Multi-modal based cyber security protection method, device and medium

Abstract

The application relates to the technical field of voice semantics, and discloses a network security protection method and device based on multiple modes and a medium. The method comprises the following steps: collecting network activity data of minors and interactive objects in real time, identifying and replacing implicit words and real meanings according to a preset network implicit word table to obtain modified data; dividing according to a preset mode and extracting features by using a multi-modal integrated model, combining the identity and historical behavior image of the interactive object to calculate real-time early warning characteristic values. When the characteristic value is lower than the lower limit of the threshold interval, the user is prompted and the collection is continued; when the characteristic value is within the interval, the confidence degree is analyzed by an AI intelligent agent, if the confidence degree is lower than the threshold, the collection is continued, otherwise, an action suggestion is generated and pushed; when the characteristic value is higher than the upper limit, desensitization content and a warning value are generated and sent to a pre-authorized user end to form a real-time hierarchical protection closed loop. The application can improve the timeliness and accuracy of network social risk identification and processing of minors.

Description

Technical Field

[0001] This invention relates to the field of speech and semantic technology, and in particular to a network security protection method, device and medium based on multimodality. Background Technology

[0002] With the continuous integration of instant messaging, group communication, comment interaction, voice calls, and short video social networking functions, minors can communicate with others on the same online social platform in various forms, including text, emoticons, voice, and interactive behaviors. Related platforms typically use methods such as sensitive word filtering, report review, or manual inspection to identify online risks, and take action such as issuing warnings, blocking, or handling violations after discovering them.

[0003] However, the expression of risks in minors' online social interactions is often covert and cross-modal. First, online slang frequently uses homophones, abbreviations, niche terminology, or semantic shifts to express meanings different from their literal interpretations, making it easy to miss genuine risks by relying solely on sensitive word matching. Second, risk clues may be scattered throughout text, emojis, voice tone, continuous private chats, requests for privacy, and account history; judging each modality separately makes it difficult to obtain timely and stable risk conclusions. Third, uniform post-event reminders are difficult to match with the degree of risk, potentially leading to over-intervention in jokes with classmates or interactions with acquaintances, or delaying the handling of high-risk communications; furthermore, directly sending complete chat content to guardians may expand the scope of minors' privacy exposure.

[0004] In summary, existing technologies struggle to identify risks in minors' online social activities that are jointly represented by online cryptic terms and cross-modal information in a timely and accurate manner, and also find it difficult to strike a balance between risk assessment, minor protection, and authorization notification. Therefore, improving the timeliness and accuracy of identifying and handling risks in minors' online social interactions has become an urgent problem to be solved. Summary of the Invention

[0005] This invention provides a multimodal network security protection method, device, and medium, the main purpose of which is to solve the problem of how to improve the timeliness and accuracy of identifying and handling online social risks of minors.

[0006] Firstly, to achieve the above objectives, the present invention provides a multimodal-based network security protection method, comprising: Real-time collection of network activity data of target users and interactive objects; identification of network hidden words in the network activity data according to a preset network hidden word list, wherein the network hidden word list contains mapping relationship data between network words and their true meanings; The network hidden words in the network activity data are replaced with their corresponding real meanings according to the network hidden word list to obtain corrected data; the corrected data is divided into multiple single-modal data according to the preset data modality, and the single-modal data features corresponding to each single-modal data are extracted using the preset multimodal ensemble model; The identity data and historical behavior data of the interactive object are acquired and analyzed to construct the profile features of the interactive object; the real-time warning feature value of the online social activity is analyzed based on all extracted single-modal data features and the constructed profile features, and it is analyzed whether the real-time warning feature value is within a preset threshold range. If the data is within a preset threshold range, a preset AI agent is invoked, and the confidence level of the real-time warning feature value is analyzed based on the corrected data. Based on the relationship between the confidence level and the preset confidence threshold, the step of directly returning to collect the network activity data of the target user and the interactive object in real time is determined and executed. Alternatively, the step of first invoking the AI ​​agent to generate a current action suggestion, pushing the current action suggestion to the target user, and then returning to collect the network activity data of the target user and the interactive object in real time is determined and executed.

[0007] Secondly, the present invention also provides an electronic device, the electronic device comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the multimodal network security protection method described above.

[0008] Thirdly, the present invention also provides a computer-readable storage medium storing at least one computer program, which is executed by a processor in an electronic device to implement the multimodal-based network security protection method described above.

[0009] This invention reduces missed detections caused by concealed expressions by collecting real-time data on online social activities and recovering the true meaning of hidden words using a network lexicon. Through collaborative analysis of text, visual, voice, and behavioral information, combined with the identity and historical behavior of interacting individuals to construct profiles, it improves the ability of real-time warning features to express current communication risks. By implementing risk alerts, action suggestions, and anonymized content notifications through threshold ranges and confidence level grading, it achieves a balance between protecting target users and avoiding misjudgments, ensuring that high-risk content is only sent to pre-authorized users. Ultimately, this invention improves the timeliness and accuracy of identifying and handling online social risks for minors. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of an application environment for a multimodal network security protection method according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating a multimodal network security protection method according to an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of an electronic device that implements a multimodal network security protection method according to an embodiment of the present invention; Figure 4 This is another structural schematic diagram of an electronic device that implements a multimodal network security protection method according to an embodiment of the present invention.

[0012] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and embodiments. The following embodiments are for illustrative purposes only and are not intended to limit the scope of protection of this invention.

[0014] The online security protection method for minors provided in this invention can be applied to... Figure 1 The application environment is illustrated. This environment includes the target user's terminal, the interaction partner's terminal, a social networking platform server, a risk analysis server, and a pre-authorized user terminal. The target user's terminal runs a social application for minors, acquiring real-time network activity data generated during online social interactions between the target user and the interaction partner through a local data acquisition component. The social networking platform server provides message, emoticon, voice, and interactive event transmission services. The risk analysis server performs hidden word recognition, multimodal feature extraction, profile construction, real-time early warning feature value analysis, and AI agent invocation. The pre-authorized user terminal can be a guardian's mobile phone, tablet, or other trusted terminal pre-bound to the target user's account, receiving only anonymized risk content and real-time early warning feature values.

[0015] S1. Real-time collection of network activity data of target users and interactive objects, and identification of network hidden words in the network activity data according to a preset network hidden word list, wherein the network hidden word list contains mapping relationship data between network words and their true meanings.

[0016] In this embodiment of the invention, real-time data collection refers to the target user terminal or the network social platform server triggering data collection based on message arrival events, forming a continuous data stream within a preset sliding time window. The sliding time window can be set to the most recent 30 seconds, or, when the message volume is small, to the most recent 10 rounds of dialogue.

[0017] Network activity data includes text content, emoticons, images, voice messages, voice transcription results, sending time, sending account, receiving account, and interaction event type.

[0018] The target users are currently protected underage accounts, and the interaction partners are accounts that chat, comment, group chat, or make voice calls with the target users.

[0019] This embodiment uses the same real-world application scenario throughout. The target user is Xiaolin, a 14-year-old eighth-grade student, and the interaction partner is an unfamiliar account named "Akai." Xiaolin chats privately with Akai in the evening. Akai first sends the text "Let's be a couple," followed by an emoji with intimate connotations, and then a voice message asking for Xiaolin's school and home address. During the interaction, Akai initiates private chats repeatedly and requests private information twice. This solution processes the aforementioned online social activities in real time according to the following steps.

[0020] In the practical application scenario of this invention, after Xiaolin receives a text message from Akai, the target user terminal (the client Xiaolin uses, such as a mobile phone or computer) immediately captures the message upon its arrival, and simultaneously associates it with emojis, voice messages, and private chat events within the previous 30 seconds. If batch analysis is only performed at the end of the day, Akai's request for school and address may have already been completed, making timely intervention impossible; therefore, this invention uses an event-triggered method to form a real-time data stream.

[0021] In this embodiment of the invention, replacing network hidden terms in network activity data with their corresponding true meanings according to the network hidden term list includes: The network activity data is subjected to character normalization processing to obtain normalized text; A preset multi-mode string matching algorithm is used to match the normalized text with the network hidden word list to obtain candidate hidden words and the positions of the candidate hidden words in the normalized text; The candidate hidden words and their contexts are input into a pre-trained context semantic discrimination model to obtain context semantic matching results; Determine the network implicit words in the network activity data and their corresponding real meaning expressions according to the context semantic matching result and the occurrence positions, and replace the determined network implicit words with the corresponding real meaning expressions.

[0022] Specifically, the character normalization processing includes unifying full-width characters and half-width characters, removing zero-width characters, merging consecutive repeated punctuations, and converting traditional Chinese characters into simplified Chinese characters, so as to obtain the normalized text "Let's date and be CP, send me a photo of you".

[0023] In detail, the multi-pattern string matching algorithm may be an Aho-Corasick multi-pattern string matching algorithm, which can hit all candidate words in the network implicit word list by scanning the normalized text. In this example, the candidate implicit word "CP" and its position are hit. The context semantic discrimination model adopts a text classifier based on a Chinese pre-trained language model, inputs "be CP" and one sentence before and after it into the model, and outputs a context semantic matching result: "date, boyfriend and girlfriend", with a matching score of 0.96. Since "CP" may be an English abbreviation for "personal computer" when it appears alone, and is only determined to have the meaning of dating and making friends in the context structure of "be CP", S1 finally obtains the network implicit word "CP" and the real meaning expression "date, boyfriend and girlfriend".

[0024] The embodiments of the present invention obtain the network implicit words and their real meaning expressions in the above manner, so that subsequent steps no longer rely on surface text for judgment, thereby being capable of restoring layered, abbreviated and semantically shifted expressions to analyzable risk semantics.

[0025] S2. Replace the network implicit words in the network activity data with the corresponding real meaning expressions according to the network implicit word list to obtain corrected data.

[0026] In the embodiment of the present invention, the corrected data refers to data obtained after replacing the network implicit words in the network activity data with real meaning expressions. The replacement process retains the original account identifier, timestamp, dialogue turn and data modality mark, so as to facilitate subsequent time sequence analysis and evidence tracing.

[0027] The replacement refers to rewriting the original words in the network activity data into real meaning expressions according to the occurrence positions determined in S1, while maintaining the corresponding relationship among the original words, the replaced words, the timestamps and the dialogue turns. The corrected data not only includes the replaced text, but also includes the reference relationship of visual, voice and behavior data on a unified time axis.

[0028] In the practical application scenario of this invention, the original text "Let's be a couple, send me a picture of yourself" is replaced with the semantically clear text "Let's be a couple, send me a picture of yourself." If the contextual tag "being a couple" is added to the network latent word list later, the corresponding entry can be updated, but the corrected data output by S2 still retains the original message index, thus supporting the backtracking of erroneous replacements.

[0029] Specifically, S2 establishes a replacement mapping based on the "network terms and their true meanings" fields in the network hidden lexicon, and performs replacements from the last occurrence to the first to avoid subsequent positional shifts caused by changes in text length after replacement. The replacement result is written to a correction data object, which includes a dialogue identifier, account identifier, message sequence number, original text, corrected text, modality type, and collection time. In this embodiment, the obtained corrected data record is "Dialogue D001, Message M003, Original text: Let's be a couple, send me a picture of yourself; Corrected text: Let's be a couple, send me a picture of yourself; Modality type: Text; Time: 20:16:08".

[0030] This invention generates corrected data that preserves the original mapping relationship, enabling subsequent multimodal analysis to process real semantics while retaining the risk evidence chain and avoiding the loss of original communication content due to semantic replacement.

[0031] S3. Divide the corrected data into multiple single-modal data according to the preset data modality, and extract the single-modal data features corresponding to each single-modal data using the preset multimodal ensemble model.

[0032] In this embodiment of the invention, the data modality is a predefined set of data representation types.

[0033] This embodiment specifically includes monomodal data such as text modality, visual modality, speech modality, and behavioral modality.

[0034] Monomodal data refers to data that contains only one form of data representation, specifically including text modal data, visual modal data, voice modal data, and behavioral modal data. Text modal data includes chat text, nicknames, and comments; visual modal data includes emoticons, images, and their text stickers; voice modal data includes voice messages and call audio; and behavioral modal data includes interactive events such as privacy snooping behavior, high-frequency harassment behavior, initiating private chats, frequently adding friends, continuous follow-up questions, requesting private information, and message recall.

[0035] Partitioning refers to categorizing each corrected data point into a specific data modality based on its source, file format, message type, and event type. A multimodal ensemble model is a pre-trained set of models used to extract features from each modality and perform temporal alignment.

[0036] In the actual application scenario of this invention, the text sent by Akai enters the text modality, the intimate hint emoji enters the visual modality, the voice asking for school and home address enters the voice modality, and the continuous private chat and privacy request operations enter the behavior modality.

[0037] If the four types of data are directly concatenated into a single text string, the temporal order of speech tone, emoji images, and continuous behavior will be disrupted; therefore, S3 first divides the modalities and then extracts features separately.

[0038] In this embodiment of the invention, dividing the corrected data into multiple single-modal data according to a preset data modality includes: Based on the data source identifier and file characteristics of each piece of corrected data, the initial modality category to which the corrected data belongs is determined; Each piece of corrected data in the corrected data is time-aligned according to a unified time base to obtain corrected data with timestamps; The timestamped correction data is formatted into text modal data, visual modal data, speech modal data, and behavioral modal data, respectively. Missing values ​​are imputed and fields are normalized for the text modal data, visual modal data, speech modal data, and behavioral modal data respectively to obtain the various single modal data.

[0039] Specifically, messages with a data source identifier of TEXT are classified as text modal, messages with a data source identifier of IMAGE or STICKER are classified as visual modal, messages with a data source identifier of VOICE are classified as voice modal, and interaction records with a data source identifier of EVENT are classified as behavioral modal. A unified time base is used, employing millisecond-level UTC timestamps. Text modal data can be represented as "{Time:20:16:08, Text: Let's be a couple, send me a photo}", visual modal data can be represented as "{Time:20:16:13, Image identifier: IMG008, Image size: 240x240}", voice modal data can be represented as "{Time:20:16:18, Audio identifier: AUD003, Sampling rate: 16000Hz, Number of channels: 1}", and behavioral modal data can be represented as "{Time:20:16:20, Event: Privacy request, Cumulative number of times: 2}". Missing values ​​are filled using a preset default value, and field normalization uses minimum-maximum normalization, mapping values ​​uniformly to 0 to 1.

[0040] Furthermore, the multimodal ensemble model is a pre-trained and stored set of neural networks, including text encoding branches, visual encoding branches, speech encoding branches, behavior encoding branches, feature alignment layers, and risk mapping branches. Profile features are used to represent the identity attributes of the interacting object and its historical behavioral tendencies. Real-time warning feature values ​​are risk quantification results ranging from 0 to 100; the higher the value, the higher the risk of the current online social activity. The preset threshold range can be set to 40 to 75, i.e., a lower limit of 40 and an upper limit of 75; the confidence threshold can be set to 0.80. These values ​​can be adjusted according to the target user's age, guardianship level, or platform security policies.

[0041] In this embodiment of the invention, the step of extracting the single-modal data features corresponding to each type of single-modal data using a preset multimodal ensemble model includes: The text modal data is input into the text encoding branch of the multimodal ensemble model to obtain text features; The visual modal data is input into the visual coding branch of the multimodal ensemble model to obtain visual features; The speech modal data is input into the speech coding branch of the multimodal ensemble model to obtain speech features; The behavioral modal data is input into the behavioral encoding branch of the multimodal ensemble model to obtain behavioral features; The text features, visual features, speech features, and behavioral features are aligned and concatenated according to a unified timestamp to obtain the single-modal data features.

[0042] Specifically, the text encoding branch adopts the RoBERTa-wwm-ext model, which corrects the text encoding into 768-dimensional text features; The visual encoding branch uses the ResNet-18 model to encode emojis or images into 512-dimensional visual features. The speech coding branch uses the ECAPA-TDNN model to encode 16kHz mono audio into 192-dimensional speech features; The behavior encoding branch uses a temporal convolutional network (TCN) to encode continuous event sequences into 256-dimensional behavioral features.

[0043] The feature alignment layer projects the features of each branch onto 256 dimensions and aligns and concatenates them according to the same timestamp and dialogue turn to obtain a single-modal data feature set. In this example, the text feature vector is used to represent semantics such as "finding a partner" and "sending photos", the visual feature vector is used to represent intimate hints in emojis, the speech feature vector is used to represent the speech content of asking for school and address, and the behavioral feature vector is used to represent continuous private chat and privacy requests.

[0044] This invention, through modal splitting of corrected data and extracting features separately, enables text, image, voice, and behavioral information to be used together in subsequent risk analysis while preserving their temporal order, thereby reducing misjudgments of a single modality and improving the completeness of feature representation.

[0045] S4. Acquire and analyze the identity data and historical behavior data of the interactive object to construct the profile features of the interactive object.

[0046] In this embodiment of the invention, identity data is data related to the identity attributes of the interactive object, including age, occupation, gender, account registration duration, authentication status, and frequently used login regions.

[0047] Historical behavioral data are records of the behavior of the interacting parties within a preset statistical period, including historical professional behavior, historical online behavior, number of times they initiated private chats, number of times they requested privacy information, number of times they contacted each other at night, and number of times they were reported.

[0048] Profile features are fixed-dimensional vectors obtained by mapping identity coding features and behavioral statistical features.

[0049] In the actual application scenario of this invention, Akai's account information shows that he is 28 years old, a freelancer, and male. The account was registered 12 days ago and has not completed real-name authentication. In the past 7 days, he initiated 23 private messages, made 2 requests for privacy, sent 6 messages between 10 PM and 2 AM the next day, and was reported by other users once. A single message may not be enough to determine the risk, but identity information and continuous behavior can reflect the account's behavioral tendencies.

[0050] The method for constructing the profile features of the interactive object in this embodiment of the invention includes: The identity data is encoded according to the type of each identity field in the identity data to obtain the identity encoding feature; The historical behavioral data is statistically analyzed according to preset behavioral event types to obtain behavioral statistical features; The identity encoding features and the behavioral statistical features are concatenated according to a preset field order to obtain an initial profile vector; The initial image vector is nonlinearly mapped using a preset image mapping network to obtain the image features.

[0051] Specifically, the age field is binned and coded according to age under 18, age 18 to 25, age 26 to 40, and age over 40. The occupation field is one-hot encoded using a preset occupation category table. The gender field is binary encoded. The authentication status is Boolean encoded.

[0052] The behavioral statistics feature is obtained by dividing the number of proactive private chats in the past 7 days by 7 to get the daily average number of proactive private chats. The number of privacy requests, the number of nighttime contacts, and the number of reports are respectively normalized by min-max.

[0053] The preset image mapping network adopts a network structure containing two fully connected layers and a multilayer perceptron, with an input dimension of 32 and an output dimension of 64.

[0054] The profile features obtained in this embodiment of the invention have a high frequency of occurrence in the dimensions of "unverified", "short-term high-frequency private chat", "privacy requests", "nighttime contact" and "being reported".

[0055] This invention, by unifying the identity attributes and historical behaviors of interactive objects into profile features, enables subsequent risk assessments to be made by combining current communication content with the long-term behavioral tendencies of interactive objects, thus avoiding conclusions based solely on a single message.

[0056] S5. Analyze the real-time early warning feature value of online social activities based on all extracted single-modal data features and constructed profile features, and analyze whether the real-time early warning feature value is within the preset threshold range.

[0057] In this embodiment of the invention, each single-modal data feature and profile feature is mapped to a risk sub-value under the same dimension, and then fused according to weight for analysis.

[0058] The real-time early warning feature value is a comprehensive risk score of current online social activities, used to determine whether to issue a risk warning, confidence verification, action suggestion, or an anonymized authorization notification.

[0059] In the actual application scenario of this invention, Xiaolin initially receives only one text message, "Let's be a couple," when communicating with Akai. At this point, the text risk sub-value and profile risk sub-value are relatively low. As intimate emojis, voice messages asking for school and address, continuous private chats, and privacy requests appear, the risk sub-value gradually increases. If only a single sensitive word is used for judgment, it cannot reflect the process of risk increasing as communication progresses. Therefore, this embodiment of the invention performs a multi-feature fusion operation.

[0060] In this embodiment of the invention, the step of analyzing real-time early warning feature values ​​of online social activities based on all extracted unimodal data features and constructed profile features includes: The risk mapping branch in the multimodal ensemble model is used to map the single-modal data features corresponding to each type of single-modal data into text risk sub-values, visual risk sub-values, voice risk sub-values, and behavioral risk sub-values, respectively. The preset image mapping network is used to map the image features into image risk sub-values; The text risk sub-value, the visual risk sub-value, the voice risk sub-value, the behavioral risk sub-value, and the portrait risk sub-value are weighted and summed according to preset weights to obtain the real-time warning feature value.

[0061] Specifically, the risk mapping branch uses a fully connected layer and a sigmoid activation function to map each feature to a value between 0 and 1. Preset weights can be set as follows: text risk subvalue 0.25, visual risk subvalue 0.15, voice risk subvalue 0.15, behavioral risk subvalue 0.20, and profile risk subvalue 0.25.

[0062] The calculation method for real-time early warning feature values ​​is as follows: R = 100 * (0.25*T + 0.15*V + 0.15*A + 0.20*B + 0.25*P) Where R is the real-time warning feature value, T is the text risk sub-value, V is the visual risk sub-value, A is the voice risk sub-value, B is the behavioral risk sub-value, and P is the profile risk sub-value. During the initial interaction, T=0.28, V=0.15, A=0.20, B=0.55, P=0.45, resulting in R=34.5. After A-Kai sent intimate emojis and started asking for the school and address, T=0.71, V=0.67, A=0.73, B=0.80, P=0.55, resulting in R=68.5. When the privacy request behavior occurred again, T=0.92, V=0.84, A=0.92, B=0.92, P=0.73, resulting in R=86.1.

[0063] This invention integrates multimodal data features and profile features into real-time early warning feature values, enabling subsequent classification actions to have a unified, continuous, and comparable basis for judgment, and allowing for timely updates of risk results as new messages arrive.

[0064] If the data is within a preset threshold range, then execute S6: call the preset AI agent and analyze the confidence level of the real-time warning feature value based on the corrected data. Based on the relationship between the confidence level and the preset confidence threshold, determine and execute the step of directly returning to the real-time collection of network activity data of the target user and the interactive object. Alternatively, determine and execute the step of first calling the AI ​​agent to generate a current action suggestion, pushing the current action suggestion to the target user, and then returning to the real-time collection of network activity data of the target user and the interactive object.

[0065] When the real-time warning feature value is within the threshold range, a preset AI agent is invoked to analyze the confidence level of the real-time warning feature value based on the corrected data.

[0066] In this embodiment of the invention, the real-time warning feature value within the threshold range refers to a real-time warning feature value greater than or equal to 40 and less than or equal to 75.

[0067] The pre-defined AI agent is a large language model inference service that is pre-configured with safety rules for minors and runs on a risk analysis server. Its output is constrained by a rule validation layer and used to semantically verify risk scores. Confidence represents the degree to which the current corrected data supports the real-time warning feature value, and its value ranges from 0 to 1.

[0068] In the actual application scenario of this invention, after Akai sends an emoji and asks for the school and address, R=68.5, which is between 40 and 75. At this point, the risk signal is obvious, but it could still be a joke between acquaintances, a quote from a movie or TV show, or an ambiguous emoji. Therefore, the AI ​​agent is invoked to analyze whether the current evidence is sufficient to support the risk score.

[0069] In this embodiment of the invention, the step of calling a preset AI agent and analyzing the confidence level of the real-time early warning feature value based on the corrected data includes: The preset AI agent is invoked to segment the corrected data according to the dialogue rounds, resulting in multiple evidence units; Calculate the credibility of the information source, the consistency of the context, and the clarity of intent for each piece of evidence. The confidence level of the real-time warning feature value is obtained by weighting the information source credibility, the context consistency, and the intent clarity.

[0070] Specifically, the credibility of the information source is determined based on the account authentication status, the number of historical reports, and the completeness of the data source; Contextual consistency is determined based on the degree to which text, emojis, voice, and behavior corroborate each other over time. The clarity of intent is determined based on whether there are explicit requests for privacy, invitations to meet, or statements about private transfers.

[0071] The confidence level can be calculated using the following formula: C = 0.40*C1 + 0.30*C2 + 0.30*C3 Where C represents the confidence level of the real-time warning feature value, C1 represents the credibility of the information source, C2 represents the contextual consistency, and C3 represents the intent clarity. Upon first entering the interval, C1=0.80, C2=0.62, and C3=0.70, resulting in C=0.716; with continuous follow-up questions and privacy requests, C1=0.95, C2=0.92, and C3=0.90, resulting in C=0.926.

[0072] Furthermore, the calculation process for the credibility of the information source C1 is as follows: C1=0.40*A+0.25*B+0.35*Q; where A is the credibility of the current evidence chain, determined based on the account's real-name authentication status, device consistency, login source, and mutual corroboration among multiple evidence sources; B is the historical credibility, B=1-min(N,5) / 5, where N is the number of times the interactive object was reported within the preset statistical period; Q is the data integrity, Q=0.30*Q1+0.20*Q2+0.20*Q3+0.30*Q4, where Q1, Q2, Q3, and Q4 are the integrity of text data, visual data, voice data, and behavioral data, respectively. When the threshold range is first entered, A=0.80, B=0.80, Q=0.80, and C1=0.80 is calculated; after continuous questioning and privacy requests, which corroborate multiple sources of evidence, A=1.00, B=0.80, Q=1.00, and C1=0.95 is calculated.

[0073] Furthermore, the calculation process of context consistency C2 is as follows: According to the evidence units E1 to En obtained by segmenting the dialogue rounds, for any two evidence units Ei and Ej, calculate semantic consistency Sij, risk direction consistency Rij, and temporal continuity Tij, where Sij=(cos(fi,fj)+1) / 2, Rij=1-|ri-Rc|, Tij=max(0,1-|ti-tj| / Tw); where fi and fj are the semantic vectors of Ei and Ej respectively, ri is the risk score of Ei, Rc is the real-time warning feature value, ti and tj are the timestamps of Ei and Ej respectively, and Tw is the preset time window; calculate the weighted average of all evidence unit pairs according to C2=average(0.40*Sij+0.30*Rij+0.30*Tij). When the threshold range is first entered, Sij=0.65, Rij=0.50, Tij=0.70, and C2=0.62 is calculated; when subsequent text, emojis, voice and behavior all point to the same risk intent on the timeline, Sij=0.95, Rij=0.90, Tij=0.90, and C2=0.92 is calculated.

[0074] Furthermore, the calculation process for the intent clarity C3 is as follows: C3 = 0.25 * D + 0.20 * O + 0.25 * A + 0.30 * R - 0.20 * U, with the result limited to between 0 and 1; where D represents the directness of expression, O represents the clarity of the risk object, A represents the clarity of the action, R represents the intensity of the risk intent, and U represents the ambiguity penalty value. When first entering the threshold range, D = 0.80, O = 0.70, A = 0.80, R = 0.70, and U = 0.25, resulting in C3 = 0.70; subsequently, when continuous follow-up questions and explicit requests for privacy occur, D = 0.98, O = 0.88, A = 0.98, R = 0.85, and U = 0.10, resulting in C3 = 0.901.

[0075] This invention uses an AI agent to verify the confidence level of intermediate risk intervals. When a risk is just emerging but has not yet reached the high-risk condition, the system does not directly implement strong intervention, but continues to judge whether the evidence is sufficient, thereby reducing the probability of misjudging a classmate's joke, interaction with an acquaintance, or ambiguous facial expressions as a risk.

[0076] Furthermore, it can be determined whether the confidence level is less than a preset confidence threshold.

[0077] If the confidence level is less than the preset confidence threshold, then return to S1.

[0078] In this embodiment of the invention, the preset confidence threshold is 0.80. If the confidence level is less than 0.80, it indicates that the current corrected data is insufficient to confirm the reliability of the real-time warning feature value. The system returns to S1 to continue collecting new network activity data and uses the updated dialogue context in the next analysis.

[0079] In the practical application scenario of this invention, when the system first enters the intermediate risk range, C=0.716, which is less than 0.80. At this time, the system does not push strong action suggestions to the target user, nor does it send risky content to authorized users, but continues to collect subsequent messages. If Akai stops asking questions, the real-time warning feature value may decrease in the next round; if Akai continues to request privacy, the confidence level and risk score will further increase.

[0080] Specifically, the low-confidence judgment result and the corresponding evidence unit identifier are written into the process record, and S1 is returned with the dialogue round as the index. After returning, S1 re-collects the new data and associates it with the previously unresolved evidence, executes again, and obtains the updated corrected data, real-time warning feature value, and confidence level.

[0081] In this embodiment, after adding a new privacy request message and a reminder reply, C increases from 0.716 to 0.926, thus entering S10.

[0082] By continuing data collection when confidence levels are insufficient instead of immediate intervention, this invention can avoid mishandling when evidence is not yet sufficient and provide more context for the continuous identification of high-risk behaviors.

[0083] If the confidence level is greater than or equal to the confidence threshold, the AI ​​agent is invoked to generate a current action suggestion, which is then pushed to the target user, and the process returns to S1.

[0084] In this embodiment of the invention, a confidence level greater than or equal to 0.80 indicates that the current data fully supports the real-time warning feature value. The current action suggestion is a natural language safety operation prompt for the target user, and its content matches the current risk type and dialogue context. Pushing to the target user means displaying the suggestion only on the target user's terminal and not disclosing the suggestion to the interacting parties.

[0085] In a practical application scenario of this invention, after Akai sends an intimate emoji and asks for the school and address, the system obtains an R=68.5, which is within the threshold range. Continuous follow-up questions bring the confidence level to 0.926, which is greater than or equal to 0.80. At this point, the system generates and pushes a current action suggestion while continuing to collect subsequent messages. If the subsequent real-time warning feature value continues to rise and exceeds 75, the system proceeds to the next round of processing.

[0086] In this embodiment of the invention, the step of invoking the AI ​​agent to generate current action suggestions includes: The current risk type is determined based on the corrected data and the real-time early warning feature value; Select the corresponding handling strategy for the current risk type from the preset database of safety measures for minors; The AI ​​agent generates action suggestion texts based on the handling strategy. The action suggestion texts include texts for ending dangerous conversations, refusing privacy requests, preserving evidence, submitting a report, seeking help from a trusted adult, and seeking help from official channels. Sensitive information filtering and content integrity verification are performed on the action suggestion text to obtain the current action suggestion.

[0087] Specifically, current risk types can include privacy requests, inducements to meet in person, cyberbullying, improper inducements for benefits, and requests for contact information. A pre-defined database for handling minors' safety issues stores handling strategies, suggested tone, and prohibited content according to risk type.

[0088] The AI ​​agent generated sample action suggestions as follows: "Stop providing personal information such as school, address, or photos; stop communicating with the other party alone; save chat logs, pictures, and voice messages; submit evidence through the platform's reporting portal; immediately inform your parents or other trusted adults and seek help through official child protection channels." Sensitive information filtering is used to avoid repeatedly exposing the target user's real name, school, address, and contact information in the suggestion text.

[0089] This invention provides actionable suggestions for current actions to target users, enabling them to proactively terminate dangerous conversations, refuse privacy requests, and file reports and requests for help. At the same time, it keeps target users informed and able to make choices regarding the communication process, thus forming immediate, specific, and implementable protective measures.

[0090] In this embodiment of the invention, the method further includes: If the real-time warning feature value is less than the lower limit of the preset threshold range, a risk warning message in a preset format is generated and pushed to the target user, and the step of collecting network activity data of the target user and the interactive object in real time is returned. If the real-time warning feature value is greater than the upper limit of the threshold range, a preset AI agent is invoked to generate de-identified content of the network activity data, and the de-identified content and the real-time warning feature value are sent to the user terminal pre-authorized by the target user.

[0091] Specifically, when the real-time warning feature value is less than the lower limit of a preset threshold range, a risk warning is issued to the target user, and the process returns to S1.

[0092] In this embodiment of the invention, the lower limit of the threshold range can be set to 40. The risk warning is a lightweight security reminder displayed on the target user's terminal; it does not directly send a warning to the interacting object, nor does it automatically interrupt the current session. The return to the collection step refers to continuing session monitoring after completing the prompt, and re-executing S1 to S5 when new network activity data arrives.

[0093] In the actual application scenario of this invention, the initial communication yielded R=34.5, which is less than 40. The target user's terminal displayed a risk warning message in the following format: "Please protect your personal information and be cautious when adding unfamiliar friends," while simultaneously recording this warning and the corresponding evidence index. Sending the complete chat content directly to the guardian at this point might cause unnecessary privacy interference; therefore, only a low-interference warning was implemented, and data collection continued.

[0094] Specifically, risk alerts can take the form of a floating card, an in-session notification bar, or a system notification; this embodiment uses an in-session notification bar. The alert content includes the risk category, protection suggestions, and a close button. The risk alert identifier, alert time, real-time warning characteristic value, and current session identifier are written into the processing record, and the session identifier is used as the connection key when returning to S1, allowing subsequent new messages to be associated with the existing dialogue context.

[0095] By implementing risk warnings and continuing data collection under low-risk conditions, this embodiment of the invention can remind target users to pay attention to online communication security, avoid excessive interference with normal social interactions, and retain a continuous observation window for subsequent risk changes.

[0096] When the real-time warning feature value is greater than the upper limit of the threshold range, a preset AI agent is invoked to generate de-identified content of the network activity data, and the de-identified content and the real-time warning feature value are sent to the user terminal pre-authorized by the target user.

[0097] In this embodiment of the invention, a real-time warning feature value greater than the upper limit of the threshold range means that the real-time warning feature value is greater than 75. The anonymized content is a risk summary obtained by processing direct identity information, contact information, and sensitive images in network activity data. The pre-authorized user terminal is a guardian terminal or other trusted terminal that is pre-bound and verified in the target user's account.

[0098] In the actual application scenario of this invention, after Akai requested privacy again, he obtained R=86.1, which is greater than 75. The system will not send the complete chat history directly to Xiaolin's mother. Instead, it will replace the name, account, phone number, address, and school name with type tags, mask the faces and QR codes in the emojis, and retain the dialogue semantics, time sequence, risk category, and real-time warning feature values ​​related to risk assessment.

[0099] Specifically, the anonymization process is performed according to a preset anonymization rule library. Names are replaced with "[Name]", phone numbers with "[Phone Number]", school names with "[School]", home addresses with "[Address]", and account identifiers with "[Account]". The AI ​​agent generates a risk summary based on the anonymized evidence units: "The interacting object repeatedly requested school and home addresses and sent intimate suggestive emojis; the real-time warning feature value is 86.1, and the risk type is privacy solicitation and inducement to make private contacts."

[0100] The target user receives a risk summary, suggested concerns, and evidence index on the pre-authorized client side. The server stores the access permission mapping between the original data and the de-identified data, and the original evidence can only be retrieved under authorized or legal conditions.

[0101] This invention enables guardians to understand the risks and take protective measures in a timely manner by sending de-identified content instead of the complete original data under high-risk conditions. At the same time, it reduces the scope of secondary dissemination of minors' privacy information and avoids new privacy exposure caused by the risk handling itself.

[0102] In summary, this embodiment of the invention forms a closed loop through S1 to S6: after latent recognition and semantic correction, network activity data enters multimodal feature analysis; the profile of the interacting object and the current communication features jointly generate real-time early warning feature values; when the risk is low, a prompt is issued and data collection continues; when the risk is intermediate, confidence verification is performed; when the evidence is sufficient, action suggestions are pushed; when the risk is high, de-identified content and risk scores are sent to pre-authorized user terminals. This closed loop ensures that each new message triggers an updated risk assessment and that the results of each level of processing match the degree of risk.

[0103] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0104] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of the server-side of a multimodal network security protection method.

[0105] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps on the client side of a multimodal network security protection method.

[0106] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Real-time collection of network activity data of target users and interactive objects; identification of network hidden words in the network activity data according to a preset network hidden word list, wherein the network hidden word list contains mapping relationship data between network words and their true meanings; The network hidden words in the network activity data are replaced with their corresponding real meanings according to the network hidden word list to obtain corrected data; the corrected data is divided into multiple single-modal data according to the preset data modality, and the single-modal data features corresponding to each single-modal data are extracted using the preset multimodal ensemble model; The identity data and historical behavior data of the interactive object are acquired and analyzed to construct the profile features of the interactive object; the real-time warning feature value of the online social activity is analyzed based on all extracted single-modal data features and the constructed profile features, and it is analyzed whether the real-time warning feature value is within a preset threshold range. If the data is within a preset threshold range, a preset AI agent is invoked, and the confidence level of the real-time warning feature value is analyzed based on the corrected data. Based on the relationship between the confidence level and the preset confidence threshold, the step of directly returning to collect the network activity data of the target user and the interactive object in real time is determined and executed. Alternatively, the step of first invoking the AI ​​agent to generate a current action suggestion, pushing the current action suggestion to the target user, and then returning to collect the network activity data of the target user and the interactive object in real time is determined and executed.

[0107] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0108] Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the invention. No appended diagram markings in the claims should be construed as limiting the scope of the claims.

[0109] In some embodiments of this example, a computer-readable storage medium is provided, on which a computer program is stored, characterized in that the computer program, when executed by a processor, implements the steps of the method described in the above embodiments.

[0110] The readable storage medium of the present invention stores a computer program, which, when executed by a processor of an electronic device, can perform the following: Real-time collection of network activity data of target users and interactive objects; identification of network hidden words in the network activity data according to a preset network hidden word list, wherein the network hidden word list contains mapping relationship data between network words and their true meanings; The network hidden words in the network activity data are replaced with their corresponding real meanings according to the network hidden word list to obtain corrected data; the corrected data is divided into multiple single-modal data according to the preset data modality, and the single-modal data features corresponding to each single-modal data are extracted using the preset multimodal ensemble model; The identity data and historical behavior data of the interactive object are acquired and analyzed to construct the profile features of the interactive object; the real-time warning feature value of the online social activity is analyzed based on all extracted single-modal data features and the constructed profile features, and it is analyzed whether the real-time warning feature value is within a preset threshold range. If the data is within a preset threshold range, a preset AI agent is invoked, and the confidence level of the real-time warning feature value is analyzed based on the corrected data. Based on the relationship between the confidence level and the preset confidence threshold, the step of directly returning to collect the network activity data of the target user and the interactive object in real time is determined and executed. Alternatively, the step of first invoking the AI ​​agent to generate a current action suggestion, pushing the current action suggestion to the target user, and then returning to collect the network activity data of the target user and the interactive object in real time is determined and executed.

[0111] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0112] Computer-readable storage media may also store at least one computer-executable program / instruction, such as computer-readable instructions. Computer-readable storage media include, but are not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Computer-readable storage media may include, for example, read-only memory (ROM), hard disk, flash memory, etc. For example, a non-transitory computer-readable storage medium may be connected to a computing device such as a computer, and then, when the computing device executes the computer-readable instructions stored on the computer-readable storage medium, the various methods described above can be performed.

[0113] In addition, the computer device may include (but is not limited to) a data bus, an input / output (I / O) bus, a display, and input / output devices (e.g., keyboard, mouse, speakers, etc.).

[0114] In one embodiment, the at least one computer-executable instruction may also be compiled into or comprise a software product / computer program product, wherein one or more computer-executable instructions are executed by a processor to perform the steps of the various functions and / or methods in the embodiments described herein.

[0115] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Furthermore, any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory.

[0116] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0117] In the embodiments provided in this disclosure, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0118] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

[0119] It should be noted that any AI models, software tools, or components not belonging to this company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been authorized (with the knowledge and consent) by the relevant parties or has been fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

Claims

1. A multimodal network security protection method, characterized in that, The method includes: Real-time collection of network activity data of target users and interactive objects; identification of network hidden words in the network activity data according to a preset network hidden word list, wherein the network hidden word list contains mapping relationship data between network words and their true meanings; The network hidden words in the network activity data are replaced with their corresponding real meanings according to the network hidden word list to obtain corrected data; the corrected data is divided into multiple single-modal data according to the preset data modality, and the single-modal data features corresponding to each single-modal data are extracted using the preset multimodal ensemble model; The identity data and historical behavior data of the interactive object are acquired and analyzed to construct the profile features of the interactive object; the real-time warning feature value of the online social activity is analyzed based on all extracted single-modal data features and the constructed profile features, and it is analyzed whether the real-time warning feature value is within a preset threshold range. If the data is within a preset threshold range, a preset AI agent is invoked, and the confidence level of the real-time warning feature value is analyzed based on the corrected data. Based on the relationship between the confidence level and the preset confidence threshold, the step of directly returning to collect the network activity data of the target user and the interactive object in real time is determined and executed. Alternatively, the step of first invoking the AI ​​agent to generate a current action suggestion, pushing the current action suggestion to the target user, and then returning to collect the network activity data of the target user and the interactive object in real time is determined and executed.

2. The multimodal network security protection method as described in claim 1, characterized in that, The method further includes: If the real-time warning feature value is less than the lower limit of the preset threshold range, a risk warning message in a preset format is generated and pushed to the target user, and the step of collecting network activity data of the target user and the interactive object in real time is returned. If the real-time warning feature value is greater than the upper limit of the threshold range, a preset AI agent is invoked to generate de-identified content of the network activity data, and the de-identified content and the real-time warning feature value are sent to the user terminal pre-authorized by the target user.

3. The multimodal network security protection method as described in claim 1, characterized in that, The step of replacing network hidden terms in network activity data with their corresponding true meanings based on the network hidden term list includes: The network activity data is subjected to character normalization processing to obtain normalized text; A preset multi-mode string matching algorithm is used to match the normalized text with the network hidden word list to obtain candidate hidden words and the positions of the candidate hidden words in the normalized text; The candidate hidden words and their contexts are input into a pre-trained context semantic discrimination model to obtain context semantic matching results; Based on the contextual semantic matching results and the location of occurrence, the network hidden words in the network activity data and their corresponding true meaning expressions are determined, and the determined network hidden words are replaced with the corresponding true meaning expressions.

4. The multimodal network security protection method as described in claim 1, characterized in that, The step of dividing the corrected data into multiple single-modal data according to a preset data modality includes: Based on the data source identifier and file characteristics of each piece of corrected data, the initial modality category to which the corrected data belongs is determined; Each piece of corrected data in the corrected data is time-aligned according to a unified time base to obtain corrected data with timestamps; The timestamped correction data is formatted into text modal data, visual modal data, speech modal data, and behavioral modal data, respectively. Missing values ​​are imputed and fields are normalized for the text modal data, visual modal data, speech modal data, and behavioral modal data respectively to obtain the various single modal data.

5. The multimodal network security protection method as described in claim 1, characterized in that, The construction of the profile features of the interactive object includes: The identity data is encoded according to the type of each identity field in the identity data to obtain the identity encoding feature; The historical behavioral data is statistically analyzed according to preset behavioral event types to obtain behavioral statistical features; The identity encoding features and the behavioral statistical features are concatenated according to a preset field order to obtain an initial profile vector; The initial image vector is nonlinearly mapped using a preset image mapping network to obtain the image features.

6. The multimodal network security protection method as described in claim 4, characterized in that, The analysis of real-time early warning feature values ​​for online social activities based on all extracted unimodal data features and constructed profile features includes: The risk mapping branch in the multimodal ensemble model is used to map the single-modal data features corresponding to each type of single-modal data into text risk sub-values, visual risk sub-values, voice risk sub-values, and behavioral risk sub-values, respectively. The preset image mapping network is used to map the image features into image risk sub-values; The text risk sub-value, the visual risk sub-value, the voice risk sub-value, the behavioral risk sub-value, and the portrait risk sub-value are weighted and summed according to preset weights to obtain the real-time warning feature value.

7. The multimodal network security protection method as described in claim 1, characterized in that, The step of invoking a preset AI agent and analyzing the confidence level of the real-time warning feature value based on the corrected data includes: The preset AI agent is invoked to segment the corrected data according to the dialogue rounds, resulting in multiple evidence units; Calculate the credibility of the information source, the consistency of the context, and the clarity of intent for each piece of evidence. The confidence level of the real-time warning feature value is obtained by weighting the information source credibility, the context consistency, and the intent clarity.

8. The multimodal network security protection method as described in claim 1, characterized in that, The step of invoking the AI ​​agent to generate current action suggestions includes: The current risk type is determined based on the corrected data and the real-time early warning feature value; Select the corresponding handling strategy for the current risk type from the preset database of safety measures for minors; The AI ​​agent generates action suggestion texts based on the handling strategy. The action suggestion texts include texts for ending dangerous conversations, refusing privacy requests, preserving evidence, submitting a report, seeking help from a trusted adult, and seeking help from official channels. Sensitive information filtering and content integrity verification are performed on the action suggestion text to obtain the current action suggestion.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the multimodal network security protection method as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the multimodal network security protection method as described in any one of claims 1 to 8.

Images