Spam message detection method, device and equipment and storage medium

Abstract

The application discloses a kind of spam message detection method, device, equipment and storage medium, disclose: obtaining to-be-detected short message, and to-to-be-detected short message is executed multi-modal feature analysis, obtain semantic feature vector, risk feature vector and time sequence feature vector;To semantic feature vector, risk feature vector and time sequence feature vector, correlation graph analysis is carried out, determine the first weight corresponding to semantic feature vector, the second weight corresponding to risk feature vector and the third weight corresponding to time sequence feature vector;According to the first weight, the second weight and the third weight, feature fusion is carried out to semantic feature vector, risk feature vector and time sequence feature vector, and obtains fusion feature;According to fusion feature, detect whether to-be-detected short message is spam message.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, device, and storage medium for detecting spam text messages. Background Technology

[0002] Currently, the following solutions are commonly used for spam SMS detection: The first solution is based on keyword filtering and number segment monitoring. This involves setting keyword blacklists, whitelists, and number segment rules on the SMS gateway side to directly block SMS messages that match the rules. The second solution is based on high / low frequency sliding time slice monitoring. This involves statistically analyzing the SMS sending frequency within a fixed time window to identify and block SMS messages with abnormal sending frequencies. The third solution is a text preprocessing solution based on traditional Chinese character conversion. This involves pre-converting traditional Chinese characters in the SMS text to simplified Chinese characters to assist in keyword matching rule detection. The fourth solution is based on a multi-module combined model. This involves running different modules such as keyword matching, frequency monitoring, and text rules independently, and then performing simple weighted voting or static logic concatenation on their processing results to obtain the final detection result.

[0003] While the above solutions can detect spam SMS messages, they all have significant technical problems: the first and second solutions rely too heavily on preset static rules, allowing attackers to easily bypass detection through homophones, symbol insertion, and dynamic adjustments to the sending rhythm; the traditional Chinese character conversion rule in the third solution is limited in function and cannot flexibly handle variant characters not in the conversion table, or complex text variations such as regional dialects; and the combined model used in the fourth solution is a simple static fusion of multiple modules, with each module's decision-making being isolated, resulting in a high false positive rate under sudden public events or new attack methods, and the combined model updates rely on manual feature extraction and configuration, making real-time adaptation difficult. Summary of the Invention

[0004] The main objective of this invention is to provide a spam SMS detection method, apparatus, device, and storage medium, aiming to solve the problems of existing spam SMS detection methods, which rely on preset static rules and static module combinations, resulting in easily bypassable detection methods, high false alarm rates in complex scenarios, and difficulty in real-time adaptation of new attack methods due to manual model updates.

[0005] In a first aspect, embodiments of the present invention provide a method for detecting spam text messages, the method comprising: The system acquires a text message to be tested and performs multimodal feature analysis on it to obtain a semantic feature vector, a risk feature vector, and a temporal feature vector. The multimodal feature analysis includes: performing semantic analysis on the text content of the text message to generate a semantic feature vector; performing risk analysis on the metadata of the text message to generate a risk feature vector; the metadata includes at least one of user identifier, receiving number, sending device information, and embedded links; and performing temporal modeling analysis on the historical behavior data of the sending device to generate a temporal feature vector. A correlation graph analysis is performed on the semantic feature vector, the risk feature vector, and the time series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time series feature vector. Based on the first weight, the second weight, and the third weight, feature fusion is performed on the semantic feature vector, the risk feature vector, and the temporal feature vector to obtain fused features; Based on the fusion features, it is determined whether the SMS message to be detected is a spam message.

[0006] Secondly, embodiments of the present invention provide a spam text message detection device, the device comprising: An analysis module is used to acquire the SMS message to be detected and perform multimodal feature analysis on the SMS message to obtain semantic feature vectors, risk feature vectors, and temporal feature vectors. The multimodal feature analysis includes: performing semantic analysis on the text content of the SMS message to generate semantic feature vectors; performing risk analysis on the metadata of the SMS message to generate risk feature vectors; the metadata includes at least one of user identifier, receiving number, sending device information, and embedded links; and performing temporal modeling analysis on the historical behavior data of the sending end to generate temporal feature vectors. The determination module is used to perform correlation graph analysis on the semantic feature vector, the risk feature vector, and the time series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time series feature vector. The generation module is used to perform feature fusion on the semantic feature vector, the risk feature vector and the temporal feature vector according to the first weight, the second weight and the third weight to obtain fused features; The detection module is used to detect whether the SMS message to be detected is a spam SMS message based on the fusion features.

[0007] Thirdly, embodiments of the present invention provide an electronic device, including: a processor; and a memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the steps of the method described in the first aspect above.

[0008] Fourthly, embodiments of the present invention provide a computer-readable storage medium for storing computer-executable instructions that, when executed by a processor, implement the steps of the method described in the first aspect above.

[0009] Fifthly, embodiments of the present invention provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0010] The at least one technical solution provided by the embodiments of the present invention can achieve the following technical effects: By introducing multimodal deep analysis and a dynamic fusion decision-making mechanism, this approach addresses the shortcomings of existing solutions, which rely on pre-set static rules and simple module splicing, resulting in limited detection methods, susceptibility to bypassing, and difficulty in adapting to new attacks. Through correlation graph analysis of text semantics, metadata risks, and behavioral temporal sequences, it can comprehensively identify complex variants and collaborative attack patterns from multiple dimensions, overcoming the limitations of single rules or text processing. By dynamically assigning weights to different modal features and performing deep fusion through correlation graph analysis, it achieves adaptive adjustment of model decisions, replacing rigid static rule combinations and voting mechanisms. This effectively reduces false positive rates and improves overall detection accuracy and real-time performance in unexpected scenarios or when facing new attack methods. Attached Figure Description

[0011] Figure 1 This is one of the flowcharts illustrating the spam SMS detection method provided in this embodiment of the invention; Figure 2 This is a second schematic flowchart of the spam SMS detection method provided in this embodiment of the invention; Figure 3 This is the third flowchart illustrating the spam SMS detection method provided in this embodiment of the invention. Figure 4 A schematic diagram of the module composition of the spam SMS detection device 400 provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0013] The technical solutions provided by the various embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0014] Please see Figure 1 , Figure 1 This is a flowchart illustrating a spam SMS detection method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes the following steps: Step S102: Obtain the SMS message to be detected and perform multimodal feature analysis on the SMS message to be detected to obtain semantic feature vector, risk feature vector, and temporal feature vector; wherein, the multimodal feature analysis includes: performing semantic analysis on the text content of the SMS message to be detected to generate semantic feature vector; performing risk analysis on the metadata of the SMS message to be detected to generate risk feature vector; the metadata includes at least one of user identifier, receiving number, device information of the sending end, and embedded link; performing temporal modeling analysis on the historical behavior data of the sending end to generate temporal feature vector.

[0015] Step S104: Perform correlation graph analysis on the semantic feature vector, risk feature vector, and time series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time series feature vector.

[0016] Step S106: Based on the first weight, the second weight, and the third weight, perform feature fusion on the semantic feature vector, the risk feature vector, and the temporal feature vector to obtain the fused features.

[0017] Step S108: Based on the fusion features, detect whether the SMS message to be detected is a spam SMS message.

[0018] In embodiments of the present invention, a text message to be detected can be acquired, and multimodal feature analysis can be performed on the text message to obtain a semantic feature vector, a risk feature vector, and a temporal feature vector. The multimodal feature analysis can include the following three parallel analysis processes: semantic analysis of the text content of the text message to be detected to generate a semantic feature vector; risk analysis of the metadata of the text message to be detected to generate a risk feature vector; and temporal modeling analysis of the historical behavior data of the sending end to generate a temporal feature vector. The metadata can include at least one of the following: user identifier, receiving number, sending end device information, and embedded links.

[0019] In one example, after obtaining the SMS message to be detected, the current context information related to that SMS message can be acquired. Based on this current context information and a pre-defined blocking rule base, the SMS message to be detected can be pre-screened. This pre-screening is a decision point; if the SMS message is determined to need to be blocked, the process can terminate, i.e., the SMS message to be detected is blocked; if the SMS message passes the screening, it can be identified as an object that needs in-depth analysis, and multimodal feature analysis can be performed on it.

[0020] Among them, the current context information is a comprehensive environmental variable that can be used to support pre-screening decisions. It may include, but is not limited to, the following factors: the current time period, such as weekday working hours, nighttime rest time, or holidays; the overall SMS traffic situation in the current network area, such as whether regional sudden traffic peaks have been detected; and the types of spam SMS attacks that are currently prevalent, such as whether financial fraud or e-commerce order-brushing is prevalent.

[0021] For SMS messages that pass the pre-screening and enter multimodal feature analysis, their data from various aspects can be processed. This data forms the basis of multimodal analysis and can mainly include: the text content of the SMS message, the SMS message metadata, the historical behavior data of the sender, and the relational data in the network. The text content of the SMS message is the original message body to be analyzed; the SMS message metadata is a set of information describing the SMS message attributes and context, which can include at least user identifiers, such as the sender's mobile phone number MSISDN (Mobile Station International Subscriber Directory Number); the recipient number, i.e., the target mobile phone number of the SMS message; the device information of the sender, such as the address or device identifier of the Mobile Switching Center (MSC) that sent the SMS message; and the URL (Uniform Resource Locator) of the embedded links in the SMS message content. The historical behavior data of the sender can be a record of the sender's SMS sending behavior over a period of time, which can include, but is not limited to, historical sending records, sending timestamp sequences, etc.; the relational data can be data that can be mined from network interactions that reflects the interaction and connection between different entities such as sending devices, receiving numbers, and linked domain names.

[0022] In one example, when performing multimodal feature analysis on SMS messages that have passed pre-screening, text semantic analysis can be performed. Semantic analysis of the SMS message content can be conducted using a semantic analysis model. First, the original text of the input SMS message can be preprocessed, including but not limited to word segmentation, stop word removal, spelling correction, and conversion of Traditional Chinese to Simplified Chinese. After preprocessing, the preprocessed text sequence can be input into a pre-trained deep learning semantic analysis model. The semantic analysis model can be a pre-trained language model based on the Transformer architecture, such as the RoBERTa-12L model. This model encodes the input SMS text, generating a 768-dimensional dynamic word vector sequence to represent the deep semantics of each word in its context. Because it can understand the specific meaning of words in context, this semantic analysis model can capture the deep semantics of the text, rather than simply performing surface keyword matching. The last hidden state or a specific pooling layer of this semantic analysis model can output a high-dimensional, dense semantic feature vector. This semantic feature vector can comprehensively represent the semantic intent and theme of the entire text message.

[0023] To enhance the robustness of the semantic analysis model against adversarial samples, such as techniques used by attackers to evade detection, such as the insertion of homophones, near-homophones, or special symbols, this example introduces an adversarial training strategy during the model's training process. Specifically, during model training, in addition to using the standard cross-entropy loss function, an adversarial loss is calculated. The adversarial training steps include: first, adding a small, gradient-sign-based perturbation to the input word embedding vectors, aiming to maximize the model's loss. Then, the model is trained simultaneously on both the original samples and samples with the added adversarial perturbation, with the goal of minimizing the sum of the losses in both cases. The semantic analysis model trained in this way is better resistant to text obfuscation attacks, thus extracting more robust and discriminative semantic feature vectors. Furthermore, to further extract context-sensitive key threat phrases from the text, a bidirectional long short-term memory network can be superimposed on the output layer of the pre-trained model. This network encodes the word vector sequence in both forward and backward directions, effectively capturing and highlighting phrases that are crucial for identifying spam messages.

[0024] In one example, when performing risk analysis on the metadata of SMS messages to be detected that have passed pre-screening, the system can query a threat intelligence database based on the user identifier to obtain the historical reputation score corresponding to the user identifier. Alternatively, it can detect whether the sender has virtual characteristics based on the sender's device information, or perform domain risk analysis based on embedded links. The threat intelligence database may store historical behavior records associated with the user identifier, and the reputation score can be determined based on these historical behavior records. Virtual characteristics may include at least one of emulator characteristics and virtual machine characteristics. Domain risk analysis may include checking the domain registration time and checking at least one of the domain name resolution records.

[0025] In this example, risk analysis can be performed from one or more dimensions. The first dimension could be a reputation score based on user identifiers. Specifically, an online or local threat intelligence database can be queried in real time based on the user identifier in the SMS metadata, such as the sender's mobile phone number (MSISDN). This threat intelligence database persistently stores a large number of user identifiers and their associated historical behavior records. These records can include the proportion of SMS messages sent by that number that were identified as spam, the number of user complaints, and characteristics of active time periods. Based on these rich historical behavior records, the threat intelligence database can calculate and maintain a dynamically updated historical reputation score for each user identifier. The score range could be, for example, from 0 to 100, with lower scores indicating higher risk. The threat intelligence database can be queried based on the user identifier of the SMS message to be detected to directly obtain the reputation score corresponding to that user identifier and use it as part of the risk characteristics.

[0026] The second dimension of risk analysis can be virtual environment detection based on device information. Specifically, it involves analyzing the sending device information in the SMS metadata. By examining a series of device attributes such as device fingerprint, operating system characteristics, hardware parameters, installed application list, and network environment parameters, it can be detected whether the device currently sending the SMS is running in an emulator or virtual machine environment. For example, specific system property files, driver names, CPU information, etc., can be checked, as these differ between a real physical phone and an emulator or virtual machine. Attackers often use emulators to register accounts in bulk and send spam SMS messages, so a device exhibiting virtual characteristics is a high-risk signal. After obtaining the detection result—whether the device is in a virtual environment—the corresponding feature value can be obtained and used as part of the risk profile.

[0027] The third dimension of risk analysis can be domain risk analysis based on embedded links. If the SMS content contains embedded links, the domain name of that link can be extracted and a deep risk analysis performed. The analysis can include checking the domain's registration date. Newly registered domains, especially those registered less than 7 days ago, are often used for short-term fraud or phishing attacks and are therefore considered high-risk. The analysis can also include checking the domain's DNS records, such as whether the domain has frequently changed its IP address in a short period, or whether the IP address it resolves to belongs to a known malicious IP address range. These checks can be performed by querying public domain name databases and DNS (Domain Name Server) records. Based on the age of the registration and any anomalies in the DNS records, a risk characteristic value for the domain can be generated and used as part of the risk profile.

[0028] In one example, time-series modeling analysis can be performed on the historical behavior data of the senders of pre-screened SMS messages to be detected. Specifically, a time-series modeling network can be used to analyze the sending frequency and time distribution of the senders within a dynamic time window, generating time-series feature vectors that characterize the sending behavior patterns and anomalies. The time-series modeling network can dynamically adjust the size of the time window based on the sending frequency during the analysis process.

[0029] In this example, historical behavior data from a specified sender can be received. This data is typically a sequence of SMS sending events ordered by timestamps. A temporal modeling network can be used to process this sequence. This network can be a hybrid model composed of a bidirectional long short-term memory (LSTM) network and a temporal convolutional network. The LTM layer captures long-term, regular sending patterns. The input features to this layer are the historical behavior sequence of the sender, which can include the sending interval time series and the variance of the sending frequency within a specific time window. Through the bidirectional recurrent structure, this layer can learn long-term behavioral patterns such as high-frequency sending at fixed times each day. The temporal convolutional network layer, by setting an exponentially increasing dilation coefficient in the dilation convolution, expands the network's receptive field to historical data, focusing on detecting short-term, high-intensity bursts of sending behavior. This layer can effectively identify abnormal patterns such as a sharp increase in sending volume within five minutes.

[0030] Based on bidirectional long short-term memory networks and temporal convolutional networks, the core function of temporal modeling networks is to analyze the behavioral patterns of the sender within a dynamic time window, focusing on capturing two key aspects: sending frequency and sending time distribution. Sending frequency refers to the number of SMS messages sent per unit of time. Sending time distribution refers to the distribution pattern of SMS sending behavior over a 24-hour day or a 7-day week, such as whether it is evenly distributed or concentrated in specific periods like late at night. To achieve more accurate modeling, temporal modeling networks introduce a dynamic time window mechanism. Specifically, the size of the analysis window can be dynamically adjusted based on the real-time sending frequency. For example, when an abnormally high sending frequency is detected, the network can automatically shrink the time window to capture bursts of attack behavior within a short period with finer granularity; when the sending frequency is at a normal or low level, a larger time window can be used to analyze its long-term behavioral patterns and baseline. By analyzing the sequences within the dynamic window, temporal modeling networks can learn the normal sending behavior patterns of the sender and compare them with the current behavior, thereby identifying abnormal behaviors that deviate from the normal pattern, such as suddenly sending at high frequencies during inactive periods or sending intervals that do not exhibit human-like regularity.

[0031] The network ultimately outputs a temporal feature vector, which simultaneously encodes both long-term behavioral patterns and short-term anomalous signals from the transmitter. This temporal feature vector may include a burst index. The burst index measures the degree of burstiness in the transmission behavior. The formula for calculating the burst index is as follows:

[0032] in, The standard deviation of the transmission interval; This represents the average sending interval. This formula quantifies the regularity of sending behavior by comparing the volatility of the intervals to its average level. When the sending intervals are very regular, the standard deviation... Small, The value is close to -1; when the sending behavior is highly bursty, the interval time varies greatly, and the standard deviation is close to -1. Much greater than the average , The value is close to +1. Therefore, the suddenness index is relatively high. These are typical characteristics of mechanized and tool-based sending behavior, and can be encoded in a temporal feature vector.

[0033] In an embodiment of the present invention, after determining the semantic feature vector, risk feature vector, and time-series feature vector, a correlation graph analysis can be performed on the semantic feature vector, risk feature vector, and time-series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time-series feature vector.

[0034] In one example, metadata may include the sender's device information, the recipient's number, and embedded links. Based on the metadata of the SMS message to be detected and the relationships between related entities, a graph feature vector can be generated. Specifically, the sender, recipient's number, and the domain name of the embedded link can be used as nodes, and the sending relationship, containment relationship, and resolution relationship between nodes can be used as edges to construct a heterogeneous global association graph. In the association graph, all adjacent nodes and edges of the current sender node within a preset number of hops can be extracted to form a local subgraph. Graph structure metrics of this subgraph can be calculated, which may include at least one of subgraph density and average subgraph clustering degree. The calculation results of these graph structure metrics can constitute the core results of graph analysis and be used for subsequent weight decisions.

[0035] In one example, the metadata of the current SMS message can be obtained, and relevant historical interaction data can be retrieved from a global interaction history database to construct or query an association graph. The graph's node types mainly include three types: sending device, receiving number, and link domain. The edge relationships in the graph represent interactions between entities, mainly including three types: sending relationship, connecting the sending device node and the receiving number node, indicating that a device sent an SMS message to a number; link relationship, connecting the SMS event and the link domain node, indicating that a certain SMS sending action contained a link pointing to that domain; and resolution relationship, connecting the link domain node and the server address node that it ultimately resolves to. Based on the metadata of the current SMS message, the sending device, receiving number, and link domain node involved in this event can be determined. Then, in the association graph, taking the sending device node corresponding to the sending end of the current SMS message as the center, all adjacent nodes and edges within a preset number of hops are extracted to form a local subgraph. For example, all nodes within 3 hops of the sending device node and the edges between them can be extracted to form a subgraph. Then, the structural characteristics of this subgraph can be analyzed, and its graph structure index can be calculated. One key metric is subgraph density, which measures the tightness of connections between nodes in a subgraph. The formula for calculating subgraph density is:

[0036] In this formula, This represents the number of edges that actually exist in the subgraph; This represents the total number of nodes in the subgraph; Representative at The maximum number of edges that can exist in the complete graph of a given node. Higher density indicates stronger connections between entities associated with the sending device. Another key indicator is the average subgraph clustering degree, which measures the average tendency for neighbors of nodes in the graph to also be interconnected. A higher value indicates a stronger tendency for local clusters to form. These graph structure indicators collectively constitute the quantitative analysis results of whether the current sending end is involved in a coordinated network attack.

[0037] The graph structure index calculated above, i.e., the graph analysis results, can be used as a key basis for determining the weights of each modality feature. Specifically, in the dynamic fusion decision-making stage, the graph analysis results can be used as the query vector in the attention mechanism. The semantic feature vector, risk feature vector, and temporal feature vector are each mapped to a key vector in the attention mechanism through a linear transformation layer. Sum value vector The formula for calculating attention weights is:

[0038] In this formula, This represents the query vector, which is the vector obtained by encoding the results of the graph analysis. This represents the key matrix obtained after transforming the eigenvectors of the three modes; Represents the transpose of the bond matrix K; The dimension representing the key vector is a factor used to scale the dot product result and stabilize the gradient; Softmax represents the normalization exponential function, which converts the calculated attention score into a probability distribution. This represents the value matrix obtained by mapping all modal eigenvectors.

[0039] This calculation process dynamically determines which modality(s) of feature evidence should be relied upon more in the current judgment based on the collaborative attack risk patterns revealed by the graph. For example, when the graph analysis shows extremely high subgraph density and clustering, suggesting the existence of collaborative attacks, the weights of modal features that characterize mechanized behavior (such as temporal features) or forged identities (such as risk features) can be increased. Ultimately, the output of the Softmax function is the dynamic weight corresponding to each modal feature vector: the first weight for semantic feature vectors, the second weight for risk feature vectors, and the third weight for temporal feature vectors.

[0040] In embodiments of the present invention, the semantic feature vector, risk feature vector, and time series feature vector can be fused according to the first weight, second weight, and third weight determined above to obtain fused features.

[0041] In one example, a gated recurrent network can be used to fuse the weighted semantic feature vector, risk feature vector, and time-series feature vector during feature fusion. Specifically, the gated recurrent network can be configured to suppress the contribution of modal feature vectors identified as noise and enhance the contribution of modal feature vectors identified as high-confidence modal feature vectors during the fusion process.

[0042] In this example, after obtaining the dynamic weights of each modality, the feature vectors of each modality can be weighted first. Specifically, the semantic feature vector can be multiplied by a first weight, the risk feature vector by a second weight, and the temporal feature vector by a third weight to obtain the weighted modal feature vectors. These weighted feature vectors are then sequentially input into a gated recurrent network for deep fusion. The gated recurrent network specifically uses gated recurrent units and processes each weighted modal feature vector in sequence.

[0043] We can assume that we are currently processing the first... The eigenvectors of each modality, and the calculation of the gated recurrent unit, can be defined by the following formula:

[0044] in, It represents the new fusion hidden state calculated at the current moment, which can integrate information from all processed modalities so far; This represents the fusion hidden state of the previous time step, that is, the state obtained after processing the previous modality; This represents the input at the current moment, i.e., the current weighted modal feature vector. The update gate is a vector with values ​​between 0 and 1 that determines the current new fusion state. To what extent should the information be updated based on candidate information, and to what extent should the past state be preserved? ; The reset gate, also a vector with values ​​between 0 and 1, determines the extent to which past states should be considered or "forgotten" when generating candidate information. ; This represents a trainable weight matrix used to perform linear transformations on the concatenated information; represents the hyperbolic tangent activation function; the square brackets [ , ] in the formula indicate the operation of concatenating two vectors.

[0045] When calculating, you can first reset the door. Compared to the previous state Element-wise multiplication is performed, and the result determines which historical information is retained for calculating the current candidate information. This result is then compared with the current input. Concatenate them into a longer vector. Then use a weight matrix. Multiply by this concatenated vector, and then pass through The activation function performs a non-linear transformation to generate a candidate hidden information. Finally, the update gate... Controlling how much of this candidate information is adopted into the new state, while Control how many old states The information is retained. Through this gating mechanism, the gated recurrent network can dynamically fuse information from different modalities. Specifically, if the feature vector of a modality is identified as having high noise or low confidence, for example, when the device information at the sending end is forged, resulting in unreliable metadata features, the gated recurrent network can adjust and update the gating gate. The value is used to suppress the modality feature vector The contribution to the final fusion state. Conversely, if a modality's feature vector is identified as having high confidence and criticality, such as when the text contains carefully crafted adversarial examples, its semantic features may become the core of discrimination, and the gated recurrent network can update the gates. Enhance the contribution of this modality feature. During initialization, the hidden state... Set as the zero vector. The processing starts from the first weighted modal feature vector. Begin by calculating using the formula above. Then and the second weighted feature vector As input, calculate Then, the third modality is processed accordingly, finally yielding the hidden state after processing all three modalities. This final hidden state This refers to the fusion of feature vectors. These features are not simply concatenated, but rather undergo deep, adaptive fusion based on gated recurrent networks. This organically integrates textual semantics, metadata risks, and behavioral temporal sequences, providing a comprehensive data foundation for the final classification decision.

[0046] In an embodiment of the present invention, after obtaining the fused feature vector, it is possible to detect whether the SMS message to be detected is a spam SMS message based on the fused feature vector.

[0047] In one example, after obtaining the fused feature vector, it can be input into a final fully connected classification layer. This classification layer is typically one or more fully connected neural network layers, followed by a sigmoid or softmax activation function. The classification layer performs a non-linear transformation on the fused feature vector and outputs a classification probability value between 0 and 1, which represents the confidence level that the current SMS message is classified as spam. In this example, a preset decision threshold can be set, for example, 0.5. When the probability value output by the classification layer is greater than or equal to this threshold, the SMS message can be classified as spam; when the probability value is less than this threshold, it can be classified as legitimate. This determination result can serve as the final decision, triggering corresponding blocking or allowing operations.

[0048] In one example, see Figure 2 This is a schematic diagram illustrating a spam SMS detection process. Figure 2 As shown, firstly, the raw SMS data to be detected, along with its current context information, can be obtained from the operator's SMS center. The context information can include the current time period, regional traffic conditions, etc. This data is a complete set of information, which may include the SMS text content, the sender's mobile phone number, the recipient's mobile phone number, the specific time the SMS was sent, and the network device address traversed by the sending behavior, among other key information. Then, this raw data can be sent to the business processing module. This module is the initial filtering layer of the entire detection process, responsible for performing rapid rule comparisons and basic screening. The business processing module can query a continuously updated blacklist database in real time, combining the current context information, to check whether the sender's number or device network address of the current SMS has been listed as a high-risk object. If a matching record is found, the SMS can be immediately blocked to prevent its further transmission, and the event can be recorded. Simultaneously, the business processing module can also apply a series of pre-set dynamic rules combined with context information for inspection. Only SMS messages that are neither on the blacklist nor trigger any high-speed rules are considered to require further in-depth inspection and are thus allowed to proceed to the next processing stage.

[0049] Then, the SMS data that has passed the initial screening can enter the data acquisition and preprocessing module. The core task of this module is to standardize and anonymize the raw data, laying the foundation for subsequent complex analysis steps. Specifically, this module can perform a unified character encoding conversion on the SMS text and remove special symbols or invalid characters that may affect the analysis results. At the same time, in order to protect user privacy and comply with data security regulations, this module can perform one-way hash encryption operations on sensitive identifiers such as the network address of the sending device to generate an anonymous, globally unique device identifier. In addition, in order to improve the efficiency of parallel processing by multiple subsequent analysis units, this module can also split the data according to information such as the sender identifier to ensure that related data from the same source can be processed by the same computing node. After completing these steps, the data acquisition and preprocessing module can output a standard-formatted, clean, and anonymized data stream.

[0050] The preprocessed data stream can be synchronously sent to a multimodal feature extraction engine for deep analysis. This engine includes three deep analysis units: TSAU (Text Semantic Analysis Unit), MAU (Metadata Analysis Unit), and TMU (Temporal Modeling Unit). The Text Semantic Analysis Unit uses a pre-trained deep learning model to understand the deeper meaning of SMS text content. This model transforms the text into a high-dimensional feature vector representing its semantics, inferring underlying intent even if the text uses homophones, adds irrelevant symbols, or contains coded language. The Metadata Analysis Unit focuses on assessing the reliability of the SMS's "identity" and "origin." It connects to a threat intelligence database to obtain the sender's historical reputation score, checks if the sending device has emulator or virtual machine software characteristics, and, if the SMS contains a website link, analyzes the domain's registration time and historical DNS records to determine if it is malicious. These analytical results are then aggregated into a comprehensive risk feature vector. The temporal behavior modeling unit can specifically analyze the historical behavior patterns of the sending end. This unit not only statistically analyzes the sending frequency within a variable time window, but also captures the regularity, periodicity, and burstiness of sending behavior through temporal analysis models. For example, an index can be calculated to quantify the degree of burstiness of behavior. This index can be achieved by comparing the fluctuation of sending time intervals with their average level, effectively distinguishing between the random sending behavior of normal users and the regular, explosive mass sending behavior of machine programs. All these analytical conclusions can be encoded into a temporal feature vector.

[0051] The generated semantic feature vector, risk feature vector, and temporal feature vector can be fed into the Dynamic Fusion Decision Module (DFDM). This module first constructs or queries a relational graph based on SMS metadata (such as sender, receiver number, and link domain) and historical interaction records, extracting a subgraph centered on the current sender and calculating graph structure metrics such as subgraph density and average clustering degree. Then, using these graph analysis results as key criteria, different importance weights are dynamically assigned to the semantic, risk, and temporal feature vectors through an attention mechanism. This weighting process determines which modality(s) of feature evidence should be trusted more in the current judgment based on the collaborative attack risk patterns revealed by the graph. These feature vectors, assigned different weights, are then fed into a gated recurrent network for deep integration. The gating structure within this network dynamically adjusts the information flow, automatically reducing the influence of feature dimensions deemed unreliable or interfering, while enhancing the contribution of high-credibility, key feature dimensions. Finally, this module outputs a comprehensive risk probability value between zero and one.

[0052] Finally, this comprehensive risk probability value can be compared with a pre-set judgment threshold. If the probability value is greater than or equal to the threshold, the SMS message can be determined to be spam. In this case, an interception operation can be performed to prevent the SMS message from reaching the recipient. Simultaneously, key information related to the sender's characteristics and content patterns is recorded as feedback samples and used to update the rule base or blacklist of the business processing module, thereby achieving continuous learning and self-optimization during operation. If the probability value is lower than the threshold, it is determined to be a normal SMS message. At this point, a release instruction can be issued, returning to the original SMS center, which will then complete the normal delivery to the recipient.

[0053] In one example, see Figure 3 This is a schematic diagram illustrating a spam SMS detection process. Figure 3As shown, firstly, the raw SMS data to be detected, along with its current context information, can be obtained from the operator's SMS center. This context information can include the current time period, regional traffic patterns, and recent attack types. This data is a complete set of information, including the SMS text content, sender's phone number, recipient's phone number, the specific time the SMS was sent, and the network device address traversed by the sending action. Then, this raw data can be sent to the business processing module. This module is the initial filtering layer of the entire detection process, responsible for performing rapid rule comparisons and basic screening. The business processing module can query a continuously updated blacklist database in real time, combining the current context information, to check if the sender's phone number or device network address of the current SMS has been listed as a high-risk object. If a matching record is found, the module can immediately decide to block the SMS, preventing its further transmission and recording the event. Simultaneously, the business processing module can also apply a series of pre-set dynamic rules combined with context information for inspection. Only SMS messages that are neither on the blacklist nor trigger any high-speed dynamic rules are considered to require further in-depth inspection and are thus allowed to proceed to the next processing stage.

[0054] Then, the SMS data that has passed the initial screening can enter the data acquisition and preprocessing module. The core task of this module is to standardize and anonymize the raw data, laying the foundation for subsequent complex analysis steps. Specifically, this module includes a data cleaning unit that can perform unified UTF-8 character encoding conversion on the SMS text and filter out illegal characters or invalid symbols that may affect the analysis results. At the same time, to protect user privacy and comply with data security regulations, this module can process sensitive identifiers such as the network address of the sending device. In addition, to improve the efficiency and reliability of parallel processing by multiple subsequent analysis units, this module also includes a data sharding unit, which can perform hash calculations based on information such as the sender's IP address, shard the data, and schedule it to the corresponding message queue topic, ensuring that related data from the same source can be processed in an orderly manner by the same computing node. After completing these steps, the data acquisition and preprocessing module can output a standard-formatted, clean, anonymized, and sharded data stream.

[0055] The preprocessed data stream can be synchronously sent to the multimodal feature extraction engine for deep analysis. The multimodal feature extraction engine can include three deep analysis units: TSAU, MAU, and TMU. TSAU, the text semantic analysis unit, uses a deep learning-based pre-trained model to understand the deeper meaning of SMS text content, performing text semantic analysis, similarity calculation, and text variant identification. This model can transform text into a high-dimensional feature vector representing its semantics; even if the text uses homophones, adds irrelevant symbols, or contains internet slang, the model can infer its underlying intent from the context. MAU, the metadata analysis unit, focuses on assessing the reliability of the SMS's "identity" and "origin." This metadata analysis unit can connect to a threat intelligence database to obtain the sender's historical behavior reputation score, check whether the sending device has emulator or virtual machine software characteristics, and, if the SMS contains a website link, analyze the domain's registration time and historical DNS records to determine if it is a malicious domain. These analysis results can be summarized into a comprehensive risk feature vector. TMU, the time series modeling unit, specifically analyzes the sender's historical behavior patterns. This time-series modeling unit can perform behavioral anomaly analysis, not only statistically analyzing the transmission frequency within a variable time window, but also capturing the regularity, periodicity, and suddenness of transmission behavior through time-series analysis models. For example, an index can be calculated to quantify the degree of suddenness of behavior. This index can be achieved by comparing the fluctuation of the transmission time interval with its average level, effectively distinguishing between the random transmission behavior of normal users and the regular, explosive mass transmission behavior of machine programs.

[0056] The generated semantic feature vector, risk feature vector, and temporal feature vector can be fed into a dynamic fusion decision module. In this module, a correlation graph is first constructed or queried based on SMS metadata (such as sender, receiver number, and link domain) and historical interaction records. A subgraph centered on the current sender is extracted, and graph structure metrics such as subgraph density and average clustering degree are calculated. Then, using these graph analysis results as key criteria, different importance weights are dynamically assigned to the semantic, risk, and temporal feature vectors through an attention mechanism. This weighting process determines which modality(s) of feature evidence should be trusted more in the current judgment based on the collaborative attack risk patterns revealed by the graph. These feature vectors, assigned different weights, can be fed into a gated recurrent network for deep integration. The gating structure within this network dynamically adjusts the information flow, automatically reducing the influence of feature dimensions deemed unreliable or interfering, while enhancing the contribution of high-credibility, key feature dimensions. This dynamic fusion decision module outputs a comprehensive risk probability value between zero and one.

[0057] Finally, this comprehensive risk probability value can be compared with a pre-set judgment threshold. If the probability value is greater than or equal to the threshold, the SMS message can be determined to be spam. In this case, an interception operation can be performed to prevent the SMS message from reaching the recipient. Simultaneously, key information related to the sender's characteristics and content patterns is recorded as feedback samples and fed back to the rule engine of the business processing module to update the rule base or blacklist, thereby achieving continuous learning and self-optimization during operation. If the probability value is lower than the threshold, it is determined to be a normal SMS message. In this case, a release command can be issued, returning to the original SMS center, which will then complete the normal delivery to the recipient.

[0058] In this embodiment of the invention, firstly, multimodal feature analysis is performed on the SMS message to be detected, extracting semantic feature vectors, risk feature vectors, and temporal feature vectors from the text content, metadata, and historical behavior of the sender, respectively. Then, correlation graph analysis is performed on each of the above feature vectors to obtain corresponding weights. Based on the obtained weights, all feature vectors are fused to obtain a fused feature. Finally, based on this fused feature, it is determined whether the SMS message is spam.

[0059] This invention addresses the problems of existing solutions, which rely on preset static rules and simple module splicing, resulting in limited detection methods, susceptibility to bypass, and difficulty in adapting to new attacks, by introducing multimodal deep analysis and a dynamic fusion decision-making mechanism. Through correlation graph analysis of text semantics, metadata risks, and behavioral temporal sequences, it can comprehensively identify complex variants and collaborative attack patterns from multiple dimensions, overcoming the limitations of single rules or text processing. By dynamically assigning weights to different modal features and performing deep fusion through correlation graph analysis, it achieves adaptive adjustment of model decisions, replacing rigid static rule combinations and voting mechanisms. This effectively reduces false positive rates and improves overall detection accuracy and real-time performance in unexpected scenarios or when facing new attack methods.

[0060] Figure 4 The spam text message detection device 400 shown can achieve Figure 1 The method described in the embodiment achieves the same technical effect, and can be specifically referred to in the above description. Figure 1 The description of the spam SMS detection method in the illustrated embodiment will not be repeated here. The spam SMS detection device 400 includes: Analysis module 401 is used to acquire the SMS message to be detected and perform multimodal feature analysis on the SMS message to be detected to obtain semantic feature vector, risk feature vector, and temporal feature vector; wherein, the multimodal feature analysis includes: performing semantic analysis on the text content of the SMS message to be detected to generate a semantic feature vector; performing risk analysis on the metadata of the SMS message to be detected to generate a risk feature vector; the metadata includes at least one of user identifier, receiving number, device information of the sending end, and embedded links; and performing temporal modeling analysis on the historical behavior data of the sending end to generate a temporal feature vector; The determining module 402 is used to perform correlation graph analysis on the semantic feature vector, the risk feature vector, and the time series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time series feature vector. The generation module 403 is used to perform feature fusion on the semantic feature vector, the risk feature vector and the temporal feature vector according to the first weight, the second weight and the third weight, to obtain fused features; The detection module 404 is used to detect whether the SMS message to be detected is a spam SMS message based on the fusion features.

[0061] Optionally, the metadata includes the device information of the sending end, the receiving number, and the embedded link; the determining module 402 is used to: Using the sending end, the receiving number, and the domain name of the embedded link as nodes, and the sending relationship, the inclusion link relationship, and the resolution relationship between nodes as edges, an association graph is constructed. In the association graph, the neighborhood of the sending node within a preset number of hops is extracted to form a subgraph; Calculate the graph structure index of the subgraph to obtain the graph analysis results; the graph structure index includes at least one of subgraph density and average subgraph clustering degree; Using the graph analysis results as the query basis, attention scores corresponding to the semantic feature vector, the risk feature vector, and the temporal feature vector are calculated through an attention mechanism. Based on the calculated attention score, the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the temporal feature vector are determined.

[0062] Optionally, the analysis module 401 is used for: A semantic analysis model is used to perform semantic analysis on the text content of the SMS message to be detected, and a semantic feature vector representing the deep semantics of the SMS message to be detected is generated. The semantic analysis model is a deep learning-based model, and adversarial training is introduced during the model training process.

[0063] Optionally, the analysis module 401 is used for at least one of the following: Based on the user identifier, a threat intelligence database is queried to obtain the historical reputation score corresponding to the user identifier; the metadata includes the user identifier; the threat intelligence database stores historical behavior records associated with the user identifier; the historical reputation score is determined based on the historical behavior records associated with the user identifier. Based on the device information of the sending end, it is detected whether the sending end has virtual characteristics; the virtual characteristics include at least one of simulator characteristics and virtual machine characteristics; the metadata includes the device information of the sending end. Based on the embedded links, a domain risk analysis is performed; the domain risk analysis includes checking the domain registration time and checking at least one of the domain name resolution records; the metadata includes the embedded links.

[0064] Optionally, the analysis module 401 is used for: Based on the time-series modeling network, the transmission frequency and transmission time distribution of the transmitting end within a dynamic time window are analyzed to generate a time-series feature vector characterizing the transmission behavior patterns and anomalies of the transmitting end; wherein, during the analysis process, the time-series modeling network dynamically adjusts the size of the time window based on the transmission frequency.

[0065] Optionally, the device further includes ( Figure 4 (not shown in the image) The acquisition module 405 is used to acquire the current context scene information of the SMS to be detected before performing multimodal feature analysis on the SMS to be detected; The filtering module 406 is used to perform pre-screening of the SMS messages to be detected based on the current context scenario information and the preset interception rule library; The analysis module 401 is used for: Multimodal feature analysis is performed on the SMS messages to be detected that have passed the pre-screening.

[0066] Optionally, the generation module 403 is used for: A gated recurrent network is used to fuse the weighted semantic feature vector, the risk feature vector, and the temporal feature vector; wherein the gated recurrent network is configured to suppress the contribution of modal feature vectors identified as noise and enhance the contribution of modal feature vectors identified as high confidence during the fusion process.

[0067] In this embodiment of the invention, firstly, multimodal feature analysis is performed on the SMS message to be detected, extracting semantic feature vectors, risk feature vectors, and temporal feature vectors from the text content, metadata, and historical behavior of the sender, respectively. Then, correlation graph analysis is performed on each of the above feature vectors to obtain corresponding weights. Based on the obtained weights, all feature vectors are fused to obtain a fused feature. Finally, based on this fused feature, it is determined whether the SMS message is spam.

[0068] This invention addresses the problems of existing solutions, which rely on preset static rules and simple module splicing, resulting in limited detection methods, susceptibility to bypass, and difficulty in adapting to new attacks, by introducing multimodal deep analysis and a dynamic fusion decision-making mechanism. Through correlation graph analysis of text semantics, metadata risks, and behavioral temporal sequences, it can comprehensively identify complex variants and collaborative attack patterns from multiple dimensions, overcoming the limitations of single rules or text processing. By dynamically assigning weights to different modal features and performing deep fusion through correlation graph analysis, it achieves adaptive adjustment of model decisions, replacing rigid static rule combinations and voting mechanisms. This effectively reduces false positive rates and improves overall detection accuracy and real-time performance in unexpected scenarios or when facing new attack methods.

[0069] Figure 5 This is a schematic diagram of the structure of an electronic device provided in one embodiment of the present invention. Please refer to it. Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0070] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0071] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0072] The processor reads the corresponding computer program from non-volatile memory into main memory and then executes it, forming a non-contiguous transfer configuration at the logical level. The processor executes the program stored in memory and specifically performs the following operations: The system acquires a text message to be tested and performs multimodal feature analysis on it to obtain a semantic feature vector, a risk feature vector, and a temporal feature vector. The multimodal feature analysis includes: performing semantic analysis on the text content of the text message to generate a semantic feature vector; performing risk analysis on the metadata of the text message to generate a risk feature vector; the metadata includes at least one of user identifier, receiving number, sending device information, and embedded links; and performing temporal modeling analysis on the historical behavior data of the sending device to generate a temporal feature vector. A correlation graph analysis is performed on the semantic feature vector, the risk feature vector, and the time series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time series feature vector. Based on the first weight, the second weight, and the third weight, feature fusion is performed on the semantic feature vector, the risk feature vector, and the temporal feature vector to obtain fused features; Based on the fusion features, it is determined whether the SMS message to be detected is a spam message.

[0073] The above is as described in the present invention. Figure 1The spam SMS detection method disclosed in the embodiments described above can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in one or more embodiments of the present invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in one or more embodiments of the present invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0074] The electronic device can also perform Figure 1 The method for detecting spam text messages described herein will not be elaborated upon here.

[0075] This invention also provides a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by a portable electronic device including multiple applications, enable the portable electronic device to perform... Figure 1 The method of the illustrated embodiment will not be described in detail here.

[0076] This invention also provides a computer program product stored in a storage medium and executed by at least one processor to implement... Figure 1 The method of the illustrated embodiment will not be described in detail here.

[0077] Of course, in addition to the software implementation, the electronic device of the present invention does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0078] In summary, the above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of the present invention should be included within the scope of protection of one or more embodiments of the present invention.

[0079] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0080] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined in this embodiment of the invention, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0081] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0082] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A method for detecting spam text messages, characterized in that, include: The system acquires the SMS message to be detected and performs multimodal feature analysis on it to obtain semantic feature vectors, risk feature vectors, and... The time-series feature vector; wherein, the multimodal feature analysis includes: performing semantic analysis on the text content of the SMS to be detected to generate a semantic feature vector; performing risk analysis on the metadata of the SMS to be detected to generate a risk feature vector; the metadata includes at least one of user identifier, receiving number, device information of the sending end, and embedded link; performing time-series modeling analysis on the historical behavior data of the sending end to generate a time-series feature vector; A correlation graph analysis is performed on the semantic feature vector, the risk feature vector, and the time series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time series feature vector. Based on the first weight, the second weight, and the third weight, feature fusion is performed on the semantic feature vector, the risk feature vector, and the temporal feature vector to obtain fused features; Based on the fusion features, it is determined whether the SMS message to be detected is a spam message.

2. The method according to claim 1, characterized in that, The metadata includes the device information of the sending end, the receiving number, and the embedded link; The association graph analysis of the semantic feature vector, the risk feature vector, and the time-series feature vector includes: Using the sending end, the receiving number, and the domain name of the embedded link as nodes, and the sending relationship, the inclusion link relationship, and the resolution relationship between nodes as edges, an association graph is constructed. In the association graph, the neighborhood of the sending node within a preset number of hops is extracted to form a subgraph; Calculate the graph structure index of the subgraph to obtain the graph analysis results; the graph structure index includes at least one of subgraph density and average subgraph clustering degree; Using the graph analysis results as the query basis, attention scores corresponding to the semantic feature vector, the risk feature vector, and the temporal feature vector are calculated through an attention mechanism. Based on the calculated attention score, the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the temporal feature vector are determined.

3. The method according to claim 1, characterized in that, The semantic analysis of the text content of the SMS message to be detected includes: A semantic analysis model is used to perform semantic analysis on the text content of the SMS message to be detected, and a semantic feature vector representing the deep semantics of the SMS message to be detected is generated. The semantic analysis model is a deep learning-based model, and adversarial training is introduced during the model training process.

4. The method according to claim 1, characterized in that, The risk analysis of the metadata of the SMS message to be detected includes at least one of the following: Based on the user identifier, a threat intelligence database is queried to obtain the historical reputation score corresponding to the user identifier; the metadata includes the user identifier; the threat intelligence database stores historical behavior records associated with the user identifier; the historical reputation score is determined based on the historical behavior records associated with the user identifier. Based on the device information of the sending end, it is detected whether the sending end has virtual characteristics; the virtual characteristics include at least one of simulator characteristics and virtual machine characteristics; the metadata includes the device information of the sending end. Based on the embedded links, a domain risk analysis is performed; the domain risk analysis includes checking the domain registration time and checking at least one of the domain name resolution records; the metadata includes the embedded links.

5. The method according to claim 1, characterized in that, The step of performing time-series modeling analysis on the historical behavior data of the sending end includes: Based on the time-series modeling network, the transmission frequency and transmission time distribution of the transmitting end within a dynamic time window are analyzed to generate a time-series feature vector characterizing the transmission behavior patterns and anomalies of the transmitting end; wherein, during the analysis process, the time-series modeling network dynamically adjusts the size of the time window based on the transmission frequency.

6. The method according to claim 1, characterized in that, Before performing multimodal feature analysis on the SMS message to be detected, the method further includes: Obtain the current context information of the SMS message to be detected; Based on the current context and the pre-set interception rule base, the SMS messages to be detected are pre-screened. The multimodal feature analysis performed on the SMS message to be detected includes: Multimodal feature analysis is performed on the SMS messages to be detected that have passed the pre-screening.

7. A spam text message detection device, characterized in that, include: An analysis module is used to acquire the SMS message to be detected and perform multimodal feature analysis on the SMS message to obtain semantic feature vectors, risk feature vectors, and temporal feature vectors. The multimodal feature analysis includes: performing semantic analysis on the text content of the SMS message to generate semantic feature vectors; performing risk analysis on the metadata of the SMS message to generate risk feature vectors; the metadata includes at least one of user identifier, receiving number, sending device information, and embedded links; and performing temporal modeling analysis on the historical behavior data of the sending end to generate temporal feature vectors. The determination module is used to perform correlation graph analysis on the semantic feature vector, the risk feature vector, and the time series feature vector to determine the first weight corresponding to the semantic feature vector, the second weight corresponding to the risk feature vector, and the third weight corresponding to the time series feature vector. The generation module is used to perform feature fusion on the semantic feature vector, the risk feature vector and the temporal feature vector according to the first weight, the second weight and the third weight to obtain fused features; The detection module is used to detect whether the SMS message to be detected is a spam SMS message based on the fusion features.

8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store computer-executable instructions that, when executed by a processor, implement the steps of the method described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1 to 6.

Images