WO2021136315A1

WO2021136315A1 - Mail classification method and apparatus based on conjoint analysis of behavior structures and semantic content

Info

Publication number: WO2021136315A1
Application number: PCT/CN2020/141120
Authority: WO
Inventors: 陈磊华; 张琦
Original assignee: 论客科技（广州）有限公司
Priority date: 2019-12-31
Filing date: 2020-12-29
Publication date: 2021-07-08
Also published as: CN111221970B; CN111221970A

Abstract

A mail classification method and apparatus based on conjoint analysis of behavior structures and semantic content, and a device and a readable storage medium. The method comprises: extracting behavior structure information and text content information of an e-mail (S1); by means of an eigenvector calculation mode, performing calculation to obtain a behavior structure feature of the e-mail, and by using a pre-trained fastText model, performing calculation to obtain a text semantic feature of the e-mail (S2); respectively performing normalization processing on the behavior structure feature and the text semantic feature, and performing feature fusion to obtain an e-mail fusion feature (S3); training a classifier by using the e-mail fusion feature (S4); and classifying, by using the trained classifier, an e-mail to be tested so as to acquire the category of the e-mail to be tested (S5). In the method, an e-mail is classified by simultaneously using behavior structure information and text content information of the e-mail, thereby effectively improving the category determination accuracy of the e-mail.

Description

Mail classification method and device based on joint analysis of behavior structure and semantic content

Technical field

The present invention relates to the field of mail classification, in particular to a mail classification method, device, terminal device and readable storage medium based on joint analysis of behavior structure and semantic content.

Background technique

With the rapid development of Internet technology, e-mail has become one of the main communication methods of modern interpersonal communication due to its rapid and convenient transmission of information, easy to save, and not easy to lose. However, with its widespread use, e-mail has also become a carrier of commercial advertisements, malicious software and illegal files, which seriously affects people's lives and network security. How to accurately filter out spam has become an urgent problem to be solved.

There are three main existing email classification methods:

(1) Mail classification technology based on the source of the letter, the process of filtering spam by studying the source of the letter. It mainly includes black and white list filtering technology, reverse DNS query technology and so on. Among them, the black and white list filtering has the advantages of fast speed, simplicity and low memory consumption. During the SMTP connection stage, judging whether to hit the black and white list to prevent spam from entering. Reverse DNS query technology provides the correspondence between IP addresses and domain names, and can intercept spam sent using dynamically allocated or unregistered IP addresses.

(2) Rule-based mail classification technology, which extracts certain characteristics of mails and predefines some filtering rules to detect and determine the type of emails. Each rule corresponds to a score. When the mail meets a certain rule, it will The mail is judged as spam.

(3) Classification method based on statistics of mail content. Learning the classified training samples and test samples, extracting the feature vectors and feature values of non-spam and spam, and then calculating the samples in the test set according to the learned model to determine the mail category.

The existing email classification technology has the following disadvantages:

1. The mail classification technology based on the source of the letter, the source of each mail must be inquired, and the black and white list must be constantly updated, which is inefficient. At the same time, there will be large-scale misjudgments.

2. Rule-based mail classification technology. As the rule characteristics of mails are constantly changing, the rule base needs to be constantly updated, and the labor cost is relatively high.

3. Although the method based on mail content statistics takes into account the statistical information of the text content, it ignores its semantic information and some other characteristics, resulting in weaker discrimination of mail features and poor classification accuracy.

Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a mail classification method, device, terminal device, and readable storage medium based on the joint analysis of behavior structure and semantic content, which can utilize the behavior structure characteristics and text semantic characteristics of emails, Achieve high-precision classification of mail.

In order to solve the above technical problems, embodiments of the present invention provide a mail classification method based on joint analysis of behavior structure and semantic content, including:

Extract the behavioral structure information and text content information of the email; where the behavioral structure information includes the size of the email, the size of the email attachment, the number of email attachment pictures, the size of the email attachment picture, the number of times the sender's ip per unit time, and the domain name of the email One or more of credibility;

Encoding the behavior structure information by the feature vector calculation method to obtain the behavior structure characteristics of the email, and at the same time, using the pre-trained fasttext model to encode the text content information to obtain the text semantic features of the email;

Normalizing the behavior structure feature and the text semantic feature respectively, and fusing the normalized behavior structure feature and the text semantic feature to obtain the email fusion feature;

Training the classifier by using the email fusion feature;

The trained classifier is used to classify the email to be tested to obtain the category of the email to be tested.

Further, the use of a pre-trained fasttext model to encode the text content information to obtain the text semantic feature of the email is specifically:

Preprocessing the extracted text content information to convert the format of the text content information into an input format that meets the processing of the fasttext model;

The fasttext model is used to calculate the feature vector of each word segmentation in the text content information, and all the calculated feature vectors are averaged to obtain the text semantic feature.

Further, the classifier is an SVM classifier.

In order to solve the same technical problem, the present invention also provides a mail classification device based on joint analysis of behavior structure and semantic content, including:

The information extraction module is used to extract the behavioral structure information and text content information of the email; wherein the behavioral structure information includes the size of the email, the size of the email attachment, the number of email attachment pictures, the size of the email attachment picture, and the sender's ip unit time One or more of the number of emails sent and the reputation of the email domain name;

The feature calculation module is used to encode the behavior structure information by the feature vector calculation method to obtain the behavior structure characteristics of the email, and at the same time, use the pre-trained fasttext model to encode the text content information to obtain the email information Text semantic features;

The feature fusion module is used for normalizing the behavior structure feature and the text semantic feature respectively, and fusing the normalized behavior structure feature and the text semantic feature to obtain the email fusion feature;

The classifier training module is used to train the classifier by using the email fusion feature;

The mail classification module is used to classify the email to be tested by using the trained classifier to obtain the category of the email to be tested.

Further, the classifier is an SVM classifier.

In order to solve the same technical problem, the present invention also provides a mail classification terminal device based on joint analysis of behavioral structure and semantic content, including a processor, a memory, and stored in the memory and configured to be executed by the processor. A computer program in which the memory is coupled to the processor, and when the processor executes the computer program, any one of the methods for mail classification based on joint analysis of behavioral structure and semantic content is implemented.

In order to solve the same technical problem, the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, wherein when the computer program is running, the computer-readable storage medium is controlled to be located The device executes any one of the mail classification methods based on joint analysis of behavior structure and semantic content.

Compared with the prior art, the present invention has the following beneficial effects:

The embodiment of the present invention provides a mail classification method, device, terminal device, and readable storage medium based on joint analysis of behavior structure and semantic content. The method includes: extracting behavior structure information and text content information of emails; The vector calculation method encodes the behavior structure information to obtain the behavior structure characteristics of the email. At the same time, the pre-trained fasttext model is used to encode the text content information to obtain the text semantic characteristics of the email; The behavior structure feature and the text semantic feature are normalized, and the normalized behavior structure feature and the text semantic feature are feature fused to obtain the email fusion feature; using the email fusion feature to perform the classifier Perform training; use the trained classifier to classify the email to be tested to obtain the category of the email to be tested. The present invention simultaneously utilizes the behavioral structure information and text content information of the email to classify emails, overcomes the defect of poor email classification accuracy caused by insufficient use of discriminative information in existing emails, thereby effectively improving email category judgment Accuracy.

Description of the drawings

FIG. 1 is a schematic flowchart of a mail classification method based on joint analysis of behavior structure and semantic content according to an embodiment of the present invention;

2 is a schematic diagram of a calculation process of text semantic features provided by an embodiment of the present invention;

Fig. 3 is a schematic structural diagram of a mail classification device based on joint analysis of behavior structure and semantic content according to an embodiment of the present invention.

Detailed ways

The following describes the technical solutions in the embodiments of the present invention clearly and completely with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

Referring to Fig. 1, an embodiment of the present invention provides a mail classification method based on joint analysis of behavior structure and semantic content, including steps:

S1. Extract the behavioral structure information and text content information of the email; wherein the behavioral structure information includes the size of the email, the size of the email attachment, the number of the email attachment picture, the size of the email attachment picture, the number of times sent per unit time by the sender's ip, One or more of the reputation of the mail domain name;

S2. Encode the behavior structure information by the feature vector calculation method to obtain the behavior structure characteristics of the email, and at the same time, use the pre-trained fasttext model to encode the text content information to obtain the text semantic features of the email;

In the embodiment of the present invention, further, the pre-trained fasttext model is used to encode the text content information to obtain the text semantic feature of the email, specifically:

S3. Perform normalization processing on the behavior structure feature and the text semantic feature respectively, and perform feature fusion on the normalized behavior structure feature and the text semantic feature to obtain an email fusion feature;

S4. Use the email fusion feature to train a classifier; in the embodiment of the present invention, further, the classifier is an SVM classifier.

S5. Use the trained classifier to classify the email to be tested to obtain the category of the email to be tested.

It should be noted that, in view of the shortcomings of the above-mentioned existing email classification technology, the present invention proposes an email classification method that utilizes both the behavioral structural features and text semantic features of emails to enhance the discriminativeness of email features, so that E-mail classification accuracy is higher.

Specific examples are listed below to illustrate the solution of the present invention in detail:

The embodiment of the present invention provides a mail classification method based on joint analysis of behavior structure and semantic content, which mainly includes five steps:

1. Extract the behavior structure information and text content information of the e-mail; behavior structure information refers to the structure information of the e-mail itself and some operational behavior information of the e-mail sender, such as e-mail size, e-mail attachment size, number of e-mail attachment pictures, e-mail The size of the attached image, the number of emails sent by the email sender’s ip within a period of time, and the reputation of the email domain name.

2. Use the method of calculating feature vectors to encode the behavioral structure information, and use the pre-trained fasttext model to encode the text content information of the email to obtain the behavioral structural features and text semantic features of the email;

Among them, the calculation method of the structural characteristics of the email behavior is as follows:

RuleVector[size]=m_nSize/1024;

RuleVector[fngref]=m_nFngRef;

RuleVector[attref]=m_nAttRef;

RuleVector[gifx]=m_nGifX/128;

RuleVector[gify]=m_nGifY/128;

RuleVector[gifcnt]=m_nGifCnt;

RuleVector[Sender_size_diff]=m_n.SenderSizeDiff;

RuleVector[url_size_diff]=m_nURLSizeDiff;

RuleVector[domail_today_cnt]=m_nDomainTodayCnt;

Among them, RuleVector represents the behavioral structural characteristics of the email, each dimension represents a feature, size represents the size of the email, fngref represents the number of email fingerprints, attref represents the number of attachments, gifx represents the length of the image, gify represents the width of the image, and gift represents the number of images. Sender_size_diff represents the difference between the sender's letter size and the average letter size, url_size_diff represents the difference between the post url size and the average url size, and domail_today_cnt represents the number of letters sent by the domain name that day.

Please refer to Figure 2. The semantic feature of email text is calculated as follows:

Preprocess the extracted text content information to obtain the fasttext model input format file, then calculate the feature vector of each word in the email text content information, and average all the word feature vectors to obtain the final email text semantics Features TextVector. The expression is as follows:

WordVector=ft(Text);

Among them, Text represents the text content of the email, ft represents the pre-trained fasttext model, WordVector represents the word vector of the email text, n is the number of word vectors, and TextVector represents the final feature of the email text.

3. Normalize the structural characteristics of the mail behavior and the semantic characteristics of the text;

Normalize the structural characteristics of email behavior:

RuleVector_N=Normalize(RuleVector);

Normalize the semantic features of the email text:

TextVector_N=Normalize(TextVector);

Among them, Normalize represents the normalization operation, RuleVector_N represents the structural feature of the email behavior after normalization, and TextVector_N represents the semantic feature of the email text after the normalization.

(4) Jointly express the structural characteristics of the mail behavior and the semantic characteristics of the text as the final characteristic expression of the mail, and train a classifier;

MailVector=Con(RuleVector_N, TextVector_N);

Among them, Con stands for serial operation, and MailVector stands for the expression of fusion characteristics of emails.

(5) Use the trained classifier to classify the test set emails, and obtain the category of the test set emails. Optionally, the classifier is a support vector machine (SVM) classifier.

It should be noted that the email category acquisition method provided by the embodiment of the present invention integrates email behavior structure and email content semantic information, and makes full use of the behavior structural features and text semantic features of emails to better express emails. It overcomes the defect of poor classification accuracy of existing emails due to insufficient discriminative information, and improves the accuracy of the method for obtaining email categories.

It should be noted that for the above method or process embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that the embodiments of the present invention are not affected by the described sequence of actions. Limitation, because according to the embodiment of the present invention, some steps can be performed in other order or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are optional embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

Referring to Fig. 3, in order to solve the same technical problem, the present invention also provides a mail classification device based on joint analysis of behavior structure and semantic content, including:

The information extraction module 1 is used to extract the behavioral structure information and text content information of the email; wherein the behavioral structure information includes the size of the email, the size of the email attachment, the number of email attachment images, the size of the email attachment image, and the sender's ip unit time One or more of the number of internal mailings and the reputation of the mail domain name;

The feature calculation module 2 is used to encode the behavior structure information by the feature vector calculation method to obtain the behavior structure characteristics of the email, and at the same time, use the pre-trained fasttext model to encode the text content information to obtain the email Semantic characteristics of the text;

The feature fusion module 3 is used for normalizing the behavior structure feature and the text semantic feature respectively, and fusing the normalized behavior structure feature and the text semantic feature to obtain the email fusion feature ；

The classifier training module 4 is used to train the classifier by using the email fusion feature;

The mail classification module 5 is used to classify the email to be tested by using a trained classifier to obtain the category of the email to be tested.

Further, the classifier is an SVM classifier.

It is understandable that the above device item embodiment corresponds to the method item embodiment of the present invention. The embodiment of the present invention provides a mail classification device based on joint analysis of behavior structure and semantic content, which can implement any item of the present invention. The method embodiment provides a mail classification method based on joint analysis of behavior structure and semantic content.

The mail classification terminal device based on the joint analysis of behavior structure and semantic content may be computing devices such as desktop computers, notebooks, palmtop computers, and cloud servers. The processor may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (ASIC), off-the-shelf Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The processor is the control center of the mail classification terminal device based on the joint analysis of behavior structure and semantic content, using various interfaces It connects the various parts of the entire mail classification terminal device based on the joint analysis of behavioral structure and semantic content with the line.

The memory may mainly include a program storage area and a data storage area. The program storage area may store an operating system, an application program required by at least one function, and the like; the data storage area may store data created according to the use of a mobile phone. In addition, the memory can include high-speed random access memory, and can also include non-volatile memory, such as hard disks, memory, plug-in hard disks, smart media cards (SMC), and secure digital (SD) cards. , Flash Card, at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.

The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by a processor, it can implement the steps of the foregoing method embodiments. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (Read-Only Memory, ROM) , Random Access Memory (RAM), electrical carrier signal, telecommunications signal, and software distribution media, etc. It should be noted that the content contained in the computer-readable medium can be appropriately added or deleted according to the requirements of the legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to the legislation and patent practice, the computer-readable medium Does not include electrical carrier signals and telecommunication signals.

It should be noted that the device embodiments described above are only illustrative, and the units described as separate parts may or may not be physically separated, and the parts displayed as units may or may not be physically separate. Units can be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that they have a communication connection between them, which can be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art can understand and implement without creative work.

The above are the preferred embodiments of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and modifications can be made, and these improvements and modifications are also considered This is the protection scope of the present invention.

Claims

A mail classification method based on joint analysis of behavior structure and semantic content, which is characterized in that it includes:

Extract the behavioral structure information and text content information of the email; where the behavioral structure information includes the size of the email, the size of the email attachment, the number of email attachment pictures, the size of the email attachment picture, the number of times the sender's ip per unit time, and the domain name of the email One or more of credibility;

Encoding the behavior structure information by the feature vector calculation method to obtain the behavior structure characteristics of the email, and at the same time, using the pre-trained fasttext model to encode the text content information to obtain the text semantic features of the email;

Normalizing the behavior structure feature and the text semantic feature respectively, and fusing the normalized behavior structure feature and the text semantic feature to obtain the email fusion feature;

Training the classifier by using the email fusion feature;

The trained classifier is used to classify the email to be tested to obtain the category of the email to be tested.
The mail classification method based on joint analysis of behavioral structure and semantic content according to claim 1, wherein the pre-trained fasttext model is used to encode the text content information to obtain the text semantic features of the email, Specifically:

Preprocessing the extracted text content information to convert the format of the text content information into an input format that meets the processing of the fasttext model;

The fasttext model is used to calculate the feature vector of each word segmentation in the text content information, and all the calculated feature vectors are averaged to obtain the text semantic feature.
The mail classification method based on joint analysis of behavior structure and semantic content according to claim 1, wherein the classifier is an SVM classifier.
A mail classification device based on joint analysis of behavior structure and semantic content is characterized in that it includes:

The information extraction module is used to extract the behavioral structure information and text content information of the email; wherein the behavioral structure information includes the size of the email, the size of the email attachment, the number of email attachment pictures, the size of the email attachment picture, and the sender's ip unit time One or more of the number of emails sent and the reputation of the email domain name;

The feature calculation module is used to encode the behavior structure information by the feature vector calculation method to obtain the behavior structure characteristics of the email, and at the same time, use the pre-trained fasttext model to encode the text content information to obtain the email information Text semantic features;

The feature fusion module is used for normalizing the behavior structure feature and the text semantic feature respectively, and fusing the normalized behavior structure feature and the text semantic feature to obtain the email fusion feature;

The classifier training module is used to train the classifier by using the email fusion feature;

The mail classification module is used to classify the email to be tested by using the trained classifier to obtain the category of the email to be tested.
The mail classification device based on joint analysis of behavior structure and semantic content according to claim 4, characterized in that the pre-trained fasttext model is used to encode the text content information to obtain the text semantic features of the email, Specifically:

Preprocessing the extracted text content information to convert the format of the text content information into an input format that meets the processing of the fasttext model;

The fasttext model is used to calculate the feature vector of each word segmentation in the text content information, and all the calculated feature vectors are averaged to obtain the text semantic feature.
The mail classification device based on joint analysis of behavior structure and semantic content according to claim 4, wherein the classifier is an SVM classifier.
A mail classification terminal device based on joint analysis of behavior structure and semantic content, which is characterized in that it includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. The processor is coupled, and when the processor executes the computer program, the method for mail classification based on joint analysis of behavior structure and semantic content according to any one of claims 1 to 3 is realized.
A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the computer program is running, the device in which the computer-readable storage medium is located is controlled to execute as claimed in claims 1 to 3. Any one of the mail classification methods based on joint analysis of behavioral structure and semantic content.