position exists in the dictionary until the longest valid word is matched. The successfully matched substring is the identified special word. Then, based on the mapping relationship in the mapping dictionary, the identified special word is converted and replaced with the corresponding canonical explanation in the dictionary. It should be noted that in the embodiments of the present application, special words in the target content can also be identified and restored through context analysis or deep learning models. For example, in the embodiments of the present application, the cosine similarity between the candidate word and the canonical word is calculated using pre-trained word vectors. For example, if "xifan" is the closest to "xihuan" in the vector space and conforms to the verb position in the context, then it is determined that "xifan" is a homophonic variant of "xihuan". In the embodiments of the present application, a generative model can also be obtained by training with a large number of raw text - canonical text pairs of corpora. This model implicitly learns the mapping relationship of special words through an attention mechanism, and the input raw text can output the restored canonical text.

[0045] One of the above technical solutions has the following advantages or beneficial effects: By filtering and converting the chat message event stream, the embodiments of the present application obtain the chat content, can identify special words in the chat content, can comprehensively understand the chat text, and improve the efficiency of subsequent text detection.

[0046] Please refer to Figure 3 , in step S102 of some embodiments, based on a sliding time window, semantic vectorization and account clustering processing are performed on the chat content sent by multiple chat accounts to obtain a chat account set, including: Step S301, based on the sliding time window, the chat content sent by multiple chat accounts is respectively input into a sentence embedding model to generate multiple sentence semantic vectors; Step S302, calculate the semantic similarity of the sentence semantic vectors, and cluster the chat accounts based on the calculated similarity to obtain the chat account set.

[0047] A sliding time window is a computational model commonly used to process time-series or streaming data. It divides the timeline into fixed-length time intervals and allows these intervals to slide at specified steps, continuously capturing and analyzing data from the most recent period. For example, setting the window length to 10 seconds and the sliding step to 2 seconds, the system creates a new window every 2 seconds, containing all events from the past 10 seconds. A chat account refers to a personal account registered and created by a user in an instant messaging system or social platform application, corresponding to the account that sends chat messages within the application. Each account is associated with a specific user and contains the user's personal information, settings, preferences, and potentially generated data. A chat account set refers to a collection of chat accounts that send similar or identical chat content. This application embodiment uses the sliding time window to semantically vectorize the chat content sent by multiple chat accounts within the same time period, clustering chat accounts sending similar or identical chat content to obtain a chat account set.

[0048] In step S301 of some embodiments, the chat content sent by multiple chat accounts is input into a sentence embedding model based on the sliding time window to generate multiple sentence semantic vectors. Specifically, sentence embedding models refer to natural language processing models whose core function is to map sentences or short texts of variable length into a fixed-dimensional continuous vector space, generating a dense vector representation, namely, a sentence semantic vector. This sentence embedding model learns from a large amount of text to capture the grammatical structure, contextual information, and deep semantic features of sentences, transforming sentences or short texts into a fixed-length numerical array to obtain the sentence semantic vector.

[0049] In this embodiment, the sentence embedding model can employ the Sentence-BERT model. Sentence-BERT is a BERT-based sentence embedding model focused on generating efficient sentence vector representations for tasks such as semantic similarity calculation and text retrieval. By introducing a Siamese network structure and supervised fine-tuning methods, it makes the generated sentence embeddings more suitable for semantic matching scenarios. This embodiment performs semantic vectorization on all messages from the same chat channel or chat window within a sliding time window. It maintains the chat content sent by multiple chat accounts within the sliding time window using a queue, and inputs each chat content into the Sentence-BERT model to generate dense semantic vectors for the text.

[0050] In step S302 of some embodiments, semantic similarity is calculated on the sentence semantic vector, and the chat accounts are clustered based on the calculated similarity to obtain the chat account set; Specifically, semantic similarity refers to the degree of semantic similarity between two text segments. In this application, the distance between the semantic vectors corresponding to two texts can be calculated using cosine similarity, or it can be quantified using the matching score directly output by the model. The higher the semantic similarity between the semantic vectors of two sentences, the more identical or similar their meanings. This application calculates the semantic similarity of the sentence semantic vectors corresponding to the chat messages sent by each account, thereby clustering the corresponding chat accounts to obtain chat account aggregation.

[0051] In this embodiment, the semantic similarity between semantic vectors of each sentence is calculated using cosine similarity, and a clustering algorithm is used to group sentences in the vector space, so that accounts corresponding to semantically similar sentences are grouped into the same cluster, resulting in a set of chat accounts. This embodiment can use a vector database to store the semantic vectors of the sentences corresponding to the chat messages sent by each account. This embodiment can also perform clustering processing on real-time received user chat messages, filtering and transforming the chat messages to obtain text content, then calculating text vectors from the text content. By cleaning up expired data within the window, the cosine similarity between the new text vector and all vectors within the window is calculated. Furthermore, the cosine similarity index in the vector database can be used for statistical analysis to calculate the number of semantic similarities greater than or equal to a similarity threshold, which can be set to 0.85. This embodiment can determine the number of accounts sending the same or similar chat messages within a sliding time window based on the statistical count, thereby determining whether the behavior of these accounts constitutes clustered violations.

[0052] One of the above technical solutions has the following advantages or beneficial effects: The embodiments of this application obtain a set of chat accounts by performing semantic vectorization and clustering processing on the chat content of multiple chat accounts through a sliding time window. It can identify chat accounts that send the same or similar content in the same time period. By clustering these chat accounts, a reliable data foundation is provided for subsequent collaborative attack analysis of the chat account set.

[0053] Please see Figure 4 In step S103 of some embodiments, the step of performing multi-dimensional feature analysis and collaboration degree calculation on the chat account set to obtain a collaborative attack score includes: Step S401: Extract the account identifier and message timestamp based on the chat account set; Step S402: Calculate the speaking interval time of similar semantic content based on the message timestamp to obtain the speaking time compactness; Step S403: Calculate the information entropy of the chat account in different account dimensions based on the account identifier to obtain the account dispersion. Step S404: Based on the account identifier, deduplicate the chat account set to obtain the target account set, and analyze the account ratio information in the target account set to obtain the new account ratio and the simultaneous login ratio of accounts. Step S405: Calculate the speaking time compactness, account dispersion, new account ratio, and simultaneous login ratio of accounts based on the collaboration degree calculation formula to obtain the collaborative attack score.

[0054] In this embodiment, a collaborative attack score for the chat account set is obtained by analyzing the multi-dimensional features of the chat accounts in the chat account set and calculating the degree of collaboration. This embodiment can analyze multiple dimensions of the chat accounts in the chat account set, extract account identifiers from the chat accounts, and extract relevant information based on the account identifiers for multi-dimensional feature analysis. For example, analysis can be performed on feature dimensions such as basic attributes, behavioral characteristics, social relationships, and content preferences. Based on these features, a collaborative attack score is obtained by calculating the degree of collaboration. Specifically, this embodiment can construct a basic profile by extracting basic attributes such as account registration duration, level, and authentication status, and then construct behavioral sequence features based on account activity periods, speaking frequency, and message length for feature analysis. It can also construct a social graph based on the attention chains and interaction relationships between accounts to analyze the social relationships between accounts. This embodiment calculates the degree of collaboration by analyzing the behavioral characteristics of chat accounts sending the same or similar chat content in the chat account cluster. The similarity of the behavioral sequences can be calculated using cosine similarity as the collaborative attack score. This application embodiment can also perform coordination degree calculation on multiple features, such as the coordination degree calculation on multiple dimensions such as the compactness of the speaking time in the chat account set, the account dispersion, the proportion of new accounts and the proportion of accounts logging in at the same time, and calculate the coordination attack score based on the pre-constructed coordination degree calculation formula.

[0055] In step S401 of some embodiments, account identifiers and message timestamps are extracted based on the chat account set; Specifically, an account identifier refers to an identity credential used to uniquely identify a user in application software or a digital system. This identifier allows for the association or extraction of account-related content. For example, the account identifier can be used to extract account-related information such as registration time and login time. A message timestamp is an important mechanism for marking the generation or arrival time of a message. It is typically appended to the message header or metadata in a format of "year, month, day, hour, minute, second, millisecond" or even higher precision to mark the time the data was generated, thereby tracking the data's creation time and improving data integrity and traceability.

[0056] In this embodiment, the account identifier of each chat account in the chat account set is extracted. This can be achieved by identifying the account identifier based on the sender identifier field in the chat messages sent by the chat account. For example, each chat message in the database records a corresponding sender identifier, which can be directly read to obtain the account identifier. This embodiment also extracts the message timestamp from the chat messages sent by each chat account in the chat account set. For example, in standardized system logs, timestamps are usually stored as fixed key-value pairs. The specific message timestamp can be obtained by directly reading the timestamp field of the chat message and converting the format as needed. In some feasible embodiments, this embodiment directly extracts the chat account identifier from the chat account set and uses this chat account identifier to query the database records to obtain the message timestamps corresponding to the chat messages sent by that chat account within a sliding time window or a certain period.

[0057] In step S402 of some embodiments, the speaking interval time of similar semantic content is calculated based on the message timestamp to obtain the speaking time compactness; Specifically, similar semantic content refers to two or more texts that are similar or identical in their core meaning, intent, or information, and not merely limited to literal word-for-word similarity. For example, "how to upgrade a character" and "how to increase a character's level" use different words, but their semantics are highly similar, thus belonging to similar semantic content. This application's embodiments calculate the cosine similarity between texts using word vectors to obtain similar semantic content. The speaking interval time refers to the time difference between consecutively sent chat messages with similar semantic content in chat scenarios of applications such as social platforms and communication systems. Speaking time compactness is a quantitative indicator used to measure the density of speaking messages with similar semantic content within a sliding time window. This application's embodiments can reflect this by calculating the number of messages per unit time or by analyzing the variance and standard deviation of the intervals between adjacent messages in the message timestamp sequence. High compactness means very short and uniform message intervals, reflecting the coherence and high interaction intensity of sending similar content; conversely, low compactness means sparse speaking, possibly indicating low participation or delayed response.

[0058] In some feasible embodiments, the chat account set is a set of accounts that send similar semantic content. The specific time of sending similar semantic content is extracted from the account set, and the interval between messages sending similar semantic content is calculated. This interval is then combined with the time compactness calculation formula to calculate the message time compactness. In this embodiment, the number of messages sending similar semantic content within a sliding time window is counted, and the earliest and latest times of sending similar semantic content are determined based on the message timestamps. The time difference is then used to calculate the message interval. The time compactness is obtained by dividing the message interval by the number of messages. The expression for the time compactness calculation formula is as follows: ; In the formula, Indicates the tightness of the speaking time. Indicates the timestamp of sending similar semantic content. Indicates the maximum value. This represents the minimum value. This indicates the number of posts with similar semantic content within the sliding time window.

[0059] Please see Figure 5 In step S403 of some embodiments, calculating the information entropy of the chat account across different account dimensions based on the account identifier to obtain the account dispersion includes: Step S501: Extract multi-dimensional feature information from the account features of the chat account based on the account identifier; Step S502: Calculate the information entropy of different account dimensions based on the multi-dimensional feature information, and perform comprehensive calculation on the information entropy to obtain the account dispersion.

[0060] Specifically, information entropy refers to the uncertainty of possible events occurring in an information source, and it measures the amount of information. The greater the uncertainty, the greater the amount of information and the greater the entropy; conversely, the smaller the uncertainty, the smaller the amount of information and the smaller the entropy. For example, if an event has a high probability of occurrence, its uncertainty is low, and its information entropy is also low. Account dispersion refers to the distribution differences of accounts sending similar messages across various dimensions. This application's embodiments calculate account dispersion by using the information entropy of account features, which reflects the degree of dispersion of account groups. The lower the dispersion, the more concentrated the account features, the greater the likelihood of a studio using a batch of accounts, and the higher the probability of a coordinated attack.

[0061] In this embodiment, the information entropy of a chat account in different account dimensions is calculated based on the account identifier to obtain the account dispersion. The social relationships and types of content spoken by the chat account in the application can be extracted and analyzed through the account identifier. The account dispersion is obtained by comprehensively calculating the information entropy of different dimensions.

[0062] In step S501 of some embodiments, multi-dimensional feature information is obtained by extracting the account features of the chat account based on the account identifier; Specifically, account features refer to numerical values ​​or labels extracted from raw data that can quantify the behavioral patterns or attributes of a chat account in a specific dimension. In this embodiment of the application, the account features of a chat account can be identified to construct a corresponding account profile. Account features can be divided into static features and dynamic features. Static features may include account registration duration, account level, etc., while dynamic features may include daily active time periods, etc.

[0063] In some feasible embodiments, account identifiers of entertainment applications sending similar semantic content within a sliding time window are extracted. Based on these account identifiers, information about the corresponding accounts in different dimensions can be quickly extracted from the database. For example, features such as character combat power and character level in chat accounts can be extracted, as can features such as registration time and daily active time periods of chat accounts. In this embodiment, feature vectors of various dimensions can be extracted using a deep learning module. The deep learning module can convert the input text into a fixed-length vector using an encoder to obtain the feature vector.

[0064] In step S502 of some embodiments, information entropy of different account dimensions is calculated based on the multi-dimensional feature information, and the information entropy is comprehensively calculated to obtain the account dispersion. Specifically, this application embodiment calculates the information entropy of different account dimensions based on multi-dimensional feature information. By dividing the values ​​under each feature dimension into intervals and statistically analyzing the proportion of accounts in each interval, the information entropy of that dimension can be obtained. This application embodiment calculates the account dispersion based on the comprehensive account dispersion formula by comprehensively calculating the information entropy of each dimension, thereby reflecting the degree of dispersion of the account group.

[0065] In some feasible embodiments, this application embodiment can obtain the feature information of chat accounts in different dimensions based on multi-dimensional feature information, including the combat power and level of characters in the chat account, as well as the registration time and daily active time period of the chat account. Taking the feature vector of the combat power of characters in the chat account as an example, by dividing the feature vector into multiple intervals and statistically analyzing the proportion of accounts in each interval, the information entropy of the chat account set under the dimension of character combat power is calculated. This application embodiment calculates the information entropy using the information entropy calculation formula, the expression of which is shown below: ; In the formula, Represents the entropy of dimensional information. This indicates the number of intervals that divide the feature values. Represents natural numbers, Indicates the first The percentage of accounts in each interval. For example, in this embodiment of the application, the levels of chat accounts sending similar content in the chat account set are statistically obtained as 5, 5, 10, 10 and 15, thus dividing the data into three intervals with levels of 5, 10 and 15, where the accounts in the interval with level 5 account for two-fifths. When calculating the information entropy of each dimension, the account dispersion is then calculated based on the comprehensive account dispersion calculation formula, where the expression of the comprehensive account dispersion calculation formula is as follows: ; In the formula, Indicates account dispersion. Indicates the number of dimensions. Represents natural numbers, Indicates the first Information entropy in each dimension Indicates the first The number of bins in each dimension, i.e., the number of intervals to be divided.

[0066] One of the above technical solutions has the following advantages or beneficial effects: The embodiments of this application calculate the information entropy of chat accounts in different account dimensions based on account identifiers to obtain account dispersion, which can measure the degree of dispersion of account groups, thereby identifying the probability of account clusters launching coordinated attacks and improving detection efficiency.

[0067] Please see Figure 6 In step S404 of some embodiments, the step of deduplicating the chat account set based on the account identifier to obtain the target account set, and analyzing the account ratio information in the target account set to obtain the new account ratio and the simultaneous login ratio of accounts, includes: Step S601: Based on the account identifier, deduplicate the chat account set to obtain the target account set, and calculate the number of accounts in the target account set; Step S602: Extract the registration time and login time of each chat account based on the target account set; Step S603: Determine new accounts based on the registration time, and calculate the proportion of new accounts based on the number of accounts. Step S604: Determine the accounts that are logged in simultaneously based on the login time, and calculate the proportion of accounts that are logged in simultaneously based on the number of accounts.

[0068] In this embodiment, the target account set is the set of accounts obtained by deduplicating the chat accounts that appear repeatedly in the chat account set. In the chat scenario of the application, chat accounts can send multiple chat messages within a certain time period. These chat messages can be messages with the same content or messages with similar content. Therefore, when calculating the proportion of accounts, deduplicating the chat account set can reduce the error of duplicate statistics. Account proportion information refers to the proportion of accounts belonging to a certain cluster in the target account set. New account proportion refers to the proportion of accounts that are new accounts in the target account cluster. Simultaneous login proportion refers to the proportion of accounts in the target account cluster that send similar content at the same time or within a short period of time. It is conceivable that this embodiment can also perform account proportion calculations on the target account set in multiple dimensions, such as calculating the proportion of active accounts. This embodiment can also identify the speaking frequency of an account by counting the number of duplicate accounts during the account deduplication process, thereby enabling account banning or other actions based on speaking frequency, improving the security of the chat environment.

[0069] In step S601 of some embodiments, the set of chat accounts is deduplicated based on the account identifier to obtain a target set of accounts, and the number of accounts in the target set of accounts is calculated. In some feasible embodiments, this application embodiment can match account identifiers to see which account identifiers appear repeatedly in the current chat account set, thereby deduplicating the duplicate account identifiers and retaining only unique account identifiers. This application embodiment also uses an account deduplication formula for calculation, the expression of which is as follows: ; In the formula, This indicates the number of accounts in the target account set. This represents the target account set. In this embodiment, an account quantity threshold can also be set, which is the minimum number of accounts in the set that send the same semantic message; for example, this threshold can be set to 20. Subsequent calculations are only performed when the calculated account quantity exceeds this threshold; otherwise, the process exits. This is because these small numbers of chat messages may be quickly blocked or difficult to notice, thus improving detection efficiency.

[0070] In step S602 of some embodiments, the registration time and login time of each chat account are extracted based on the target account set; In some feasible embodiments, after deduplicating the chat account set, this application embodiment extracts the registration time and login time of each chat account in the target account set. When a user submits registration information through a webpage or client, the backend server receives the request and executes the registration logic. At this time, the server operating system obtains the current system time as the registration time and writes it along with the account information into the user table of the database. The user table can then be retrieved by identifying the chat account, and the account's registration time can be obtained from the user table. As for obtaining the login time, the server updates the login time field in the database to the current time each time the user successfully logs in, ensuring that this field always stores the user's most recent login time. This application embodiment can also retain a complete login history record, inserting a new record into a separate login log table each time the account logs in, and the login time can be obtained by searching this login log table.

[0071] In step S603 of some embodiments, new accounts are determined based on the registration time, and the proportion of new accounts is obtained by statistically analyzing the number of accounts. In some feasible embodiments, this application embodiment can confirm whether a chat account is a new account by comparing the registration time of each chat account. This application embodiment can compare the time when the chat account sends a chat message within a sliding time window with the registration time, and can also compare the current content detection time with the registration time. For example, this application embodiment sets a registration time threshold of 24 hours, compares the registration time of each chat account in the target account set with the current time, calculates the difference between the registration time and the current time, and confirms accounts with a registration time threshold of less than 24 hours as new accounts. Then, by statistically analyzing the number of new accounts, the proportion of new accounts can be calculated. This application embodiment provides a formula for calculating the proportion of new accounts, the expression of which is as follows: ; In the formula, Indicates the proportion of new accounts. This indicates the number of accounts after deduplication. Indicates the current time. Indicates the registration time. The threshold for determining registration time is denoted by I(P). In the indicator function I(P), if proposition P is true, then I(P) = 1; if proposition P is false, then I(P) = 0. This application's embodiment, by calculating the proportion of new accounts, can identify a surge in the number of accounts with extremely short registration times within a short period in a chat session or chat window. This often indicates that attackers are using newly registered zombie accounts or temporary accounts in bulk to conduct coordinated attacks such as traffic diversion and sending illegal content.

[0072] In step S604 of some embodiments, simultaneously logged-in accounts are determined based on the login time, and the simultaneous login ratio of the accounts is obtained by statistically analyzing the number of accounts. In some feasible embodiments, this application embodiment determines the proportion of accounts simultaneously logged into the application by statistically analyzing the login times of accounts sending similar semantic content in the account set. For example, this application embodiment sets a login time determination threshold of 30 minutes, compares the login time of each chat account in the target account set with the current time, calculates the difference between the login time and the current time, and identifies accounts with login times less than the login time determination threshold as simultaneously logged-in accounts. Then, by statistically analyzing the number of simultaneously logged-in accounts, the proportion of new accounts can be calculated. This application embodiment uses a formula for calculating the proportion of accounts simultaneously logged in, the expression of which is shown below: ; In the formula, This indicates the percentage of accounts logged in simultaneously. This indicates the number of accounts after deduplication. Indicates the current time. Indicates login time. The threshold for determining login time is defined in the indicator function I(A). If proposition A is true, then I(A) = 1; if proposition A is false, then I(A) = 0. This application's embodiments calculate the proportion of accounts simultaneously logging in, thus identifying the proportion of multiple accounts simultaneously initiating login requests within a specific time window. This helps identify related risks, such as the risk of hundreds or thousands of accounts being simultaneously logged in on the same device via scripts to send illegal messages.

[0073] One of the above technical solutions has the following advantages or beneficial effects: By calculating the proportion of new accounts and the proportion of accounts logged in simultaneously, this application embodiment can identify the risk of collaborative attacks involving large-scale machine behavior or illegal operations based on the proportion of new accounts and the proportion of accounts logged in simultaneously, thereby improving the comprehensiveness of chat security detection.

[0074] In step S405 of some embodiments, the speaking time compactness, the account dispersion, the proportion of new accounts, and the proportion of accounts logging in simultaneously are calculated based on the coordination degree calculation formula to obtain the coordinated attack score; In this embodiment, a collaborative attack score is obtained by comprehensively calculating multiple dimensions of information, such as the frequency of messages sent by the chat account set, the account dispersion, the proportion of new accounts, and the proportion of accounts logging in simultaneously. This score can be used to determine whether the behavior of the chat account set sending chat content is a risky behavior. The expression for the collaborative attack score calculation formula is as follows: ; In the formula, Indicates the score of the coordinated attack. , , and These are the weighting coefficients, and + + + =1 One of the above technical solutions has the following advantages or beneficial effects: This application embodiment, by performing multi-dimensional feature analysis and collaboration calculation on the chat account set, can detect chat content using both order dimensions such as login time and semantic dimensions of sent chat messages as dual constraints, thereby reducing the false detection rate of normal user discussion content. This application embodiment, by performing multi-dimensional analysis of the chat content and account information of the chat account set, can determine whether sent similar semantic content constitutes collaborative attack behavior, improving the security of chat security detection.

[0075] Please see Figure 7 In step S104 of some embodiments, the risk processing based on the risk detection result determined by the collaborative attack score includes: Step S701: Obtain the collaborative attack threshold. When the collaborative attack score is greater than or equal to the collaborative attack threshold, the accounts in the chat account set that send similar semantic content are identified as risky accounts. Step S702: Based on the risky account, determine the risky device and risky Internet Protocol address, and perform risk control on all accounts under the risky device and the risky Internet Protocol address.

[0076] In this embodiment, the calculated collaborative attack score can be used to detect the risk of chat content sent by a set of chat accounts, thereby triggering the system to perform corresponding risk management on the set of chat accounts, such as banning the corresponding accounts. This embodiment can also use predefined rules to detect the chat content sent by the set of chat accounts, determining whether the chat content is illegal and triggering corresponding risk management, such as deleting the illegal message and banning the chat account that sent the illegal content.

[0077] In step S701 of some embodiments, a collaborative attack threshold is obtained. When the collaborative attack score is greater than or equal to the collaborative attack threshold, the accounts in the chat account set that send similar semantic content are identified as risky accounts. In some feasible embodiments, the collaborative attack threshold is a pre-set scoring threshold. When the calculated collaborative attack score is greater than or equal to the collaborative attack threshold, accounts in the chat account set that send similar semantic content are identified as risky accounts. Risky accounts refer to accounts with risky behavior, such as unreasonable account clustering operations like sending illegal content in a group. Embodiments of this application can also classify the calculated collaborative attack score using a neural network model to obtain the risk level of the chat account set. It is conceivable that embodiments of this application can also use a pre-trained neural network model to perform multi-dimensional feature analysis and collaborative degree calculation on the chat account set to obtain a collaborative attack score, and send the chat account set with a collaborative attack score greater than or equal to the collaborative attack threshold to the management terminal for analysis or alarm processing by setting a collaborative attack threshold.

[0078] In step S702 of some embodiments, risky devices and risky Internet Protocol addresses are determined based on the risky account, and risk control is performed on all accounts under the risky device and the risky Internet Protocol address; Specifically, a risky account refers to an account within a set of chat accounts that sends content with similar semantics. A risky device refers to the device that logs into the risky account, which can include mobile terminals, in-vehicle terminals, computers, etc. A risky Internet Protocol address refers to the IP address that logs into the risky account.

[0079] In some feasible embodiments, when a user logs in via a browser or client, the server can collect various attributes reported by the device, including hardware information, operating system version, and other device information. A unique string is generated from this device information using a hash algorithm to obtain a device identifier. This device identifier is then bound to each account, allowing the corresponding device to be found through the account lookup. The server can directly obtain the source IP address of the account login request and can identify whether a proxy has been used by parsing fields in the HTTP header or TCP / IP protocol stack characteristics. Embodiments of this application can perform risk management measures such as muting or banning all accounts under the risky device and the risky internet protocol address.

[0080] One of the above technical solutions has the following advantages or beneficial effects: This application embodiment determines the risk detection result by using the collaborative attack score to handle the risk, which can predict the collaborative attack of the account cluster, temporarily mute the registered accounts that have not spoken and temporarily prohibit the login of multiple account login devices, thereby reducing the probability of being saturated by the attack.

[0081] This application's embodiments can be applied to animation and game production engine software and development systems, digital cultural product production software, and digital cultural and creative software technology fields within the digital creative industry. They can be used in chat or social application scenarios and are widely applied in the field of natural language processing. In one feasible embodiment, please refer to... Figure 8 This application embodiment acquires chat messages from chat windows, chat sessions, or chat channels within an application and performs content detection on these messages. First, by determining whether these chat messages belong to system messages, the user-sent chat messages undergo message preprocessing to generate semantic vectors. By comparing the similarity of these semantic vectors, corresponding chat accounts are clustered. When the number of messages with similar semantics sent by these chat accounts exceeds a preset threshold, multi-dimensional analysis of the chat messages and accounts is performed. This allows for the calculation of sending time compactness, account dispersion, the proportion of new accounts, and the proportion of accounts logging in simultaneously, resulting in a comprehensive collaborative attack score. The collaborative attack score enables risk assessment of the account set, allowing for risk mitigation of accounts whose chat content is confirmed to be risky. This identifies collaborative attacks and manages risks, reducing false positive rates and improving the efficiency of chat security detection and risk handling.

[0082] Corresponding to the above method embodiments, this application also provides embodiments of a chat security detection system. Figure 9 A schematic diagram of the structure of a chat security detection system according to an embodiment of this application is shown. Figure 9 As shown, the chat security detection system includes: The content extraction module 901 is configured to perform message filtering and transformation processing on the received chat message event stream to obtain the chat content; The semantic clustering module 902 is configured to perform semantic vectorization and account clustering processing on the chat content sent by multiple chat accounts based on a sliding time window to obtain a set of chat accounts; The collaborative computing module 903 is configured to perform multi-dimensional feature analysis and collaborative degree calculation on the chat account set to obtain a collaborative attack score. The risk processing module 904 is configured to determine the risk detection result based on the collaborative attack score and then perform risk processing.

[0083] The above is an illustrative scheme of a chat security detection system according to this embodiment. It should be noted that the technical solution of this chat security detection system and the technical solution of the chat security detection method applied to the chat security detection system described above belong to the same concept. For details not described in detail in the technical solution of the chat security detection system, please refer to the description of the technical solution of the chat security detection method described above.

[0084] like Figure 10 As shown, Figure 10 A structural block diagram of an electronic device 1000 according to an embodiment of this application is shown. The components of the electronic device 1000 include, but are not limited to, a memory 1010 and a processor 1020. The processor 1020 is connected to the memory 1010 via a bus 1030, and a database 1050 is used to store data.

[0085] Electronic device 1000 also includes access device 1040, which enables electronic device 1000 to communicate via one or more networks 1060. Examples of such networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. Access device 1040 may include one or more of any type of wired or wireless network interface (e.g., a Network Interface Card (NIC)), such as an IEEE 1002.11 Wireless Local Area Network (WLAN) wireless interface, a Global System for Microwave Access (GSM) interface, or a Wi-Fi interface. MAX interface, Ethernet interface, Universal Serial Bus (USB) interface, Cellular network interface, Bluetooth interface, Near Field Communication (NFC) interface, etc.

[0086] In one embodiment of this application, the above-mentioned components of the electronic device 1000 and Figure 10 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 10The illustrated electronic device block diagram is for illustrative purposes only and is not intended to limit the scope of this application. Those skilled in the art can add or replace other components as needed.

[0087] Electronic device 1000 can be any type of stationary or mobile electronic device, including mobile computers or mobile electronic devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable electronic devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary electronic devices such as desktop computers or PCs. Electronic device 1000 can also be a mobile or stationary server.

[0088] The processor 1020 is used to execute computer-executable instructions for the chat security detection method.

[0089] The above is an illustrative scheme of an electronic device according to this embodiment. It should be noted that the technical solution of this electronic device and the technical solution of the chat security detection method described above belong to the same concept. For details not described in detail in the technical solution of the electronic device, please refer to the description of the technical solution of the chat security detection method described above.

[0090] This application embodiment also provides a storage medium, which is a computer-readable storage medium, storing a computer program that, when executed by a processor, implements the above-described chat security detection method.

[0091] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof. The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate, and may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0092] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically include computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0093] The above is a detailed description of the preferred embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A chat security detection method, characterized in that, include: The received chat message event stream is filtered and transformed to obtain the chat content; Based on a sliding time window, the chat content sent by multiple chat accounts is semantically vectorized and clustered to obtain a set of chat accounts; Multidimensional feature analysis and collaboration degree calculation are performed on the chat account set to obtain the collaborative attack score; Risk detection results are determined based on the collaborative attack score, and risk handling is carried out accordingly.

2. The method according to claim 1, characterized in that, The process of filtering and transforming the received chat message event stream to obtain chat content includes: The system messages in the chat message event stream are filtered to obtain the target message stream; The interference symbols in the target message stream are removed to obtain the target content; The chat content is obtained by restoring the special words in the target content based on the mapping dictionary.

3. The method according to claim 1, characterized in that, The process of semantic vectorizing and clustering the chat content sent by multiple chat accounts based on a sliding time window yields a set of chat accounts, including: Based on the sliding time window, the chat content sent by multiple chat accounts is input into the sentence embedding model to generate multiple sentence semantic vectors; The semantic similarity of the sentence semantic vector is calculated, and the chat accounts are clustered based on the calculated similarity to obtain the chat account set.

4. The method according to claim 1, characterized in that, The process of performing multi-dimensional feature analysis and collaboration degree calculation on the chat account set to obtain a collaborative attack score includes: Based on the set of chat accounts, the account identifier and message timestamp are extracted; The speaking time compactness is obtained by calculating the speaking interval time of similar semantic content based on the message timestamp; Based on the account identifier, the information entropy of the chat account in different account dimensions is calculated to obtain the account dispersion. Based on the account identifier, the set of chat accounts is deduplicated to obtain the target account set, and the account ratio information in the target account set is analyzed to obtain the new account ratio and the simultaneous login ratio of accounts; The collaborative attack score is obtained by calculating the speaking time compactness, account dispersion, new account ratio, and simultaneous login ratio of accounts based on the collaborative degree calculation formula.

5. The method according to claim 4, characterized in that, The calculation of information entropy of chat accounts across different account dimensions based on the account identifier to obtain account dispersion includes: Based on the account identifier, the account features of the chat account are extracted to obtain multi-dimensional feature information; Based on the multi-dimensional feature information, the information entropy of different account dimensions is calculated, and the information entropy is comprehensively calculated to obtain the account dispersion.

6. The method according to claim 4, characterized in that, The process of deduplicating the chat account set based on the account identifier to obtain the target account set, and analyzing the account ratio information in the target account set to obtain the new account ratio and the simultaneous login ratio of accounts, includes: Based on the account identifier, the set of chat accounts is deduplicated to obtain the target account set, and the number of accounts in the target account set is calculated. Based on the target account set, the registration time and login time of each chat account are extracted; New accounts are determined based on the registration time, and the proportion of new accounts is obtained by statistically analyzing the number of accounts. The accounts that log in simultaneously are determined based on the login time, and the simultaneous login ratio of the accounts is obtained by statistically analyzing the number of accounts.

7. The method according to claim 1, characterized in that, The risk processing based on the risk detection result determined by the collaborative attack score includes: Obtain a collaborative attack threshold. When the collaborative attack score is greater than or equal to the collaborative attack threshold, identify accounts in the chat account set that send similar semantic content as risky accounts. Based on the risky account, risky devices and risky Internet Protocol addresses are identified, and risk control is implemented for all accounts under the risky device and the risky Internet Protocol address.

8. A chat security detection system, characterized in that, include: The content extraction module is configured to filter and transform the received chat message event stream to obtain the chat content; The semantic clustering module is configured to perform semantic vectorization and account clustering processing on the chat content sent by multiple chat accounts based on a sliding time window to obtain a set of chat accounts; The collaborative computing module is configured to perform multi-dimensional feature analysis and collaborative degree calculation on the set of chat accounts to obtain a collaborative attack score. The risk processing module is configured to determine the risk detection result based on the collaborative attack score and then perform risk processing.

9. An electronic device, characterized in that, It includes at least one control processor and a memory for communicatively connecting to the at least one control processor; the memory stores instructions executable by the at least one control processor, which, when executed by the at least one control processor, enable the at least one control processor to perform the chat security detection method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product stores computer-executable instructions, which are used to cause the computer to perform the chat security detection method as described in any one of claims 1 to 7.

Images