A method and system for identifying and processing spam messages, an electronic device and a storage medium

By combining large-scale artificial intelligence models with abnormal behavior triggering strategies and data augmentation training, the accuracy and robustness issues in identifying distorted fraudulent text messages in spam text message monitoring systems have been solved, enabling precise control over fraudulent text messages.

CN122496822APending Publication Date: 2026-07-31CHINA UNITED NETWORK COMM GRP CO LTD
View PDF 0 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
CHINA UNITED NETWORK COMM GRP CO LTD
Filing Date
2026-05-09
Publication Date
2026-07-31

AI Technical Summary

Technical Problem

Existing spam SMS monitoring systems struggle to effectively identify fraudulent SMS messages that have been modified by changing keywords, inserting noise, or using homophones or synonyms. Furthermore, they lack analysis of sending behavior, resulting in insufficient accuracy and robustness in identification.

Method used

The system employs a large AI model for semantic understanding and classification, combines a pre-defined abnormal behavior trigger strategy to filter SMS messages, and implements communication capability restrictions when risk categories are identified. The system also enhances the model's recognition capabilities through low-rank adaptation techniques and data augmentation training.

Benefits of technology

It achieves accurate identification of changing keywords and sending behavior, improves the accuracy and robustness of spam SMS identification, and can efficiently process massive amounts of SMS messages with limited computing resources.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122496822A_ABST
    Figure CN122496822A_ABST
Patent Text Reader

Abstract

This invention relates to the field of artificial intelligence technology and proposes a method, system, electronic device, and storage medium for identifying and handling spam text messages. The method includes: acquiring text messages to be identified, which are selected from original text messages that meet a preset abnormal behavior triggering strategy; wherein the preset abnormal behavior triggering strategy is a judgment rule describing the abnormal characteristics of the text message; using a large-scale artificial intelligence model to perform semantic understanding and classification of the text messages to be identified, obtaining the category corresponding to the text message, where the category is information used to indicate the content attributes or risk level of the text message; when the category corresponding to the text message to be identified belongs to a preset risk category, executing a corresponding preset handling strategy according to the category of the text message to restrict the communication capabilities of the sending number corresponding to the text message to be identified. Utilizing a large-scale artificial intelligence model for deep semantic understanding and classification of text message content can effectively identify fraudulent text messages and overcome the limitations of traditional methods.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, system, electronic device, and storage medium for identifying and handling spam text messages. Background Technology

[0002] With the widespread adoption of mobile communication technology, spam text messages (especially fraudulent, pornographic, and gambling-related messages) pose a serious threat to public safety and the communication environment. Currently, telecommunications operators generally use spam text message monitoring systems to control these messages. Existing spam text message monitoring systems are typically connected to short message centers, configuring control policies based on keyword content and the number of messages sent. Messages that match the blocking policies are intercepted, and the sending numbers are blacklisted.

[0003] Specifically, existing technical solutions typically set keywords (such as 4.cc) and blocking thresholds (such as sending 10 messages per hour). When the content of a text message sent by a certain number matches the keyword rule and the number of messages sent reaches the threshold, the system will block the text message. If the number of messages sent reaches a higher threshold (such as sending 200 messages per hour), the sending number will be blacklisted, preventing it from sending more text messages.

[0004] However, existing spam SMS monitoring technologies based on keywords and the number of messages sent have the following drawbacks: Criminals often bypass keyword identification by changing keywords, inserting spaces or special symbols, or using homophones or synonyms. They can also exploit system vulnerabilities to send a large number of illegal SMS messages in a short period to evade interception. Furthermore, some fraudulent SMS messages (such as those related to express delivery) are difficult to identify based on a single message's content alone; accurate identification requires combining the sending behavior, which existing systems lack. Therefore, improving the accuracy and robustness of spam SMS identification and handling has become a pressing technical problem in this field. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a method, system, electronic device and storage medium for identifying and handling spam text messages, so as to solve the above-mentioned technical problem.

[0006] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A method for identifying and handling spam text messages, comprising: acquiring text messages to be identified, wherein the text messages to be identified are those selected from original text messages that meet a preset abnormal behavior triggering strategy; wherein the preset abnormal behavior triggering strategy is a judgment rule describing the abnormal characteristics of the text messages; using an artificial intelligence big data model to perform semantic understanding and classification on the text messages to be identified, to obtain the category corresponding to the text messages to be identified, wherein the category is information used to indicate the content attributes or risk level of the text messages; when the category corresponding to the text messages to be identified belongs to a preset risk category, executing a corresponding preset handling strategy according to the category corresponding to the text messages to be identified, so as to restrict the communication capabilities of the sending number corresponding to the text messages to be identified.

[0007] The beneficial effects of this invention are as follows: First, by using a preset abnormal behavior triggering strategy to filter the original SMS messages, only those with potential risks are sent to an artificial intelligence model for identification, thus achieving efficient processing of massive amounts of SMS messages with limited computing resources. Second, by utilizing the artificial intelligence model to perform deep semantic understanding and classification of SMS content, it can effectively identify fraudulent SMS messages that have been distorted by changing keywords, inserting noise, or using homophones or synonyms, overcoming the limitations of traditional keyword matching methods. Finally, when an SMS message is identified as belonging to a preset risk category, targeted actions such as communication capability restrictions are implemented on the sending number, achieving precise control over fraudulent SMS messages.

[0008] Based on the above technical solution, the present invention can be further improved as follows.

[0009] Furthermore, the large-scale artificial intelligence model is obtained through the following methods: acquiring an original labeled dataset, which contains multiple data samples consisting of instruction text, SMS content, and category labels; training the pre-defined large-scale artificial intelligence model based on the original labeled dataset using low-rank adaptation techniques to obtain an initial adjustment model; performing data augmentation processing on the data samples in the original labeled dataset whose corresponding category labels are the target category to generate a set of difficult examples; and training the initial adjustment model based on the original labeled dataset and the set of difficult examples to obtain the large-scale artificial intelligence model.

[0010] The beneficial effects of adopting the above-mentioned further scheme are: the low-rank adaptation technique reduces the computational resource consumption of model fine-tuning, and the generation of difficult sample samples by data augmentation of the original samples and training them together with the original data significantly improves the model's ability to identify variant fraudulent text messages, thereby enhancing the robustness of the model while maintaining the basic classification accuracy.

[0011] Furthermore, the step of training a pre-defined large-scale artificial intelligence model using low-rank adaptation techniques based on the original labeled dataset to obtain an initial adjustment model includes: sequentially concatenating the instruction text, SMS content, and category labels from each data sample in the original labeled dataset into an input sequence; adding a low-rank matrix to the target parameters in the pre-defined large-scale artificial intelligence model based on low-rank adaptation techniques; for each input sequence, inputting the input sequence into the pre-defined large-scale artificial intelligence model for causal language modeling prediction, and calculating the loss between the prediction result obtained based on label masking operations and the category labels of the input sequence, so as to update the parameters in the low-rank matrix according to the loss; repeating the above operations for each input sequence until a preset number of times is reached to obtain the initial adjustment model.

[0012] The beneficial effect of adopting the above-mentioned further scheme is that by calculating the loss of only the label part through the label mask, the model can focus on learning the mapping from SMS content to category labels, thereby improving training efficiency and classification accuracy.

[0013] Further, the step of performing data augmentation processing on data samples in the original labeled dataset whose corresponding category label is the target category to generate a hard example sample set includes: for each data sample in the original labeled dataset whose corresponding category label is the target category, processing the SMS content corresponding to the data sample using at least one of synonym replacement augmentation, noise injection augmentation, and structural change augmentation to generate new data samples; wherein, the synonym replacement augmentation is based on a predefined fraud domain synonym library, replacing the target word in the SMS content with the synonym corresponding to the target word with a preset probability; the noise injection augmentation is inserting punctuation marks, spaces, or characters at random positions in the SMS content; the structural change augmentation is based on a preset variety of fraud SMS spoofing templates, adding prefixes or suffixes to the SMS content; and obtaining a hard example sample set based on each of the new data samples.

[0014] The beneficial effects of adopting the above-mentioned further scheme are: by using three enhancement strategies, namely synonym replacement, noise injection and structural change, various variant forms of spam text messages in real-world scenarios are simulated. The generated high-quality difficult example samples can effectively improve the model's ability to recognize variant language, non-standard formats and disguised structures, thereby enhancing the model's generalization performance and anti-interference ability.

[0015] Furthermore, the step of training the initial adjustment model based on the original labeled dataset and the difficult example sample set to obtain the large artificial intelligence model includes: mixing data samples from the original labeled dataset with data samples from the difficult example sample set, and training the initial adjustment model using a weighted loss function to obtain the large artificial intelligence model; wherein, the loss weight of each data sample in the difficult example sample set is greater than the loss weight of each data sample in the original labeled dataset.

[0016] The beneficial effect of adopting the above-mentioned further scheme is that by mixing the original data with difficult sample samples and assigning higher loss weights to the difficult sample samples, the model pays more attention to difficult-to-identify variant fraud samples during the training process, thereby significantly improving the identification accuracy of complex fraud cases without sacrificing the ability to identify normal samples.

[0017] Furthermore, the preset abnormal behavior triggering strategy is a traffic monitoring strategy or a behavior analysis strategy; wherein, the traffic monitoring strategy indicates that the total number of SMS messages sent by the same sending number reaches a first threshold within a preset first time window; the behavior analysis strategy indicates that the number of SMS messages with the same content sent by the same sending number reaches a second threshold within a preset second time window.

[0018] The beneficial effects of adopting the above-mentioned further solution are: by filtering SMS messages to be identified through traffic monitoring and behavior analysis strategies, and only calling the large model to identify SMS messages with potential risks, it can achieve efficient processing under limited computing resources, and accurately capture spam SMS messages sent in batches by exploiting system vulnerabilities as well as fraudulent SMS messages with repetitive content related to express delivery.

[0019] Furthermore, the preset risk categories include at least fraud, political, and pornography / gambling; the execution of the corresponding preset handling strategy based on the category of the SMS to be identified includes: when the category of the SMS to be identified is fraud or political, blacklisting and suspending the sending number of the SMS to be identified; when the category of the SMS to be identified is pornography / gambling and the number of SMS messages sent by the sending number of the SMS to be identified exceeds a third threshold, blacklisting the sending number of the SMS to be identified.

[0020] The beneficial effects of adopting the above-mentioned further solutions are: implementing differentiated handling measures according to different risk categories of text messages, achieving precise hierarchical control, effectively curbing the spread of fraudulent text messages, and avoiding the impact of excessive handling on normal communication.

[0021] To address the aforementioned technical problems, the present invention also provides a spam text message identification and disposal system, comprising: A short message screening module, configured to obtain the to-be-identified short messages, where the to-be-identified short messages are the short messages screened from the original short messages and satisfying a preset abnormal behavior triggering policy; wherein, the preset abnormal behavior triggering policy is a determination rule describing the abnormal features of the short messages. A category recognition module, configured to use an artificial intelligence large model to perform semantic understanding and classification on the to-be-identified short messages, and obtain the category corresponding to the to-be-identified short messages, where the category is information indicating the content attribute or risk level of the short messages. A number disposal module, configured to, when the category corresponding to the to-be-identified short message belongs to a preset risk category, execute a corresponding preset disposal policy according to the category corresponding to the to-be-identified short message, so as to restrict the communication ability of the sending number corresponding to the to-be-identified short message.

[0022] To solve the above technical problems, the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it implements a method for identifying and disposing of spam short messages as described above.

[0023] To solve the above technical problems, the present invention further provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute a method for identifying and disposing of spam short messages as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of a method for identifying and disposing of spam short messages according to the present invention. Figure 2 It is a schematic diagram of a system for identifying and disposing of spam short messages according to the present invention. Figure 3 It is a schematic diagram of an electronic device according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0025] The principles and features of the present invention are described below. The examples given are only used to explain the present invention and are not intended to limit the scope of the present invention.

[0026] As described above, currently, spam short message monitoring systems generally identify spam short messages based on setting keywords. This technology has the following disadvantages: Lawbreakers often change keywords or add spaces, special symbols, etc. in the middle of keywords to bypass keyword recognition. For example, when setting the keyword "fraud", lawbreakers can write "fraud" as "fraud.", bypassing keyword detection.

[0027] Criminals often bypass keyword recognition by using homophones. For example, if the keyword is "fraud", criminals can write "fraud" as "zha pian" to bypass keyword detection.

[0028] Criminals often bypass keyword recognition by using synonyms or similar-meaning phrases. For example, if the keyword is "fraud", criminals might write "fraud" instead of "fraud" to bypass keyword detection.

[0029] Criminals exploited vulnerabilities in spam SMS monitoring systems to send a large number of illegal SMS messages in a short period of time, bypassing keyword identification.

[0030] Some fraudulent text messages, as well as those involving pornography or gambling, are difficult to identify based on the content of a single message alone. It is necessary to combine the text message behavior to accurately identify them. For example, fraudulent text messages about express delivery often contain the same content when sent from the same number within a short period of time, while normal express delivery text messages contain different tracking numbers, recipient information, and other details.

[0031] Example 1 Based on this, such as Figure 1 As shown, this embodiment provides a method for identifying and handling spam text messages, including: S101. Obtain the SMS message to be identified, wherein the SMS message to be identified is an SMS message selected from the original SMS messages that meets the preset abnormal behavior triggering strategy; wherein the preset abnormal behavior triggering strategy is a judgment rule describing the abnormal characteristics of the SMS message.

[0032] S102. Use an artificial intelligence big data model to perform semantic understanding and classification on the SMS to be identified, and obtain the category corresponding to the SMS to be identified. The category is information used to indicate the content attributes or risk level of the SMS.

[0033] S103. When the category corresponding to the SMS to be identified belongs to a preset risk category, execute the corresponding preset handling strategy according to the category corresponding to the SMS to be identified, so as to restrict the communication capability of the sending number corresponding to the SMS to be identified.

[0034] First, a pre-defined abnormal behavior trigger strategy filters raw SMS messages, sending only those with potential risks to a large-scale AI model for identification. This enables efficient processing of massive amounts of SMS messages with limited computing resources. Second, the AI ​​model performs deep semantic understanding and classification of SMS content, effectively identifying fraudulent messages that have been disguised by changing keywords, inserting noise, or using homophones or synonyms, overcoming the limitations of traditional keyword matching methods. Finally, when an SMS message is identified as belonging to a pre-defined risk category, targeted actions such as communication capability restrictions are implemented on the sending number, achieving precise control over fraudulent SMS messages.

[0035] In this embodiment, the spam SMS monitoring system receives raw SMS messages from the SMS center in real time. To efficiently identify fraudulent SMS messages with limited computing resources, not all SMS messages are analyzed using AI; instead, they are filtered based on a preset abnormal behavior triggering strategy. Only SMS messages that meet this strategy are sent to the subsequent large-scale artificial intelligence model (AI model) for identification.

[0036] Optionally, in an embodiment, the preset abnormal behavior triggering strategy is a traffic monitoring strategy or a behavior analysis strategy; wherein, the traffic monitoring strategy indicates that the total number of SMS messages sent by the same sending number reaches a first threshold within a preset first time window; the behavior analysis strategy indicates that the number of SMS messages with the same content sent by the same sending number reaches a second threshold within a preset second time window.

[0037] This embodiment provides two specific strategies, which can be selected or used in combination. In the spam SMS monitoring system, a behavior analysis strategy and a traffic monitoring strategy are configured separately, and the strategy parameters can be customized according to actual needs.

[0038] Traffic monitoring strategy: Set a first time window (e.g., 1 hour) and a first threshold (e.g., 100 messages). When a sending number sends a total of 100 SMS messages within 1 hour, filtering is triggered, and SMS messages sent by that number during that time period are marked as pending identification. In actual deployment, more stringent parameters can be set, such as sending 2000 messages within 24 hours.

[0039] Behavioral analysis strategy: Set a second time window (e.g., 2 minutes) and a second threshold (e.g., 30 messages). When a sending number sends 30 identical text messages within 2 minutes, filtering is triggered. This strategy is particularly effective in identifying fraudulent text messages related to express delivery services, which often contain highly repetitive content but lack any obvious malicious intent in individual messages.

[0040] The two strategies mentioned above can be configured independently. If either one is satisfied, the text message is considered to have potential risks and needs to be sent to an AI model for in-depth identification.

[0041] The AI ​​model can perform deep semantic understanding of SMS content and output the category to which the SMS belongs. In this embodiment, the model classifies SMS messages into the following six categories: fraud, pornography / gambling, political, marketing, debt collection, and normal.

[0042] To achieve high accuracy in SMS classification, this embodiment employs a two-stage fine-tuning approach to train the large AI model. The base model chosen is the open-source Qwen2.5-7B, deployed on a Huawei 8-NIC NPU server.

[0043] Optionally, in an embodiment, the large-scale artificial intelligence model is obtained through the following methods: acquiring an original labeled dataset, which contains multiple data samples consisting of instruction text, SMS content, and category labels; training a pre-defined large-scale artificial intelligence model based on the original labeled dataset using low-rank adaptation techniques to obtain an initial adjusted model; performing data augmentation processing on data samples in the original labeled dataset whose corresponding category labels are the target category to generate a set of difficult examples; and training the initial adjusted model based on the original labeled dataset and the set of difficult examples to obtain the large-scale artificial intelligence model.

[0044] Specifically, a large amount of historical SMS data is first acquired and categorized into six types by professionals: fraud, pornography / gambling, political, marketing, debt collection, and normal. The training data can be continuously iterated, but the SMS types remain constant. Each data sample is constructed as a JSON object containing three fields: instruction: fixed instruction text; input: SMS content; output: corresponding category label.

[0045] For example, the training data format is as follows: [ { "instruction": "Based on the content of the text messages, they are categorized into six types: fraudulent, pornographic / gambling, political, marketing, debt collection, and normal." "input":"Message content: Zuo Yu urgently needs to contact you. She has added you as a friend on Alipay. Please accept her request." "output": "Involved in fraud" }, { "instruction": "Based on the content of the text message, it will be categorized into six types: fraudulent, pornographic / gambling, political, marketing, debt collection, and normal. If the content of the text message is not categorized as 'fraudulent,' 'pornographic / gambling,' 'political,' 'marketing,' or 'debt collection,' it will be classified as 'normal.'" "input":"SMS content: [Shopping Mall] Member: Happy Birthday! The shopping mall is offering you exclusive birthday benefits: a movie ticket for Saturday morning at 10:00 AM (excluding public holidays) and a restaurant discount coupon set. To claim your benefits: contact customer service on the fourth floor." "output":"Marketing" }, { "instruction": "Based on the content of the text messages, they are categorized into six types: fraudulent, pornographic / gambling, political, marketing, debt collection, and normal." "input":"SMS content: Device 3406150546, low battery, please charge." "output":"Normal" } ].

[0046] Optionally, in an embodiment, the step of training a preset large-scale artificial intelligence model using low-rank adaptation technique based on the original labeled dataset to obtain an initial adjustment model includes: sequentially concatenating the instruction text, SMS content, and category label from each data sample in the original labeled dataset into an input sequence; adding a low-rank matrix to the target parameters in the preset large-scale artificial intelligence model based on low-rank adaptation technique; for each input sequence, inputting the input sequence into the preset large-scale artificial intelligence model for causal language modeling prediction, and calculating the loss between the prediction result obtained based on label masking operation and the category label of the input sequence, so as to update the parameters in the low-rank matrix according to the loss; repeating the above operations for each input sequence until a preset number of times is reached to obtain the initial adjustment model.

[0047] Specifically, when selecting a large open-source AI model, it is important to consider both its strong natural language recognition capabilities and the computing power of the local GPU server. Taking all factors into account, a model with around 7B parameters can be selected, such as the "Qwen2.5-7B" large open-source model selected in this embodiment.

[0048] The goal of the first fine-tuning phase is to enable the base model to learn general classification capabilities. Specifically, the instruction, input, and output from each data sample are concatenated in sequence into a complete text sequence. The first part of this sequence contains the instruction and text message content, while the second part contains the category label to be predicted.

[0049] To conserve computational resources, a lightweight fine-tuning technique called Low-Rank Adaptation (LoRA) is employed. Specifically, low-rank matrices are added to the target parameters of the base model (including q_proj, k_proj, v_proj, and o_proj of the attention layer, and gate_proj, up_proj, and down_proj of the feedforward network). The low-rank parameter r is set to 8, and the scaling factor lora_alpha is set to 16. All other parameters of the base model are frozen, and only the parameters of the low-rank matrices are updated during training.

[0050] The concatenated input sequence is fed into the model for causal language modeling and prediction, meaning the model predicts the next word word by word based on the preceding text. When calculating the loss, a label masking technique is used: labels belonging to the instruction text and SMS content in the input sequence are set to ignored values ​​(e.g., -100), and only labels belonging to the category labels are retained for calculating the cross-entropy loss. In this way, the model only learns gradients from the prediction errors of the category labels, and does not learn to predict fixed instruction text.

[0051] Repeat the above steps for each input sequence in the training set. Each complete traversal of the entire dataset is called an epoch. This example sets the training to 3 epochs. After each epoch, the low-rank matrix parameters are saved. After training, an initially tuned model with basic classification capabilities is obtained.

[0052] By employing low-rank adaptation techniques, only the key attention layer of the model is fine-tuned, which reduces the consumption of computational resources while preserving the model's generalization ability. Furthermore, the cross-entropy loss function is used to focus on optimizing the recognition results and enhance the classification decision-making ability.

[0053] Specifically, the model fine-tuning process can be implemented using a deployed Python fine-tuning program, part of which is shown below: lora_config=LoraConfig( r=8, lora_alpha=16, target_modules=["q_proj","k_proj","v_proj","o_proj", "gate_proj","up_proj","down_proj"], lora_dropout=0.0, bias="none", task_type=TaskType.CAUSAL_LM ) model=get_peft_model(model,lora_config) if local_rank==0: trainable_params=sum(p.numel()for p in model.parameters()ifp.requires_grad) total_params=sum(p.numel()for p in model.parameters()) trainable_percentage=(trainable_params / total_params) 100 logger.info(f"√Model LoRA configuration complete") logger.info(f"M trainable parameters: {trainable_params:,}|Total parameters: {total_params:,}|Trainable percentage: {trainable_percentage:.2f}%") phases=[ { "name":"Phase-I: Standard Fine-tuning", "epochs":3, "1r":1e-4, "phase_id":0, "desc":"Learn common fraud characteristics", "batch_size":2, "max_length":512, "gradient_accumulation":8 }, { "name":"Phase-II: Adversarial Enhancement Training", "epochs":1, "1r":5e-5, "phase_id":1, "desc":"Enhancing the identification of complex cases", "batch_size":1, "max_length":512, "gradient_accumulation":8 } ].

[0054] To balance the model's fundamental capabilities with its adaptability to complex scenarios, a step-by-step optimization approach is used to improve task performance. The program fine-tunes the basic model in two stages. The first stage (standard fine-tuning) trains the model using raw data, allowing it to learn common fraud features (such as keywords like "fraudulent" and "verification code" and classification logic). LoRA lightweight adjustment is used to fine-tune model parameters, laying the foundation for basic discrimination capabilities and ensuring accurate identification of typical cases. The second stage (adversarial enhancement training) only enhances fraud samples by performing synonym replacement, noise injection, and structural changes to generate difficult examples. At the same time, a weighted loss (doubling the weight of difficult examples) is used to strengthen the model's ability to identify variant fraud patterns, addressing the insufficient identification of complex and variant cases in the first stage and improving robustness.

[0055] Optionally, in an embodiment, the step of performing data augmentation processing on data samples in the original labeled dataset whose corresponding category label is the target category to generate a hard example sample set includes: for each data sample in the original labeled dataset whose corresponding category label is the target category, processing the SMS content corresponding to the data sample using at least one of synonym replacement enhancement, noise injection enhancement, and structural change enhancement to generate new data samples; wherein, the synonym replacement enhancement is based on a predefined fraud domain synonym library, replacing the target word in the SMS content with the synonym corresponding to the target word with a preset probability; the noise injection enhancement is inserting punctuation marks, spaces, or characters at random positions in the SMS content; the structural change enhancement is based on a preset variety of fraud SMS disguise templates, adding prefixes or suffixes to the SMS content; and obtaining a hard example sample set based on each of the new data samples.

[0056] The target categories include at least fraud, and may also include pornography, gambling, politics, marketing, and debt collection. Building upon the first phase, the second phase involves fine-tuning three new enhancement strategies to address the evolving characteristics of fraudulent text messages.

[0057] Specifically, the synonym replacement enhancement involves building a dedicated thesaurus for the fraud domain (containing over 100 sets of near-synonyms such as "fraudulent," "scam," "fraudulent," "verification code," "security code," and "dynamic code"), and randomly replacing key terms in text messages with a 10% probability. This can simulate the behavior of fraudsters evading detection through synonym replacement, strengthening the model's ability to identify semantically equivalent variants of language.

[0058] The following is an example of a synonym enhancement configuration, which can be optimized to adapt to emerging new situations: synonyms={ "Involved in fraud": ["fraud", "scam", "deception", "extortion", "extortion"], "Bank Card": ["Credit Card", "Debit Card", "Account", "Card Number", "Account Name", "Payment Account"], "Verification Code":["Confirmation Code","Security Code","Dynamic Code","Verification Code","Verification Password"],……}.

[0059] Noise enhancement involves randomly inserting punctuation marks (such as "、"" / ""—"), spaces, or special characters (such as ") into the SMS text. The "~" symbol simulates input errors or deliberate format obfuscation in real text messages. It can improve the model's robustness to non-standard text and solve the problem of recognition failure caused by format variations.

[0060] The following is an example of an injected noise enhancement configuration, which can be optimized to adapt to emerging new situations: noise_chars=[".",",","!","?","~"," ","-","—","=","·","`","〞","'","(",")","

","

[0061] Enhanced structural variation: Ten common fraudulent SMS templates are provided (including disguised financial institution messages, disguised delivery notifications, threatening inducements, etc.). The text structure is altered by prefixing / suffixing (e.g., "[Bank A] Your account is at risk, click the link to verify"). This covers common fraudulent SMS disguise techniques and strengthens the model's deep semantic understanding of structured variant language.

[0062] A template is randomly selected, and the original SMS content is embedded into the template to generate a new structural variant. In this embodiment, 10 scenarios for structural variation enhancement have been summarized, which can be optimized according to emerging new situations: 1. Notification type (institution prefix) - includes disguised financial institutions. For example, lambda t:f"

Important Notice

[0063] 2. Induced response type For example, lambda t:f "Friendly reminder: {t}, reply 1 for priority processing!".

[0064] 3. Disguised courier / logistics services - including disguised courier consultation. For example, lambda t:f"

Courier Notification

[0065] 4. Faking social / dating interactions For example, lambda t:f "Hello friend, I was introduced by Aunt Zhang, {t}".

[0066] 5. Funds / Loans Disguised - Including Inducement to Perform Repayment Procedures For example, lambda t:f"{t}, earn 500+ per day, no risk guarantee!", lambda t:f"Ms / Mr., {t}, when you log in to the APP and click to repay, it shows that the balance is insufficient. Please click to process again."

[0067] 6. Threat / Urgency Type For example, lambda t:f"{t}, please act immediately, valid today!".

[0068] 7. The compassionate / help-seeking type For example, lambda t:f"Dear, {t}, exclusive benefits for new users, first come first served!", lambda t:f"Hello sister, {t}, I am your friend's sister, I'm in trouble and need your help."

[0069] 8. Part-time / Recruitment Disguise For example, lambda t:f "Hello, your application for typist position has been approved, {t}, daily pay 300, reply 3 to join the company."

[0070] 9. Refund / Rebate Disguise - Including Merchant Shipment Disguise For example, lambda t:f"{t}, no fees required, scan the code to claim immediately!".

[0071] 10. Game / Gambling Disguise - Including Service Request Disguise For example, lambda t:f"Warning: {t}, your account is at risk, please verify immediately!", lambda t:f"

Home Appliance Service

[0072] Optionally, in an embodiment, training the initial adjustment model based on the original labeled dataset and the hard example sample set to obtain the large artificial intelligence model includes: mixing data samples from the original labeled dataset with data samples from the hard example sample set, and training the initial adjustment model using a weighted loss function to obtain the large artificial intelligence model; wherein, the loss weight of each data sample in the hard example sample set is greater than the loss weight of each data sample in the original labeled dataset.

[0073] The model is then retrained by mixing all samples from the original labeled dataset with samples from the hard example set. When calculating the loss, a weighted cross-entropy loss is used, where the loss weight for each data sample in the hard example set is greater than the loss weight for each data sample in the original labeled dataset. This ensures the model pays more attention to hard examples when updating parameters, thereby improving its ability to identify variant fraudulent text messages. The final large-scale AI model is obtained after training.

[0074] The two-stage adaptive AI model fine-tuning method described above addresses the issues of weak generalization ability and low accuracy in identifying complex cases in existing spam SMS identification models. The first stage fine-tunes the model using LoRA lightweight tuning and a causal language modeling loss function, giving the AI ​​model strong general recognition capabilities for spam SMS. The second stage, building on the first, adds three enhancement strategies—synonym replacement, noise injection, and structural variation—to address the variant characteristics of spam SMS. These strategies enhance fraudulent samples by generating difficult examples, and a weighted loss (doubling the weight of difficult examples) is used to strengthen the model's ability to identify variant fraudulent phrases. This solves the problem of insufficient recognition of complex and variant cases in the first stage, significantly improving the model's robustness.

[0075] Optionally, in the embodiments, the preset risk categories include at least fraud, political, and pornography / gambling; the execution of the corresponding preset handling strategy according to the category of the SMS to be identified includes: when the category of the SMS to be identified is fraud or political, blacklisting and suspending the sending number of the SMS to be identified; when the category of the SMS to be identified is pornography / gambling and the number of SMS messages sent by the sending number of the SMS to be identified exceeds a third threshold, blacklisting the sending number of the SMS to be identified.

[0076] The system pre-defines risk categories that require priority control, including at least fraud, political involvement, and pornography / gambling. When the category output by the AI ​​model falls into one of these risk categories, differentiated handling strategies are implemented based on the specific category to restrict the communication capabilities of the sending number.

[0077] In this embodiment, if a text message is identified as fraudulent or politically sensitive, the sending number will be blacklisted and its service suspended. After being blacklisted, the number will be unable to send text messages; after being suspended, the number's communication functions will be completely halted.

[0078] If a text message is identified as involving pornography or gambling, and the number of messages sent from that number exceeds a third threshold within a preset third time window (e.g., 200 messages sent within one hour), the number will be blacklisted. If the number of messages sent is small, it can be blocked without blacklisting to balance control and the risk of misjudgment. In addition, alerts can be sent to relevant personnel so that operations staff can intervene promptly.

[0079] In actual use, the company's spam monitoring system was enhanced with behavioral analysis (forwarding SMS messages with identical content to the cybersecurity data processing server when a set number are reached within a certain timeframe) and spam SMS data forwarding (setting traffic policies to forward SMS messages meeting certain traffic thresholds to the cybersecurity data processing server). A cybersecurity data processing server was built on the company's intranet to process data requiring AI recognition. GPU servers were deployed to host environments for AI large-scale model fine-tuning and API services. Strict firewalls and system account access restrictions were implemented on both the data processing server and the GPU server to ensure data security.

[0080] The AI ​​foundational model is fine-tuned on a GPU server to enable it to powerfully identify spam SMS messages. This embodiment deploys the fine-tuned AI model on an NPU server, using the Mindie inference engine to provide API services. Specifically, deployment is achieved through Docker containerization: a container is created, sharing the inter-process communication namespace with the host machine, and running in privileged mode, allowing the container to directly use the host machine's network ports without additional mapping. The NPU device on the host machine is mounted into the container, along with the Ascend driver directory, log directory, and model file directory. The Mindie inference image is used as the container image. After the container starts, the API service of the foundational model is launched within the container, allowing external applications to call this API interface for real-time classification of SMS messages. After deployment, the container's running status and resource usage can be viewed using container management tools. This deployment method fully utilizes the NPU's computing resources, achieving low-latency, high-throughput online inference services.

[0081] Based on the traffic and behavior analysis policies configured in the monitoring system, the system forwards SMS messages requiring AI identification to the cybersecurity data processing server. On the server, the messages are JSON encoded, converting them into a data format recognizable by the AI ​​model. The encoded data is then sent to the GPU server's AI interface for spam message type identification. Finally, SMS messages identified by the AI ​​model are handled according to their type; for example, numbers associated with fraudulent messages are directly blocked, while numbers associated with pornography or gambling are blacklisted.

[0082] On the cybersecurity data processing server, the AI ​​model is used to identify data uploaded by the spam SMS monitoring system. After actual testing on the live network, the daily accuracy rate for identifying fraudulent SMS messages is over 96%. The remaining 4% of SMS messages, while not fraudulent, are still spam messages related to pornography, gambling, or debt collection; the AI ​​model's accuracy in identifying these is high, and the overall results are good.

[0083] To further verify the model's performance, 561 SMS samples were randomly selected for phased testing: in the first phase, the model was fine-tuned and correctly identified 555 samples with an accuracy of 98.93%; in the second phase, the model was fine-tuned and correctly identified 560 samples, with the accuracy improved to 99.82%.

[0084] The effectiveness of AI model fine-tuning is strongly correlated with the quality of training samples, the sample coverage in the enhancement strategy, and the test data. The above-mentioned fine-tuning training methods can be used to continuously improve the training sample data and the sample coverage in the enhancement strategy through actual network applications, thereby continuously improving the accuracy of AI models in identifying fraudulent text messages.

[0085] Example 2 like Figure 2 As shown, this embodiment provides a spam text message identification and disposal system 200, including: SMS filtering module 201 is used to acquire SMS messages to be identified, wherein the SMS messages to be identified are SMS messages that meet the preset abnormal behavior triggering strategy selected from the original SMS messages; wherein the preset abnormal behavior triggering strategy is a judgment rule describing the abnormal characteristics of the SMS messages. The category identification module 202 is used to perform semantic understanding and classification on the SMS to be identified using an artificial intelligence big data model to obtain the category corresponding to the SMS to be identified. The category is information used to indicate the content attributes or risk level of the SMS. The number processing module 203 is used to execute a corresponding preset processing strategy according to the category of the SMS to be identified when the category of the SMS to be identified belongs to a preset risk category, so as to restrict the communication capability of the sending number corresponding to the SMS to be identified.

[0086] Optionally, in an embodiment, the large-scale artificial intelligence model is obtained through the following methods: acquiring an original labeled dataset, which contains multiple data samples consisting of instruction text, SMS content, and category labels; training a pre-defined large-scale artificial intelligence model based on the original labeled dataset using low-rank adaptation techniques to obtain an initial adjusted model; performing data augmentation processing on data samples in the original labeled dataset whose corresponding category labels are the target category to generate a set of difficult examples; and training the initial adjusted model based on the original labeled dataset and the set of difficult examples to obtain the large-scale artificial intelligence model.

[0087] Optionally, in an embodiment, the step of training a preset large-scale artificial intelligence model using low-rank adaptation technique based on the original labeled dataset to obtain an initial adjustment model includes: sequentially concatenating the instruction text, SMS content, and category label from each data sample in the original labeled dataset into an input sequence; adding a low-rank matrix to the target parameters in the preset large-scale artificial intelligence model based on low-rank adaptation technique; for each input sequence, inputting the input sequence into the preset large-scale artificial intelligence model for causal language modeling prediction, and calculating the loss between the prediction result obtained based on label masking operation and the category label of the input sequence, so as to update the parameters in the low-rank matrix according to the loss; repeating the above operations for each input sequence until a preset number of times is reached to obtain the initial adjustment model.

[0088] Optionally, in an embodiment, the step of performing data augmentation processing on data samples in the original labeled dataset whose corresponding category label is the target category to generate a hard example sample set includes: for each data sample in the original labeled dataset whose corresponding category label is the target category, processing the SMS content corresponding to the data sample using at least one of synonym replacement enhancement, noise injection enhancement, and structural change enhancement to generate new data samples; wherein, the synonym replacement enhancement is based on a predefined fraud domain synonym library, replacing the target word in the SMS content with the synonym corresponding to the target word with a preset probability; the noise injection enhancement is inserting punctuation marks, spaces, or characters at random positions in the SMS content; the structural change enhancement is based on a preset variety of fraud SMS disguise templates, adding prefixes or suffixes to the SMS content; and obtaining a hard example sample set based on each of the new data samples.

[0089] Optionally, in an embodiment, training the initial adjustment model based on the original labeled dataset and the hard example sample set to obtain the large artificial intelligence model includes: mixing data samples from the original labeled dataset with data samples from the hard example sample set, and training the initial adjustment model using a weighted loss function to obtain the large artificial intelligence model; wherein, the loss weight of each data sample in the hard example sample set is greater than the loss weight of each data sample in the original labeled dataset.

[0090] Optionally, in an embodiment, the preset abnormal behavior triggering strategy is a traffic monitoring strategy or a behavior analysis strategy; wherein, the traffic monitoring strategy indicates that the total number of SMS messages sent by the same sending number reaches a first threshold within a preset first time window; the behavior analysis strategy indicates that the number of SMS messages with the same content sent by the same sending number reaches a second threshold within a preset second time window.

[0091] Optionally, in the embodiments, the preset risk categories at least include fraud, political involvement, and pornography / gambling; the number processing module 203 includes: The first processing unit is used to blacklist and suspend the sending number corresponding to the SMS message to be identified when the category of the SMS message to be identified is fraud or political. The second processing unit is used to blacklist the sending number corresponding to the SMS to be identified when the category of the SMS to be identified is related to pornography or gambling and the number of SMS messages sent by the sending number corresponding to the SMS to be identified exceeds a third threshold.

[0092] In some embodiments, the spam SMS identification and disposal system 200 of the present invention can be implemented in a combination of hardware and software. As an example, the spam SMS identification and disposal system 200 of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute a spam SMS identification and disposal method of the present invention. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0093] The modules described in the embodiments of this invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0094] Example 3 like Figure 3 As shown, this embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a spam SMS identification and disposal method as described in Embodiment 1.

[0095] In other words, an electronic device according to an embodiment of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store computer programs; the processor is used to execute a spam SMS identification and disposal method shown in any embodiment of the present invention by calling the computer programs.

[0096] In one alternative embodiment, an electronic device is provided. Figure 3 The illustrated electronic device 300 includes a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, for example, via a bus 302. Optionally, the electronic device 300 may further include a transceiver 304, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 304 is not limited to one type, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present invention.

[0097] Processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 301 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0098] Bus 302 may include a path for transmitting information between the aforementioned components. Bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 302 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The bus 302 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0099] The memory 303 may be a ROM (Read Only Memory) or other type of static storage device capable of storing static information and instructions, RAM (Random Access Memory) or other type of dynamic storage device capable of storing information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0100] The memory 303 is used to store application code (computer program) for executing the present invention, and its execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the content shown in the foregoing method embodiments.

[0101] Among them, electronic devices can also be terminal devices, which can be any device that can install applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0102] It should be noted that, Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0103] Example 4 This embodiment provides a non-transitory computer-readable storage medium that stores computer instructions for causing a computer to execute a spam SMS identification and disposal method as described in Embodiment 1.

[0104] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0105] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned method for identifying and handling spam text messages.

[0106] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0107] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0108] The computer-readable storage medium provided in this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EEPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0109] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0110] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0111] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0112] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0113] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for identifying and handling spam messages, characterized in that, include: Obtain the SMS message to be identified, which is an SMS message selected from the original SMS messages that meets the preset abnormal behavior triggering strategy; wherein, the preset abnormal behavior triggering strategy is a judgment rule describing the abnormal characteristics of the SMS message. The text message to be identified is semantically understood and classified using a large artificial intelligence model to obtain the category corresponding to the text message to be identified. The category is information used to indicate the content attributes or risk level of the text message. When the category corresponding to the SMS message to be identified belongs to a preset risk category, the corresponding preset handling strategy is executed according to the category of the SMS message to be identified, so as to restrict the communication capability of the sending number corresponding to the SMS message to be identified.

2. The method for identifying and handling spam text messages according to claim 1, characterized in that, The large-scale artificial intelligence model was obtained in the following way: Obtain the original labeled dataset, which contains multiple data samples consisting of instruction text, SMS content, and category labels; Based on the original labeled dataset, a pre-defined large-scale artificial intelligence model is trained using low-rank adaptation techniques to obtain an initial adjusted model; Data augmentation processing is performed on the data samples in the original labeled dataset whose corresponding category labels are the target category to generate a hard example sample set; Based on the original labeled dataset and the set of difficult examples, the initial adjustment model is trained to obtain the large artificial intelligence model.

3. The method for identifying and handling spam text messages according to claim 2, characterized in that, The process of training a pre-defined large-scale artificial intelligence model using low-rank adaptation techniques based on the original labeled dataset to obtain an initial adjusted model includes: The instruction text, SMS content, and category label in each data sample of the original labeled dataset are concatenated in sequence to form the input sequence. Based on low-rank adaptation technology, a low-rank matrix is ​​added to the target parameters in the pre-set large-scale artificial intelligence model; For each input sequence, the input sequence is fed into a preset large-scale artificial intelligence model for causal language modeling and prediction, and the loss between the prediction result calculated based on the label masking operation and the category label of the input sequence is updated according to the loss. Repeat the above operations for each input sequence until a preset number of times is reached to obtain the initial adjustment model.

4. The method for identifying and handling spam text messages according to claim 2, characterized in that, The step of performing data augmentation on data samples in the original labeled dataset whose corresponding category label is the target category to generate a hard example sample set includes: For each data sample in the original labeled dataset whose corresponding category label is the target category, at least one of the following methods is used to process the SMS content corresponding to the data sample to generate a new data sample: synonym replacement enhancement, noise injection enhancement, and structural change enhancement. The synonym replacement enhancement involves replacing target words in the SMS content with their corresponding synonyms based on a predefined thesaurus for the fraud domain, with a preset probability; the noise injection enhancement involves inserting punctuation marks, spaces, or characters at random positions in the SMS content; and the structural change enhancement involves adding prefixes or suffixes to the SMS content based on a variety of preset fraud SMS spoofing templates. Based on each of the new data samples, a set of difficult examples is obtained.

5. The method for identifying and handling spam text messages according to claim 2, characterized in that, The process of training the initial adjustment model based on the original labeled dataset and the difficult example sample set to obtain the large artificial intelligence model includes: The data samples in the original labeled dataset are mixed with the data samples in the hard example dataset, and the initial adjusted model is trained using a weighted loss function to obtain the large artificial intelligence model; The loss weight of each data sample in the difficult example set is greater than the loss weight of each data sample in the original labeled dataset.

6. The method for identifying and handling spam text messages according to claim 1, characterized in that, The preset abnormal behavior triggering strategy is a traffic monitoring strategy or a behavior analysis strategy; wherein, the traffic monitoring strategy indicates that the total number of SMS messages sent by the same sending number reaches a first threshold within a preset first time window; the behavior analysis strategy indicates that the number of SMS messages with the same content sent by the same sending number reaches a second threshold within a preset second time window.

7. The method for identifying and handling spam text messages according to claim 1, characterized in that, The preset risk categories include at least fraud, political involvement, and involvement in pornography and gambling; The step of executing a preset processing strategy according to the category of the SMS message to be identified includes: When the category of the SMS message to be identified is fraud or political, the sending number corresponding to the SMS message to be identified will be blacklisted and the number will be suspended. When the category of the SMS message to be identified is related to pornography or gambling and the number of SMS messages sent by the number corresponding to the SMS message to be identified exceeds the third threshold, the number corresponding to the SMS message to be identified will be blacklisted.

8. A spam text message identification and disposal system, characterized in that, include: The SMS filtering module is used to acquire SMS messages to be identified, wherein the SMS messages to be identified are those selected from the original SMS messages that meet a preset abnormal behavior triggering strategy; wherein the preset abnormal behavior triggering strategy is a judgment rule describing the abnormal characteristics of the SMS messages. The category recognition module is used to perform semantic understanding and classification of the SMS message to be identified using a large artificial intelligence model, and to obtain the category corresponding to the SMS message to be identified. The category is information used to indicate the content attributes or risk level of the SMS message. The number processing module is used to execute a corresponding preset processing strategy based on the category of the SMS to be identified when the category of the SMS to be identified belongs to a preset risk category, so as to restrict the communication capability of the sending number corresponding to the SMS to be identified.

9. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a spam text message identification and disposal method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to execute the spam text message identification and disposal method according to any one of claims 1 to 7.