WO2017185862A1

WO2017185862A1 - Method, apparatus and device for identifying malicious call and establishing identification model

Info

Publication number: WO2017185862A1
Application number: PCT/CN2017/074169
Authority: WO
Inventors: 李靖
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2016-04-28
Filing date: 2017-02-20
Publication date: 2017-11-02
Also published as: CN107343077B; CN107343077A

Abstract

Disclosed are a method, apparatus and device for identifying a malicious call and establishing an identification model, and a storage medium. The method for identifying a malicious call comprises: acquiring a feature parameter of a first call event, wherein the first call event is a call event between a first user and a second user, and the feature parameter comprises a parameter for describing a call voice feature, with the parameter for describing a call voice feature comprising: at least one of a waveform feature parameter of a call voice, and the number and probability of first keywords in a text corresponding to the call voice; according to the feature parameter of the first call event and a current pre-set identification model, identifying the first call event, wherein the identification model uses the feature parameter as a classification parameter; acquiring an identification result of the first call event identified by the identification model; and outputting the identification result of the first call event.

Description

Method, device and device for identifying a malicious call and establishing a recognition model

This patent application claims that the Chinese patent application number submitted on April 28, 2016 is 201610278825.9, and the applicant is Tencent Technology (Shenzhen) Co., Ltd., and the invention is entitled "Recognition of Malicious Telephones and Methods, Devices, and Equipment for Establishing Identification Models". The entire content of this application is incorporated herein by reference.

Technical field

The present invention relates to the field of communications, and in particular, to a method, an apparatus, a device, and a storage medium for identifying a malicious phone and establishing a recognition model.

Background technique

The rapid development of communication technology has brought a lot of convenience to people's work and daily life, but it has also brought a lot of troubles. In daily life, more and more lawless elements rely on mobile phones or landlines. Communication tools carry out malicious acts, such as phone fraud to others, causing economic losses to others; therefore, when a user makes a call with a strange phone, it is necessary to identify whether the strange phone is a malicious call, thereby avoiding the loss of the user's economy. .

The method for identifying a malicious phone in the prior art is to use a blacklist technology. The process includes: obtaining a phone number of the current call, determining whether the phone number has a preset blacklist, and if so, determining that the current call is a malicious call. However, with the advent of the number hiding service and the network renaming technology, the accuracy of identifying the malicious phone by applying the above method is reduced.

Summary of the invention

In view of the above, the embodiment of the present invention provides a method, device, device, and storage medium for identifying a malicious phone and establishing a recognition model, which can greatly improve the recognition accuracy and response in order to solve at least one problem existing in the prior art. faster.

The technical solution of the present invention is implemented as follows:

An embodiment of the present invention provides a method for identifying a malicious phone, where the method includes:

Obtaining a feature parameter of the first call event, the first call event is a call event between the first user and the second user, and the feature parameter includes a parameter for describing a call voice feature, wherein the description call voice The parameter of the feature includes: a waveform feature parameter of the call voice, at least one of a number of the first keyword and a probability in the text corresponding to the call voice;

Determining, according to the feature parameter of the first call event and the current preset recognition model, the first call event, wherein the identification model uses the feature parameter as a classification parameter;

Obtaining a recognition result of the first call event identified by the identification model;

The recognition result of the first call event is output.

Determining a sample type of the sample, the sample type comprising a positive sample and a negative sample, the positive sample being a sample belonging to a malicious phone, the negative sample being a sample not belonging to a malicious phone;

Obtaining a feature parameter of the sample, where the feature parameter includes a parameter for describing a call voice feature, where the parameter describing the call voice feature includes: a waveform feature parameter of the call voice, and a first keyword in the text corresponding to the call voice At least one of a number and a probability;

Obtaining, according to a characteristic parameter of the sample and a set training model, a training result output by the training model, where the training model uses the feature parameter as a classification parameter;

Determining whether the training result meets the sample type of the sample;

If the training result does not satisfy the sample type of the sample, adjusting the model parameter of the training model until the training result satisfies the sample type of the sample, and training the training result to satisfy the sample type of the sample The model is output as a preset recognition model.

An embodiment of the present invention provides a device for identifying a malicious phone, where the device includes: a first acquiring unit, an identifying unit, a second acquiring unit, and an output unit, where

The first acquiring unit is configured to acquire a feature parameter of the first call event, where the first The call event is a call event between the first user and the second user, and the feature parameter includes a parameter for describing a call voice feature, wherein the parameter describing the call voice feature includes: a waveform feature parameter of the call voice, and a call At least one of the number and probability of the first keyword in the text corresponding to the voice;

The identifying unit is configured to identify the first call event according to the feature parameter of the first call event and the currently preset recognition model, where the recognition model uses the feature parameter as a classification parameter;

The second acquiring unit is configured to acquire a recognition result of the first call event identified by the identification model;

The first output unit is configured to output a recognition result of the first call event.

An embodiment of the present invention provides a device for establishing a malicious model, where the device includes: a second determining unit, a third acquiring unit, a training unit, a determining unit, an adjusting unit, and a second output unit, where

The second determining unit is configured to determine a sample type of the sample, the sample type includes a positive sample and a negative sample, the positive sample is a sample belonging to a malicious phone, and the negative sample is a sample not belonging to a malicious phone ;

The third acquiring unit is configured to acquire a feature parameter of the sample, where the parameter describing the call voice feature includes: a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability At least one;

The training unit is configured to obtain a training result output by the training model according to a characteristic parameter of the sample and a set training model, where the training model uses the feature parameter as a classification parameter;

The determining unit is configured to determine whether the training result meets a sample type of the sample;

The adjusting unit is configured to: when the training result does not satisfy the sample type of the sample, Adjusting model parameters of the training model until the training result satisfies a sample type of the sample;

The second output unit is configured to output the training model that the training result satisfies the sample type of the sample as a preset recognition model.

An embodiment of the present invention provides a device for identifying a malicious phone, where the device includes: a first processor and a first external communication interface, or the device includes a first processor and a display screen;

The first processor is configured to acquire a feature parameter of the first call event, where the first call event is a call event between the first user and the second user, and the feature parameter includes a feature for describing a call voice feature. a parameter, wherein the parameter describing the voice feature of the call includes: at least one of a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability; according to the feature of the first call event Identifying the first call event by using the parameter and the current preset recognition model, wherein the recognition model uses the feature parameter as a classification parameter; and acquiring a recognition result of the first call event identified by the recognition model; Outputting the recognition result of the first call event through the first external communication interface, or displaying the recognition result of the first call event through the display screen.

An embodiment of the present invention provides a device for establishing a malicious model, where the device includes: a second processor and a second external communication interface, where

The second processor is configured to determine a sample type of the sample, the sample type includes a positive sample and a negative sample, the positive sample is a sample belonging to a malicious phone, and the negative sample is a sample not belonging to a malicious phone Obtaining a feature parameter of the sample, the feature parameter includes a parameter for describing a call voice feature, wherein the parameter describing the call voice feature includes: a waveform feature parameter of the call voice, and a first keyword in the text corresponding to the call voice At least one of a number and a probability; obtaining a training result output by the training model according to a characteristic parameter of the sample and a set training model, wherein the training model uses the feature parameter as a classification parameter; Whether the training result conforms to the sample type of the sample; if the training result does not satisfy the sample type of the sample, adjusting the model parameter of the training model until the training result satisfies the sample type of the sample, The second external communication interface outputs the training model in which the training result satisfies the sample type of the sample as a preset recognition model.

The embodiment of the present invention provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are configured to perform the method for identifying a malicious phone and establishing a recognition model provided by the embodiments of the present invention.

An embodiment of the present invention provides a method, an apparatus, a device, and a storage medium for identifying a malicious call and establishing a recognition model. The method for identifying a malicious call includes: acquiring a feature parameter of a first call event, where the first call event is a call event between the first user and the second user, the feature parameter includes a parameter for describing a voice feature of the call; the first parameter is determined according to a feature parameter of the first call event and a current preset recognition model The call event is identified, the recognition model takes the feature parameter as a classification parameter, acquires a recognition result of the first call event identified by the recognition model, and outputs a recognition result of the first call event; The parameters of the call voice feature are used as the identification criteria. Since the malicious user's tone and terminology during malicious calls such as sales promotion and fraud are not arbitrarily changed, the malicious call event can be accurately identified, and the recognition result is output to remind the user to be protected. Fraud can greatly reduce the user's economic loss; in addition, the identification model is built. Need to keep on training model for training, the training results continue to adjust the model parameters based on a training model, so that the final training model called quasi-rate optimal sample identification, so to enhance the accuracy of the identification of malicious calls.

DRAWINGS

1 is a schematic diagram of an implementation environment according to an embodiment of the present invention;

2 is a schematic flowchart of an implementation process of a method for identifying a malicious phone according to an embodiment of the present invention;

3A is a schematic diagram of a first implementation process of a method for identifying a malicious phone according to an embodiment of the present invention;

FIG. 3B is a schematic diagram of a second implementation process of a method for identifying a malicious phone according to an embodiment of the present invention; FIG.

3C is a schematic diagram of a third implementation process of a method for identifying a malicious phone according to an embodiment of the present invention;

3D is a schematic flowchart of a fourth implementation process of a method for identifying a malicious phone according to an embodiment of the present invention;

4 is a schematic structural diagram of a device for identifying a malicious phone according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a device for establishing a malicious model according to an embodiment of the present invention; FIG.

6 is a schematic structural diagram of hardware components of a device for identifying a malicious phone according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of hardware components of a device for establishing a malicious model according to an embodiment of the present invention.

detailed description

The following is a schematic diagram of an implementation environment according to an embodiment of the present invention. As shown in FIG. 1, the implementation environment includes: a first terminal 11, a second terminal 12, and a server 13 disposed on the network side; the first terminal 11 and The second terminal 12 exchanges information through a server set in the network, and one of the information exchanges between the first terminal 11 and the second terminal 12 may be a voice call. The embodiments of the present invention relate to a voice call scenario between terminals.

The first terminal 11 or the second terminal 12 may be a mobile terminal, such as a mobile phone, a tablet computer, or the like; or may be a fixed terminal such as a fixed telephone. A client having a call function is run in both the first terminal 11 and the second terminal 12. The client can also record the call behavior of the terminal where the terminal is located, such as the call number and the call time of the two parties, and can also cache the current call. The call voice information and the like; in this way, the first terminal 11 and the second terminal 12 can determine the call event between the two users in the following embodiments and extract the feature parameters of the call event; the client can be an application client, Can be a web client. In the embodiment of the present invention, the type of the call includes, but is not limited to, any one of a voice call and a video call.

The server 13 is provided by an operator, and may be a server, a server cluster composed of multiple servers, or a cloud computing service center. The server 13 is configured to carry control signaling for controlling the user's call, such as call, answer, and reject, and forward the call voice information between the first terminal 11 and the second terminal 12; thus, the first terminal 11 And the second terminal 12 can determine the call event between the two users in the following embodiments and extract the characteristics of the call event. parameter. The first terminal 11 and the second terminal 12 complete the call interaction between the first terminal 11 and the second terminal 12 through a communication connection established with the server 13. The communication connection is usually a TCP/IP (Transmission Control Protocol/Internet Protocol) connection.

The technical solutions of the present invention are further elaborated below in conjunction with the accompanying drawings and specific embodiments.

In order to solve the problems in the prior art, the embodiments of the present invention provide a method for identifying a malicious phone, which is applied to a computing device, and the function implemented by the method for identifying a malicious phone can be implemented by a processor calling program code in the computing device. Of course, the program code can be stored in a computer storage medium. As can be seen, the computing device includes at least a processor and a storage medium. The computing device can be any electronic device capable of information processing, for example, a terminal, a server, where the terminal can be a computing device with a call capability such as a tablet or a mobile phone.

FIG. 2 is a schematic flowchart of a method for identifying a malicious phone according to an embodiment of the present invention. As shown in FIG. 2, the method for identifying a malicious phone includes:

Step S101: Acquire a feature parameter of the first call event.

The first call event is a call event between the first user and the second user, and the feature parameter includes a parameter for describing a call voice feature, wherein the parameter describing the call voice feature includes: a waveform of the call voice At least one of the number of the first keyword and the probability in the text corresponding to the feature parameter and the call voice; since the purpose of the call by the malicious user is generally fraud and promotion, the tone and tone are usually mild, and the term is often used. Very similar, it is possible to analyze the call voice, obtain the feature parameters of the call voice, and identify the malicious call by the parameters describing the call voice feature.

In other embodiments of the present invention, the parameter for describing a call voice feature is a first feature parameter, and the feature parameter further includes a second feature parameter for describing a call behavior feature of the first user.

In other embodiments of the present invention, there are two types of feature parameters for acquiring the first call event. Method to realize:

The first implementation manner is: determining a first call event; at this time, correspondingly, acquiring the feature parameter of the first call event includes: extracting a feature parameter of the first call event. The computing device can be implemented as the first terminal 11, the second terminal 12 or the server 13. When the first terminal 11 and the second terminal 12 make a call through the server 13, the first terminal 11, the second terminal 12 or the server 13 can Determining a first call event between the first user and the second user, and extracting feature parameters of the first call event.

The second implementation manner is: the computing device is implemented as the first terminal, and the acquiring, by the computing device, the feature parameter of the first call event includes: receiving, by the first terminal, a feature parameter of the first call event sent by the server, where The first terminal corresponds to the first user. The computing device may also be a second terminal. If the computing device is the first terminal or the second terminal, in order to reduce the load of the computing device, the characteristic parameters of the first call event may be extracted on the server 13 side, and then, Transmitting the characteristic parameters of the first call event to the computing device.

Step S102: Identify the first call event according to the feature parameter of the first call event and the currently preset recognition model, where the feature model uses the feature parameter as a classification parameter.

The feature parameter of the first call event is an input of the recognition model, and the recognition result is an output of the recognition model. The recognition model may include models of various classification algorithms, including Logistic Regression (LR), Support Vector Machine (SVM), and Gradient Boosting Decision Tree (Gradient Boosting Decision Tree). GBDT) and so on.

Step S103: Acquire a recognition result of the first call event identified by the recognition model.

Step S104: Output a recognition result of the first call event.

The first terminal corresponds to the first user, and the second terminal corresponds to the second user. When the computing device is the first terminal or the second terminal, the outputting the result of the first call event may include: at the computing device Displaying a recognition result of the first call event on the display interface; When the computing device is a server, the outputting the identification result of the first call event may include: the server sending the identification result of the first call event to the first terminal and the second through a communication device (external communication interface) terminal.

In the embodiment of the present invention, the parameter describing the characteristics of the call voice is used as the identification standard, and the tone and the term of the malicious user during the malicious call such as promotion and fraud are not arbitrarily changed, so that the malicious call event can be accurately identified, and Output recognition results to alert users to fraud, which can greatly reduce the user's economic loss.

Based on the foregoing embodiments, an embodiment of the present invention provides a recognition model based on the introduction of machine learning technology. The machine learning refers to a theory of probability theory, statistics, and neural propagation, so that a computer can simulate human learning behavior. To acquire new knowledge or skills, reorganize existing knowledge structures to continuously improve their performance. In the initial stage of forming the recognition model, it is necessary to manually select as many normal call events and malicious call events as positive and negative samples for machine learning model training. In this embodiment, the identification of the malicious phone based on the machine learning model is very complicated, and the malicious user cannot detect and crack by simply adjusting the call number, and the model itself has the function of evolutionary learning, even if the malicious user changes the call mode, Simply re-training the model can identify new malicious call patterns and train them, making it difficult for malicious users to bypass the recognition strategy.

The application of machine learning technology in identifying malicious phones can be shared and disseminated freely, because the principle of machine learning recognition is complex and self-evolving, not specific to a certain call mode, so even for malicious users, it can be disclosed based on machine learning models. A way to identify a malicious call. Based on the foregoing embodiments, an embodiment of the present invention provides a method for establishing a recognition model, which is applied to a computing device, and the function implemented by the method for establishing a recognition model may be implemented by a processor calling program code in a computing device, of course, the program The code can be stored in a computer storage medium, as seen, the computing device includes at least a processor and a storage medium. The method for establishing a recognition model includes:

Step S201, determining a sample type of the sample.

The sample type includes a positive sample and a negative sample, the positive sample being a sample belonging to a malicious phone, and the negative sample being a sample not belonging to a malicious phone. The sample type can be determined by means of a manual return visit. For example, by collecting statistics, if the number of unfamiliar calls made by a certain user within a preset time period exceeds a certain threshold, the peer users of the user are manually dialed back. To confirm whether the call event between the two users is a malicious call, if it is a malicious call, determine the call event as a negative sample, and if it is not a malicious call, determine the call event as a positive sample.

The determination of the positive and negative samples is purely based on the problem that the sample size is limited and the cost is high. Therefore, the embodiment of the present invention can also automatically extract positive and negative samples by using the program. The determination of the positive samples can be determined by a combination of a rule-based determination method and a statistical-based determination method. The rule-based identification method is used for roughly screening large-scale call events as samples, wherein the rule-based identification method is adopted. In the process, a certain rule may be preset to roughly filter the sample, and then the statistic-based identification method is used for screening, for example, the number of times marked as a malicious call and the number of calls of a strange phone exceed a certain threshold (the threshold is statistically The user, and therefore the screening method is called a statistical-based identification method, and then uses the cross-filtering method to clean the sample, and finally obtains a positive sample and a negative sample, wherein there is a certain proportion of normal calls and malicious calls. This ratio is the configuration ratio, and the positive and negative samples obtained in this embodiment are to comply with the configuration ratio.

Step S202: Acquire feature parameters of the sample.

The feature parameters include parameters used to describe the characteristics of the call voice. The acquiring the feature parameters of the sample includes: acquiring the call voice information of the sample; and extracting the feature parameter from the call voice information of the sample, where the feature parameter includes: a waveform feature parameter of the call voice, and a text corresponding to the call voice. At least one of the number and probability of the first keyword.

For example, acquiring waveform feature parameters of the call voice includes: extracting a waveform of the call voice from the call voice information of the sample, the waveform including a time domain waveform or a frequency domain waveform; A waveform characteristic parameter of the waveform, the waveform characteristic parameter including at least one of a peak amplitude value, a valley amplitude value, a waveform amplitude average, a peak position, and a trough position.

For example, obtaining the number or probability of the first keyword in the text corresponding to the call voice includes: performing voice recognition on the call voice information of the sample, obtaining text corresponding to the call voice; and extracting a text keyword in the text; Comparing the text keyword with the preset first keyword, determining the number or probability of the first keyword in the text keyword. The purpose of malicious users to conduct calls is generally to scam and sell, so you can count the words often used in fraud and promotion as the first keywords such as "money", "winning", "buy", "bank", " Product" and so on.

In other embodiments of the present invention, the parameter for describing a call voice feature may be recorded as a first feature parameter, and the feature parameter further includes a second feature parameter for describing a call behavior feature. In other embodiments, the suspicious user in the two parties in the sample may be first determined, for example, the first call behavior of the two users of the two parties in the first preset time period is collected; and according to the two users In the first call behavior in the first preset time period, the suspicious users in the two parties are determined; for example, since the malicious users usually frequently talk to the strange telephone, it is possible to count the two parties and the stranger in one day. The number of calls made by the phone, and the number of users who have more calls with strange calls is a suspicious user.

The second feature parameter may be a parameter describing a call behavior feature of the non-suspicious user, including: the number of calls marked as a malicious user, the average duration of the call, and the number of calls with the unfamiliar user in the second preset time period, At least one of the number of calls with overseas users. The second feature parameter may also be a parameter describing a call behavior feature of the suspicious user, including: the number of calls marked as a malicious user, the average duration of the call, and the number of calls with the unfamiliar user during the second preset time period. At least one of the average duration of the call, the number of calls to the overseas user, the number of times marked as a malicious user, and the like.

By way of example, as shown in Table 1, one of the training sets for training the recognition model is:

Table 1

The number of calls marked as malicious users under the call behavior feature table shown in Table 1 "The average duration of calls marked as malicious users" "Number of calls with overseas users" "Number of calls with strange users" The "marked condition" is an example of the second characteristic parameter described in the embodiment; the parameter values of each parameter are statistical results in a preset time period, and the preset time period may be the start of the current call event. The day before. The "time domain waveform parameter", the "frequency domain waveform parameter", the "number of first keywords in the text corresponding to the call voice", and the like in the voice feature table shown in Table 1 are the same as described in this embodiment. The first characteristic parameter of the call event; the time domain waveform parameter may include a plurality of parameters (such as peak amplitude value, valley amplitude value, waveform amplitude average, peak position, and trough position, etc.) as described above, and these parameters may form parameters. Vectors such as "Vector 1", "Vector 2", "Vector 3", etc.; frequency domain waveform parameters may also include a variety of parameters as described above, which may form parameter vectors such as "Vector 4", "Vector 5", " Vector 6" and so on. Whether the malicious call list in Table 1 indicates whether the call event is a malicious call, if it is "Yes", the sample is a positive sample, and if it is "No", the sample is a negative sample, such as As shown in Table 1, the sample 1 is a positive sample, and the sample 2 and the sample 3 are negative samples.

Step S203: Obtain a training result output by the training model according to a characteristic parameter of the sample and a set training model, where the training model uses the feature parameter as a classification parameter.

The training model may include models of various classification algorithms including logistic regression algorithms, support vector machines, gradient elevation decision trees, and the like.

Step S204: Determine whether the training result meets the sample type of the sample.

Step S205: If the training result does not satisfy the sample type of the sample, adjust the model parameter of the training model until the training result satisfies the sample type of the sample, and the training result satisfies the sample of the sample. The type of training model is output as a preset recognition model.

The training model may have multiple, such as a time domain waveform training model, a frequency domain waveform training model, a call behavior training model, etc., and the time domain waveform parameter in the sample may be used as an input of a time domain waveform training model, and the frequency is The domain waveform parameter is used as the input of the frequency domain waveform training model, and the call behavior feature is used as the input of the call behavior training model, etc., and the training results of each training model are obtained, as long as the training results of the respective training models satisfy the sample type of the sample, These training models can be output as a preset recognition model.

In the embodiment of the present invention, regardless of the training model, when the training is started, the input of the training model includes the above-mentioned feature parameters, and the feature parameters of each sample are used as input of the training model, and the training model can be obtained from the training model. Various training results.

If the training model obtains the sample type of the sample according to the characteristic parameters of each sample, that is, after the feature parameter of the positive sample is input into the training model, the obtained training result indicates that the sample corresponding to the feature parameter is a positive sample. After the characteristic parameter of the negative sample is input into the training model, the obtained training result indicates that the sample corresponding to the feature parameter is a negative sample, and the training result satisfies the training model of the sample type of the sample.

If the training model is based on the characteristic parameters of each sample, the training knot corresponding to each sample If there is a sample type that does not satisfy the sample, that is, after the feature parameter of the positive sample is input into the training model, the obtained training result indicates that the sample corresponding to the feature parameter is a negative sample, or the characteristic parameter of the negative sample is input into the training model, and The training result indicates that the sample corresponding to the feature parameter is a positive sample, and then the model parameters of the training model are adjusted until the training results corresponding to all the samples satisfy the sample type of the sample; and then the adjusted training result is satisfied. The training model of the sample type of the sample is output as a preset recognition model.

In other embodiments of the present invention, the feature parameters of the sample include a first feature parameter for describing a call speech feature and a second feature parameter for describing a call behavior feature; the training model includes a first sub-training model and The second sub-training model, the method of establishing the recognition model at this time:

Step A1: Identify the sample according to the second feature parameter and the first sub-training model, where the first sub-training model uses the second feature parameter as a classification parameter; acquiring the first sub-child Training a first training result of the sample output by the model; adjusting the model parameter of the first training model until the first training result satisfies the sample when the first training result does not satisfy the sample type of the sample The sample type of the sample;

Step A2: Identify the sample according to the third feature parameter and the second sub-training model, where the second sub-training model uses the third feature parameter as a classification parameter, and the third feature parameter is a Determining a second feature parameter or the feature parameter; acquiring a second sub-training result output by the second sub-training model; adjusting the second when the second sub-training result does not satisfy the sample type of the sample Model parameters of the sub-training model until the second training result satisfies the sample type of the sample;

Step A3: output, as a preset first sub-recognition model, the first sub-training model that satisfies the sample type of the sample, and the second training result satisfies the sample type of the sample. The second sub-training model is output as a preset second sub-recognition model.

In the embodiment of the present invention, the first feature parameter describing the characteristics of the call voice is used to train the training model, and the model parameters of the training model are continuously adjusted according to the training result, so that the final The training model optimizes the call rate for sample identification, thus improving the accuracy of identifying malicious calls. And a distinguishing feature of the recognition model adopted by the embodiment of the present invention is that the model can self-evolve, and automatically adjust the model parameters according to the change of the call voice or the call behavior, thereby avoiding the rule-based manual frequent intervention adjustment parameters.

Based on the foregoing embodiments, an embodiment of the present invention provides a method for identifying a malicious phone, which is applied to a computing device, where the computing device is implemented as a server, and the function implemented by the method for identifying a malicious phone may be invoked by a processor in a server. The program code is implemented. Of course, the program code can be stored in a computer storage medium. As can be seen, the server includes at least a processor and a storage medium.

3A is a schematic flowchart of an implementation of a method for identifying a malicious phone according to an embodiment of the present invention. As shown in FIG. 3A, the method for identifying a malicious phone includes:

Step S301: The server determines a first call event, and extracts a feature parameter of the first call event.

The first user establishes a communication connection with the second user through the server, thereby implementing a call between the first user and the second user, and the server is configured to carry control signaling for controlling the user's call, such as calling, answering, and rejecting. The signaling is forwarded, and the call voice information between the first terminal 11 and the second terminal 12 is forwarded. Therefore, the server may determine a call event between the first user and the second user and call behavior information of the first user and the second user.

The feature parameters include a first feature parameter for describing a call voice feature and a second feature parameter for describing a call behavior feature.

The server 13 can forward the call voice information between the first terminal 11 and the second terminal 12, the first terminal corresponds to the first user, and the second terminal corresponds to the second user; therefore, the first session of the first call event is extracted. The feature parameter may include: acquiring call voice information of the first call event; extracting the first feature parameter from call voice information of the first call event, where the first feature parameter includes: waveform feature of the call voice In the text corresponding to the parameter and call voice At least one of the number and probability of the first keyword.

In other embodiments of the present invention, the server may extract a waveform of a call voice from the call voice information of the first call event, where the waveform includes a time domain waveform or a frequency domain waveform; and extracting waveform characteristics of the waveform a parameter, the waveform characteristic parameter comprising at least one of a peak amplitude value, a valley amplitude value, a waveform amplitude average, a peak position, and a trough position.

The server may also perform voice recognition on the call voice information of the first call event, obtain text corresponding to the call voice, extract a text keyword in the text, and compare the text keyword with a preset first key. a word determining a number or probability of the first keyword in the text keyword. For example, the purpose of a malicious user to make a call is generally to scam and sell, so it is possible to count the words often used in fraud and promotion as the first keywords such as "money", "winning", "buy", "banking "," "products" and so on.

The server may collect the first call behavior of the first user and the second user in the first preset time period; according to the first call of the first user and the second user in the first preset time period Behavior, determining whether the first user is a suspicious user; for example, since a malicious user usually frequently talks to a strange phone, it is possible to count the two parties (first user and second user) and the strange phone in one day. The number of calls, the number of users who have more calls with strange calls is suspicious.

The second feature parameter may be a parameter describing a call behavior feature of the non-suspicious user, so if the first user is not a suspicious user, the server is used to describe the first from the call behavior information of the first user. The second characteristic parameter of the call behavior feature of the user, where the second feature parameter includes: the number of calls marked as a malicious user, the average duration of the call, the number of calls with the unfamiliar user, and the overseas time in the second preset time period At least one of the number of calls of the user; the second characteristic parameter may be a parameter describing a call behavior characteristic of the suspicious user, and if the first user is a suspicious user, the call behavior of the server from the first user a second feature parameter used in the information to describe a call behavior feature of the first user, the second feature parameter comprising: At least one of the number of calls with the unfamiliar user, the average duration of the call, and the number of calls with the overseas user during the third predetermined time period.

Step S302: The server identifies the first call event according to the feature parameter of the first call event and the current preset recognition model, where the feature model uses the feature parameter as a classification parameter.

The online model shown in FIG. 3A is the current preset recognition model; the current preset recognition model is established by the server using the method for establishing a recognition model described in the foregoing embodiment.

The recognition model includes a first sub-recognition model and a second sub-recognition model, and step S302 includes the following steps B1-B4:

Step B1: Identify the first call event according to the second feature parameter and the first sub-identification model, where the first sub-identification model uses the second feature parameter as a classification parameter.

Step B2: Acquire an initial recognition result of the first call event identified by the first sub-identification model.

Step B3: Acquire a first feature parameter of the first call event if the initial recognition result satisfies a first preset condition.

If the initial recognition result satisfies the first preset condition, it indicates that the first call event may be a malicious event, and a subsequent step is needed to further identify the first call event. If the initial recognition result does not satisfy the first preset condition, it indicates that the first call event is not a malicious event, and the process ends.

Step B4: Identify, according to the feature parameter of the first call event and the second sub-identification model, the first call event, where the second sub-recognition model uses the feature parameter as a classification parameter; or Determining, according to the first feature parameter of the first call event and the second sub-identification model, the first call event, wherein the second sub-identification model uses the first feature parameter as a classification parameter.

Correspondingly, the acquiring the identification of the first call event identified by the recognition model The method includes: obtaining a recognition result of the first call event identified by the second sub-identification model.

Step S303: The server acquires a recognition result of the first call event identified by the identification model, and determines a reminding instruction of the first call event according to the recognition result of the first call event.

In the embodiment of the present invention, when the identification result of the first call event meets the second preset condition, the server determines that the reminding instruction of the first call event is a first reminding instruction, and the first reminding instruction is used to indicate And not outputting, to the terminal, the recognition result of the first call event; the server determining, when the recognition result of the first call event meets the third preset condition, that the reminding instruction of the first call event is the second reminding instruction, The second reminding instruction is configured to send a short message to the first terminal, where the short message carries the identification result of the first call event; and the server identifies that the first call event meets the fourth preset condition Determining, by the third terminal, that the reminding instruction of the first call event is a third reminding instruction, where the third reminding instruction is used to initiate a call to the first terminal, and after the first terminal answers the call to the first The terminal notifies the identification result of the first call event.

Step S304: When the first user is not a suspicious user, the server outputs the recognition result of the first call event to the first terminal according to the reminding instruction of the first call event.

The first terminal corresponds to the first user, and the second terminal corresponds to the second user.

For example, it may be assumed that the recognition result identified by the recognition model is the probability that the identified call event is a malicious call, the second preset condition is [a, b], and the third preset condition is ( b, c], the fourth preset condition is (c, d); assuming that a is 0, b is 10%, c is 50%, and d is 100%. If the first call event is identified If the value is 5%, the server determines that the identification result of the first call event meets the second preset condition, indicating that the first call event is a risk-free event, and the server may not remind the user; If the recognition result of the call event is 30%, the server determines that the recognition result of the first call event satisfies the third preset The condition indicates that the first call time is a low-risk event, and the server may send a reminder message to a non-suspect user such as the first user in the first call event, and the content of the short message may be “Dear User, hello, The number of the call with XXXXX may be a malicious call, please strengthen the defense, etc.; if the recognition result of the first call event is 60%, the server determines that the recognition result of the first call event satisfies the first The four preset conditions indicate that the first call time is a high-risk event, and the server may initiate a call to a non-suspect user in the first call event, such as the first user, and automatically after the first terminal answers the call. Broadcast to the first terminal voice "Dear user, hello, the number XXXX call with you may be a malicious call, please strengthen your defense." Of course, the server can also initiate reminders to both users at the same time.

The server may further increase the number of times the second user is marked as a malicious user by 1 when the recognition result of the first call event satisfies the second preset condition or the third preset condition, so that the second user When continuing to initiate a malicious call to other users, the server may send the number of times the second user is marked as a malicious user to the other user, alerting the other user to the attention.

For example, the second user is a salesperson, and the number of calls with the strange number is many times in this day. When the second terminal used by the second user dials the first terminal, the first user of the first terminal is promoted to the product. In the scenario, because the second user is a salesperson, the tone of the call is very mild. I often say "our product XXX" "our product is very good" "original price is XXX", "Buy now can give you a discount XXX" "Buy our products will not regret" and so on. After the first terminal is connected, the server may determine a call event between the first user and the second user, and identify the call event according to the foregoing method, and the final recognition result is that the call event is low risk. At this time, the server sends a reminder message to the first user. After receiving the reminder message, the first user carefully considers his or her behavior and decides whether to continue communication with the second user to make a purchase or to the first The second user leaks his identity information, etc.; this prevents the first user from being defrauded.

Step S305: The server sends the feature parameter of the first call event to an offline model establishing module in the server, where the offline model establishing module uses a feature parameter of the first call event as a feature parameter of the sample.

After the server extracts the feature parameters of the first call event, the server may proceed to step S305.

As shown in FIG. 3A, the offline model establishing module may add a feature parameter of the first call event to a training set as a feature parameter of a sample.

Step S306: The server determines a sample type of the sample.

As shown in FIG. 3A, the sample type of the sample (ie, the first call event) can be automatically determined manually or by an offline model building module in the server to determine whether the sample is a positive sample or a negative sample.

Step S307: The server obtains a training result output by the training model according to the feature parameter of the sample and the set training model, where the training model uses the feature parameter as a classification parameter; and determines whether the training result meets the sample. a sample type; if the training result does not satisfy the sample type of the sample, adjusting a model parameter of the training model until the training result satisfies a sample type of the sample, and obtaining the training result that satisfies the sample A training model for the sample type.

Step S308: The server uses the training model whose training result satisfies the sample type of the sample as a preset recognition model.

The offline model shown in FIG. 3A is a training model that satisfies the sample type of the sample, so that the offline model building module can continuously obtain the feature parameters of the call event from the server in which it is located, and take the feature parameters of the call event as The sample is used for machine learning to carry out model training. The model parameters are automatically adjusted according to the change of call voice and call behavior, and the evolution is automatically performed to avoid the rule-based manual frequent intervention adjustment parameters.

In other embodiments of the present invention, the currently preset recognition model in the server may also be The first device is configured to be sent to the server by using the method for establishing a recognition model described in the foregoing embodiment; that is, the offline model establishing module in the server is disposed in the first device, and the first device is capable of Other devices (which may be the first terminal or the second terminal) that the server communicates with. The step S305 to the step S308 can also be implemented in the first device. In this case, the step S305 includes: the server sending the feature parameter of the first call event to the first device, where the first device sends the first call The feature parameter of the event is used as the feature parameter of the sample, and then steps S306 and S307 are performed, and the training model whose training result satisfies the sample type of the sample is output to the server as the current preset recognition model.

For example, the first device is the first terminal 11. As shown in FIG. 3B, the first terminal 11 establishes a recognition model by using the method for establishing a recognition model described in the foregoing embodiment, and then sends the identifier to the server 13; After the first call event performs feature extraction and performs malicious phone identification according to the recognition model, the identification result of the first call event is sent to the first terminal and/or the second terminal. Of course, the server 13 sends the feature parameters of the first call event to the first terminal 11 after the feature extraction of the first call event, and the first terminal 11 may The feature parameter is trained as a feature parameter of the sample to establish a current recognition model, and then the updated recognition model is sent to the server.

For example, the first device is not the first terminal and the second terminal, but other devices capable of communicating with the server 13. At this time, as shown in FIG. 3C, the first device 14 adopts the foregoing embodiment. After the identification model is established, the identification model is established, and then sent to the server 13; after the server 13 uses the scheme in this embodiment to identify the malicious phone, the identification result of the first call event is sent to the first terminal 11 and/or The second terminal 12. Of course, the server 13 sends the feature parameters of the first call event to the first device 14 after the feature extraction of the first call event, and the first device 14 may The feature parameter is used as a feature parameter of the sample to train to establish a current recognition model.

In other embodiments of the present invention, the computing device may also be implemented as a first terminal, where The step S304 needs to be replaced by: the first terminal displays the recognition result of the first call event on the display interface of the first terminal. Of course, the computing device can also be implemented as a second terminal, and the implementation process is the same as that of the first terminal; for example, the computing device is the first terminal 11, as shown in FIG. 3D, the server adopts the foregoing embodiment. After the identification model is established, the identification model is sent to the first terminal 11, and the first terminal 11 extracts the feature parameters of the first call event, and performs malicious phone identification according to the recognition model. The recognition result of the first call event is displayed on the display interface of the first terminal. Of course, the first terminal 11 sends the feature parameters of the first call event to the server 13 after performing feature extraction on the first call event, and the server 13 may set the feature parameters of the first call event. Training is established as a feature parameter of the sample to establish a current recognition model.

In the embodiment of the present invention, the initial recognition is performed by using the call behavior feature, and when the preliminary recognition result satisfies the first preset condition, the second feature parameter of the call event that satisfies the first preset condition is used for identification, so that Pre-screening part of the call event that does not satisfy the first preset condition can speed up the recognition rate, and finally the identification of the malicious call event must be identified by using the second feature parameter describing the voice feature to ensure the identification of the malicious call event. accuracy.

Based on the foregoing embodiments, an embodiment of the present invention provides an apparatus for identifying a malicious phone. Each unit included in the device for identifying a malicious phone, and each module included in each unit may be processed by a processor in the device. The implementation can of course also be implemented by logic circuits; in the process of the embodiment, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA). )Wait.

4 is a schematic structural diagram of a device for identifying a malicious phone according to an embodiment of the present invention. As shown in FIG. 4, the device includes a first acquiring unit 401, an identifying unit 402, a second obtaining unit 403, and a first output unit 404, where:

The first obtaining unit 401 is configured to acquire a feature parameter of the first call event, where the first call event is a call event between the first user and the second user, and the feature parameter includes The parameter describing the call voice feature, wherein the parameter describing the call voice feature comprises: at least one of a waveform feature parameter of the call voice, a number of first keywords in the text corresponding to the call voice, and a probability.

The identifying unit 402 is configured to identify the first call event according to the feature parameter of the first call event and the currently preset recognition model, and the recognition model uses the feature parameter as a classification parameter.

The second obtaining unit 403 is configured to acquire a recognition result of the first call event identified by the identification model.

The first output unit 404 is configured to output a recognition result of the first call event.

The first obtaining unit 401 includes: an obtaining module and an extracting module, wherein the acquiring module is configured to acquire call voice information of the first call event; and the extracting module is configured to be from the first call event The feature parameters are extracted from the call voice information.

The extracting module is configured to extract a waveform of the call voice from the call voice information of the first call event, where the waveform includes a time domain waveform or a frequency domain waveform; and extract waveform characteristic parameters of the waveform, the waveform feature The parameters include at least one of a peak amplitude value, a valley amplitude value, a waveform amplitude average, a peak position, and a valley position.

The extracting module is configured to perform voice recognition on the call voice information of the first call event, obtain text corresponding to the call voice, extract a text keyword in the text, and compare the text keyword with a preset number a keyword determining a number or probability of the first keyword in the text keyword.

The parameter for describing a call voice feature is a first feature parameter, and the feature parameter further includes a second feature parameter for describing a call behavior feature of the first user.

In another embodiment of the present invention, the device further includes an acquisition unit and a third determining unit, wherein the collecting unit is configured to collect the first user and the second user for a first preset time period a first call behavior; the third determining unit configured to be used according to the first Determining, by the first call behavior of the user and the second user in the first preset time period, whether the first user is a suspicious user; correspondingly, if the first user is not a suspicious user, the second feature parameter includes : at least one of a number of calls marked as a malicious user and an average duration of the call, a number of calls to the unfamiliar user, and a number of calls with the overseas user during the second predetermined time period; if the first user is a suspicious user The second characteristic parameter includes: at least one of a number of conversations with an unfamiliar user, an average duration of the call, and a number of conversations with the overseas user in the third preset time period.

In other embodiments of the present invention, the identification model includes a first sub-identification model and a second sub-recognition model, and the identification unit includes a first identification module and a second identification module, wherein the first identification module And configured to identify the first call event according to the second feature parameter and the first sub-identification model, and obtain an initial recognition result of the first call event identified by the first sub-recognition model The first sub-identification model is configured to use the second feature parameter as a classification parameter, and the second identification module is configured to: when the initial recognition result satisfies a first preset condition, according to the first call event The feature parameter and the second sub-recognition model identify the first call event, the second sub-recognition model uses the feature parameter as a classification parameter; or, according to the first feature of the first call event The parameter and the second sub-identification model identify the first call event, and the second sub-recognition model uses the first feature parameter as a classification parameter; correspondingly, the first Obtaining module 403, the second sub-configuration to obtain the recognition result of the first call event recognition model identified.

In another embodiment of the present invention, the device further includes: a first determining unit, wherein the first determining unit is configured to determine a reminder of the first call event according to the recognition result of the first call event The first output unit is further configured to output a recognition result of the first call event to the terminal according to the reminding instruction of the first call event, where the terminal includes a first terminal corresponding to the first user And a second terminal corresponding to the second user.

The first determining unit is configured to satisfy a second recognition result of the first call event Determining, by the preset condition, that the reminding instruction of the first call event is a first reminding instruction, where the first reminding instruction is used to indicate that the recognition result of the first call event is not output to the terminal; When the recognition result of the event meets the third preset condition, the reminder instruction of the first call event is determined as a second reminder instruction, and the second reminder instruction is used to send a short message to the terminal, where the short message carries a recognition result of the first call event; when the recognition result of the first call event satisfies a fourth preset condition, determining that the alert command of the first call event is a third alert command, the third alert command Instructing to initiate a call to the terminal, and notifying the first terminal of the recognition result of the first call event after the terminal answers the call; the terminal includes a first terminal corresponding to the first user and a corresponding second a second terminal of the user; correspondingly, the first output unit 404 is configured to output a recognition result of the first call event to the terminal according to the reminding instruction of the first call event

In another embodiment of the present invention, the first output unit 404 is further configured to display a recognition result of the first call event on a display interface of the first terminal, where the first terminal corresponds to the first One user. In other embodiments of the present invention, the apparatus further includes a third output unit, wherein the third output unit is configured to transmit the characteristic parameter of the first call event to the first device.

It should be noted that the description of the above device embodiment is similar to the description of the above method embodiment, and has similar advantages as the method embodiment. For technical details not disclosed in the device embodiments of the present invention, please refer to the description of the method embodiments of the present invention.

Based on the foregoing embodiments, an embodiment of the present invention provides an apparatus for establishing a malicious model, where each unit included in the apparatus for establishing a malicious model, and each module included in each unit can be processed by a processor in the apparatus. The implementation can of course also be implemented by logic circuits; in the process of the embodiment, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA). )Wait.

FIG. 5 is a schematic structural diagram of a device for establishing a malicious model according to an embodiment of the present invention, as shown in FIG. 5 The device for establishing a malicious model includes: a second determining unit 501, a third obtaining unit 502, a training unit 503, a determining unit 504, an adjusting unit 505, and a second output unit 506, wherein:

The second determining unit 501 is configured to determine a sample type of the sample, where the sample type includes a positive sample and a negative sample, the positive sample is a sample belonging to a malicious phone, and the negative sample is not belonging to a malicious phone. sample.

The third obtaining unit 502 is configured to acquire a feature parameter of the sample, where the parameter describing the voice feature of the call includes: a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability At least one of them.

The training unit 503 is configured to obtain a training result output by the training model according to a characteristic parameter of the sample and a set training model, where the training model uses the feature parameter as a classification parameter.

The determining unit 504 is configured to determine whether the training result meets the sample type of the sample.

The adjusting unit 505 is configured to adjust a model parameter of the training model until the training result satisfies the sample type of the sample when the training result does not satisfy the sample type of the sample.

The second output unit 506 is configured to output, as a preset recognition model, a training model in which the training result satisfies the sample type of the sample.

In the embodiment of the present invention, the first acquiring unit is further configured to receive a feature parameter of the first call event, and use a feature parameter of the first call event as a feature parameter of the sample.

Based on the foregoing embodiments, the embodiment of the present invention provides a device for identifying a malicious phone, and the device may be implemented as a server. FIG. 6 is a schematic structural diagram of a server according to an embodiment of the present invention. As shown in FIG. 6, the device for identifying a malicious phone includes a first processor 601 and a first external communication interface 602, wherein:

The first processor 601 is configured to acquire a feature parameter of the first call event, where the first call event is a call event between the first user and the second user, and the feature parameter includes a feature for describing the call voice. The parameter, wherein the parameter describing the voice feature of the call includes: at least one of a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability; according to the first call event Identifying the first call event by using a feature parameter and a current preset recognition model, wherein the recognition model uses the feature parameter as a classification parameter; and acquiring a recognition result of the first call event identified by the recognition model Transmitting, by the first external communication interface 602, a recognition result of the first call event.

The device for identifying a malicious phone may also be implemented as a first terminal or a second terminal. In this case, the device for identifying a malicious phone includes a first processor and a display screen, wherein: the first processor is configured to acquire a characteristic parameter of the first call event, the first call event is a call event between the first user and the second user, and the feature parameter includes a parameter for describing a call voice feature; according to the first call event Identifying the first call event by using a feature parameter and a current preset recognition model, wherein the recognition model uses the feature parameter as a classification parameter; and acquiring a recognition result of the first call event identified by the recognition model Displaying the recognition result of the first call event through the display screen. The display screen is configured to display a recognition result of the first call event.

It should be noted that the description of the above device embodiment items is similar to the above method description, and has the same beneficial effects as the method embodiments. For technical details not disclosed in the device embodiments of the present invention, those skilled in the art will understand with reference to the description of the method embodiments of the present invention.

Based on the foregoing embodiments, an embodiment of the present invention provides a device for establishing a malicious model, where the device for establishing a malicious model may be implemented as a server, a first terminal, or a second terminal, and FIG. 7 is a method for establishing a malicious model according to an embodiment of the present invention. Schematic diagram of the structure of the device, as shown in Figure 7, the design A second processor 701 and a second external communication interface 702 are included, wherein:

The second processor 701 is configured to determine a sample type of the sample, where the sample type includes a positive sample and a negative sample, the positive sample is a sample belonging to a malicious phone, and the negative sample is not belonging to a malicious phone. a sample; a feature parameter of the sample, the feature parameter includes a parameter for describing a call voice feature, wherein the parameter describing the call voice feature includes: a waveform feature parameter of the call voice, and a first key in the text corresponding to the call voice At least one of a number of words and a probability; obtaining, according to a characteristic parameter of the sample and a set training model, a training result output by the training model, wherein the training model uses the feature parameter as a classification parameter; Whether the training result conforms to the sample type of the sample; if the training result does not satisfy the sample type of the sample, adjusting the model parameter of the training model until the training result satisfies the sample type of the sample, The second external communication interface 702 makes the training model that the training result satisfies the sample type of the sample Pre-recognition model output.

It should be noted that, in the embodiment of the present invention, if the foregoing method for identifying a malicious phone and establishing a recognition model is implemented in the form of a software function module, and is sold or used as an independent product, it may also be stored in a computer readable state. In the storage medium. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

Correspondingly, the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the method for identifying a malicious phone and establishing a recognition model in the embodiment of the present invention. .

It is to be understood that the phrase "one embodiment" or "an embodiment" or "an" Thus, "in one embodiment" or "in an embodiment" or "an" In addition, these particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. It should be understood that, in various embodiments of the present invention, the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be directed to the embodiments of the present invention. The implementation process constitutes any limitation. The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments. It is to be understood that the term "comprises", "comprising", or any other variants thereof, is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes those elements. It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.

The units described above as separate components may or may not be physically separated. The components displayed as the unit may be, or may not be, physical units; they may be located in one place or on multiple network units; some or all of the units may be selected according to actual needs to implement the solution of the embodiment. purpose. In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

It will be understood by those skilled in the art that all or part of the steps of implementing the foregoing method embodiments may be performed by hardware related to program instructions. The foregoing program may be stored in a computer readable storage medium, and when executed, the program includes The foregoing steps of the method embodiment; and the foregoing storage medium includes: a removable storage device, a read only memory (ROM), a magnetic disk, or an optical disk, and the like, which can store program codes. Alternatively, the above-described integrated unit of the present invention may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a mobile storage device, a ROM, a magnetic disk, or an optical disk.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Industrial applicability

In the embodiment of the present invention, the parameter describing the characteristics of the call voice is used as the identification standard, and the tone and the term of the malicious user during the malicious call such as promotion and fraud are not arbitrarily changed, so that the malicious call event can be accurately identified, and Outputting the recognition result to remind the user from fraud, can greatly reduce the economic loss of the user; in addition, the establishment of the recognition model needs to continuously train the training model, and continuously adjust the model parameters of the training model according to the training result, so as to finally The training model optimizes the call rate for sample identification, thus improving the accuracy of identifying malicious calls.

Claims

A method of identifying a malicious phone, the method comprising:

Obtaining a feature parameter of the first call event, the first call event is a call event between the first user and the second user, and the feature parameter includes a parameter for describing a call voice feature, wherein the description call voice The parameter of the feature includes: a waveform feature parameter of the call voice, at least one of a number of the first keyword and a probability in the text corresponding to the call voice;

Determining, according to the feature parameter of the first call event and the current preset recognition model, the first call event, wherein the identification model uses the feature parameter as a classification parameter;

Obtaining a recognition result of the first call event identified by the identification model;

The recognition result of the first call event is output.
The method of claim 1 wherein the method further comprises:

Determining the first call event;

The acquiring the feature parameter of the first call event includes: extracting a feature parameter of the first call event.
The method of claim 1, wherein the obtaining the characteristic parameters of the first call event comprises:

The first terminal receives a feature parameter of the first call event sent by the server, where the first terminal corresponds to the first user.
The method of claim 1, wherein the parameter for describing a call speech feature is a first feature parameter, the feature parameter further comprising a second feature parameter for describing a call behavior feature of the first user.
The method according to claim 4, wherein the recognition model comprises a first sub-recognition model and a second sub-recognition model, wherein the feature parameter according to the first call event and the current preset recognition model are The first call event is identified, including:

Determining the first call according to the second feature parameter and the first sub-identification model Identifying, the first sub-identification model taking the second characteristic parameter as a classification parameter;

Obtaining an initial recognition result of the first call event identified by the first sub-identification model;

Acquiring the first feature parameter of the first call event when the initial recognition result meets the first preset condition;

Determining, according to the feature parameter of the first call event and the second sub-identification model, the first call event, wherein the second sub-recognition model uses the feature parameter as a classification parameter; or, according to the The first feature parameter of the first call event and the second sub-identification model identify the first call event, and the second sub-identification model uses the first feature parameter as a classification parameter;

Correspondingly, the obtaining the identification result of the first call event identified by the recognition model comprises: acquiring a recognition result of the first call event identified by the second sub-recognition model.
The method of claim 2, wherein the extracting characteristic parameters of the first call event comprises:

Obtaining call voice information of the first call event;

Extracting the feature parameter from the call voice information of the first call event.
The method of claim 6, wherein the extracting the feature parameters from the call voice information of the first call event comprises:

Extracting a waveform of the call voice from the call voice information of the first call event, where the waveform includes a time domain waveform or a frequency domain waveform;

A waveform characteristic parameter of the waveform is extracted, the waveform characteristic parameter including at least one of a peak amplitude value, a valley amplitude value, a waveform amplitude average, a peak position, and a trough position.
The method of claim 6, wherein the extracting the feature parameters from the call voice information of the first call event comprises:

Performing voice recognition on the call voice information of the first call event, and obtaining a text corresponding to the call voice;

Extracting text keywords in the text;

Comparing the text keyword with the preset first keyword, determining the number or probability of the first keyword in the text keyword.
The method of claim 4 wherein the method further comprises:

Collecting, by the first user and the second user, a first call behavior in a first preset time period;

Determining, according to the first call behavior of the first user and the second user in the first preset time period, whether the first user is a suspicious user;

Correspondingly, if the first user is not a suspicious user, the second feature parameter includes: the number of calls marked as a malicious user, the average duration of the call, the number of calls with the unfamiliar user, and the number of calls to the unfamiliar user during the second preset time period, At least one of the number of calls with the overseas user; if the first user is a suspicious user, the second characteristic parameter includes: the number of calls with the unfamiliar user and the average duration of the call during the third preset time period, and At least one of the number of calls from overseas users.
The method according to claim 9, wherein, before the first user is not a suspicious user, before the outputting the recognition result of the first call event, the method further comprises:

Determining, by the server, a reminder instruction of the first call event according to the recognition result of the first call event;

Correspondingly, the outputting the recognition result comprises:

The server outputs the identification result of the first call event to the first terminal according to the reminding instruction of the first call event, where the first terminal corresponds to the first user.
The method of claim 10, wherein the determining, by the server, the reminder instruction of the first call event according to the recognition result of the first call event comprises:

The server determines that the reminding instruction of the first call event is a first reminding instruction, and the first reminding instruction is used to indicate that the terminal is not outputting to the terminal, when the recognition result of the first call event meets the second preset condition The recognition result of the first call event;

The server determines that the reminder instruction of the first call event is a second reminder instruction, and the second reminder instruction is used to indicate to the first terminal, when the recognition result of the first call event meets a third preset condition Sending a short message, where the short message carries the identification result of the first call event;

The server determines that the reminder instruction of the first call event is a third reminder instruction, and the third reminder instruction is used to indicate to the first terminal, when the recognition result of the first call event meets the fourth preset condition Initiating a call, and notifying the first terminal of the recognition result of the first call event after the first terminal answers the call.
The method according to any one of claims 1 to 11, wherein said outputting said identification result comprises:

The first terminal displays the identification result of the first call event on the display interface of the first terminal, where the first terminal corresponds to the first user.
The method of claim 1 or 2, wherein the method further comprises:

Sending the characteristic parameter of the first call event to the first device.
The method of any of claims 1 to 11, wherein the method further comprises:

Determining a sample type of the sample, the sample type comprising a positive sample and a negative sample, the positive sample being a sample belonging to a malicious phone, the negative sample being a sample not belonging to a malicious phone;

Obtaining characteristic parameters of the sample;

Obtaining, according to a characteristic parameter of the sample and a set training model, a training result output by the training model, where the training model uses the feature parameter as a classification parameter;

Determining whether the training result meets the sample type of the sample;

If the training result does not satisfy the sample type of the sample, adjusting the model parameter of the training model until the training result satisfies the sample type of the sample, and training the training result to satisfy the sample type of the sample The model is output as a preset recognition model.
The method of claim 14, wherein the parameter for describing a call speech feature is a first feature parameter, the feature parameter further comprising a second feature parameter for describing a call behavior feature; the training model comprising The first sub-training model and the second sub-training model, the method further includes:

Determining the sample according to the second feature parameter and the first sub-training model, wherein the first sub-training model uses the second feature parameter as a classification parameter; and acquiring the first sub-training model output a first training result of the sample; when the first training result does not satisfy the sample type of the sample, adjusting a model parameter of the first training model until the first training result satisfies a sample of the sample Types of;

Identifying the sample according to the third feature parameter and the second sub-training model, wherein the second sub-training model uses the third feature parameter as a classification parameter, and the third feature parameter is the second And acquiring the second sub-training result output by the second sub-training model; adjusting the second sub-training model when the second sub-training result does not satisfy the sample type of the sample Model parameters until the second training result satisfies the sample type of the sample;

And the first sub-training model that satisfies the sample type of the sample as the preset first sub-recognition model output, and the second training result satisfies the second sub-training of the sample type of the sample The model is output as a preset second sub-recognition model.
A method of establishing a recognition model, wherein the method comprises:

Determining a sample type of the sample, the sample type comprising a positive sample and a negative sample, the positive sample being a sample belonging to a malicious phone, the negative sample being a sample not belonging to a malicious phone;

Obtaining a feature parameter of the sample, the feature parameter including a feature for describing a call voice a parameter, wherein the parameter describing the voice feature of the call includes: at least one of a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability;

Obtaining, according to a characteristic parameter of the sample and a set training model, a training result output by the training model, where the training model uses the feature parameter as a classification parameter;

Determining whether the training result meets the sample type of the sample;

If the training result does not satisfy the sample type of the sample, adjusting the model parameter of the training model until the training result satisfies the sample type of the sample, and training the training result to satisfy the sample type of the sample The model is output as a preset recognition model.
An apparatus for identifying a malicious phone, wherein the device includes: a first acquiring unit, an identifying unit, a second acquiring unit, and a first output unit, wherein

The first acquiring unit is configured to acquire a feature parameter of the first call event, where the first call event is a call event between the first user and the second user, and the feature parameter includes a feature for describing a call voice feature. a parameter, wherein the parameter describing the voice feature of the call includes: at least one of a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability;

The identifying unit is configured to identify the first call event according to the feature parameter of the first call event and the currently preset recognition model, where the recognition model uses the feature parameter as a classification parameter;

The second acquiring unit is configured to acquire a recognition result of the first call event identified by the identification model;

The first output unit is configured to output a recognition result of the first call event.
The apparatus of claim 17, wherein the parameter for describing a call voice feature is a first feature parameter, the feature parameter further comprising a second feature parameter for describing a call behavior feature of the first user, The identification model includes a first sub-identification model and a second sub-recognition model, and the identification unit includes a first identification module and a second identification module, wherein

The first identification module is configured to identify the first call event according to the second feature parameter and the first sub-identification model, and acquire the first identifier identified by the first sub-identification model An initial recognition result of the call event; the first sub-identification model uses the second feature parameter as a classification parameter;

The second identification module is configured to: when the initial recognition result meets the first preset condition, perform the first call event according to the feature parameter of the first call event and the second sub-recognition model Identifying that the second sub-identification model uses the feature parameter as a classification parameter; or, identifying the first call event according to the first feature parameter of the first call event and the second sub-identification model The second sub-identification model takes the first feature parameter as a classification parameter;

Correspondingly, the second acquiring unit is configured to acquire a recognition result of the first call event identified by the second sub-recognition model.
An apparatus for establishing a malicious model, the apparatus comprising: a second determining unit, a third obtaining unit, a training unit, a determining unit, an adjusting unit, and a second output unit, wherein

The second determining unit is configured to determine a sample type of the sample, the sample type includes a positive sample and a negative sample, the positive sample is a sample belonging to a malicious phone, and the negative sample is a sample not belonging to a malicious phone ;

The third acquiring unit is configured to acquire a feature parameter of the sample, where the parameter describing the call voice feature includes: a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability At least one;

The training unit is configured to obtain a training result output by the training model according to a characteristic parameter of the sample and a set training model, where the training model uses the feature parameter as a classification parameter;

The determining unit is configured to determine whether the training result meets a sample type of the sample;

The adjusting unit is configured to adjust a model parameter of the training model until the training result satisfies a sample type of the sample when the training result does not satisfy a sample type of the sample;

The second output unit is configured to output the training model that the training result satisfies the sample type of the sample as a preset recognition model.
A device for identifying a malicious phone, the device comprising a first processor and a first external communication interface, or the device comprising a first processor and a display screen; wherein

The first processor is configured to acquire a feature parameter of the first call event, where the first call event is a call event between the first user and the second user, and the feature parameter includes a feature for describing a call voice feature. a parameter, wherein the parameter describing the voice feature of the call includes: at least one of a waveform feature parameter of the call voice, a number of the first keyword in the text corresponding to the call voice, and a probability; according to the feature of the first call event Identifying the first call event by using the parameter and the current preset recognition model, wherein the recognition model uses the feature parameter as a classification parameter; and acquiring a recognition result of the first call event identified by the recognition model; Outputting the recognition result of the first call event through the first external communication interface, or displaying the recognition result of the first call event through the display screen.
The device according to claim 20, wherein the parameter for describing a call voice feature is a first feature parameter, and the feature parameter further comprises a second feature parameter for describing a call behavior feature of the first user, The recognition model includes a first sub-recognition model and a second sub-recognition model, then,

The first processor is configured to identify the first call event according to the second feature parameter and the first sub-identification model, and acquire the first identifier identified by the first sub-recognition model An initial recognition result of the call event; the first sub-identification model uses the second feature parameter as a classification parameter; and when the initial recognition result satisfies a first preset condition, according to a characteristic parameter of the first call event The second sub-identification model, for the first call The event is identified, the recognition result of the first call event identified by the second sub-identification model is obtained, and the second sub-recognition model uses the feature parameter as a classification parameter; or, according to the first call event The first feature parameter and the second sub-identification model identify the first call event, and obtain a recognition result of the first call event identified by the second sub-recognition model, the second sub- The recognition model takes the first feature parameter as a classification parameter.
A device for establishing a malicious model, the device comprising: a second processor and a second external communication interface, wherein

The second processor is configured to determine a sample type of the sample, the sample type includes a positive sample and a negative sample, the positive sample is a sample belonging to a malicious phone, and the negative sample is a sample not belonging to a malicious phone Obtaining a feature parameter of the sample, the feature parameter includes a parameter for describing a call voice feature, wherein the parameter describing the call voice feature includes: a waveform feature parameter of the call voice, and a first keyword in the text corresponding to the call voice At least one of a number and a probability; obtaining a training result output by the training model according to a characteristic parameter of the sample and a set training model, wherein the training model uses the feature parameter as a classification parameter; determining the training Whether the result conforms to the sample type of the sample; if the training result does not satisfy the sample type of the sample, adjusting the model parameter of the training model until the training result satisfies the sample type of the sample, The external communication interface uses the training model in which the training result satisfies the sample type of the sample as a pre- The recognition model output.
A computer storage medium having stored therein computer executable instructions for performing the method of identifying a malicious phone according to any one of claims 1 to 15 or establishing identification The method of the model.