A method for identifying point-based anomaly SMS messages based on communication trajectory evolution modeling

Abstract

This invention discloses a method for identifying point-based anomaly SMS messages based on communication trajectory evolution modeling. The method involves acquiring SMS communication records that have passed legal verification, including the enterprise SMS port, submitting account, and SMS signature; generating an ordered communication trajectory in the order of enterprise SMS port, submitting source address, access gateway, service code, and SMS center; establishing a set of confirmed trajectories; comparing the ordered communication trajectory to be verified with confirmed ordered communication trajectories of the same business identity combination to determine the common prefix, common suffix, replaced trajectory segments, and newly introduced trajectory segments, forming a trajectory change context; confirming legitimate group migrations based on the number of different message identifiers, the number of continuous observation windows, and the number of received number hash partitions; identifying trajectory change SMS messages that have not formed legitimate group migrations within the confirmation period as point-based anomaly SMS messages and locating the abnormal entry relationship; and distinguishing between legitimate path migrations and non-systematic abnormal trajectories to improve the accuracy of identification and location.

Description

Technical Field

[0001] This invention relates to the field of mobile communication and SMS security monitoring technology, specifically to a method for identifying point-based abnormal SMS messages based on communication trajectory evolution modeling. Background Technology

[0002] With the increasing number of enterprise verification codes, transaction notifications, and business alerts via SMS, enterprise SMS messages are typically initiated by the SMS port and submitting accounts, and then distributed via the submission source address, access gateway, service code, and SMS center. Existing SMS security technologies mainly use methods such as SMS content filtering, port and account legitimacy verification, SMS signature verification, blacklist / whitelist matching, and sending frequency statistics to identify spam, fraudulent SMS messages, or abnormal batch sending; some communication anomaly detection methods also identify anomalies by constructing communication relationship graphs and identifying anomalies based on the number of node connections, frequency of occurrence, or degree of deviation from historical relationships.

[0003] However, when the enterprise SMS port, submitting account, and SMS signature all pass valid verification, existing technologies often struggle to further verify whether the existing connection relationships are maintained between the actual submission source address, access gateway, service code, and SMS center through which the SMS actually passes. If the submitting account is abnormally invoked, the source address is misconfigured, the gateway routing is convoluted, or the service code binding relationship is unexpectedly changed, the SMS content and identity elements may still appear normal, making it difficult for single-item verification methods to detect anomalies in a timely manner. While static whitelists can record legitimate source addresses or gateways, they cannot maintain the ordered relationship between multi-level path elements and are difficult to adapt to new paths introduced by business expansion, load balancing, and disaster recovery switching. Directly classifying new paths as abnormal can easily lead to false alarms; directly including them in the whitelist may allow a single or a small number of abnormal SMS messages to pass.

[0004] Furthermore, existing detection methods based on the number and frequency of transmissions are mainly applicable to batch anomalies, and are difficult to identify isolated, sudden point anomalies in normal business flows that have not formed a systematic migration. Existing communication graph anomaly detection methods can usually only provide anomaly nodes or anomaly links, and are difficult to further locate the specific relationship position in which the anomaly first occurred in the port-submission source, submission source-gateway, gateway-service code, or service code-SMS center.

[0005] In view of this, the present invention provides a point-abnormal SMS identification method based on communication trajectory evolution modeling to solve the above problems. Summary of the Invention

[0006] The purpose of this invention is to provide a point-abnormal SMS identification method based on communication trajectory evolution modeling, which solves the technical problems of difficulty in distinguishing between legitimate group migration and trajectory changes that have not formed legitimate group migration within the confirmation period, and difficulty in locating the entry relationship of point-abnormal SMS, under the conditions that the enterprise SMS identity elements are legitimate and the communication path allows for business expansion or disaster recovery switching.

[0007] To achieve the above objectives, the present invention provides the following technical solution: This invention provides a method for identifying point-based anomaly SMS messages based on communication trajectory evolution modeling, comprising the following steps: S101: Obtain SMS communication records that have passed the legal verification of the enterprise SMS port, submitted account, and SMS signature, and generate an ordered communication trajectory in the order of enterprise SMS port, submitted source address, access gateway, service code, and SMS center; S102, combine the enterprise SMS port, submitting account and SMS signature into a business identity combination, summarize the orderly communication trajectory according to the business identity combination and observation window, and write the orderly communication trajectory that reaches the preset number of times within the baseline period and the adjacent relationship into the confirmed trajectory set. S103, compare the unverified ordered communication trajectories that have not been written into the confirmed trajectory set with the confirmed ordered communication trajectories with the same business identity combination from the port side forward and the SMS center side reverse, determine the common prefix, common suffix, replaced trajectory fragment and newly introduced trajectory fragment, and form a trajectory change context; S104. Summarize the SMS communication records corresponding to the new ordered communication trajectory according to the condition of consistent trajectory change context. When the number of different message identifiers, the number of continuous observation windows and the number of receiving number hash partitions reach the corresponding thresholds, write the new ordered communication trajectory into the confirmed trajectory set and record the migration relationship. S105, when the confirmation period expires and the new ordered communication trajectory does not simultaneously reach the aforementioned thresholds, the new ordered communication trajectory is not written into the confirmed trajectory set, the corresponding SMS is determined as a point abnormal SMS, and the adjacent relationship involved in the trajectory change context is verified. The first adjacent relationship that does not appear in the confirmed trajectory set corresponding to the same business identity combination along the communication processing order from the enterprise SMS port side to the SMS center side is determined as an abnormal entry relationship. The abnormal SMS message refers to an SMS message where the enterprise SMS port, the submitted account, and the SMS signature have passed the legal verification, the ordered communication trajectory deviates partially from the confirmed ordered communication trajectory of the same business identity combination, and the partial deviation does not form an SMS message that meets the aforementioned thresholds for legitimate group migration within the confirmation period.

[0008] As a preferred technical solution of the present invention, the SMS identification device encodes each path element in the ordered communication trajectory as element type, element value and processing order, and merges adjacent duplicate path elements with the same element type and element value under the same message identifier into one path element, while retaining the first entry time and the last exit time of adjacent duplicate path elements.

[0009] As a preferred technical solution of the present invention, the confirmed trajectory set records the effective observation window and the last occurrence observation window of each confirmed ordered communication trajectory; the SMS identification device sorts the comparison results in descending order according to the total number of path elements contained in the common prefix and common suffix, and sorts them in descending order according to the starting window number of the effective observation window when the total number of path elements is the same, and sorts them in descending order according to the last occurrence observation window when the starting window number is still the same, and determines the confirmed ordered communication trajectory at the top of the sort as the reference confirmed trajectory.

[0010] As a preferred technical solution of the present invention, the SMS recognition device records the parallel expansion migration relationship when both the reference confirmation trajectory and the new ordered communication trajectory have SMS communication records in the same continuous observation window, and records the successive switching migration relationship when a new ordered communication trajectory appears in the adjacent observation window after the reference confirmation trajectory stops and the common suffix remains unchanged.

[0011] As a preferred technical solution of the present invention, the SMS recognition device generates a migration chain according to the reference confirmation trajectory, the new ordered communication trajectory, and the effective observation window; when the SMS recognition device detects the reappearance of the reference confirmation trajectory in the adjacent observation window after the new ordered communication trajectory stops and the common suffix remains unchanged, it writes the back-cut relationship from the new ordered communication trajectory to the reference confirmation trajectory in the migration chain.

[0012] As a preferred technical solution of the present invention, the SMS identification device sets an effective state, a parallel state, and a historical state for the confirmed orderly communication trajectory; when the confirmed orderly communication trajectory in the historical state reappears and there is no corresponding back-cut relationship in the migration chain, the SMS identification device writes the orderly communication trajectory formed by the reappearing SMS communication records into the pending trajectory set, and re-confirms the migration according to the trajectory change context.

[0013] As a preferred technical solution of the present invention, when the same newly introduced submission source address or the same newly introduced access gateway appears in multiple service identity combinations, the SMS identification device verifies the service code and SMS center corresponding to each service identity combination respectively; when the adjacency relationship between the service code and SMS center corresponding to each service identity combination is included in the confirmed trajectory set corresponding to the corresponding service identity combination, the SMS identification device merges the new ordered communication trajectories corresponding to multiple service identity combinations into a shared infrastructure migration group, and respectively counts the number of different message identifiers, the number of continuous observation windows, and the number of received number hash partitions corresponding to each service identity combination.

[0014] As a preferred technical solution of the present invention, the SMS identification device writes the new ordered communication trajectory within the confirmation period into a pending trajectory set that is isolated from the confirmed trajectory set, and prohibits the new ordered communication trajectory in the pending trajectory set from being used as a comparison benchmark for other ordered communication trajectories to be verified or from being counted as the number of different message identifiers of other new ordered communication trajectories.

[0015] As a preferred embodiment of the present invention, the observation window is one hour and the confirmation period is twenty-four hours; the SMS identification device performs hash calculation on the receiving number or the anonymized value of the receiving number, and maps the receiving number or the anonymized value of the receiving number to sixteen receiving number hash partitions according to the hash result; when the number of different message identifiers corresponding to the new ordered communication trajectory reaches one hundred, the number of consecutive observation windows reaches three, and the number of covered receiving number hash partitions reaches eight, the SMS identification device writes the new ordered communication trajectory into the confirmed trajectory set.

[0016] As a preferred embodiment of the present invention, the SMS identification device generates an adjacency sequence according to the processing order of the common prefix, the newly introduced trajectory segment, and the common suffix in the new ordered communication trajectory. When both the newly introduced trajectory segment and the common suffix are not empty, the adjacency sequence includes the adjacency relationships between the last path element of the common prefix and the first path element of the newly introduced trajectory segment, within the newly introduced trajectory segment, and between the last path element of the newly introduced trajectory segment and the first path element of the common suffix. When the newly introduced trajectory segment is not empty and the common suffix is ​​empty, the adjacency sequence includes the adjacency relationships between the last path element of the common prefix and the first path element of the newly introduced trajectory segment, and within the newly introduced trajectory segment. When the newly introduced trajectory segment is empty and the common suffix is ​​not empty, the adjacency sequence includes the cross-adjacency relationship between the last path element of the common prefix and the first path element of the common suffix.

[0017] The technical effects and advantages provided by the present invention in the above technical solution are as follows: This invention constructs an ordered communication trajectory according to the processing order of enterprise SMS port, submission source address, access gateway, service code, and SMS center. Based on business identity combinations, observation windows, and confirmed trajectory sets, it continuously records the evolution of communication relationships, enabling structured comparison of new communication paths using common prefixes, common suffixes, replaced trajectory fragments, and newly introduced trajectory fragments. Furthermore, it confirms the group migration of new ordered communication trajectories by using different numbers of message identifiers, continuous observation windows, and receive number hash partitions, avoiding misjudging legitimate paths formed by business expansion, load balancing, or disaster recovery switching as abnormal. Simultaneously, by isolating the pending trajectory set from the confirmed trajectory set, it prevents unconfirmed new paths from mutually providing legitimacy support. For trajectory change SMS messages that do not form a legitimate group migration within the confirmation period, it verifies the adjacent relationships involved in newly introduced trajectory fragments according to the communication processing order, thereby locating the anomaly to the specific entry relationship within port-submission source, submission source-gateway, gateway-service code, or service code-SMS center, improving the accuracy of point-to-point anomaly SMS identification and the efficiency of anomaly investigation. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0019] Figure 1 This is a flowchart of the abnormal SMS identification method of the present invention; Figure 2 This is a schematic diagram of the system architecture of the SMS recognition device of the present invention; Figure 3 This is a schematic diagram illustrating the orderly communication trajectory generation, path element encoding, and merging of adjacent duplicate path elements according to the present invention. Figure 4 This is a schematic diagram of the confirmed trajectory set, adjacent relationship record table, and trajectory migration chain of the present invention; Figure 5 This is a schematic diagram illustrating the bidirectional comparison between the reference confirmation trajectory and the ordered communication trajectory to be verified, forming a trajectory change context. Figure 6 This is a flowchart illustrating the process of confirming legitimate group migration and locating abnormal entry points via SMS messages in this invention. Detailed Implementation

[0020] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of the invention will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art. The drawings are merely illustrative of the invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0021] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more exemplary embodiments. Numerous specific details are provided in the following description to give a full understanding of exemplary embodiments of the invention. However, those skilled in the art will be able to omit some non-essential details or implement the invention using other equivalent methods, components, or steps without departing from the inventive concept. In other instances, well-known structures, methods, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of the invention.

[0022] This invention provides a method for identifying point-based anomaly SMS messages based on communication trajectory evolution modeling, applicable to enterprise SMS platforms, SMS service provider platforms, operator SMS business systems, or communication security monitoring systems. This method addresses situations where the enterprise SMS port, submitting account, and SMS signature have all passed legitimate verification, but unexpected changes occur in the SMS's actual submission source address, access gateway, service code, or SMS center. It continuously models the SMS communication path and distinguishes between legitimate group migrations and trajectory changes where no legitimate group migration has occurred within the confirmation period.

[0023] It should be noted that the aforementioned "point-of-origin abnormal SMS" refers to SMS messages where the enterprise's SMS port, submitting account, and SMS signature all pass legitimate verification, but the corresponding ordered communication trajectory deviates partially from the confirmed ordered communication trajectory under the same business identity combination. Furthermore, this partial deviation does not simultaneously reach the thresholds corresponding to the number of different message identifiers, the number of consecutive observation windows, and the number of received number hash partitions within the confirmation period, thus not forming a legitimate group migration. Point-of-origin abnormal SMS messages can manifest as a single SMS message, a small number of discrete SMS messages, or a set of SMS messages that do not form a continuous, group migration relative to the normal communication scale of the corresponding business identity combination. This excludes continuous, group communication path changes caused by business expansion, load balancing, gateway switching, disaster recovery switching, or disaster recovery.

[0024] In this implementation, abnormal SMS messages may correspond to the following situations: the submitting account is called by an unauthorized program; a legitimate enterprise port submits an SMS message through an unregistered submission source address; the submission source address is incorrectly routed to an unexpected access gateway; the access gateway is incorrectly bound to the service code of another service; the service code is routed to an unexpected SMS center; or the node relationship in the communication processing link is tampered with.

[0025] For ease of explanation, in this embodiment, the ordered communication trajectory to be verified refers to the ordered communication trajectory that has not yet been compared with the confirmed ordered communication trajectory corresponding to the same business identity combination; the new ordered communication trajectory refers to the ordered communication trajectory to be verified that has been determined to have a replaced trajectory segment or a newly introduced trajectory segment relative to the confirmed ordered communication trajectory corresponding to the same business identity combination; the SMS identification device writes the new ordered communication trajectory that is within the confirmation period and has not yet reached all the thresholds required for the confirmation of legitimate group migration into the pending trajectory set.

[0026] Example 1 Please see Figure 2 The hardware device for identifying abnormal SMS messages is an SMS identification device, which is connected to the enterprise SMS platform, access gateway logs, service routing system and its routing processing logs, and SMS center logs.

[0027] The enterprise SMS platform is used to provide SMS submission records. The SMS submission record includes at least the message identifier, SMS submission time, enterprise SMS port, submitting account, SMS signature, submission source address, and receiving number or receiving number anonymization value.

[0028] Access gateway logs are used to provide processing records when SMS messages enter the access gateway. These processing records include at least the message identifier, access gateway identifier, entry time, and exit time.

[0029] The service routing system and its routing processing logs are used to provide the routing relationship between the access gateway and the service code, as well as the routing relationship between the service code and the SMS center. The routing relationship is the actual routing processing record formed during SMS processing, and includes message identifiers or routing flow identifiers that can establish a corresponding relationship with upstream message identifiers.

[0030] SMS center logs are used to provide log records generated when the SMS center receives, processes, and sends SMS messages.

[0031] The SMS recognition device includes a data access unit, a trajectory generation unit, a trajectory set management unit, a trajectory comparison unit, a migration confirmation unit, and an anomaly recording unit.

[0032] The data access unit is used to obtain SMS processing records from various data sources and associate multi-node processing records belonging to the same SMS message into SMS communication records based on message identifiers.

[0033] When the enterprise SMS platform, access gateway, service routing system and its routing processing logs and SMS center use different message identifiers, the data access unit associates the processing records from different data sources with the same SMS message based on the message identifier mapping records stored between adjacent processing nodes. When there is no direct message identifier mapping record, the data access unit generates joint association conditions based on the enterprise SMS port, submitting account, SMS submission time, receiving number hash value and preset time tolerance, and associates the processing records of multiple nodes that meet the joint association conditions with the same SMS communication record.

[0034] When multiple candidate processing records meet the joint association conditions, the data access unit sorts them from smallest to largest according to the processing time difference between the candidate processing records and the upstream processing records, and verifies whether the time order of the candidate processing records conforms to the communication processing order of the enterprise SMS port, submission source address, access gateway, service code, and SMS center. When a unique association result can be formed, the corresponding multi-node processing records are associated as the same SMS communication record. When a unique association result cannot be formed or the necessary path elements are missing, the corresponding record is marked as an incomplete trajectory record. The incomplete trajectory record is not used for legitimate group migration confirmation and point abnormal SMS determination.

[0035] The trajectory generation unit encodes SMS communication records into an ordered communication trajectory according to the processing order of the enterprise SMS port, submission source address, access gateway, service code, and SMS center.

[0036] The trajectory set management unit manages the confirmed trajectory set and the pending trajectory set. The confirmed trajectory set is used for long-term storage of ordered communication trajectories and their adjacency relationships that have been confirmed by benchmark or migration. The pending trajectory set is isolated from the confirmed trajectory set and is used to temporarily store new ordered communication trajectories that have not yet completed the legal group migration confirmation.

[0037] The confirmed trajectory set includes a trajectory record table and an adjacency record table. The trajectory record table is used to record trajectory identifiers, confirmed ordered communication trajectories, active observation windows, last occurrence observation windows, stopped observation windows, and trajectory status. The adjacency record table is used to record adjacency relationships obtained from the decomposition of confirmed ordered communication trajectories, the number of times adjacency relationships occur, the first occurrence observation window, and the last occurrence observation window.

[0038] The trajectory comparison unit is used to perform a two-way comparison between the ordered communication trajectory to be verified and the confirmed ordered communication trajectory under the same business identity combination, and to determine the common prefix, common suffix, replaced trajectory segment and newly introduced trajectory segment.

[0039] The migration confirmation unit is used to summarize the SMS communication records corresponding to the new ordered communication trajectory according to the condition of consistent trajectory change context, and to confirm the legitimate group migration based on the number of different message identifiers, the number of continuous observation windows, and the number of receiving number hash partitions.

[0040] The anomaly recording unit is used to identify the corresponding SMS as an anomaly SMS when the confirmation period expires and the new orderly communication trajectory has not been confirmed through legitimate group migration, and to record the anomaly entry relationship.

[0041] Example 2 Please see Figure 1 This embodiment provides a point anomaly SMS identification method based on communication trajectory evolution modeling, which is executed in the SMS identification device described in Embodiment 1, and includes the following steps: S101: Obtain SMS communication records that have passed the legal verification of the enterprise SMS port, submitted account, and SMS signature, and generate an ordered communication trajectory in the order of enterprise SMS port, submitted source address, access gateway, service code, and SMS center; Specifically, the SMS recognition device obtains SMS communication records from enterprises whose SMS ports, submitted accounts, and SMS signatures have all passed legal verification.

[0042] In this implementation, the legitimacy verification can be performed by the existing authentication module of the enterprise SMS platform or SMS service provider platform. The SMS recognition device directly receives the verification result, without needing to repeat the identity authentication. The objects that pass the legitimacy verification include the enterprise SMS port, the submitting account, and the SMS signature. The submitting source address, access gateway, service code, and SMS center are used as objects for communication trajectory evolution analysis.

[0043] like Figure 3 As shown, a text message communication record includes the following fields: The message identifier is MSG0001; The enterprise SMS port is P01; The submitted account is Account-01; The text message signature reads "Company X"; The source address for submission is IP-A; The access gateway is GW-A; The service code is SC-01; The SMS center is SMSC-01; The anonymized value of the receiving number is 138****1234.

[0044] The SMS identification device encodes the SMS communication record into the following ordered communication trajectory according to the communication processing order of the enterprise SMS port, submission source address, access gateway, service code, and SMS center: P01→IP-A→GW-A→SC-01→SMSC-01.

[0045] The received number or its anonymized value is used for subsequent received number hash partition statistics and is not considered a path element in the ordered communication trajectory. To distinguish between different types of path elements with the same character value, the trajectory generation unit encodes each path element as its element type, element value, and processing order. The path elements in the above ordered communication trajectory are encoded as follows: Port: P01:1; Submission source: IP-A:2; Gateway: GW-A: 3; Service Code: SC-01:4; SMS Center: SMSC-01:5.

[0046] The processing sequence number indicates the order in which path elements occur during SMS communication processing. The same SMS message may contain the same path elements consecutively in the original log due to gateway retries, timeout retransmissions, or duplicate log reports. For example, the original processing sequence could be: P01→IP-A→GW-A→GW-A→SC-01→SMSC-01.

[0047] The SMS identification device identifies two adjacent GW-A nodes that have the same element type and element value, and that correspond to the same message identifier. Therefore, the two GW-A nodes are merged into one path element, forming: P01→IP-A→GW-A→SC-01→SMSC-01.

[0048] When merging adjacent duplicate path elements, the SMS identification device retains the GW-A's first entry time and last exit time. This process avoids misidentifying internal gateway retries or duplicate log entries as communication path changes.

[0049] S102, combine the enterprise SMS port, submitting account and SMS signature into a business identity combination, summarize the orderly communication trajectory according to the business identity combination and observation window, and write the orderly communication trajectory that reaches the preset number of times within the baseline period and the adjacent relationship into the confirmed trajectory set. Specifically, the SMS identification device combines the enterprise SMS port, the submitting account, and the SMS signature into a business identity combination. For example, business identity combination B01 includes: Enterprise SMS port P01; Submit account number Account-01; The SMS signature reads "Company X".

[0050] The SMS identification device summarizes ordered communication trajectories according to business identity combinations and observation windows. In this embodiment, the observation window is set to one hour, and SMS communication records are divided into continuous and non-overlapping observation windows according to the SMS submission time.

[0051] This implementation sets a seven-day baseline period and writes ordered communication trajectories that occur at least one hundred times within the baseline period into the confirmed trajectory set. The baseline period is preferably a stable operating period during which the enterprise's SMS service has not undergone port adjustments, source address adjustments, gateway expansion, or disaster recovery switching.

[0052] The stable operating period can be determined based on network configuration change records, maintenance work orders, historical security alarm records, and SMS service operation status. If there are incomplete routing adjustments, gateway switching, service code changes, or security anomalies within the candidate baseline period, the SMS identification device will not use the corresponding time period as the baseline period for establishing the confirmed trajectory set.

[0053] For example, business identity combination B01 exhibits the following two ordered communication trajectories during the baseline period: Ordered communication trajectory T1: P01→IP-A→GW-A→SC-01→SMSC-01; Ordered communication trajectory T2: P01→IP-C→GW-C→SC-01→SMSC-01; T1 occurred 12,000 times during the baseline period, and T2 occurred 20 times during the baseline period. Since T1 occurred 100 times, the SMS identification device added T1 to the confirmed trajectory set; since T2 occurred less than 100 times, the SMS identification device did not add T2 to the confirmed trajectory set.

[0054] The SMS recognition device also writes the adjacent relationships in T1 into the adjacent relationship record table of the confirmed trajectory set, wherein the adjacent relationships include: P01—IP-A; IP-A—GW-A; GW-A—SC-01; SC-01—SMSC-01.

[0055] Please see Figure 4 The trajectory record table in the confirmed trajectory set records the trajectory ID, ordered communication trajectory, active observation window, last occurrence observation window, stopped observation window, and trajectory status.

[0056] The trajectory states include valid states, parallel states, and historical states; A valid state indicates that the corresponding ordered communication trajectory is currently being used as a business communication path; Parallel state indicates that the corresponding ordered communication trajectory carries services simultaneously with other confirmed ordered communication trajectories. Historical states indicate that the corresponding ordered communication trajectories have ceased to be used, but are still retained in the communication trajectory evolution record.

[0057] In one example, the effective observation window for T1 is observation windows 1 to 120, the last observed window is observation window 120, the stop observation window is observation window 150, and the trajectory status is historical. The effective observation window for the subsequently confirmed new ordered communication trajectory T3 is observation windows 151 to the current observation window, the last observed window is the current observation window, and the trajectory status is valid.

[0058] The last observed window represents the observation window where the last SMS communication record appeared in the corresponding ordered communication trajectory; the stop observed window represents the observation window where the SMS recognition device adjusts the status to the historical state after the ordered communication trajectory stops appearing, following a preset stop confirmation period. Therefore, the stop observed window can be later than the last observed window.

[0059] The confirmed trajectory set simultaneously records the occurrence count, first occurrence window, and last occurrence window of each adjacent relationship, thereby forming a communication trajectory evolution record that can be continuously updated as the business communication path changes.

[0060] S103, compare the unverified ordered communication trajectories that have not been written into the confirmed trajectory set with the confirmed ordered communication trajectories with the same business identity combination from the port side forward and the SMS center side reverse, determine the common prefix, common suffix, replaced trajectory fragment and newly introduced trajectory fragment, and form a trajectory change context; The SMS identification device identifies ordered communication trajectories that are not written into the confirmed trajectory set as ordered communication trajectories to be verified, and selects confirmed ordered communication trajectories corresponding to the same business identity combination from the confirmed trajectory set for comparison.

[0061] like Figure 5 As shown, the reference confirmed trajectory T1 is: P01→IP-A→GW-A→SC-01→SMSC-01.

[0062] The order of communication trajectory T3 to be verified is: P01→IP-B→GW-B→SC-01→SMSC-01.

[0063] The SMS recognition device starts by comparing T1 and T3 from the enterprise's SMS port side.

[0064] The first path element of both T1 and T3 is P01, and the second path elements are IP-A and IP-B respectively. Therefore, the SMS identification device determines P01 as the common prefix.

[0065] The SMS identification device then performs a reverse comparison of T1 and T3 from the SMS center side. Both T1 and T3 use SMSC-01 as their SMS center, with service code SC-01, and access gateways GW-A and GW-B respectively. Therefore, the SMS identification device identifies SC-01→SMSC-01 as the common suffix. The path element in T1 located between the common prefix and common suffix is ​​IP-A→GW-A, which the SMS identification device identifies as the replaced trajectory segment.

[0066] In T3, the path element located between the common prefix and the common suffix is: IP-B→GW-B. The SMS identification device identifies IP-B→GW-B as the newly introduced trajectory segment. The SMS identification device combines the service identity combination, the common prefix, the replaced trajectory segment, the newly introduced trajectory segment, and the common suffix to form the trajectory change context.

[0067] The above trajectory change context includes: Business identity combination: B01; Public prefix: P01; Replaced trajectory segment: IP-A→GW-A; Newly introduced trajectory segment: IP-B→GW-B; Public suffix: SC-01 → SMSC-01.

[0068] When the ordered communication trajectory to be verified only adds path elements compared to the reference confirmed trajectory, the replaced trajectory segment can be empty, and the added path elements constitute the newly introduced trajectory segment; when the ordered communication trajectory to be verified deletes path elements compared to the reference confirmed trajectory, the newly introduced trajectory segment can be empty, and the deleted path elements constitute the replaced trajectory segment; when the two trajectories do not have the same path elements from the SMS center side, the common suffix can be empty. The SMS identification device still constructs the trajectory change context according to the processing order of the common prefix, the replaced trajectory segment, the newly introduced trajectory segment, and the common suffix in the complete trajectory.

[0069] When there are multiple confirmed ordered communication trajectories under the same business identity combination, the SMS identification device will compare the ordered communication trajectory to be verified with each confirmed ordered communication trajectory in both directions, and sort the comparison results in descending order according to the total number of path elements contained in the common prefix and common suffix.

[0070] If the total number of path elements corresponding to the two comparison results is the same, the SMS recognition device will sort them in descending order according to the starting window number of the effective observation window of the confirmed orderly communication trajectory, and arrange the confirmed orderly communication trajectory with the more recent effective time first.

[0071] If the starting window numbers are still the same, then the confirmed orderly communication trajectories are arranged in descending order according to the last occurrence observation window of each confirmed orderly communication trajectory. The confirmed orderly communication trajectories with the most recent last occurrence time are arranged first, and the confirmed orderly communication trajectory that is ranked first in the final sort is determined as the reference confirmed trajectory.

[0072] This method allows for the selection of historical trajectories that have more stable path elements and are closer in time to the current orderly communication trajectory to be verified, even when the same business identity combination has undergone multiple expansions, switches, and rollbacks.

[0073] The SMS identification device stores new ordered communication trajectories within the confirmation period into the pending trajectory set. The pending trajectory set is isolated from the confirmed trajectory set. New ordered communication trajectories in the pending trajectory set cannot be used as reference confirmation trajectories for other pending ordered communication trajectories, nor can they be counted in the number of different message identifiers of other new ordered communication trajectories.

[0074] For example, if an abnormal submission source continuously generates ten SMS messages with the same abnormal path, that abnormal path can only accumulate the number of different message identifiers in the corresponding trajectory change context. The path formed by the first abnormal SMS message cannot be directly used as a legitimate trajectory to support subsequent SMS messages. This prevents unconfirmed new paths from providing legitimacy evidence to each other and thus contaminating the confirmed trajectory set.

[0075] S104. Summarize the SMS communication records corresponding to the new ordered communication trajectory according to the condition of consistent trajectory change context. When the number of different message identifiers, the number of continuous observation windows and the number of receiving number hash partitions reach the corresponding thresholds, write the new ordered communication trajectory into the confirmed trajectory set and record the migration relationship. The SMS recognition device aggregates SMS communication records corresponding to the new ordered communication trajectory based on the condition that the trajectory change context is consistent. Consistent trajectory change context means that the business identity combination, common prefix, replaced trajectory segment, newly introduced trajectory segment, and common suffix are all the same.

[0076] Please see Figure 6 This implementation sets the confirmation period to 24 hours and sets the following conditions for confirming the legitimate migration of groups: The number of different message identifiers reaches one hundred; The number of consecutive observation windows reaches three; The number of received number hash partitions reaches eight, and the total number of received number hash partitions is sixteen.

[0077] The SMS identification device deduplicates SMS communication records based on message identifiers. If multiple communication records are generated due to multiple retries, duplicate logs, or duplicate records from multiple nodes for the same message identifier, they are counted only once.

[0078] When there is at least one SMS communication record in an observation window that corresponds to the new ordered communication trajectory after deduplication by message identifier, the observation window is determined as a valid observation window; the number of consecutive observation windows is the number of observation windows that are consecutive in time and all belong to valid observation windows.

[0079] The SMS identification device performs a hash calculation on the receiving number or its anonymized value, and maps the receiving number or its anonymized value to sixteen receiving number hash partitions according to the hash result. The same receiving number or the same anonymized value is always mapped to the same receiving number hash partition. The SMS identification device counts the number of receiving number hash partitions actually covered by the new ordered communication trajectory within the confirmation period.

[0080] The fact that the number of received number hash partitions reaches eight indicates that the corresponding new ordered communication trajectory is distributed across multiple receiving objects, rather than being formed by repeated transmissions of a single number or a small number of numbers.

[0081] The number of different message identifiers, the number of continuous observation windows, and the number of received number hash partitions are used to reflect the message size, duration, and distribution of recipients of a new ordered communication trajectory, respectively. Only when a new ordered communication trajectory simultaneously meets all three conditions can the SMS identification device confirm that it has formed a legitimate group migration.

[0082] For example, within a 24-hour confirmation period, T3 corresponds to 180 different message identifiers, continuously covering four one-hour observation windows, and the receiving numbers are distributed across ten receiving number hash partitions. At this point, T3 simultaneously meets all three conditions, and the SMS identification device writes T3 into the confirmed trajectory set.

[0083] The SMS recognition device simultaneously records the migration relationship from T1 to T3: T1: P01→IP-A→GW-A→SC-01→SMSC-01; Migration to T3: P01→IP-B→GW-B→SC-01→SMSC-01.

[0084] For business expansion scenarios, if T1 and T3 both have SMS communication records within the same continuous observation window, the SMS recognition device will record the migration relationship from T1 to T3 as a parallel expansion migration relationship and set T1 and T3 to a parallel state.

[0085] For disaster recovery handover scenarios, if T1 stops in a certain observation window and T3 appears in an adjacent observation window, and the common suffix of T1 and T3 remains unchanged, then the SMS recognition device will record the migration relationship from T1 to T3 as a succession handover migration relationship.

[0086] For example, if T1 stops at observation window 150 and T3 appears at observation window 151, and both of them pass through SC-01 and SMSC-01, then the SMS identification device will set T1 to historical state and T3 to valid state, and record: T1→T3, and continue switching.

[0087] The SMS identification device forms a migration chain based on the reference confirmation trajectory, the new ordered communication trajectory, and the effective observation window. If the adjacent observation window after T3 stops detects the reappearance of the reference confirmation trajectory T1, and the common suffix remains unchanged, the SMS identification device records the back-switch relationship from T3 to T1 in the migration chain, i.e., T3→T1. This back-switch relationship is used to indicate that after disaster recovery, the SMS communication path returns to the original submission source address or the original access gateway, and T1 is restored to a valid state or a parallel state.

[0088] The one-hour observation window, twenty-four-hour confirmation period, one hundred different message identifiers, three consecutive observation windows, eight receiving number hash partitions, and the total number of sixteen receiving number hash partitions mentioned above are example parameters applicable to high-frequency enterprise SMS services. In practical applications, corresponding thresholds can be set based on the SMS sending scale, sending time distribution, and recipient dispersion of the corresponding business identity combination during historical stable operating periods.

[0089] S105, when the confirmation period expires and the new ordered communication trajectory does not simultaneously reach the aforementioned thresholds, the new ordered communication trajectory is not written into the confirmed trajectory set, the corresponding SMS is identified as a point abnormal SMS, and the adjacent relationship involved in the trajectory change context is verified. The first adjacent relationship that does not appear in the confirmed trajectory set corresponding to the same business identity combination along the communication processing order from the enterprise SMS port side to the SMS center side is identified as an abnormal entry relationship.

[0090] If the new orderly communication trajectory does not meet the conditions for confirming legitimate group migration after the confirmation period expires, the SMS identification device will not write the new orderly communication trajectory into the confirmed trajectory set, and will identify the SMS corresponding to the new orderly communication trajectory as an abnormal point SMS.

[0091] Please continue reading. Figure 6 The business identity combination B01 includes the enterprise SMS port P01, the submission account Account-01, and the SMS signature "a certain enterprise". The reference confirmation trajectory T1 is: P01→IP-A→GW-A→SC-01→SMSC-01. The abnormal trajectory T4 corresponding to a specific SMS message is: P01→IP-A→GW-X→SC-01→SMSC-01.

[0092] Within the 24-hour confirmation period, only one message identifier corresponds to T4, and T4 appears in only one observation window. The number of receive number hash partitions it covers has not reached the corresponding threshold. Therefore, T4 has not simultaneously reached the thresholds corresponding to the number of different message identifiers, the number of consecutive observation windows, and the number of receive number hash partitions, and cannot form a legitimate group migration.

[0093] The SMS recognition device performs a two-way comparison between T1 and T4 to determine: The common prefix is ​​P01→IP-A; The common suffix is ​​SC-01→SMSC-01; The replaced trajectory segment is GW-A; The newly introduced trajectory segment is GW-X.

[0094] When both the newly introduced trajectory segment and the common suffix are not empty, the SMS recognition device generates a sequence of adjacent relationships directly involved in the trajectory change context, according to the processing order of the common prefix, the newly introduced trajectory segment, and the common suffix in the abnormal trajectory T4: IP-A—GW-X; GW-X—SC-01.

[0095] Among them, IP-A—GW-X represents the adjacency relationship between the last path element of the common prefix and the first path element of the newly introduced trajectory segment, and GW-X—SC-01 represents the adjacency relationship between the last path element of the newly introduced trajectory segment and the first path element of the common suffix.

[0096] In this embodiment, the confirmed trajectory set corresponding to service identity combination B01 also includes another confirmed ordered communication trajectory, which contains the neighbor relationship GW-X—SC-01. Therefore, GW-X—SC-01 has been recorded in the neighbor relationship record table. The neighbor relationship IP-A—GW-X is not included in the confirmed trajectory set corresponding to service identity combination B01.

[0097] The SMS identification device verifies, in the order of communication processing from the enterprise SMS port to the SMS center, whether each adjacent relationship involved in the trajectory change context is included in the confirmed trajectory set corresponding to business identity combination B01: IP-A—GW-X is not included in the confirmed trajectory set corresponding to service identity combination B01; GW-X—SC-01 is included in the confirmed trajectory set corresponding to service identity combination B01.

[0098] Therefore, the SMS identification device identifies the first adjacent relationship IP-A—GW-X that appears in the communication processing sequence but is not included in the confirmed trajectory set corresponding to the service identity combination B01 as an abnormal entry relationship, corresponding to the abnormal relationship between the submitted source address IP-A and the access gateway GW-X.

[0099] The public suffix SC-01→SMSC-01 remains unchanged. SC-01—SMSC-01 is included in the confirmed trajectory set corresponding to the business identity combination B01. It can be further verified during the complete trajectory review process, but it is not considered as a newly introduced adjacent relationship directly formed by the newly introduced trajectory segment.

[0100] The anomaly recording unit generates point anomaly records, which include at least: message identifier, service identity combination, reference confirmation trajectory, abnormal ordered communication trajectory, replaced trajectory segment, newly introduced trajectory segment, anomaly entry relationship, and anomaly occurrence observation window.

[0101] In another example, the abnormally ordered communication trajectory is: P01→IP-A→GW-X→SC-X→SMSC-01. The reference confirmation trajectory remains: P01→IP-A→GW-A→SC-01→SMSC-01.

[0102] SMS recognition device identified: The common prefix is ​​P01→IP-A; The common suffix is ​​SMSC-01; The replaced trajectory segment is GW-A→SC-01; The newly introduced trajectory segment is GW-X→SC-X.

[0103] The SMS recognition device generates the following adjacent relationships in sequence: IP-A—GW-X; GW-X—SC-X; SC-X—SMSC-01.

[0104] If IP-A—GW-X is not included in the confirmed trajectory set corresponding to service identity combination B01, the SMS identification device will determine IP-A—GW-X as an abnormal entry relationship and submit the corresponding source-access gateway relationship as abnormal.

[0105] If IP-A—GW-X is already included in the confirmed trajectory set corresponding to service identity combination B01, but GW-X—SC-X is not included in the confirmed trajectory set, then the SMS identification device will determine GW-X—SC-X as an abnormal entry relationship, and the corresponding access gateway—service code relationship will be abnormal.

[0106] If both of the aforementioned adjacent relationships are included in the confirmed trajectory set corresponding to business identity combination B01, but SC-X—SMSC-01 is not included in the confirmed trajectory set, then the SMS identification device will determine SC-X—SMSC-01 as an abnormal entry relationship, and the corresponding service code—SMS center relationship will be abnormal.

[0107] Therefore, even if there are multiple continuously changing path elements in the ordered communication trajectory to be verified, the SMS identification device can still locate the adjacent relationship of the first confirmed trajectory set that deviates from the same business identity combination according to the communication processing order.

[0108] When the newly introduced trajectory segment is not empty and the common suffix is ​​empty, the SMS recognition device generates a sequence of adjacent relationships between the last path element of the common prefix and the first path element of the newly introduced trajectory segment, as well as within the newly introduced trajectory segment, and verifies them sequentially according to the communication processing order.

[0109] When the newly introduced trajectory segment is empty and the common suffix is ​​not empty, the SMS recognition device generates a cross-adjacent relationship between the last path element of the common prefix and the first path element of the common suffix due to the deletion of the original path element, and verifies whether the cross-adjacent relationship is included in the confirmed trajectory set corresponding to the same business identity combination.

[0110] For SMS processing records that cannot form at least two of the common prefix, newly introduced trajectory fragment, and common suffix due to the lack of necessary path elements, the SMS recognition device marks them as incomplete trajectory records and does not perform legitimate group migration confirmation or point abnormal SMS determination through the trajectory change context of this embodiment.

[0111] Example 3 This embodiment, based on Embodiment 2, allows the same submission source address or the same access gateway to simultaneously carry multiple service identity combinations within the enterprise SMS platform. For example, service identity combinations B01, B02, and B03 are all migrated from access gateway GW-A to GW-B.

[0112] When the SMS identification device detects that the same newly introduced access gateway GW-B appears simultaneously in the new ordered communication trajectories corresponding to multiple service identity combinations, it verifies the adjacency relationship between the service code corresponding to each service identity combination and the SMS center.

[0113] If the adjacency relationship between the service codes corresponding to B01, B02, and B03 and the SMS center is included in the confirmed trajectory set corresponding to the corresponding business identity combination, then the SMS identification device will merge the new ordered communication trajectories corresponding to B01, B02, and B03 into a shared infrastructure migration group.

[0114] For example: B01 corresponds to SC-01—SMSC-01; B02 corresponds to SC-02—SMSC-01; B03 corresponds to SC-03—SMSC-02.

[0115] If the above-mentioned adjacent relationships are all existing confirmed adjacent relationships of each service identity combination, it means that multiple services jointly change the access gateway, but the downstream routing relationship of each service remains stable.

[0116] The shared infrastructure migration group is used to indicate that multiple business identity combinations have experienced the same infrastructure node changes, and to provide cross-evidence for determining whether the infrastructure node changes constitute unified expansion or switching. The SMS identification device separately counts the number of different message identifiers, the number of consecutive observation windows, and the number of received number hash partitions corresponding to B01, B02, and B03, without directly merging the number of different message identifiers between different business identity combinations or substituting the migration confirmation conditions of one business identity combination with the statistical results of another.

[0117] Only when the number of different message identifiers, the number of continuous observation windows, and the number of receiving number hash partitions for the corresponding business identity combination reach the corresponding thresholds will the SMS identification device write the new ordered communication trajectory corresponding to the business identity combination into the confirmed trajectory set.

[0118] If a certain business identity combination uses a service code that does not belong to that business identity combination while changing its access gateway, the SMS identification device will not incorporate that business identity combination into the shared infrastructure migration group, but will continue to retain the corresponding new ordered communication trajectory in the pending trajectory set.

[0119] Similarly, when the same newly introduced submission source address appears simultaneously in the new ordered communication trajectories corresponding to multiple business identity combinations, the SMS identification device verifies the downstream adjacent relationships of the corresponding business identity combinations in the manner described above, and counts the three migration confirmation parameters corresponding to each business identity combination.

[0120] This process can distinguish between legitimate migrations involving multiple services expanding together or switching access gateways, and abnormal changes where a single service is incorrectly linked to other service codes. It also prevents a small number of abnormal SMS messages from multiple service identity combinations from being mistakenly identified as legitimate group migrations due to cross-service accumulation.

[0121] Example 4 Based on Example 2, this embodiment sets an effective state, a parallel state, and a historical state for the confirmed orderly communication trajectory of the SMS identification device.

[0122] When a confirmed, orderly communication trajectory in the historical state reappears, the SMS identification device queries whether there is a corresponding back-switch relationship in the migration chain.

[0123] If a corresponding back-cut relationship exists in the migration chain, the SMS recognition device restores the effective state or parallel state of the historical trajectory according to the back-cut relationship.

[0124] If there is no corresponding back-cut relationship in the migration chain, the SMS identification device will not directly release the route because the trajectory has been confirmed as legitimate before. Instead, it will write the ordered communication trajectory formed by the re-emerging SMS communication records into the pending trajectory set and re-execute the trajectory change context determination and legitimate group migration confirmation.

[0125] For example, T1 is in a historical state after switching to T3. If T1 reappears, but there is no T3→T1 back-switch relationship in the migration chain, the SMS identification device will write the ordered communication trajectory corresponding to T1 formed by the reappearing SMS communication records into the pending trajectory set, and will count the number of different message identifiers, the number of continuous observation windows, and the number of received number hash partitions corresponding to its reappearance. Only when the three statistics reach the corresponding thresholds will T1 be reconfirmed as the current legitimate communication trajectory.

[0126] This method avoids situations where discontinued submission source addresses, gateways, or servers are automatically recognized as legitimate communication paths upon reappearance due to the long-term retention of historical legitimate records.

[0127] This invention constructs an ordered communication trajectory using the enterprise SMS port, submission source address, access gateway, service code, and SMS center. It records the evolution of communication paths and adjacent relationships through a set of confirmed trajectories. It constructs a trajectory change context using common prefixes, common suffixes, replaced trajectory segments, and newly introduced trajectory segments. It confirms legitimate group migrations using the number of different message identifiers, the number of consecutive observation windows, and the number of received number hash partitions. For trajectory change SMS messages that do not form legitimate group migrations within the confirmation period, the first abnormal entry relationship is determined according to the communication processing order of adjacent relationships.

[0128] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A method for identifying point-anomaly SMS messages based on communication trajectory evolution modeling, characterized in that, Includes the following steps: S101: Obtain SMS communication records that have passed the legal verification of the enterprise SMS port, submitted account, and SMS signature, and generate an ordered communication trajectory in the order of enterprise SMS port, submitted source address, access gateway, service code, and SMS center; S102, combine the enterprise SMS port, submitting account and SMS signature into a business identity combination, summarize the orderly communication trajectory according to the business identity combination and observation window, and write the orderly communication trajectory that reaches the preset number of times within the baseline period and the adjacent relationship into the confirmed trajectory set. S103, compare the unverified ordered communication trajectories that have not been written into the confirmed trajectory set with the confirmed ordered communication trajectories with the same business identity combination from the port side forward and the SMS center side reverse, determine the common prefix, common suffix, replaced trajectory fragment and newly introduced trajectory fragment, and form a trajectory change context; S104. Summarize the SMS communication records corresponding to the new ordered communication trajectory according to the condition of consistent trajectory change context. When the number of different message identifiers, the number of continuous observation windows and the number of receiving number hash partitions reach the corresponding thresholds, write the new ordered communication trajectory into the confirmed trajectory set and record the migration relationship. S105, when the confirmation period expires and the new ordered communication trajectory does not simultaneously reach the aforementioned thresholds, the new ordered communication trajectory is not written into the confirmed trajectory set, the corresponding SMS is determined as a point abnormal SMS, and the adjacent relationship involved in the trajectory change context is verified. The first adjacent relationship that does not appear in the confirmed trajectory set corresponding to the same business identity combination along the communication processing order from the enterprise SMS port side to the SMS center side is determined as an abnormal entry relationship. The abnormal SMS message refers to an SMS message where the enterprise SMS port, the submitted account, and the SMS signature have passed the legal verification, the ordered communication trajectory deviates partially from the confirmed ordered communication trajectory of the same business identity combination, and the partial deviation does not form an SMS message that meets the aforementioned thresholds for legitimate group migration within the confirmation period.

2. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 1, characterized in that, The SMS identification device encodes each path element in the ordered communication trajectory as element type, element value and processing order, and merges adjacent duplicate path elements with the same element type and element value under the same message identifier into one path element, while retaining the first entry time and the last exit time of adjacent duplicate path elements.

3. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 1, characterized in that, The confirmed trajectory set records the effective observation window and the last occurrence observation window of each confirmed ordered communication trajectory; the SMS identification device sorts the comparison results in descending order according to the total number of path elements contained in the common prefix and common suffix, and sorts them in descending order according to the starting window number of the effective observation window when the total number of path elements is the same, and sorts them in descending order according to the last occurrence observation window when the starting window number is still the same, and determines the confirmed ordered communication trajectory at the top of the sort as the reference confirmed trajectory.

4. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 3, characterized in that, When both the reference confirmation trajectory and the new ordered communication trajectory have SMS communication records within the same continuous observation window, the SMS recognition device records the parallel expansion migration relationship. When a new ordered communication trajectory appears in the adjacent observation window after the reference confirmation trajectory stops and the common suffix remains unchanged, the device records the successive switching migration relationship.

5. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 4, characterized in that, The SMS recognition device generates a migration chain based on the reference confirmation trajectory, the new ordered communication trajectory, and the effective observation window; When the SMS recognition device detects the reappearance of the reference confirmation trajectory in the adjacent observation window after the new ordered communication trajectory stops and the common suffix remains unchanged, it writes the back-cut relationship from the new ordered communication trajectory to the reference confirmation trajectory in the migration chain.

6. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 5, characterized in that, The SMS identification device sets an effective state, a parallel state, and a historical state for the confirmed ordered communication trajectory. When a confirmed ordered communication trajectory in the historical state reappears and there is no corresponding back-cut relationship in the migration chain, the SMS identification device writes the ordered communication trajectory formed by the reappeared SMS communication records into the pending trajectory set and re-confirms the migration according to the trajectory change context.

7. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 1, characterized in that, When the same newly introduced submission source address or the same newly introduced access gateway appears in multiple service identity combinations, the SMS identification device verifies the service code and SMS center corresponding to each service identity combination respectively. When the adjacency relationship between the service code and SMS center corresponding to each service identity combination is included in the confirmed trajectory set corresponding to the corresponding service identity combination, the SMS identification device merges the new ordered communication trajectories corresponding to multiple service identity combinations into a shared infrastructure migration group, and respectively counts the number of different message identifiers, the number of continuous observation windows, and the number of received number hash partitions corresponding to each service identity combination.

8. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 1, characterized in that, The SMS identification device writes new ordered communication trajectories within the confirmation period into a pending trajectory set that is isolated from the confirmed trajectory set, and prohibits new ordered communication trajectories in the pending trajectory set from being used as comparison benchmarks for other pending ordered communication trajectories or from being counted as different message identifiers in other new ordered communication trajectories.

9. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 8, characterized in that, The observation window is one hour, and the confirmation period is twenty-four hours; the SMS identification device performs hash calculation on the receiving number or the anonymized value of the receiving number, and maps the receiving number or the anonymized value of the receiving number to sixteen receiving number hash partitions according to the hash result; When the number of different message identifiers corresponding to the new ordered communication trajectory reaches one hundred, the number of continuous observation windows reaches three, and the number of covered receiving number hash partitions reaches eight, the SMS identification device writes the new ordered communication trajectory into the confirmed trajectory set.

10. The point anomaly SMS identification method based on communication trajectory evolution modeling according to claim 1, characterized in that, The SMS identification device generates an adjacency sequence according to the processing order of the common prefix, newly introduced trajectory segment, and common suffix in the new ordered communication trajectory. When neither the newly introduced trajectory segment nor the common suffix is ​​empty, the adjacency sequence includes the adjacency relationships between the last path element of the common prefix and the first path element of the newly introduced trajectory segment, within the newly introduced trajectory segment, and between the last path element of the newly introduced trajectory segment and the first path element of the common suffix. When the newly introduced trajectory segment is not empty and the common suffix is ​​empty, the adjacency sequence includes the adjacency relationships between the last path element of the common prefix and the first path element of the newly introduced trajectory segment, and within the newly introduced trajectory segment. When the newly introduced trajectory segment is empty and the common suffix is ​​not empty, the adjacency sequence includes the cross-adjacency relationship between the last path element of the common prefix and the first path element of the common suffix.

Images