Message processing method and device, computer device and storage medium

Abstract

Embodiments of the present application disclose a message processing method and device, computer equipment and a storage medium, wherein the method comprises: in response to a propagation trigger operation on a message, obtaining a propagation path of the message, and establishing a propagation triple of the message according to the propagation path; according to the propagation triple, performing an accidental detection process on the propagation path of the message to obtain an accidental detection result of the propagation path; wherein the accidental detection result is used to indicate whether the propagation path is a suspicious path for accidental message propagation; when the accidental detection result indicates that the propagation path is a suspicious path for accidental propagation, the propagation heat of the message is counted, and based on the propagation heat, the message is subjected to abnormal analysis processing to obtain an abnormal analysis result of the message, which can improve the effectiveness of abnormal analysis of the message.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a message processing method, apparatus, computer device, and storage medium. Background Technology

[0002] With the continuous development of computer technology, message propagation via computer networks has become a major trend in message dissemination. Message propagation in a computer network refers to the sending of messages to different objects within the network. However, to avoid the adverse effects of abnormal messages propagating within the network, anomaly analysis is necessary during message propagation to prevent the widespread dissemination of such messages. Therefore, effective anomaly analysis of messages has become a current research hotspot. Summary of the Invention

[0003] This invention provides a message processing method, apparatus, computer device, and storage medium, which can improve the effectiveness of message anomaly analysis.

[0004] On one hand, embodiments of the present invention provide a message processing method, including:

[0005] In response to a message propagation trigger operation, the propagation path of the message is obtained, and a propagation triple of the message is established based on the propagation path;

[0006] Based on the propagation triple, the propagation path of the message is subjected to incidental detection processing to obtain the incidental detection result of the propagation path; wherein, the incidental detection result is used to indicate whether the propagation path is a suspicious path for incidental message propagation;

[0007] When the sporadic detection result indicates that the propagation path is a sporadic suspicious path, the propagation popularity of the message is counted, and based on the propagation popularity, anomaly analysis processing is performed on the message to obtain the anomaly analysis result of the message.

[0008] In another aspect, embodiments of the present invention provide a message processing apparatus, including:

[0009] The acquisition unit is used to acquire the propagation path of the message in response to the message propagation trigger operation, and to establish the propagation triple of the message based on the propagation path.

[0010] The processing unit is configured to perform occasional detection processing on the propagation path of the message based on the propagation triple, and obtain the occasional detection result of the propagation path; wherein, the occasional detection result is used to indicate whether the propagation path is a suspicious path for occasional message propagation;

[0011] The processing unit is also used to calculate the spread popularity of the message when the sporadic detection result indicates that the propagation path is a sporadic suspicious path;

[0012] The processing unit is further configured to perform anomaly analysis on the message based on the propagation popularity, and obtain the anomaly analysis result of the message.

[0013] In one embodiment, the processing unit is specifically used for:

[0014] Obtain a triplet database; the triplet database contains at least one reference triplet, each reference triplet being used to indicate a reference path;

[0015] Based on the propagation path of the propagation triples, path matching is performed on the reference path indicated by each reference triple in the triple database to perform occasional detection processing on the propagation path of the message.

[0016] Based on the path matching results, the sporadic detection results of the propagation path are determined.

[0017] In one embodiment, the path matching is used to determine a reference path that is the same as the propagation path of the message, and the reference path is a reliable path that frequently propagates messages; the processing unit is specifically used for:

[0018] If the path matching result indicates that a reference path identical to the propagation path of the message has been successfully determined, then the incidental detection result of the propagation path is determined to be a reliable path.

[0019] Otherwise, the result of the incidental detection of the propagation path is determined to be an incidental suspicious path.

[0020] In one embodiment, the acquiring unit is specifically used for:

[0021] Obtain at least one historical message that was frequently propagated within a historical time period, and the historical propagation path of each historical message; frequent propagation means that the propagation frequency of the corresponding historical message is greater than or equal to the frequency threshold.

[0022] From each historical dissemination path, select the corresponding message type of the historical message as the specified type of historical dissemination path; the specified type includes at least one of the following: news type, marketing type, material type, and greeting type;

[0023] For each selected historical propagation path, a corresponding historical triplet is established, and the historical triplet is stored as a reference triplet in the triplet database.

[0024] In one embodiment, the processing unit is specifically used for:

[0025] Obtain the propagation time period of the message, and perform a popularity count on the message within the propagation time period to obtain the propagation popularity of the message;

[0026] The heat indexing process is used to count the number of times the message is propagated within the propagation period, or the heat indexing process is used to count the propagation frequency of the message within the propagation period.

[0027] In one embodiment, the processing unit is specifically used for:

[0028] The spread intensity is compared with the intensity threshold, and the message is subjected to anomaly analysis based on the comparison result to obtain the anomaly analysis result of the message.

[0029] Specifically, when the comparison result shows that the spread popularity is less than the popularity threshold, the abnormal analysis result of the message is determined to be that the message is normal; when the comparison result shows that the spread popularity is greater than or equal to the popularity threshold, the abnormal analysis result of the message is determined to be that the message is abnormal.

[0030] In one embodiment, when the comparison result is that the spread popularity is greater than or equal to the popularity threshold, the processing unit is further configured to call the anomaly analysis model to identify the message and obtain the identification result of the message; the anomaly analysis model includes any one or more of the following: keyword analysis model, topic analysis model, and path analysis model;

[0031] The processing unit is further configured to determine the anomaly analysis result of the message based on the message identification and processing result.

[0032] In one embodiment, the keyword analysis model's identification result of the message is used to indicate whether the message contains abnormal keywords;

[0033] The topic analysis model's identification result for the message is used to indicate whether the message contains an anomalous topic;

[0034] The path analysis model identifies the message based on its propagation path, indicating whether the path is abnormal.

[0035] In one embodiment, the processing unit is further configured to, when determining that the anomaly analysis result of the message is that the message is abnormal, send an anomaly prompt message to the anomaly control object corresponding to the message, and obtain an anomaly tag added to the message based on the anomaly prompt message from the anomaly control object;

[0036] The processing unit is further configured to generate propagation control rules for the message based on the anomaly marker, and to control the propagation of the message according to the propagation control rules.

[0037] In another aspect, embodiments of the present invention provide a computer device, including a processor, an input device, an output device, and a memory, wherein the processor, input device, output device, and memory are interconnected, wherein the memory is used to store a computer program supporting the computer device in executing the above-described method, the computer program including program instructions, and the processor is configured to invoke the program instructions to execute the following steps:

[0038] In response to a message propagation trigger operation, the propagation path of the message is obtained, and a propagation triple of the message is established based on the propagation path;

[0039] Based on the propagation triple, the propagation path of the message is subjected to incidental detection processing to obtain the incidental detection result of the propagation path; wherein, the incidental detection result is used to indicate whether the propagation path is a suspicious path for incidental message propagation;

[0040] When the sporadic detection result indicates that the propagation path is a sporadic suspicious path, the propagation popularity of the message is counted, and based on the propagation popularity, anomaly analysis processing is performed on the message to obtain the anomaly analysis result of the message.

[0041] In another aspect, embodiments of the present invention provide a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor, cause the processor to perform the message processing method as described in the first aspect.

[0042] In another aspect, embodiments of the present invention provide a computer program product, the computer program product including a computer program, the computer program including program instructions, and when the program instructions are invoked by a processor, causing the processor to execute the message processing method as described in the first aspect.

[0043] In this embodiment, after a message is propagated, the computer device first performs a preliminary suspicion assessment of the propagation path based on the current propagation path. Then, if the propagation path is determined to be suspicious, the computer device further analyzes whether the message is abnormal by considering its propagation popularity. This allows the computer device to perform message anomaly detection and processing from two dimensions: the propagation path and the message itself. Furthermore, since the computer device judges abnormal messages based on the statistical analysis of message propagation popularity, it can send real-time alerts once the message propagation exceeds a certain popularity threshold. This improves the timeliness of abnormal message detection and the effectiveness of message anomaly analysis. Additionally, sending alerts for abnormal messages allows relevant management entities to effectively manage abnormal messages and prevent their widespread propagation. Moreover, the computer device can combine message identification and processing with models to perform message anomaly analysis, enabling multi-dimensional and multi-method message anomaly analysis and effectively improving the accuracy of message anomaly analysis. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of a message processing system provided in an embodiment of the present invention;

[0046] Figure 2 This is a schematic flowchart of a message processing method provided in an embodiment of the present invention;

[0047] Figure 3a This is a schematic diagram illustrating the establishment of a triplet database according to an embodiment of the present invention;

[0048] Figure 3b This is a schematic diagram illustrating message anomaly analysis provided by an embodiment of the present invention;

[0049] Figure 3c This is a schematic diagram of message anomaly analysis based on model recognition provided in an embodiment of the present invention;

[0050] Figure 4 This is a schematic diagram illustrating the entire process of message anomaly analysis provided by an embodiment of the present invention;

[0051] Figure 5This is a schematic block diagram of a message processing device provided in an embodiment of the present invention;

[0052] Figure 6 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] This application proposes a message processing method that allows a computer device to construct a propagation triple based on the propagation path of a message after it has been propagated once. Based on this propagation triple, the propagation path can be subjected to incidental detection to determine whether the use of this propagation path is suspicious. In one embodiment, if the computer device determines that the propagation path is an incidental path, it indicates that this propagation path is not a regular message propagation path; that is, generally, this path would not be used for message propagation. In this case, the computer device can consider the propagation path suspicious. Then, the computer device can perform popularity statistics on the messages propagated along this path to obtain the message's popularity, and further analyze the message's anomaly based on this popularity. By employing this method for message anomaly analysis, computer equipment can first detect the propagation path to determine the suspiciousness of message propagation through that path. Then, by combining this with statistical analysis of message propagation popularity, the anomaly of the message can be confirmed. This allows computer equipment to perform an initial judgment based on the suspiciousness of the propagation path when analyzing message anomalies. If the propagation path is determined to be suspicious, further anomaly analysis of the message will be conducted. If the propagation path is determined to be non-suspicious, subsequent anomaly analysis of the corresponding message will not be triggered. This effectively improves the efficiency of computer equipment in message anomaly analysis while ensuring the accuracy and effectiveness of the analysis.

[0055] The following section will first describe the relevant technologies involved in message propagation and message anomaly analysis in the embodiments of this application.

[0056] (1) Messages and message identifiers.

[0057] The messages involved in this application embodiment are various forms of content that can be sent and forwarded. For example, the message can be any one or more of text, video, audio and images that can be sent and forwarded. Specifically, the message can be a conversation message in instant messaging software, a post message in a social square, or a notification message for a followed account, etc. The message is not limited in this application embodiment.

[0058] A message identifier is a unique identifier used to identify a message. In this application embodiment, the message identifier mainly refers to the Universally Unique Identifier (UUID) of the message. It can be understood that when messages are transmitted in a computer network (or distributed system), message identifiers are used to identify the corresponding messages, and different messages are identified by different message identifiers, while the same message corresponds to the same message identifier. Therefore, computer devices can determine the similarities and differences of corresponding messages by comparing the differences in message identifiers. It can be understood that the message processing process in this application embodiment is based on this message identifier. For example, the message propagation popularity statistics involved in this application embodiment are determined by counting the number of times the corresponding message identifier appears in different propagation paths.

[0059] (2) Triplet.

[0060] The triples involved in this application include the propagation triples corresponding to the message being propagated, and the reference triples contained in the triple database. The triples are object triples formed based on the objects to which the message is sent during propagation. In other words, the propagation path used to establish the triples is generated by the different objects to which the message is sent during propagation, and the order in which the message is propagated to these different objects.

[0061] As the name suggests, a triple contains three elements. In other words, the triple constructed in this embodiment is based on the three different objects to which the message is sent during propagation, and the order in which the message is sent to these three objects (i.e., the message propagation path). In one embodiment, assuming the propagated message is message 1, and the three objects propagating message 1 include: object A (denoted as userA), object B (denoted as userB), and object C (denoted as userC), and the propagation path of message 1 to these three objects is: object A sends it to object B, and then object B sends message 1 to object C, then the triple constructed by the computer device based on this propagation path of message 1 can be denoted as (userA-userB-userC).

[0062] In one embodiment, the propagation triple corresponding to the message being propagated is determined based on the propagation path of the message being sent to three different objects. The reference triples contained in the triple database are determined based on the order (i.e., propagation path) of historical messages of a specified type that were frequently propagated to three different objects within a historical time period. Historical messages of a specified type are known to be normal messages; therefore, the frequent propagation of normal messages will not be abnormal. Thus, the propagation path determined by the computer device based on the frequent propagation of known normal messages can be considered a normal propagation path, while propagation paths other than these normal propagation paths can be considered by the computer device to be suspicious propagation paths.

[0063] Since the computer device establishes corresponding triples based on the different objects involved in the propagation path, it can subsequently identify and confirm the corresponding propagation path based on the triples. In other words, the computer device determines whether the propagation path is suspicious by using the corresponding triples.

[0064] It should also be noted that, in this application embodiment, after the propagation of the message is carried out by establishing the propagation triple, the message is analyzed for anomalies based on the propagation triple. After the message is propagated, multi-tuples, such as quadruples and quintuples, can also be established. For the established quadruples and quintuples, the analysis method of this application embodiment can also be used to perform anomaly analysis on the corresponding propagated messages.

[0065] (3) Occasional paths and frequent paths.

[0066] In one embodiment, an occasional path refers to a path whose information propagation frequency using the corresponding path is less than a frequency threshold, while a frequent path, also known as a high-frequency path, specifically refers to a path whose information propagation frequency using the corresponding path is greater than or equal to a frequency threshold. The reference propagation paths corresponding to the reference triples included in the aforementioned triple database are frequent paths; that is, frequent paths can be considered propagation paths without message propagation anomalies, while occasional paths are considered paths where abnormal message propagation may occur.

[0067] Please see Figure 1 , Figure 1 This is a schematic diagram of the network architecture of a message processing system provided in an embodiment of this application. Figure 1 As shown, this network architecture may include a server 200 and a terminal device cluster. The terminal device cluster may include one or more terminal devices; the number of terminal devices is not limited here. Figure 1As shown, multiple terminal devices can specifically include terminal device 1, terminal device 2, terminal device 3, ..., terminal device n, where n is a positive integer. For example... Figure 1 As shown, terminal device 1, terminal device 2, terminal device 3, ..., terminal device n can all connect to server 200 via the network, so that each terminal device can interact with server 200 through the network connection.

[0068] like Figure 1 The server 200 shown can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The terminal device can be a smartphone, tablet, laptop, desktop computer, smart TV, in-vehicle terminal, smart home device, or other smart terminal. The following description uses the communication between terminal device 1 and server 200 as an example to illustrate the specific implementation of this application.

[0069] Each of the n terminal devices can be a user terminal, and each terminal device can have a business client. This business client is a client capable of receiving and sending messages, and can be software, a mini-program (a program that does not require installation), a webpage, etc. Server 200 can be the backend server to which this business client belongs.

[0070] The following description, using the interaction between terminal device 1 and server 200 as an example, provides an overall explanation of the message processing method involved in the embodiments of this application.

[0071] (1) Terminal device 1 receives a message sent by another terminal device (assuming it is terminal device 2), and assuming the message is denoted as message 1; then, terminal device 1 sends message 1 to another terminal device (such as terminal device 3);

[0072] (2) Server 200 determines the propagation path of message 1 among the objects corresponding to terminal devices 1, 2, and 3 based on the sending order of message 1 among terminal devices 1, 2, and 3, and constructs a corresponding propagation triple based on the propagation path. The propagation triple can be denoted as: (object A - object B - object C). Object A is the terminal corresponding to terminal device 2, object B is the terminal corresponding to terminal device 1, and object C is the terminal corresponding to terminal device 3.

[0073] (3) Based on the propagation triplet, the server 200 performs an occasional detection process on the propagation path to determine whether the propagation path is a suspicious path for occasional message propagation;

[0074] (4) When the server 200 determines that the propagation path is a suspicious path for occasional message propagation, it performs anomaly analysis on the message based on the propagation popularity of the message and determines the final anomaly analysis result of the message.

[0075] By performing incidental detection on the propagation path of a message after it has been propagated, it is possible to determine whether the propagation of the message using a corresponding path is suspicious. If the propagation path is deemed suspicious, further anomaly analysis is performed based on the message's propagation popularity. This allows computer equipment to make an initial judgment on the suspiciousness of the message by checking the propagation path. Then, based on the results of this initial judgment and the message's propagation popularity, a final analysis is performed to determine whether the message is abnormal. This improves the effectiveness and accuracy of anomaly analysis by computer equipment. Furthermore, since incidental detection is performed on the propagation path after each propagation to determine its suspiciousness, and anomaly analysis is performed based on the message's propagation popularity when a suspicious path is determined, the message's propagation popularity is updated as the propagation progresses. Therefore, by statistically analyzing the message's propagation popularity after each propagation, real-time updates to the propagation popularity can be achieved. This real-time updated propagation popularity allows for anomaly determination, improving the timeliness and accuracy of message anomaly analysis.

[0076] It should be specifically noted that the relevant data involved in the message processing process in this application (such as the transmitted message, the message identifier corresponding to the message, and the exception tags added to the message, etc.) requires the permission or consent of the target audience when the above embodiments of this application are applied to specific products or technologies. Furthermore, the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the region, and conform to the principles of legality, legitimacy, and necessity, without involving the acquisition of data types prohibited or restricted by laws and regulations. In some optional embodiments, the relevant data involved in the embodiments of this application is obtained after separate authorization from the target audience. Additionally, when obtaining separate authorization from the target audience, the purpose of the relevant data is explained to the target audience.

[0077] Please see Figure 2 This is a schematic flowchart illustrating a message processing method proposed in an embodiment of this application. The method can be executed by a computer device, which may be... Figure 1 The terminal device in the middle can also be a server, such as Figure 2 As shown, the method may include:

[0078] S201, in response to the message propagation trigger operation, obtain the message propagation path, and establish the message propagation triple based on the propagation path.

[0079] Message propagation refers to sending messages to different devices in a distributed system, such as those that can be sent to... Figure 1 In a distributed system, each device corresponds to a specific object. Therefore, by sending messages between different devices in the distributed system, messages can be sent to different objects. Furthermore, by circulating messages between different objects, message propagation can be achieved.

[0080] Generally, the flow of a message between at least three objects can be considered a message propagation. For example, if a message is sent from object A to object B, and then from object B to object C, this can be considered a message propagation. After each propagation, the order in which the message is sent between different objects constitutes the message propagation path. Based on this propagation path, a propagation triplet describing the order in which the message is sent between different objects can be created; this is the propagation triplet corresponding to the message. In a distributed system, after a message propagation, a propagation triplet corresponding to the message propagated in that propagation can be created. This propagation triplet could be (userA-userB-userC).

[0081] After each message propagation and the establishment of the corresponding propagation triplet, the computer device can perform anomaly analysis on the message based on the propagation triplet. That is, the computer device can first perform suspicious analysis on the propagation path of the message based on the propagation triplet, and then determine whether the message is abnormal based on the result of the suspicious analysis. In other words, after each propagation triplet is established based on the message propagation, the computer device can first perform suspicious analysis on the corresponding propagation path based on the propagation triplet, and then proceed to step S202.

[0082] In one embodiment, the computer device can be considered as the device where the real-time risk control system is located, and the distributed system for message propagation is associated with the risk control system. Alternatively, the distributed system for message propagation can also be considered as the risk control system. In this case, after each message propagation, the propagation triple established based on the message propagation can trigger the risk control system, and the computer device corresponding to the risk control system will perform anomaly analysis on the message.

[0083] After a message is propagated and a corresponding propagation triple is generated based on the corresponding propagation path, the message identifier (i.e., UUID) of the message can be associated with the propagation triple. This propagation triple, associated with the message identifier, flows into the real-time risk control system, triggering the corresponding computer equipment to perform anomaly analysis on the message based on the message identifier and the propagation triple. In one embodiment, by associating the propagation triple flowing into the risk control system with the corresponding message identifier, it can be used to indicate which message propagation the propagation triple was generated from. This allows the propagation triple to represent the propagation path of the corresponding message, enabling effective association between the propagation triple, the corresponding propagated message, and the propagation path corresponding to the propagated message. This improves the accuracy of subsequent message anomaly analysis based on the propagation triple analysis.

[0084] Furthermore, since message identifiers are unique identifiers for messages and correspond to relatively small amounts of data, associating message identifiers with propagation triples allows subsequent processing of the message by computer devices to be transformed into processing of message identifiers. For example, the subsequent statistics on the propagation popularity of a message can be based on the identification and quantity statistics of message identifiers. This effectively reduces the computational load on computer devices during message anomaly analysis, thereby saving computer resources.

[0085] In one embodiment, the computer device establishes the propagation triplet corresponding to the message in real time after the message has completed propagation, and the triplet is associated with the message identifier and flows into the computer device in real time. The computer device then performs a suspiciousness detection on the propagation path based on the propagation triplet, and then proceeds to step S202.

[0086] S202, based on the propagation triple, perform occasional detection processing on the propagation path of the message to obtain the occasional detection result of the propagation path; wherein, the occasional detection result is used to indicate whether the propagation path is a suspicious path for occasional message propagation.

[0087] After the computer device obtains the propagation triplet established based on the message's propagation, it can perform occasional detection processing on the message propagation path based on this propagation triplet. Specifically, by performing occasional detection processing on the propagation path, the computer device can determine whether the propagation path indicated by the propagation triplet is a suspicious path for occasional message transmission. "Occasional" means that the frequency of occurrence is less than or equal to a preset frequency threshold. In other words, by performing occasional detection processing on the propagation path, it can be determined whether the frequency (or probability) of using this propagation path for message propagation is sufficiently high. If the frequency (or probability) of using this propagation path for message propagation is determined to be low, i.e., when the propagation path is determined to be an occasional path, it can be considered a suspicious path. Messages propagated on suspicious paths can be considered messages whose normality is unclear. Therefore, when the computer device determines that the propagation path is an occasional path (i.e., an occasional suspicious path), it can further determine whether the corresponding message is abnormal by subsequently statistically analyzing the message's propagation popularity.

[0088] In one implementation, if a computer device detects the occasional nature of a propagation path and determines that the frequency (or probability) of using that path for message propagation is high (i.e., when the propagation path is determined to be a non-occasional path (i.e., a frequent path), since the messages propagated in the frequent path are already clearly normal messages, the computer device can directly determine that the message is a normal message when it determines that the propagation path is a frequent path, without needing to further statistically analyze the propagation popularity of the message. This effectively reduces the data processing pressure on the computer device.

[0089] In other words, by using computer equipment to detect and process occasional events along the message propagation path, a preliminary judgment of message anomalies can be made. If the message is initially judged to be a normal message, there is no need to perform subsequent anomaly analysis on the message. This can effectively reduce the data processing pressure on computer equipment and improve the utilization efficiency of computer equipment's processing resources.

[0090] In one embodiment, when a computer device performs incidental detection processing on the message propagation path based on the propagation triplet, it can do so through a triplet database. In one embodiment, the triplet database contains at least one reference triplet, each reference triplet indicating a reference path. The reference triplets in the database are established based on the propagation paths of frequently propagated historical messages within a historical time period. The historical time period refers to a preset time period prior to the current message propagation, such as the 20 hours prior to the current message propagation, or the day before the current message propagation, etc. This embodiment does not impose any limitations. Messages propagated within this historical time period can be considered historical messages. Furthermore, "frequent" is a relative concept to "occasional," meaning that the frequency of occurrence is greater than a preset frequency threshold. Frequent propagation means that the frequency (or probability) of message propagation is greater than or equal to the preset frequency threshold.

[0091] Therefore, when a computer device establishes a triplet database based on frequently propagated historical messages within a historical time period, it can first obtain at least one historical message that frequently propagated within that time period, and the historical propagation path of each historical message. That is, the computer device can first obtain historical messages with a propagation frequency greater than or equal to a frequency threshold within that historical time period, and the historical propagation path corresponding to each historical message. Then, the computer device can select historical propagation paths whose message type corresponds to a specified type from each historical propagation path. The specified type includes at least one of the following: news type, marketing type, material type, and greeting type (such as a "good morning" greeting). Then, the computer device can establish a corresponding historical triplet based on each selected historical propagation path and store this historical triplet as a reference triplet in the triplet database. The specified type can also be other types of messages that are determined to be normal messages.

[0092] In other words, the triplet database established by the computer device is determined by historical propagation paths generated from the frequent propagation of specified types of historical messages within a historical time period. Since the specified types of historical messages are known to be normal, propagation paths based on these known normal historical messages do not contain any suspicious propagation paths. Therefore, the propagation paths corresponding to each reference triplet contained in the triplet database established in this way have been determined to be free of suspicious propagation paths. Thus, when the computer device subsequently determines whether the propagation path of the current message is abnormal, it can match the propagation triplet corresponding to the current message with the reference triplets in the triplet database. If a reference triplet matching the same propagation triplet as the current message is successfully found in the triplet database, the propagation path corresponding to the current message is considered to be frequently occurring and not suspicious; otherwise, the propagation path corresponding to the current message is considered to be occasional and potentially suspicious.

[0093] In one embodiment, the establishment of the triplet database by the computer device can be temporary when the computer device determines that anomaly detection is required for the current message propagation, or it can be established in advance. It should be noted that if the triplet database is established in advance, the established triplet database will also be periodically updated with reference triplets to ensure the credibility of the propagation paths indicated by the reference triplets stored in the database. For example, after the distributed system completes the propagation of historical messages each day, the computer device can establish the triplet database based on the propagation paths of specified types of historical messages that are frequently propagated on that day (or one or more current time slices), or update the current triplet database. This allows for occasional detection of the propagation paths of historical messages propagated in real-time on the next day, based on the triplet database established the previous day. Since the triplet database is established based on the historical propagation paths of historical messages propagated the previous day, the credibility of each reference path indicated in the triplet database can be guaranteed, thereby improving the accuracy of judging the suspiciousness of the propagation path corresponding to the current message propagation based on the triplet database.

[0094] Since this triplet database is built based on reference triples corresponding to the historical propagation paths of historical messages of a specified type that frequently propagate within a historical time period, these reference triples can also be called frequent triples. Frequent triples not belonging to this triplet database can be considered newly added triples. In one embodiment, the computer device can also, at a certain point in time before message propagation begins in the distributed system that day (e.g., 0:00), aggregate the propagation paths corresponding to the historical messages propagated the previous day based on the historical message identifiers, and then build the triplet database based on this aggregation. In another implementation, the computer device can also aggregate propagation paths based on the historical propagation paths corresponding to the historical messages propagated in a certain historical time segment of the distributed system that day, thereby establishing the triplet database.

[0095] When a computer device aggregates the propagation paths corresponding to historical messages propagated on a specific day based on the message identifier (UUID) of the messages propagated on that day, it aggregates propagation paths associated with the same UUID together, resulting in multiple clusters. Each cluster corresponds to the same UUID. The computer device can then further count the number of propagation paths contained in each cluster and determine at least one target cluster whose number of propagation paths is greater than or equal to a preset threshold. In other words, the historical messages corresponding to each determined target cluster are the frequently propagated historical messages on that day. The computer device can then perform sampling processing on the historical messages corresponding to each target cluster to determine historical messages of a specified type from the historical messages corresponding to each target cluster. The triples established by the propagation paths corresponding to the specified type of historical messages can then be stored as frequent triples (or reference triples) in a triplet database. This process can be described in detail as follows: Figure 3a As shown, where, Figure 3a In this diagram, a small circle represents the propagation path of a historical message, and a large circle represents an aggregate cluster. The different fill colors of the small circles indicate the different historical messages corresponding to the propagation paths represented by the corresponding small circles.

[0096] In one embodiment, the propagation and processing of historical messages based on a distributed system involves feeding the message identifiers of the propagated messages into a computer device. Therefore, the aggregation processing of historical messages by this computer device is essentially the aggregation processing of these message identifiers. Since the number of historical messages propagated by the distributed system within a historical time period is enormous, the number of message identifiers requiring aggregation processing by the computer device is also enormous. Therefore, a corresponding big data processing framework (such as Spark, a large-scale data processing framework) can be configured in this computer device to achieve batch aggregation of a large number of message identifiers, thereby improving the computing efficiency of the computer device and reducing resource consumption. Furthermore, the computer device can use a MySQL relational database to store and manage the frequent triplets, thereby improving the high-performance storage of frequent triples and enhancing the reliability and security of the triplet database storage.

[0097] In one embodiment, when the computer device performs occasional detection processing on the propagation path corresponding to the propagation triple through the triple database, specifically, after obtaining the triple database, the computer device can perform path matching on the reference path indicated by each reference triple contained in the triple database according to the propagation path of the established propagation triple, so as to perform occasional detection processing on the propagation path of the message; then, the computer device can determine the occasional detection result of the propagation path according to the path matching result.

[0098] The computer device performs path matching in the triplet database based on the propagation path of the current message to determine a reference path that is the same as the propagation path of the current message. This reference path is a reliable path that is frequently used for message propagation. Therefore, when the computer device determines the occasional detection result of the propagation path based on the path matching result, it can determine that the occasional detection result of the current message propagation path is a reliable path if the path matching result indicates that a reference path that is the same as the propagation path of the message has been successfully determined. Otherwise, it determines that the occasional detection result of the current message propagation path is an occasional suspicious path. The frequency of using an occasional suspicious path for message propagation is less than the frequency of using a frequently used reliable path for message propagation.

[0099] In other words, based on the propagation triplet corresponding to the message being propagated, the computer device can preliminarily determine whether the propagation path that established the propagation triplet is suspicious by matching the propagation triplet in the triplet database. If the propagation path is determined to be suspicious, the computer device will statistically analyze the propagation popularity of the message and then make a final judgment on whether the message is abnormal based on the propagation popularity, i.e., proceed to step S203. If the computer device determines that the propagation path corresponding to the message being propagated is a reliable path, it will directly determine that the message is a normal message.

[0100] S203, when the sporadic detection result indicates that the propagation path is a sporadic suspicious path, the propagation popularity of the message is counted, and based on the propagation popularity, the message is subjected to anomaly analysis processing to obtain the anomaly analysis result of the message.

[0101] In one embodiment, if the propagation path of the message being propagated is initially subjected to sporadic detection processing and the propagation path is determined to be suspicious, it indicates that the message being propagated is likely to be an abnormal message. In this case, the computer device can further analyze and confirm the abnormality of the message when it is determined that the propagation path corresponding to the message being propagated is a suspicious path.

[0102] In a specific implementation, when the computer device further analyzes and confirms whether the message is abnormal, it can do so by statistically analyzing the message's propagation popularity. In one embodiment, when statistically analyzing the propagation popularity of this message, the computer device can first obtain the propagation time period of the message, and then perform popularity counting processing on the message within the propagation time period to obtain the message's propagation popularity; wherein, the popularity counting processing is used to count the total number of times the message was propagated in this propagation within the propagation time period, or, the popularity counting processing is used to count the propagation frequency of the message in this propagation within the propagation time period.

[0103] In one embodiment, the propagation period corresponding to the message being propagated is determined by using the end time of the current message propagation as the end time and the start time of the message propagation as the start time. In another implementation, the computer device can further determine the propagation period by using any time point before the start time of the current message propagation as the start time, and combining this with the end time. Here, the start time of the message propagation refers to the time when the message (or its corresponding message identifier) ​​first enters the risk control system. In other words, the propagation period determined based on the start and end times of the message propagation is the time from when the message enters the risk control system until the end of the current propagation of the message.

[0104] Specifically, if the propagation path of message 1 in this transmission is userA-userB-userC, and message 1 has already been propagated to object x (i.e., userx) and object y (i.e., usery) before this transmission, and it was propagated to object x first and then to object y, then the target time period for propagating this message is: the time period between the start time of message 1's propagation to object x and the end time of message 1's propagation to object C.

[0105] In another implementation, the propagation time period corresponding to the message being propagated can also be a preset time period, such as a preset popularity statistics period of P minutes. In this case, the computer device can use the popularity statistics period (P minutes) in which the message is propagated as the propagation time period of the message. Here, P is a positive integer.

[0106] In one embodiment, since the risk control system (i.e., computer device) receives the UUID of the corresponding message after the message is propagated, the computer device confirms the propagation time period of the message through the UUID corresponding to the message being propagated, and the computer device also calculates the propagation popularity of the message within the propagation time period based on the UUID corresponding to the message.

[0107] In one embodiment, when a computer device calculates the propagation popularity of a message based on its corresponding UUID, it can use a counter to count the UUIDs. This counting is done by counting the number of identical UUIDs among the UUIDs associated with each triple flowing into the risk control system during the propagation period that match the UUID of the message being propagated. The count of identical UUIDs is then used to represent the propagation popularity of the message. More specifically, when using the count of identical UUIDs to represent the propagation popularity, the computer device can directly use the count as the propagation popularity, or it can normalize the count based on the propagation period, using the normalized data as the propagation frequency of the message during that period, and then using that frequency as the propagation popularity. This counter can be implemented using a high-performance caching database such as Redis (a high-concurrency database) to ensure real-time performance and high-concurrency processing capabilities.

[0108] When the time period corresponding to the dissemination of the message in this instance is within a preset heat statistics period, the computer device can perform periodic anomaly detection processing on messages flowing into the risk control system based on a sliding window of P days.

[0109] After the computer equipment completes the statistical analysis of the message's popularity, it can further perform anomaly analysis based on this popularity to obtain the anomaly analysis results. Specifically, the computer equipment can compare the popularity with a popularity threshold (denoted as Threshold) and perform anomaly analysis based on the comparison results to obtain the anomaly analysis results. This popularity threshold can be dynamically set according to business scenarios and risk control needs, such as based on the strictness of risk control and the number of risk control management objects.

[0110] In one embodiment, when the comparison result shows that the spread popularity is less than the popularity threshold, it indicates that the message spread through an occasional suspicious spread path has low popularity, that is, it involves fewer objects. In this case, the computer device can determine that the abnormal analysis result of the message being spread is that the message is normal. Conversely, when the comparison result shows that the spread popularity is greater than or equal to the popularity threshold, it indicates that the message spread through an occasional suspicious spread path has high popularity, that is, it involves more objects. In this case, the computer device can further determine that the abnormal analysis result of the message being spread is that the message is abnormal.

[0111] Below, in conjunction with Figure 3b The process of message anomaly analysis involved in the embodiments of this application is described in its entirety, and the following steps are specifically performed:

[0112] (1) The computer device obtains the propagation triplet corresponding to the propagated message based on the UUID of the propagated message;

[0113] (2) Through the triple database, perform occasional detection on the message being propagated to determine whether the propagation triple corresponding to the message being propagated is a frequent triple. If the triple is determined to be a frequent triple, the propagation path of the message being propagated is determined to be an occasional suspicious path, and then proceed to step (3); otherwise, the propagation path of the message being propagated is determined to be a reliable path, and the message being propagated is determined to be a normal message.

[0114] (3) Statistical analysis of the spread of the message in the risk control system to obtain the spread of the message;

[0115] (4) The obtained dissemination popularity is compared with the popularity threshold. If the dissemination popularity is greater than or equal to the popularity threshold, the message is determined to be abnormal; otherwise, the message is determined to be normal. When the computer device determines that the message is abnormal, it can also send an abnormality prompt message to the relevant risk control personnel at the same time.

[0116] In one embodiment, when the comparison between the propagation popularity of the message being propagated and a popularity threshold is found to be greater than or equal to the popularity threshold, to further enhance the accuracy of the message anomaly analysis results, the computer device can further invoke anomaly analysis models to identify the message and obtain the message identification results. The anomaly analysis models include any one or more of the following: keyword analysis models, topic analysis models, and path analysis models. The keyword analysis model's identification results indicate whether the message contains abnormal keywords; the topic analysis model's identification results indicate whether the message contains abnormal topics; and the path analysis model's identification results indicate whether the message's propagation path is an abnormal path. After obtaining the identification results for the message being propagated, the computer device can determine the message anomaly analysis results based on the message identification processing results.

[0117] The keyword analysis model can be a black / white keyword service model, the topic analysis model can be a Natural Language Processing (NLP) model, and the path analysis model can be a Large Language Model (LLM). In one embodiment, Natural Language Processing aims to enable computer devices to understand, generate, and process natural language. An NLP model refers to a computational model used to solve Natural Language Processing tasks, while a deep learning-based neural network model, i.e., an LLM model, can process and understand large amounts of natural language text data. Through pre-training on large-scale corpora, these models can learn rich linguistic knowledge, including grammatical, semantic, and contextual information. Therefore, the black / white keyword service model can filter sensitive word information contained in the message being disseminated; the NLP model can be used for sentiment analysis and topic classification of the message; and the LLM model can be used to analyze the propagation path of the message to determine whether malicious propagation behavior exists.

[0118] To ensure the accuracy of anomaly analysis results based on the model's identification of the message transmitted, computer equipment typically uses all three models mentioned above to process the message. The computer equipment only classifies the transmitted message as normal if each of the three models' corresponding identification results determines it to be normal; otherwise, it classifies the transmitted message as abnormal. Specifically, this can be done as follows: Figure 3c As shown.

[0119] In another implementation, after obtaining the recognition results of each model for the message, the computer device can perform weighted summation on each recognition result according to the corresponding weighted processing rules to obtain the final recognition result. Based on the final recognition result, it can then determine whether the message is abnormal. For example, if each model outputs a score, the recognition scores of each model can be weighted and summed to obtain the final score. Based on the comparison between the final score and a score threshold, it can be determined whether the message is abnormal.

[0120] When a message is widely disseminated, computer devices can further identify and process the message by calling a model, and then analyze any anomalies based on the model's identification and processing results. This allows computer devices to analyze message anomalies from multiple dimensions using various methods, thereby improving the accuracy of message anomaly analysis.

[0121] Below, in conjunction with Figure 4 This application provides an overall description of the entire process of message anomaly analysis in the embodiments, and specifically describes the following steps:

[0122] ① First follow the steps as follows Figure 3b The steps are as follows: determine the current popularity of the message being spread, and call the model when the popularity is greater than or equal to the popularity threshold;

[0123] ② Call the black / white keyword service model, NLP model and LLM model respectively to identify and process the message being propagated, and obtain the identification result of each model for the message;

[0124] ③ When the recognition results of each model indicate that the message is normal, the message is determined to be a normal message and the process ends;

[0125] ④ When the model's identification result for the message indicates that the message is abnormal, the process ends after confirming that the message is abnormal, pushing a prompt message to issue a message alarm.

[0126] In one embodiment, when a computer device determines that a message's anomaly analysis result indicates that the message is abnormal, it sends an anomaly alert message to the corresponding anomaly control object (i.e., the management object of the risk control system). The flag indicates whether the message is ultimately determined to be an abnormal and non-propagable message, and the type of anomaly. The computer device then retrieves the anomaly flag added to the message based on the anomaly alert message from the anomaly control object. Based on the anomaly flag, it generates propagation control rules for the message and controls the propagation of the message according to these rules to prevent the widespread dissemination of the abnormal message. The alert message can be pushed via SMS, email, or an app (application). By pushing alert messages corresponding to abnormal messages, effective control over abnormal messages can be achieved.

[0127] In this embodiment, after a message is propagated, the computer device first performs a preliminary suspicion assessment of the propagation path based on the current propagation path. Then, if the propagation path is determined to be suspicious, the computer device further analyzes whether the message is abnormal by considering its propagation popularity. This allows the computer device to perform message anomaly detection and processing from two dimensions: the propagation path and the message itself. Furthermore, since the computer device judges abnormal messages based on the statistical analysis of message propagation popularity, it can send real-time alerts once the message propagation exceeds a certain popularity threshold. This improves the timeliness of abnormal message detection and the effectiveness of message anomaly analysis. Additionally, sending alerts for abnormal messages allows relevant management entities to effectively manage abnormal messages and prevent their widespread propagation. Moreover, the computer device can combine message identification and processing with models to perform message anomaly analysis, enabling multi-dimensional and multi-method message anomaly analysis and effectively improving the accuracy of message anomaly analysis.

[0128] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a message processing device provided in an embodiment of this application. Figure 5 As shown, the message processing device may include an acquisition unit 501 and a processing unit 502.

[0129] The acquisition unit 501 is used to acquire the propagation path of the message in response to the message propagation trigger operation, and to establish the propagation triple of the message based on the propagation path.

[0130] The processing unit 502 is configured to perform occasional detection processing on the propagation path of the message based on the propagation triple, and obtain the occasional detection result of the propagation path; wherein, the occasional detection result is used to indicate whether the propagation path is a suspicious path for occasional message propagation;

[0131] The processing unit 502 is further configured to, when the sporadic detection result indicates that the propagation path is a sporadic suspicious path, count the propagation popularity of the message;

[0132] The processing unit 502 is further configured to perform anomaly analysis on the message based on the propagation popularity, and obtain the anomaly analysis result of the message.

[0133] In one embodiment, the processing unit 502 is specifically used for:

[0134] Obtain a triplet database; the triplet database contains at least one reference triplet, each reference triplet being used to indicate a reference path;

[0135] Based on the propagation path of the propagation triples, path matching is performed on the reference path indicated by each reference triple in the triple database to perform occasional detection processing on the propagation path of the message.

[0136] Based on the path matching results, the sporadic detection results of the propagation path are determined.

[0137] In one embodiment, the path matching is used to determine a reference path that is the same as the propagation path of the message, and the reference path is a reliable path that frequently propagates messages; the processing unit 502 is specifically used for:

[0138] If the path matching result indicates that a reference path identical to the propagation path of the message has been successfully determined, then the incidental detection result of the propagation path is determined to be a reliable path.

[0139] Otherwise, the result of the incidental detection of the propagation path is determined to be an incidental suspicious path.

[0140] In one embodiment, the acquisition unit 501 is specifically used for:

[0141] Obtain at least one historical message that was frequently propagated within a historical time period, and the historical propagation path of each historical message; frequent propagation means that the propagation frequency of the corresponding historical message is greater than or equal to the frequency threshold.

[0142] From each historical dissemination path, select the corresponding message type of the historical message as the specified type of historical dissemination path; the specified type includes at least one of the following: news type, marketing type, material type, and greeting type;

[0143] For each selected historical propagation path, a corresponding historical triplet is established, and the historical triplet is stored as a reference triplet in the triplet database.

[0144] In one embodiment, the processing unit 502 is specifically used for:

[0145] Obtain the propagation time period of the message, and perform a popularity count on the message within the propagation time period to obtain the propagation popularity of the message;

[0146] The heat indexing process is used to count the number of times the message is propagated within the propagation period, or the heat indexing process is used to count the propagation frequency of the message within the propagation period.

[0147] In one embodiment, the processing unit 502 is specifically used for:

[0148] The spread intensity is compared with the intensity threshold, and the message is subjected to anomaly analysis based on the comparison result to obtain the anomaly analysis result of the message.

[0149] Specifically, when the comparison result shows that the spread popularity is less than the popularity threshold, the abnormal analysis result of the message is determined to be that the message is normal; when the comparison result shows that the spread popularity is greater than or equal to the popularity threshold, the abnormal analysis result of the message is determined to be that the message is abnormal.

[0150] In one embodiment, when the comparison result is that the spread popularity is greater than or equal to the popularity threshold, the processing unit 502 is further configured to call the anomaly analysis model to identify the message and obtain the identification result of the message; the anomaly analysis model includes any one or more of the following: keyword analysis model, topic analysis model, and path analysis model;

[0151] The processing unit 502 is further configured to determine the anomaly analysis result of the message based on the message identification and processing result.

[0152] In one embodiment, the keyword analysis model's identification result of the message is used to indicate whether the message contains abnormal keywords;

[0153] The topic analysis model's identification result for the message is used to indicate whether the message contains an anomalous topic;

[0154] The path analysis model identifies the message based on its propagation path, indicating whether the path is abnormal.

[0155] In one embodiment, the processing unit 502 is further configured to send an exception prompt message to the exception control object corresponding to the message when the exception analysis result of the message is determined to be an exception, and obtain the exception tag added to the message based on the exception prompt message from the exception control object;

[0156] The processing unit 502 is further configured to generate a propagation control rule for the message based on the anomaly marker, and to control the propagation of the message according to the propagation control rule.

[0157] In this embodiment, after the message propagation, the processing unit 502 first performs a preliminary suspicion judgment on the propagation path corresponding to the message obtained by the acquisition unit 501. Then, if the processing unit 502 determines that the propagation path of the message propagation is suspicious, it can further analyze whether the message is abnormal by combining the propagation popularity of the message. This achieves message anomaly discrimination and processing through two dimensions: the propagation path and the message itself. In addition, since the processing unit 502 judges abnormal messages based on the statistics of message propagation popularity, a prompt message can be sent in real time after the propagation of the message exceeds a certain propagation popularity, which can improve the timeliness of abnormal message discovery and thus improve the effectiveness of message anomaly analysis. Furthermore, by sending prompt messages for abnormal messages, relevant management objects can effectively manage abnormal messages and avoid the widespread propagation of abnormal messages. In addition, the processing unit 502 can also combine the model to identify and process messages to perform anomaly analysis on messages, thereby realizing multi-dimensional and multi-method anomaly analysis of messages, which can effectively improve the accuracy of message anomaly analysis.

[0158] According to one embodiment of this application, Figure 5 The modules in the message processing device shown can be individually or entirely combined into one or more units, or some of these units can be further divided into multiple functionally smaller sub-units to achieve the same operation without affecting the technical effects of the embodiments of this application. The above modules are based on logical functional division. In practical applications, the function of one module can be implemented by multiple units, or the function of multiple modules can be implemented by one unit. In other embodiments of this application, the message processing device may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented collaboratively by multiple units.

[0159] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0160] According to one embodiment of this application, a computer program capable of executing the steps involved in the corresponding methods shown in the various embodiments of this application can be run on a general-purpose computer device (which may include processing elements and storage elements such as a central processing unit (CPU), random access memory (RAM), and read-only memory (ROM)) to construct a system as described in the embodiments of this application. Figure 5 The message processing apparatus shown herein. The computer program described above can be recorded on a computer-readable recording medium, and can be loaded into the computer device described above through the computer-readable recording medium and run therein.

[0161] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 6 As shown, the computer device 1000 may include a processor 1001, a network interface 1004, and a memory 1005. In some embodiments, the computer device 1000 may also include a user interface 1003 and at least one communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 1005 may also be at least one storage device located remotely from the aforementioned processor 1001. Figure 6 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a device control application program.

[0162] exist Figure 6In the computer device 1000 shown, the network interface 1004 provides network communication functionality; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0163] In response to a message propagation trigger operation, the propagation path of the message is obtained, and a propagation triple of the message is established based on the propagation path;

[0164] Based on the propagation triple, the propagation path of the message is subjected to incidental detection processing to obtain the incidental detection result of the propagation path; wherein, the incidental detection result is used to indicate whether the propagation path is a suspicious path for incidental message propagation;

[0165] When the sporadic detection result indicates that the propagation path is a sporadic suspicious path, the propagation popularity of the message is counted, and based on the propagation popularity, anomaly analysis processing is performed on the message to obtain the anomaly analysis result of the message.

[0166] In one embodiment, the processor 1001 can be used to invoke a device control application stored in the memory 1005, and also to implement:

[0167] Obtain a triplet database; the triplet database contains at least one reference triplet, each reference triplet being used to indicate a reference path;

[0168] Based on the propagation path of the propagation triples, path matching is performed on the reference path indicated by each reference triple in the triple database to perform occasional detection processing on the propagation path of the message.

[0169] Based on the path matching results, the sporadic detection results of the propagation path are determined.

[0170] In one embodiment, the path matching is used to determine a reference path that is the same as the propagation path of the message, the reference path being a reliable path that frequently propagates messages; the processor 1001 can be used to call the device control application stored in the memory 1005, and is also used to implement:

[0171] If the path matching result indicates that a reference path identical to the propagation path of the message has been successfully determined, then the incidental detection result of the propagation path is determined to be a reliable path.

[0172] Otherwise, the result of the incidental detection of the propagation path is determined to be an incidental suspicious path.

[0173] In one embodiment, the processor 1001 can be used to invoke a device control application stored in the memory 1005, and also to implement:

[0174] Obtain at least one historical message that was frequently propagated within a historical time period, and the historical propagation path of each historical message; frequent propagation means that the propagation frequency of the corresponding historical message is greater than or equal to the frequency threshold.

[0175] From each historical dissemination path, select the corresponding message type of the historical message as the specified type of historical dissemination path; the specified type includes at least one of the following: news type, marketing type, material type, and greeting type;

[0176] For each selected historical propagation path, a corresponding historical triplet is established, and the historical triplet is stored as a reference triplet in the triplet database.

[0177] In one embodiment, the processor 1001 can be used to invoke a device control application stored in the memory 1005, and also to implement:

[0178] Obtain the propagation time period of the message, and perform a popularity count on the message within the propagation time period to obtain the propagation popularity of the message;

[0179] The heat indexing process is used to count the number of times the message is propagated within the propagation period, or the heat indexing process is used to count the propagation frequency of the message within the propagation period.

[0180] In one embodiment, the processor 1001 can be used to invoke a device control application stored in the memory 1005, and also to implement:

[0181] The spread intensity is compared with the intensity threshold, and the message is subjected to anomaly analysis based on the comparison result to obtain the anomaly analysis result of the message.

[0182] Specifically, when the comparison result shows that the spread popularity is less than the popularity threshold, the abnormal analysis result of the message is determined to be that the message is normal; when the comparison result shows that the spread popularity is greater than or equal to the popularity threshold, the abnormal analysis result of the message is determined to be that the message is abnormal.

[0183] In one embodiment, when the comparison result indicates that the propagation heat is greater than or equal to the heat threshold, the processor 1001 can be used to call the device control application stored in the memory 1005, and also to implement:

[0184] The anomaly analysis model is invoked to identify and process the message, and the identification result of the message is obtained; the anomaly analysis model includes any one or more of the following: keyword analysis model, topic analysis model, and path analysis model;

[0185] Based on the message identification and processing results, the anomaly analysis results of the message are determined.

[0186] In one embodiment, the keyword analysis model's identification result of the message is used to indicate whether the message contains abnormal keywords;

[0187] The topic analysis model's identification result for the message is used to indicate whether the message contains an anomalous topic;

[0188] The path analysis model identifies the message based on its propagation path, indicating whether the path is abnormal.

[0189] In one embodiment, the processor 1001 can be used to invoke a device control application stored in the memory 1005, and also to implement:

[0190] When the anomaly analysis result of the message is determined to be an anomaly, an anomaly prompt message is sent to the anomaly control object corresponding to the message, and the anomaly mark added to the message based on the anomaly prompt message is obtained from the anomaly control object.

[0191] Based on the anomaly marker, a propagation control rule for the message is generated, and the propagation of the message is controlled according to the propagation control rule.

[0192] It should be understood that the computer device 1000 described in the embodiments of this application can execute the message processing methods described in the embodiments of this application, and can also execute the methods described above. Figure 5 The description of the message processing apparatus in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0193] Furthermore, it should be noted that this application also provides a computer-readable storage medium storing a computer program. When a processor executes the computer program, it can perform the message processing methods described in the various embodiments of this application; therefore, these descriptions will not be repeated here. Additionally, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the embodiments of the computer storage medium involved in this application, please refer to the description of the method embodiments of this application.

[0194] As an example, the aforementioned computer program can be deployed and executed on a single computer device, or deployed and executed on multiple computer devices located in one location, or executed on multiple computer devices distributed across multiple locations and interconnected via a communication network. These multiple computer devices distributed across multiple locations and interconnected via a communication network can form a blockchain network.

[0195] The aforementioned computer-readable storage medium can be an internal storage unit of the computer device, such as a hard drive or memory. It can also be an external storage device, such as a plug-in hard drive, smart media card (SMC), secure digital card (SD) card, or flash card. Furthermore, the computer-readable storage medium can include both internal and external storage units of the computer device. This computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. It can also be used to temporarily store data that has been output or will be output.

[0196] This application provides a computer program product comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the message processing methods described in the embodiments of this application; therefore, these descriptions will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the embodiments of the computer-readable storage medium involved in this application, please refer to the description of the method embodiments of this application.

[0197] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0198] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0199] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A message processing method, characterized in that, include: In response to a message propagation trigger operation, the propagation path of the message is obtained, and a propagation triple of the message is established based on the propagation path; Based on the propagation triple, the propagation path of the message is subjected to incidental detection processing to obtain the incidental detection result of the propagation path; wherein, the incidental detection result is used to indicate whether the propagation path is a suspicious path for incidental message propagation; When the sporadic detection result indicates that the propagation path is a sporadic suspicious path, the propagation popularity of the message is counted, and based on the propagation popularity, anomaly analysis processing is performed on the message to obtain the anomaly analysis result of the message.

2. The method as described in claim 1, characterized in that, The step of performing incident detection processing on the propagation path of the message based on the propagation triple to obtain the incident detection result of the propagation path includes: Obtain a triplet database; the triplet database contains at least one reference triplet, each reference triplet being used to indicate a reference path; Based on the propagation path of the propagation triples, path matching is performed on the reference path indicated by each reference triple in the triple database to perform occasional detection processing on the propagation path of the message. Based on the path matching results, the sporadic detection results of the propagation path are determined.

3. The method as described in claim 2, characterized in that, The path matching is used to determine a reference path that is the same as the propagation path of the message. The reference path is a reliable path that frequently propagates messages. The step of determining the sporadic detection result of the propagation path based on the path matching result includes: If the path matching result indicates that a reference path identical to the propagation path of the message has been successfully determined, then the incidental detection result of the propagation path is determined to be a reliable path. Otherwise, the result of the incidental detection of the propagation path is determined to be an incidental suspicious path.

4. The method as described in claim 2, characterized in that, The process of obtaining the triplet database includes: Obtain at least one historical message that was frequently propagated within a historical time period, and the historical propagation path of each historical message; frequent propagation means that the propagation frequency of the corresponding historical message is greater than or equal to the frequency threshold. From each historical dissemination path, select the corresponding message type of the historical message as the specified type of historical dissemination path; the specified type includes at least one of the following: news type, marketing type, material type, and greeting type; For each selected historical propagation path, a corresponding historical triplet is established, and the historical triplet is stored as a reference triplet in the triplet database.

5. The method as described in claim 1, characterized in that, The statistical analysis of the message's popularity includes: Obtain the propagation time period of the message, and perform a popularity count on the message within the propagation time period to obtain the propagation popularity of the message; The heat indexing process is used to count the number of times the message is propagated within the propagation period, or the heat indexing process is used to count the propagation frequency of the message within the propagation period.

6. The method as described in claim 1, characterized in that, The step of performing anomaly analysis on the message based on the spread popularity to obtain the anomaly analysis results of the message includes: The spread intensity is compared with the intensity threshold, and the message is subjected to anomaly analysis based on the comparison result to obtain the anomaly analysis result of the message. Specifically, when the comparison result shows that the spread popularity is less than the popularity threshold, the abnormal analysis result of the message is determined to be that the message is normal; when the comparison result shows that the spread popularity is greater than or equal to the popularity threshold, the abnormal analysis result of the message is determined to be that the message is abnormal.

7. The method as described in claim 6, characterized in that, When the comparison result indicates that the propagation heat is greater than or equal to the heat threshold, the method further includes: The anomaly analysis model is invoked to identify and process the message, and the identification result of the message is obtained; the anomaly analysis model includes any one or more of the following: keyword analysis model, topic analysis model, and path analysis model; Based on the message identification and processing results, the anomaly analysis results of the message are determined.

8. The method as described in claim 7, characterized in that, The keyword analysis model's identification result for the message is used to indicate whether the message contains abnormal keywords; The topic analysis model's identification result for the message is used to indicate whether the message contains an anomalous topic; The path analysis model identifies the message based on its propagation path, indicating whether the path is abnormal.

9. The method as described in claim 1, characterized in that, The method further includes: When the anomaly analysis result of the message is determined to be an anomaly, an anomaly prompt message is sent to the anomaly control object corresponding to the message, and the anomaly mark added to the message based on the anomaly prompt message is obtained from the anomaly control object. Based on the anomaly marker, a propagation control rule for the message is generated, and the propagation of the message is controlled according to the propagation control rule.

10. A message processing device, characterized in that, include: The acquisition unit is used to acquire the propagation path of the message in response to the message propagation trigger operation, and to establish the propagation triple of the message based on the propagation path. The processing unit is configured to perform occasional detection processing on the propagation path of the message based on the propagation triple, and obtain the occasional detection result of the propagation path; wherein, the occasional detection result is used to indicate whether the propagation path is a suspicious path for occasional message propagation; The processing unit is also used to calculate the spread popularity of the message when the sporadic detection result indicates that the propagation path is a sporadic suspicious path; The processing unit is further configured to perform anomaly analysis on the message based on the propagation popularity, and obtain the anomaly analysis result of the message.

11. A computer device, characterized in that, The system includes a processor, an input device, an output device, and a memory, wherein the processor, the input device, the output device, and the memory are interconnected, wherein the memory is used to store a computer program, the computer program including program instructions, and the processor is configured to invoke the program instructions to execute the method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes a computer program, the computer program including program instructions, which, when invoked by a processor, cause the processor to perform the method as described in any one of claims 1 to 9.

Images