CN109547393A - Malice number identification method, device, equipment and storage medium - Google Patents
Malice number identification method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN109547393A CN109547393A CN201710861442.9A CN201710861442A CN109547393A CN 109547393 A CN109547393 A CN 109547393A CN 201710861442 A CN201710861442 A CN 201710861442A CN 109547393 A CN109547393 A CN 109547393A
- Authority
- CN
- China
- Prior art keywords
- vector
- call
- message registration
- malice
- feature vector
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Telephonic Communication Services (AREA)
Abstract
The present invention relates to a kind of malice number identification method, device, equipment and storage mediums, this method comprises: obtaining multiple message registrations including destination number；Extract corresponding every record information included by the message registration；Call vector corresponding to the corresponding message registration is generated according to every record information；The call vector is merged according to the generation timing of corresponding message registration, obtains feature vector；Malice Number Reorganization is carried out to the destination number according to described eigenvector.The scheme of the application makes the recognition result of malice number more accurate.
Description
Technical field
The present invention relates to field of computer technology, more particularly to a kind of malice number identification method, device, equipment and deposit
Storage media.
Background technique
Currently, the case where implementing malicious act by verbal system is commonplace, for example, the malicious acts such as telephone fraud.
For these malicious acts, conventional method is to preset blacklist, whether there is in the blacklist by detection number, comes
Determine whether the number is malice number.
It it is added to this premise in blacklist is in advance just able to achieve however, conventional method must be based on malice number, and
Malice number is added in blacklist by user's report, and the report situation of user is limited to.If user do not report or
Person reports not in time, can not just identify malice number, thus causes the accuracy rate of malice Number Reorganization relatively low.
Summary of the invention
Based on this, it is necessary to for the lower problem of malice Number Reorganization accuracy rate, provide a kind of malice Number Reorganization side
Method, device, computer equipment and storage medium.
A kind of malice number identification method, which comprises
Obtain multiple message registrations including destination number；
Extract corresponding every record information included by the message registration；
Call vector corresponding to the corresponding message registration is generated according to every record information；
The call vector is merged according to the generation timing of corresponding message registration, obtains feature vector；
Malice Number Reorganization is carried out to the destination number according to described eigenvector.
A kind of malice NID number identifier, described device include:
Module is obtained, for obtaining multiple message registrations including destination number；
Information extraction modules are recorded, for extracting corresponding every record information included by the message registration；
Call vector generation module, for being generated corresponding to the message registration accordingly according to every record information
Call vector；
Feature vector generation module, for the call vector to be merged according to the generation timing of corresponding message registration,
Obtain feature vector；
Malice number identification module, for carrying out malice Number Reorganization to the destination number according to described eigenvector.
A kind of computer equipment, including memory and processor are stored with computer program, the meter in the memory
When calculation machine program is executed by processor, so that the processor executes following steps:
Obtain multiple message registrations including destination number；
Extract corresponding every record information included by the message registration；
Call vector corresponding to the corresponding message registration is generated according to every record information；
The call vector is merged according to the generation timing of corresponding message registration, obtains feature vector；
Malice Number Reorganization is carried out to the destination number according to described eigenvector.
A kind of storage medium being stored with computer program, the computer program are executed by one or more processors
When, so that one or more processors execute following steps:
Obtain multiple message registrations including destination number；
Extract corresponding every record information included by the message registration；
Call vector corresponding to the corresponding message registration is generated according to every record information；
The call vector is merged according to the generation timing of corresponding message registration, obtains feature vector；
Malice Number Reorganization is carried out to the destination number according to described eigenvector.
Above-mentioned malice number identification method, device, computer equipment and storage medium, by that will include the more of destination number
A message registration is converted into corresponding call vector；According to the generation timing of corresponding message registration, each call vector is merged
To feature vector.Since each call vector is corresponding to each message registration, the feature vector that vector of conversing chronologically is merged
The feature for behavior of conversing corresponding to the destination number can be characterized to a certain extent, thus based on characterization destination number
The feature vector of call behavior carries out malice Number Reorganization to destination number, and malice number can be identified by not needing user's report
Code, so that recognition result is more accurate.
Detailed description of the invention
Fig. 1 is the flow diagram of malice number identification method in one embodiment；
Fig. 2 is the schematic diagram for taking combination in one embodiment in call vector；
Fig. 3 is the schematic diagram of statistical vector element information in one embodiment；
Fig. 4 is the process overview schematic diagram of malice number identification method in one embodiment；
Fig. 5 is the flow diagram of malice number identification method in another embodiment；
Fig. 6 is the structural block diagram of malice NID number identifier in one embodiment；
Fig. 7 is the structural block diagram of malice NID number identifier in another embodiment；
Fig. 8 is the schematic diagram of internal structure of computer equipment in one embodiment.
Specific embodiment
In order to make the objectives, technical solutions, and advantages of the present invention clearer, with reference to the accompanying drawings and embodiments, right
The present invention is further elaborated.It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, and
It is not used in the restriction present invention.
Fig. 1 is the flow diagram of malice number identification method in one embodiment.The present embodiment is mainly with the malice number
Code recognition methods is applied to computer equipment to illustrate.Referring to Fig.1, this method specifically comprises the following steps:
S102 obtains multiple message registrations including destination number.
Wherein, destination number, be it is to be identified whether be malice number number.Message registration is carried out to call behavior
Record obtained record information.Message registration including destination number, be destination number as calling number or called number when
Corresponding message registration.
In one embodiment, the multiple message registrations obtained in step S102 be destination number as calling number and/
Or corresponding message registration when called number.When i.e. acquired multiple message registrations can be destination number as calling number
Corresponding message registration, corresponding message registration when being also possible to destination number as called number can also be both include mesh
When label code is as calling number corresponding message registration include again destination number as called number when corresponding message registration.
In one embodiment, the multiple message registrations obtained in step S102 can be all or part of logical including the destination number
Words record.
In one embodiment, computer equipment can extract the message registration including destination number from CDR file.
S104 extracts corresponding every record information included by message registration.
Wherein, information is recorded, is the relevant information of institute's ticket call behavior.It is appreciated that including extremely in message registration
The record information of one item missing.In one embodiment, the record information for including in message registration, including calling number, called number
At least one record information in code, calling and called relationship, call turn-on time point, the duration of call and end of conversation time point etc..
For example, a message registration including destination number 138******** is as follows:
138********, 156********, caller, 2017-8-30 14:18:00,20.
5 record information that then message registration includes are respectively as follows: 138******** (calling number), 156********
(called number), caller (calling and called relationship), 2017-8-30 14:18:00 (call turn-on time point) and 20 is (when call
It is long).
It is appreciated that computer equipment is to extract corresponding every record information included by each message registration respectively.
S106 generates call vector corresponding to corresponding message registration according to items record information.
Wherein, call vector, is the vector for indicating the ticket call behavior of message registration institute, i.e., message registration is recorded
The form of call behavior vector be indicated.
In one embodiment, it is vector element that step S106, which includes: by items record information MAP, and combinatorial mapping obtains
Each vector element to generate vector of conversing corresponding with message registration.
Specifically, the mapping relations between record information and vector element are pre-set in computer equipment, are reflected according to this
Relationship is penetrated, the record information MAP of items included by message registration can be directly vector element by computer equipment.Further
The obtained vector element of mapping can be combined by ground, computer equipment, with generate it is corresponding with the message registration converse to
Amount.It is appreciated that vector of conversing corresponding with the message registration then only wraps when in message registration only including individual event record information
Include the vector element obtained after individual event record information MAP.
In another embodiment, computer equipment can also be determined according to items record information corresponds to default characteristic item
Characteristic information, according to the identified characteristic information for corresponding to default characteristic item generate it is corresponding with the message registration converse to
Amount.Wherein, characteristic item is preset, is the default item for embodying the feature of call behavior.
S108, the vector that will converse merge according to the generation timing of corresponding message registration, obtain feature vector.
Wherein, the generation timing of message registration is the sequencing for generating message registration.The merging of vector is by vector
Vector element spliced, the vector obtained after merging includes all vector elements of each vector merged.Feature
Vector is the vector for indicating the feature of call behavior of destination number, i.e., indicates the call behavior of destination number in the form of vectors
Feature.
It is appreciated that multiple call behaviors of destination number can reflect the call row of destination number to a certain extent
For feature, then obtain feature vector after the multiple call vectors for indicating multiple call behaviors are merged, what this was obtained
Feature vector can also characterize the feature of the call behavior of destination number to a certain extent.
It is appreciated that the sequencing that the generation timing of message registration and the message registration institute ticket call behavior occur
It is adapted.For example, message registration A is used for recording call behavior a, message registration B for recording call behavior b, message registration C
In record call behavior c.Wherein, the sequencing that these three call behaviors occur is successively are as follows: call behavior c → call behavior a
→ call behavior b, then, the generation timing of these three message registrations are as follows: message registration C → message registration A → message registration B.
Specifically, computer equipment can be according to the generation timing between message registration corresponding to each call vector, will
Vector element in each call vector is spliced, and feature vector is obtained.
For example, call vectorCall vectorConverse to
AmountWith call vectorThe generation timing of corresponding message registration are as follows: message registration A → message registration B, then, then it presses
According to the generation timing, by vector of conversingIn vector element and call vectorIn vector element spliced, obtain spy
Levy vector
It should be noted that computer equipment can be by whole call vectors according to the generation of corresponding message registration
Timing, merging obtain a feature vector.Each call vector can also be combined by computer equipment, by the call in combination
Vector merges according to the generation timing of corresponding message registration, obtains feature vector.
S110 carries out malice Number Reorganization to destination number according to feature vector.
Specifically, computer equipment can directly the feature vector according to obtained in step S108 dislike destination number
Meaning Number Reorganization, to identify whether destination number is malice number.Computer equipment can also to obtained feature vector into
Row screening is (for example, computer equipment can be right by carrying out the modes such as cluster or prominence score to obtained feature vector
Feature vector is screened), malice Number Reorganization is carried out to destination number according to the feature vector filtered out, to identify target
Whether number is malice number.
In one embodiment, computer equipment can will carry out the feature vector of malice Number Reorganization, input malice number
Code identification model, output obtain the probability that destination number is malice number, when probability is greater than predetermined probabilities threshold value, then identify mesh
Label code is malice number.Wherein, malice Number Reorganization model is by feature vector and malice number probability as training sample
This, carries out the malice Number Reorganization model that machine learning training obtains.
Above-mentioned malice number identification method, by will include that multiple message registrations of destination number are converted into corresponding call
Vector；According to the generation timing of corresponding message registration, merge each call vector to obtain feature vector.Due to each call vector pair
The target should can be characterized to a certain extent in each message registration, the feature vector that vector chronologically merges that will converse
Call behavioural characteristic corresponding to number, thus based on characterization destination number call behavior feature vector to destination number into
Row malice Number Reorganization, malice number can be identified by not needing user's report, so that recognition result is more accurate.
In one embodiment, step S106 includes: that the spy for corresponding to default characteristic item is determined according to every record information
Reference breath；Characteristic information is mapped as vector element；Mix vector element is to generate vector of conversing corresponding with message registration.
Wherein, characteristic item is preset, is the default item for embodying call behavioural characteristic.
In one embodiment, default characteristic item includes this type of number, opposite-terminal number type, calling and called relationship, opposite end
The call relationship of number and this number, the duration of call, with the call office of last time call every etc. at least one.
In one embodiment, the type of number includes the types such as overseas number, fixed-line telephone, mobile number and network number
At least one of.Calling and called relationship includes caller relationship and called relationship.Opposite-terminal number and the call relationship of this number include
At least one of call for the first time, normal open words and general call etc..
Specifically, computer equipment can correspond to according to the included every record information determination of the message registration itself
The characteristic information of default characteristic item.Computer equipment can also the record of the items according to included by acquired multiple message registrations
Information corresponds to the characteristic information of default characteristic item to determine.For example, for the call office conversed with last time every this characteristic item
For, computer equipment just need according to the record information in the record information and next message registration in a upper message registration come
Determine correspond to this feature item characteristic information, that is, determine specific call office every.
In one embodiment, computer equipment can be according to the generated history before current message registration generates
Record information in message registration, to determine in current message registration, the call relationship of opposite-terminal number and this number.With true
It is scheduled in current message registration, whether is call for the first time, normal open words or general call between opposite-terminal number and this number.
In one embodiment, the mapping relations between characteristic information and vector element are pre-set in computer equipment,
According to the mapping relations, the characteristic information of identified default characteristic item can be mapped as vector element by computer equipment.Into
One step, the vector element that mapping obtains can be combined by computer equipment, to generate lead to corresponding with the message registration
Talk about vector.
It is illustrated now in conjunction with example.For example, being continuously generated including 3 of destination number 138******** logical
The message registration of words behavior is as follows:
Message registration 1:138********, 156********, caller, 2017-8-30 14:18:00,20；
Message registration 2:156********, 138******** are called, 2017-8-30 15:08:00,10；
Message registration 3:138********, 137********, caller, 2017-8-30 15:30:00,15.
So, in the call vector for determining message registration 2, computer equipment can be according to the items in message registration 2
Information is recorded, determines that this type of number in default characteristic item is mobile number, opposite-terminal number type is mobile number, calling and called
Relationship is called, duration of call 10min, and according to the message registration of the call behavior generated before message registration 2, is determined
The relationship of opposite-terminal number and this number is that normal open talks about relationship, according in message registration 2 record information and last call lead to
Record information in words record 1, it is determining to be divided into 30min with last call office.So, it is preset corresponding to the message registration
The characteristic information of characteristic item is respectively as follows: that this type of number is mobile number, opposite-terminal number type is mobile number, calling and called relationship
Relationship for called, duration of call 10min, opposite-terminal number and this number be normal open talk about relationship, with last call office every
For 30min, then obtained each characteristic information is each mapped to vector element, available and message registration 2 by computer equipment
Corresponding call vector is (1,1,2,1,2,30).
In above-described embodiment, the characteristic information for corresponding to default characteristic item is determined according to every record information；Feature is believed
Breath is mapped as vector element, and call vector generated is enabled more accurately to characterize the feature of call behavior.To mention
The high accuracy of malice Number Reorganization.
In one embodiment, step S108 include: corresponding to multiple message registrations call vector in take it is different
Combination；The call vector of each combination is merged by the generation timing of corresponding message registration, obtains feature vector.
In one embodiment, multiple call vectors can be divided directly and be combined by computer equipment.It is appreciated that direct
Multiple call vectors are divided and are combined, the call vector between obtained each combination do not repeat, i.e., one call vector there is only
In a combination after directly division combination.
Specifically, computer equipment can determine corresponding multiple call vectors according to the generation timing of multiple message registrations
Sequentially, according to respective sequence, every call vector for meeting default vector quantity is iteratively divided into one group, to be conversed
Vector divide after combination.Wherein, vector quantity is preset, is the preset quantity of the call vector in a combination.
For example, call vector is represented sequentially as call vector 1~9, presets vector quantity according to the sequence of call vector
It is 3, then available 3 combinations, are combination G1 respectively: call vector 1~3 combines G2: call vector 4~6, and combination
G3: call vector 7~9.
It is appreciated that when the quantity of last remaining call vector is unsatisfactory for default vector quantity, then by remaining call
Vector is combined as one.
Multiple call vectors are divided into satisfaction according to respective sequence by computer equipment also available default number of combinations
The combination of default number of combinations.For example, default number of combinations is 2, call vector is 1~8, then can be divided into call vector
3 combinations, respectively call vector 1~4 and the two combinations of vector 5~8 of conversing.
It is appreciated that then computer is set when the ratio of the total quantity for vector of conversing and default number of combinations is not integer
It is standby the combination for add call vector to be determined according to the quantity of the remaining call vector come out, and by remaining call out
Vector correspondence is added in determined combination.
In another embodiment, multiple call vectors can also be carried out permutation and combination by computer equipment, to obtain not
Same combination.It is appreciated that a call vector can reside in the multiple combinations obtained after permutation and combination.Specifically, it counts
Permutation and combination can be carried out for multiple call vectors according to default vector quantity by calculating machine equipment.Default vector quantity, is a group
The preset quantity of call vector in conjunction.
Fig. 2 is the schematic diagram for taking combination in one embodiment in call vector.Referring to Fig. 2, presetting vector quantity is 2,
Then can will call vector 1,2 and 3 according to default vector quantity 2 carry out permutation and combination (in i.e. each combination include 2 converse to
Amount), obtain the combination of call vector 1 and vector 2 of conversing, the combination of call vector 2 and vector 3 of conversing, and call 1 He of vector
The combination of call vector 3.Four-headed arrow in Fig. 2 indicates that the call vector at both ends is combined with each other.
In other embodiments, computer equipment can also will carry out random combine between each call vector, to obtain difference
Combination.
In above-described embodiment, different combinations is taken in the call vector corresponding to multiple message registrations；By each combination
Call vector by corresponding message registration generation timing merge, obtain feature vector.It ensure that the diversity of combination, thus
So that the feature vector according to combination producing is more, and then more in many aspects, more accurately embody the call row of destination number
For feature.In addition, by each combination call vector by corresponding message registration generation timing merge, obtain feature to
Amount is equivalent to so that behavior of conversing is with order, and then feature vector is enabled to more accurately to embody destination number
The feature of call behavior.
In one embodiment, corresponding to multiple message registrations call vector in take different combinations include: according to
The generation timing of multiple message registrations determines the sequence of corresponding multiple call vectors；From multiple call vectors, take respectively default
The combination of quantity and call vector adjacent according to the sequence.
Specifically, computer equipment can determine corresponding multiple call vectors according to the generation timing of multiple message registrations
Sequentially, so that the sequence of multiple call vectors and the generation timing of corresponding message registration are adapted.I.e. message registration is raw
At it is more early, corresponding to call vector sequence it is more forward.
Wherein, adjacent in order, it is to belong to neighbouring relations according to the sequence of call vector.For example, according to call vector
Sequentially, multiple call vectors are represented sequentially as call vector 1,2,3,4 and 5, then conversing between vector 1 and call vector 2 is by suitable
Sequence is adjacent, call vector 2 and 3 be it is adjacent in order, be then not belonging to adjacent in order between vector 1 and 3 of conversing, and belong to
It is non-conterminous.
Preset quantity and call vector adjacent in order are adjacent in order between the call vector for indicating preset quantity.
For example, call vector 1,2 and 3 is exactly 3 adjacent call vectors in order, and vector 1,2 and 4 of conversing just be not belonging to 3 by
Sequentially adjacent call vector, because being not belonging between call vector 2 and 4 adjacent in order.
Further, computer equipment iteratively can meet the logical of preset quantity for every according to the sequence of call vector
Words vector is divided into one group, to obtain the combination after call vector divides.
In one embodiment, from multiple call vectors, preset quantity is taken respectively and call vector adjacent in order
Combination include: according to preset quantity, cyclically choose after current call vector and adjacent in order call to
Amount, wherein the sum of the quantity for the call vector that current call vector sum is chosen meets the preset quantity；By current call to
Amount and the call vector accordingly chosen are as combination.
It is appreciated that current call vector, is currently to be used to determine group during cyclically determining combination
The call vector of conjunction.For example, call vector is 1~10 (there are 10 call vectors), the 1st call vector is being directed to according to upper
Mode is stated come when determining combination, the 1st call vector is then current call vector, is being directed to the 2nd call vector according to upper
When stating to determine combination, the 2nd call vector is then current call vector.
Specifically, computer equipment can cyclically be chosen after current call vector and be pressed according to preset quantity
Sequentially adjacent call vector, wherein the sum of the quantity for the call vector that current call vector sum is chosen meets the present count
Amount.It is appreciated that being adjacent in order each other for selected call vector, and wherein sequence is most preceding
Vector of conversing also is adjacent in order with current call vector.
For example, a shared n call vector, preset quantity 3, then, it is being combined for k-th call vector to determine
When, then k-th call vector is current call vector, can be according to preset quantity 3, after selection k-th call vector
K+1 and the K+2 call vector, so that the quantity for the call vector that current call vector sum is chosen (chooses 2 calls
Vector) the sum of be 3.Using k-th call vector sum K+1 and the K+2 call vector as combination.
In above-described embodiment, from multiple call vectors, preset quantity and in order adjacent call vector are taken respectively
Combination, ensure that the diversity of combination, so that the feature vector according to combination producing is more, and then more in many aspects, more
Add the feature for accurately embodying the call behavior of destination number.In addition, taking preset quantity and call vector work adjacent in order
For combination, the problem of not only having avoided composite component excessively leads to processing pressure, but also since sequentially adjacent call vector carries out group
It closes, is equivalent to so that corresponding call behavior can more accurately embody the call behavior of destination number with continuity
Feature.
In one embodiment, the call vector of each combination is merged by the generation timing of corresponding message registration, is obtained
It include: to merge the call vector of each combination by the generation timing of corresponding message registration to feature vector；It is participating in merging
Each call vector in determine corresponding with default statistical items vector element；It will be right according to the corresponding statistical of default statistical items
The vector element answered is counted；The obtained vector element of statistics is added in the vector after corresponding merge, obtain feature to
Amount.
Wherein, statistical items are preset, are the default items for statistical vector element information.
Specifically, computer equipment can preset the default statistical items counted for vector element information, needle
Corresponding statistical is provided with to each default statistical items.It is right that each combined call vector can be pressed institute by computer equipment
It answers the generation timing of message registration to merge, element vector corresponding with default statistical items is determined in each call vector for participating in merging
Element counts corresponding vector element according to the corresponding statistical of default statistical items.Wherein, default statistical items can be
It is one or more.
In one embodiment, can be arranged for each vector element of call vector in computer equipment corresponding pre-
If statistical items, to count the information of the item vector element.For example, this for corresponding to the duration of call in call vector can be directed to
Statistical items are preset in vector element setting accordingly, for example, statistics call total duration etc..
Fig. 3 is the schematic diagram of statistical vector element information in one embodiment.Referring to Fig. 3, will call vector 1, converse to
Amount 2 and vector 3 of conversing, the vector element of column direction represented by vertical dotted line corresponds to identical default statistical items, right respectively
Ying Yusan different default statistical items.According to statistical corresponding to each default statistical items, by corresponding vector element into
Row counts, the vector element after being counted, the vector element " Vx0 in Fig. 3s,”、“Vx1s" and " Vx2s" it is after counting
Vector element.
Further, the vector element that statistics obtains can be added in the vector after corresponding merging by computer equipment,
Obtain feature vector.
Specifically, the vector element that statistics obtains can be added to the default position in the vector after merging by computer equipment
It sets.In one embodiment, the vector element that statistics obtains can be added to the head and the tail of the vector after merging by computer equipment
Or the position at end.
For example, merge after vector be (V00, V01, V02, V10, V11, V12, V20, V21, V22), count to
Secondary element is (Vx0s,Vx1s,Vx2s), then obtain feature vector be (V00, V01, V02, V10, V11, V12, V20, V21, V22,
Vx0s,Vx1s,Vx2s)
In above-described embodiment, counted for the vector element for the call vector for participating in merging according to default statistical items,
The vector element that statistics obtains is added in the vector after merging, so that characteristic information possessed by obtained feature vector is more
What is added is abundant, and then can more accurately embody the feature of the call behavior of destination number.
In one embodiment, it is different clustering clusters that step S110, which includes: by feature vector clusters,；It is selected from clustering cluster
Replace the feature vector of the corresponding clustering cluster of table；Malice Number Reorganization is carried out to destination number according to the feature vector of selection.
Wherein, clustering cluster is gathered for a kind of feature vector set.It is appreciated that the feature vector in same clustering cluster
The feature of the call behavior characterized is closer to.
Specifically, feature vector clusters can be different clustering clusters by clustering processing by computer equipment.At one
In embodiment, computer equipment can select the feature vector of preset quantity as initial clustering cluster center from feature vector
Point, then calculate each feature vector to initial clustering cluster central point distance, by each feature vector be divided into distance it is nearest just
In clustering cluster representated by beginning clustering cluster central point, then redefined further according to the feature vector being divided into each clustering cluster
The central point of the clustering cluster, then iteration the division of carry out feature vector and the step of update clustering cluster central point, until clustering cluster
Central point does not change, or reaches specified the number of iterations, is different clustering clusters by feature vector clusters.
Further, computer equipment can choose the feature vector for representing corresponding clustering cluster from each clustering cluster.Root
Malice Number Reorganization is carried out to destination number according to the feature vector of selection.
In one embodiment, computer equipment can randomly select a feature vector conduct from clustering cluster and represent phase
Answer the feature vector of clustering cluster.In another embodiment, computer equipment can also be with selected distance clustering cluster central point pre-
If the feature vector within range, as the feature vector for representing corresponding clustering cluster.
It is appreciated that clustering cluster is the set for the feature vector that characterized feature is closer to, so from clustering cluster
It chooses for representing the feature vector of the clustering cluster to carry out malice identification to destination number, feature can kept not lack
Under the premise of, the feature vector dimension for participating in the processing of malice Number Reorganization is reduced, calculates pressure to save computing resource and reduce
Power.
In one embodiment, step S110 includes: to carry out prominence score to the feature vector of selection；Filter out scoring
Value is higher than default scoring threshold value or score value is located at the feature vector of preceding presetting digit capacity；According to the feature vector filtered out to target
Number carries out malice Number Reorganization.
In one embodiment, computer equipment can carry out machine learning training according to the feature vector of selection, in machine
It determines that the corresponding data of each feature vector divide ability during device learning training, divides ability to phase according to identified data
Each feature vector is answered to carry out prominence score.
Specifically, computer equipment can carry out decision tree training according to the feature vector of selection by decision Tree algorithms,
It determines that the corresponding data of each feature vector divide ability in decision tree training process, divides ability pair according to identified data
Corresponding each feature vector carries out prominence score.
In another embodiment, computer equipment can also carry out Logic Regression Models according to each feature vector of selection
The corresponding each model as Logic Regression Models of the unknown prominence score of each feature vector of selection is joined in training
Number determines each model parameter by iterative calculation in Logic Regression Models training process, using determining model parameter as phase
The prominence score value for the feature vector answered.It is appreciated that the size of the model parameter of Logic Regression Models, embodies to logic
The influence power of regression result is strong and weak, and the power of influence power can embody importance degree, so, the size of model parameter can
Embody importance degree.
Further, computer equipment can will carry out the score value and default scoring threshold value progress that prominence score obtains
It compares, filters out score value and be higher than default scoring threshold value.Computer equipment can also will filter out score value and be located at preceding default position
Several feature vectors.For example, filtering out score value is located at preceding 10 feature vectors.Computer equipment can be according to filtering out
Feature vector carries out malice Number Reorganization to destination number.
In above-described embodiment, by feature vector carry out prominence score, according to scoring choose importance feature to
Amount carries out malice Number Reorganization.It does not lack because maintaining important feature without influencing recognition result, meanwhile, it reduces and participates in malice number
The feature vector dimension of code identifying processing calculates pressure to save computing resource and reduce.
In one embodiment, step S110 comprises determining that call behavior pattern corresponding to feature vector；When determining
When call behavior pattern belongs to the call behavior pattern of malice number, then identify that destination number is malice number.
Wherein, call behavior pattern is to be analyzed in advance for a large amount of call behavioral data, the conduct row summarized
For theoretical abstraction and basic framework.
Specifically, the corresponding relationship that computer equipment pre-sets feature vector between behavior pattern of conversing, according to
The corresponding relationship, computer equipment can determination to carry out call behavior mould corresponding to the feature vector of malice Number Reorganization
Formula.Computer equipment may determine that whether determined call behavior pattern belongs to the call behavior pattern of malice number, when
When determining call behavior pattern belongs to the call behavior pattern of malice number, then identify that destination number is malice number.When true
When fixed call behavior pattern is not belonging to the call behavior pattern of malice number, then identify that destination number is non-malicious number.
In one embodiment, computer equipment can be in judging call behavior pattern corresponding to each feature vector
There are when the call behavior pattern for belonging to malice number of at least one, identification destination number is malice number.
In above-described embodiment, by determining call behavior pattern corresponding to feature vector；When determining call behavior mould
When formula belongs to the call behavior pattern of malice number, then identify that destination number is malice number.It is equivalent to by determining call row
Counter for mode pushes away mode and identifies whether destination number is malice number, without being calculated by comparing complicated model,
Improve malice Number Reorganization efficiency.
Fig. 4 is the process overview schematic diagram of malice number identification method in one embodiment.Referring to Fig. 4, computer equipment
Call vector successively can be converted into the multiple message registrations for including destination number, according to the combination between call vector, generated
Multiple feature vectors cluster multiple feature vectors, by machine learning training module to the feature vector after cluster into
Row screening, filters out important feature vector, carries out malice Number Reorganization according to the important feature vector filtered out.
As shown in figure 5, in one embodiment, providing another malice number identification method, this method is specifically included
Following steps:
S502 obtains multiple message registrations including destination number, extracts corresponding every record included by message registration
Information.
S504 determines the characteristic information for corresponding to default characteristic item according to every record information.
Characteristic information is mapped as vector element by S506, and mix vector element is to generate converse corresponding with message registration
Vector.
S508 determines the sequence of corresponding multiple call vectors according to the generation timing of multiple message registrations；From multiple calls
In vector, preset quantity is taken respectively and the combination of call vector adjacent in order.
S510 is merged the call vector of each combination by the generation timing of corresponding message registration.
S512 determines vector element corresponding with default statistical items in each call vector for participating in merging.
S514 counts corresponding vector element according to the corresponding statistical of default statistical items.
The vector element that statistics obtains is added in the vector after corresponding merging, obtains feature vector by S516.
Feature vector clusters are different clustering clusters by S518；The feature for representing corresponding clustering cluster is chosen from clustering cluster
Vector.
S520 carries out prominence score to the feature vector of selection；Score value is filtered out to be higher than default scoring threshold value or comment
Score value is located at the feature vector of preceding presetting digit capacity.
S522 determines call behavior pattern corresponding to the feature vector filtered out.
S524 then identifies destination number when determining call behavior pattern belongs to the call behavior pattern of malice number
For malice number.
Above-mentioned malice number identification method, by will include that multiple message registrations of destination number are converted into corresponding call
Vector；According to the generation timing of corresponding message registration, merge each call vector to obtain feature vector.Due to each call vector pair
The target should can be characterized to a certain extent in each message registration, the feature vector that vector chronologically merges that will converse
Call behavioural characteristic corresponding to number, thus based on characterization destination number call behavior feature vector to destination number into
Row malice Number Reorganization, malice number can be identified by not needing user's report, so that recognition result is more accurate.
Secondly, determining the characteristic information for corresponding to default characteristic item according to every record information；Characteristic information is mapped as
Vector element enables call vector generated more accurately to characterize the feature of call behavior.To improve malice
The accuracy of Number Reorganization.
Then, from multiple call vectors, preset quantity is taken respectively and the combination of call vector adjacent in order, guaranteed
Combined diversity so that the feature vector according to combination producing is more, and then more in many aspects, more accurately body
The feature of the call behavior of existing destination number.In addition, taking preset quantity and call vector conduct combination adjacent in order, both kept away
The problem of having exempted from composite component excessively leads to processing pressure, and since sequentially adjacent call vector is combined, being equivalent to makes
Obtaining call behavior accordingly has continuity, can more accurately embody the feature of the call behavior of destination number.
Then, it is counted, will be counted according to default statistical items for the vector element for the call vector for participating in merging
To vector element be added to merge after vector in so that characteristic information possessed by obtained feature vector is more rich
Richness, and then can more accurately embody the feature of the call behavior of destination number.
Furthermore it is chosen from clustering cluster for representing the feature vector of the clustering cluster to carry out malice knowledge to destination number
Not, the feature vector dimension for participating in the processing of malice Number Reorganization can be reduced, to save under the premise of keeping feature not lack
It saves computing resource and reduces and calculate pressure.
Moreover, being disliked by carrying out prominence score to feature vector according to the feature vector that importance is chosen in scoring
Meaning Number Reorganization.It does not lack because maintaining important feature without influencing recognition result, meanwhile, it reduces and participates at malice Number Reorganization
The feature vector dimension of reason calculates pressure to save computing resource and reduce.
Finally, by determine call behavior pattern it is counter push away mode and identify whether destination number is malice number, without
It needs to calculate by comparing complicated model, improves malice Number Reorganization efficiency.
As shown in fig. 6, in one embodiment, providing a kind of malice NID number identifier 600, which includes:
It obtains module 602, record information extraction modules 604, call vector generation module 606, feature vector generation module 608 and dislikes
Meaning number identification module 610, in which:
Module 602 is obtained, for obtaining multiple message registrations including destination number.
Information extraction modules 604 are recorded, for extracting corresponding every record information included by message registration.
Call vector generation module 606 leads to corresponding to corresponding message registration for being generated according to items record information
Talk about vector.
Feature vector generation module 608 merges according to the generation timing of corresponding message registration for that will converse vector, obtains
To feature vector.
Malice number identification module 610, for carrying out malice Number Reorganization to destination number according to feature vector.
As shown in fig. 7, in one embodiment, call vector generation module 606 includes:
Characteristic information determining module 606a, for determining that the feature for corresponding to default characteristic item is believed according to every record information
Breath.
Mapping block 606b, for characteristic information to be mapped as vector element.
Generation module 606c generates vector of conversing corresponding with message registration for mix vector element.
In one embodiment, feature vector generation module 608 be also used to the call corresponding to multiple message registrations to
Different combinations is taken in amount；The call vector of each combination is merged by the generation timing of corresponding message registration, obtains feature
Vector.
In one embodiment, feature vector generation module 608 is also used to true according to the generation timing of multiple message registrations
The sequence of fixed corresponding multiple call vectors；From multiple call vectors, take preset quantity respectively and call adjacent in order to
The combination of amount.
In one embodiment, feature vector generation module 608 is also used to each combined call vector by corresponding
Message registration generation timing merge；Element vector corresponding with default statistical items is determined in each call vector for participating in merging
Element；Corresponding vector element is counted according to the corresponding statistical of default statistical items；The vector element that statistics is obtained
In vector after being added to corresponding merge, feature vector is obtained.
In one embodiment, malice number identification module 610 is also used to feature vector clusters be different clustering clusters；
The feature vector for representing corresponding clustering cluster is chosen from clustering cluster；Malice number is carried out to destination number according to the feature vector of selection
Code identification.
In one embodiment, malice number identification module 610 is also used to carry out importance to the feature vector of selection to comment
Point；Filter out the feature vector that score value is higher than default scoring threshold value or score value is located at preceding presetting digit capacity；According to what is filtered out
Feature vector carries out malice Number Reorganization to destination number.
In one embodiment, malice number identification module 610 is also used to determine call behavior corresponding to feature vector
Mode；When determining call behavior pattern belongs to the call behavior pattern of malice number, then identify destination number for malice number
Code.
Fig. 8 is the schematic diagram of internal structure of computer equipment in one embodiment.Referring to Fig. 8, which includes
Processor, memory and the network interface connected by system bus.Wherein, memory include non-volatile memory medium and
Built-in storage.The non-volatile memory medium of the computer equipment can storage program area and computer program, the computer journey
Sequence is performed, and processor may make to execute a kind of malice number identification method.The processor of the computer equipment is for providing
Calculating and control ability, support the operation of entire computer equipment.Computer program can be stored in the built-in storage, the calculating
When machine program is executed by processor, processor may make to execute a kind of malice number identification method.The network of computer equipment connects
Mouth is for carrying out network communication.
It will be understood by those skilled in the art that structure shown in Fig. 8, only part relevant to application scheme is tied
The block diagram of structure does not constitute the restriction for the computer equipment being applied thereon to application scheme, specific computer equipment
It may include perhaps combining certain components or with different component layouts than more or fewer components as shown in the figure.
In one embodiment, malice NID number identifier provided by the present application can be implemented as a kind of computer program
Form, the computer program can be run in computer equipment as shown in Figure 8, and the non-volatile of the computer equipment is deposited
Storage media can store each program module for forming the malice NID number identifier, for example, acquisition module 602 shown in fig. 6, note
Record information extraction modules 604, call vector generation module 606, feature vector generation module 608 and malice number identification module
610.Computer program composed by each program module is for making the computer equipment execute this Shen described in this specification
Please step in the malice number identification method of each embodiment, for example, computer equipment can pass through malice as shown in FIG. 6
Acquisition module 602 in NID number identifier 600 obtains multiple message registrations including destination number, and is mentioned by recording information
Modulus block 604 extracts corresponding every record information included by message registration.Computer equipment can talk vector generation module
606 generate call vector corresponding to corresponding message registration according to items record information, and pass through feature vector generation module
608 will converse vector according to the generation timing merging of corresponding message registration, obtain feature vector.Computer equipment can pass through
Malice number identification module 610 carries out malice Number Reorganization to destination number according to feature vector.
In one embodiment, a kind of computer equipment, including memory and processor are provided, is deposited in the memory
Computer program is contained, when the computer program is executed by processor, so that the processor executes following steps:
Obtain multiple message registrations including destination number；
Extract corresponding every record information included by the message registration；
Call vector corresponding to the corresponding message registration is generated according to every record information；
The call vector is merged according to the generation timing of corresponding message registration, obtains feature vector；
Malice Number Reorganization is carried out to the destination number according to described eigenvector.
In one embodiment, described to be generated corresponding to the corresponding message registration according to every record information
Call vector include:
The characteristic information for corresponding to default characteristic item is determined according to every record information；
The characteristic information is mapped as vector element；
The vector element is combined to generate vector of conversing corresponding with the message registration.
In one embodiment, described to merge the call vector according to the generation timing of corresponding message registration, it obtains
Include: to feature vector
Different combinations is taken in the call vector corresponding to the multiple message registration；
The call vector of each combination is merged by the generation timing of corresponding message registration, obtains feature vector.
In one embodiment, different combination packets is taken in the call vector corresponding to the multiple message registration
It includes:
The sequence of corresponding multiple call vectors is determined according to the generation timing of multiple message registrations；
From the multiple call vector, preset quantity is taken respectively and the combination of call vector adjacent according to the sequence.
In one embodiment, the call vector by each combination is closed by the generation timing of corresponding message registration
And it obtains feature vector and includes:
The call vector of each combination is merged by the generation timing of corresponding message registration；
Vector element corresponding with default statistical items is determined in each call vector for participating in merging；
The corresponding vector element is counted according to the corresponding statistical of the default statistical items；
In vector after the vector element that statistics obtains to be added to corresponding merge, feature vector is obtained.
In one embodiment, described that malice Number Reorganization packet is carried out to the destination number according to described eigenvector
It includes:
Described eigenvector is clustered as different clustering clusters；
The feature vector for representing corresponding clustering cluster is chosen from the clustering cluster；
Malice Number Reorganization is carried out to the destination number according to the described eigenvector of selection.
In one embodiment, the described eigenvector according to selection carries out the knowledge of malice number to the destination number
Do not include:
Prominence score is carried out to the described eigenvector of selection；
Filter out the feature vector that score value is higher than default scoring threshold value or score value is located at preceding presetting digit capacity；
Malice Number Reorganization is carried out to the destination number according to the feature vector filtered out.
In one embodiment, described that malice Number Reorganization packet is carried out to the destination number according to described eigenvector
It includes:
Determine call behavior pattern corresponding to described eigenvector；
When the determining call behavior pattern belongs to the call behavior pattern of malice number, then
Identify that the destination number is malice number.
In one embodiment, a kind of storage medium for being stored with computer program, the computer program quilt are provided
When one or more processors execute, so that one or more processors execute following steps:
Obtain multiple message registrations including destination number；
Extract corresponding every record information included by the message registration；
Call vector corresponding to the corresponding message registration is generated according to every record information；
The call vector is merged according to the generation timing of corresponding message registration, obtains feature vector；
Malice Number Reorganization is carried out to the destination number according to described eigenvector.
In one embodiment, described to be generated corresponding to the corresponding message registration according to every record information
Call vector include:
The characteristic information for corresponding to default characteristic item is determined according to every record information；
The characteristic information is mapped as vector element；
The vector element is combined to generate vector of conversing corresponding with the message registration.
In one embodiment, described to merge the call vector according to the generation timing of corresponding message registration, it obtains
Include: to feature vector
Different combinations is taken in the call vector corresponding to the multiple message registration；
The call vector of each combination is merged by the generation timing of corresponding message registration, obtains feature vector.
In one embodiment, different combination packets is taken in the call vector corresponding to the multiple message registration
It includes:
The sequence of corresponding multiple call vectors is determined according to the generation timing of multiple message registrations；
From the multiple call vector, preset quantity is taken respectively and the combination of call vector adjacent according to the sequence.
In one embodiment, the call vector by each combination is closed by the generation timing of corresponding message registration
And it obtains feature vector and includes:
The call vector of each combination is merged by the generation timing of corresponding message registration；
Vector element corresponding with default statistical items is determined in each call vector for participating in merging；
The corresponding vector element is counted according to the corresponding statistical of the default statistical items；
In vector after the vector element that statistics obtains to be added to corresponding merge, feature vector is obtained.
In one embodiment, described that malice Number Reorganization packet is carried out to the destination number according to described eigenvector
It includes:
Described eigenvector is clustered as different clustering clusters；
The feature vector for representing corresponding clustering cluster is chosen from the clustering cluster；
Malice Number Reorganization is carried out to the destination number according to the described eigenvector of selection.
In one embodiment, the described eigenvector according to selection carries out the knowledge of malice number to the destination number
Do not include:
Prominence score is carried out to the described eigenvector of selection；
Filter out the feature vector that score value is higher than default scoring threshold value or score value is located at preceding presetting digit capacity；
Malice Number Reorganization is carried out to the destination number according to the feature vector filtered out.
In one embodiment, described that malice Number Reorganization packet is carried out to the destination number according to described eigenvector
It includes:
Determine call behavior pattern corresponding to described eigenvector；
When the determining call behavior pattern belongs to the call behavior pattern of malice number, then
Identify that the destination number is malice number.
Those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method, being can be with
Relevant hardware is instructed to complete by computer program, which can be stored in a computer-readable storage and be situated between
In matter, the program is when being executed, it may include such as the process of the embodiment of above-mentioned each method.Wherein, storage medium above-mentioned can be
The non-volatile memory mediums such as magnetic disk, CD, read-only memory (Read-Only Memory, ROM) or random storage note
Recall body (Random Access Memory, RAM) etc..
Each technical characteristic of above embodiments can be combined arbitrarily, for simplicity of description, not to above-described embodiment
In each technical characteristic it is all possible combination be all described, as long as however, the combination of these technical characteristics be not present lance
Shield all should be considered as described in this specification.
Only several embodiments of the present invention are expressed for above embodiments, and the description thereof is more specific and detailed, but can not
Therefore it is construed as limiting the scope of the patent.It should be pointed out that for those of ordinary skill in the art,
Under the premise of not departing from present inventive concept, various modifications and improvements can be made, and these are all within the scope of protection of the present invention.
Therefore, the scope of protection of the patent of the invention shall be subject to the appended claims.
Claims (15)
1. a kind of malice number identification method, which comprises
Obtain multiple message registrations including destination number；
Extract corresponding every record information included by the message registration；
Call vector corresponding to the corresponding message registration is generated according to every record information；
The call vector is merged according to the generation timing of corresponding message registration, obtains feature vector；
Malice Number Reorganization is carried out to the destination number according to described eigenvector.
2. the method according to claim 1, wherein described generate corresponding institute according to every record information
Stating call vector corresponding to message registration includes:
The characteristic information for corresponding to default characteristic item is determined according to every record information；
The characteristic information is mapped as vector element；
The vector element is combined to generate vector of conversing corresponding with the message registration.
3. the method according to claim 1, wherein it is described by the call vector according to corresponding message registration
Generation timing merge, obtaining feature vector includes:
Different combinations is taken in the call vector corresponding to the multiple message registration；
The call vector of each combination is merged by the generation timing of corresponding message registration, obtains feature vector.
4. according to the method described in claim 3, taking difference in the call vector corresponding to the multiple message registration
Combination include:
The sequence of corresponding multiple call vectors is determined according to the generation timing of multiple message registrations；
From the multiple call vector, preset quantity is taken respectively and the combination of call vector adjacent according to the sequence.
5. according to the method described in claim 3, it is characterized in that, described press corresponding call for each combined call vector
The generation timing of record merges, and obtaining feature vector includes:
The call vector of each combination is merged by the generation timing of corresponding message registration；
Vector element corresponding with default statistical items is determined in each call vector for participating in merging；
The corresponding vector element is counted according to the corresponding statistical of the default statistical items；
In vector after the vector element that statistics obtains to be added to corresponding merge, feature vector is obtained.
6. the method according to claim 1, wherein it is described according to described eigenvector to the destination number into
Row malice Number Reorganization includes:
Described eigenvector is clustered as different clustering clusters；
The feature vector for representing corresponding clustering cluster is chosen from the clustering cluster；
Malice Number Reorganization is carried out to the destination number according to the described eigenvector of selection.
7. according to the method described in claim 6, it is characterized in that, the described eigenvector according to selection is to the target
Number carries out malice Number Reorganization
Prominence score is carried out to the described eigenvector of selection；
Filter out the feature vector that score value is higher than default scoring threshold value or score value is located at preceding presetting digit capacity；
Malice Number Reorganization is carried out to the destination number according to the feature vector filtered out.
8. the method according to any one of claims 1 to 5, which is characterized in that it is described according to described eigenvector to institute
Stating destination number progress malice Number Reorganization includes:
Determine call behavior pattern corresponding to described eigenvector；
When the determining call behavior pattern belongs to the call behavior pattern of malice number, then
Identify that the destination number is malice number.
9. a kind of malice NID number identifier, which is characterized in that described device includes:
Module is obtained, for obtaining multiple message registrations including destination number；
Information extraction modules are recorded, for extracting corresponding every record information included by the message registration；
Call vector generation module is logical corresponding to the corresponding message registration for being generated according to every record information
Talk about vector；
Feature vector generation module is obtained for merging the call vector according to the generation timing of corresponding message registration
Feature vector；
Malice number identification module, for carrying out malice Number Reorganization to the destination number according to described eigenvector.
10. device according to claim 9, which is characterized in that described eigenvector generation module is also used to described more
Different combinations is taken in call vector corresponding to a message registration；Each combined call vector is pressed into corresponding message registration
Generation timing merge, obtain feature vector.
11. device according to claim 10, described eigenvector generation module is also used to according to multiple message registrations
Generate the sequence that timing determines corresponding multiple call vectors；From the multiple call vector, preset quantity is taken respectively and by institute
State the combination of the adjacent call vector of sequence.
12. device according to claim 10, which is characterized in that described eigenvector generation module is also used to each group
The call vector of conjunction is merged by the generation timing of corresponding message registration；It is determined in each call vector for participating in merging
Vector element corresponding with default statistical items；According to the corresponding statistical of the default statistical items by the corresponding element vector
Element is counted；In vector after the vector element that statistics obtains to be added to corresponding merge, feature vector is obtained.
13. device according to claim 9, which is characterized in that the malice number identification module is also used to the spy
Sign vector clusters are different clustering clusters；The feature vector for representing corresponding clustering cluster is chosen from the clustering cluster；According to selection
Described eigenvector to the destination number carry out malice Number Reorganization.
14. a kind of computer equipment, including memory and processor, computer program, the meter are stored in the memory
When calculation machine program is executed by processor, so that the processor executes the step such as any one of claims 1 to 8 the method
Suddenly.
15. a kind of storage medium for being stored with computer program, when the computer program is executed by one or more processors,
So that one or more processors are executed such as the step of any one of claims 1 to 8 the method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710861442.9A CN109547393B (en) | 2017-09-21 | 2017-09-21 | Malicious number identification method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710861442.9A CN109547393B (en) | 2017-09-21 | 2017-09-21 | Malicious number identification method, device, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109547393A true CN109547393A (en) | 2019-03-29 |
| CN109547393B CN109547393B (en) | 2021-04-06 |
Family
ID=65828394
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710861442.9A Active CN109547393B (en) | 2017-09-21 | 2017-09-21 | Malicious number identification method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109547393B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110086943A (en) * | 2019-04-29 | 2019-08-02 | 北京羽乐创新科技有限公司 | Number monitoring method and device |
| CN110113471A (en) * | 2019-04-29 | 2019-08-09 | 北京羽乐创新科技有限公司 | Number monitoring method and device |
| CN110177179A (en) * | 2019-05-16 | 2019-08-27 | 国家计算机网络与信息安全管理中心 | A kind of swindle number identification method based on figure insertion |
| CN111884821A (en) * | 2020-03-27 | 2020-11-03 | 马洪涛 | Ticket data processing and displaying method and device and electronic equipment |
| CN114374769A (en) * | 2021-12-01 | 2022-04-19 | 恒安嘉新（北京）科技股份公司 | Abnormal number acquisition method, abnormal number acquisition device, server and storage medium |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130097706A1 (en) * | 2011-09-16 | 2013-04-18 | Veracode, Inc. | Automated behavioral and static analysis using an instrumented sandbox and machine learning classification for mobile security |
| CN103632091A (en) * | 2012-08-21 | 2014-03-12 | 腾讯科技（深圳）有限公司 | Malicious feature extraction method and device and storage media |
| CN104113466A (en) * | 2013-04-17 | 2014-10-22 | 腾讯科技（深圳）有限公司 | Harassing phone call identification method, client, server and system |
| CN104159229A (en) * | 2013-05-15 | 2014-11-19 | 腾讯科技（深圳）有限公司 | Incoming call processing method and apparatus |
| CN104735671A (en) * | 2015-02-27 | 2015-06-24 | 腾讯科技（深圳）有限公司 | Malicious call recognition method and device |
| CN105320885A (en) * | 2014-06-04 | 2016-02-10 | 腾讯科技（深圳）有限公司 | Method and device for detecting malicious website |
| CN106255116A (en) * | 2016-08-24 | 2016-12-21 | 王瀚辰 | A kind of recognition methods harassing number |
| US20170111506A1 (en) * | 2015-10-14 | 2017-04-20 | Pindrop Security, Inc. | Fraud detection in interactive voice response systems |
| CN106686210A (en) * | 2016-11-22 | 2017-05-17 | 腾讯科技（深圳）有限公司 | Incoming call processing method, apparatus and system thereof |
-
2017
- 2017-09-21 CN CN201710861442.9A patent/CN109547393B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130097706A1 (en) * | 2011-09-16 | 2013-04-18 | Veracode, Inc. | Automated behavioral and static analysis using an instrumented sandbox and machine learning classification for mobile security |
| CN103632091A (en) * | 2012-08-21 | 2014-03-12 | 腾讯科技（深圳）有限公司 | Malicious feature extraction method and device and storage media |
| CN104113466A (en) * | 2013-04-17 | 2014-10-22 | 腾讯科技（深圳）有限公司 | Harassing phone call identification method, client, server and system |
| CN104159229A (en) * | 2013-05-15 | 2014-11-19 | 腾讯科技（深圳）有限公司 | Incoming call processing method and apparatus |
| CN105320885A (en) * | 2014-06-04 | 2016-02-10 | 腾讯科技（深圳）有限公司 | Method and device for detecting malicious website |
| CN104735671A (en) * | 2015-02-27 | 2015-06-24 | 腾讯科技（深圳）有限公司 | Malicious call recognition method and device |
| US20170111506A1 (en) * | 2015-10-14 | 2017-04-20 | Pindrop Security, Inc. | Fraud detection in interactive voice response systems |
| CN106255116A (en) * | 2016-08-24 | 2016-12-21 | 王瀚辰 | A kind of recognition methods harassing number |
| CN106686210A (en) * | 2016-11-22 | 2017-05-17 | 腾讯科技（深圳）有限公司 | Incoming call processing method, apparatus and system thereof |
Non-Patent Citations (1)
| Title |
|---|
| 张一乾: "电信反欺诈相关技术研究", 《中国优秀硕士学位论文全文数据库信息科技辑》 * |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110086943A (en) * | 2019-04-29 | 2019-08-02 | 北京羽乐创新科技有限公司 | Number monitoring method and device |
| CN110113471A (en) * | 2019-04-29 | 2019-08-09 | 北京羽乐创新科技有限公司 | Number monitoring method and device |
| CN110177179A (en) * | 2019-05-16 | 2019-08-27 | 国家计算机网络与信息安全管理中心 | A kind of swindle number identification method based on figure insertion |
| CN111884821A (en) * | 2020-03-27 | 2020-11-03 | 马洪涛 | Ticket data processing and displaying method and device and electronic equipment |
| CN111884821B (en) * | 2020-03-27 | 2022-04-29 | 马洪涛 | Ticket data processing and displaying method and device and electronic equipment |
| CN114374769A (en) * | 2021-12-01 | 2022-04-19 | 恒安嘉新（北京）科技股份公司 | Abnormal number acquisition method, abnormal number acquisition device, server and storage medium |
| CN114374769B (en) * | 2021-12-01 | 2024-07-19 | 恒安嘉新（北京）科技股份公司 | Abnormal number acquisition method and device, server and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109547393B (en) | 2021-04-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109547393A (en) | Malice number identification method, device, equipment and storage medium | |
| US11748463B2 (en) | Fraud detection in interactive voice response systems | |
| CN110072017A (en) | Abnormal phone recognition methods and system based on feature selecting and integrated study | |
| CN110417607B (en) | Flow prediction method, device and equipment | |
| CN102083010B (en) | Method and equipment for screening user information | |
| CN108462785B (en) | Method and device for processing malicious call | |
| CN110147469A (en) | A kind of data processing method, equipment and storage medium | |
| CN108243191B (en) | Risk behavior recognition methods, storage medium, equipment and system | |
| CN109474756B (en) | Telecommunication anomaly detection method based on collaborative network representation learning | |
| CN113961712B (en) | Knowledge-graph-based fraud telephone analysis method | |
| CN105281925A (en) | Network service user group dividing method and device | |
| CN108513313A (en) | One germplasm difference cell determining method and equipment | |
| CN109471853A (en) | Data noise reduction, device, computer equipment and storage medium | |
| CN110245696A (en) | Illegal incidents monitoring method, equipment and readable storage medium storing program for executing based on video | |
| CN106933927B (en) | Data table connection method and device | |
| CN107657286A (en) | A kind of advertisement recognition method and computer-readable recording medium | |
| CN101741974A (en) | Terminal and method for counting utilization rate of loadable module of terminal | |
| CN106056137B (en) | A kind of business recommended method of telecommunications group based on data mining multi-classification algorithm | |
| CN113283351B (en) | Video plagiarism detection method using CNN optimization similarity matrix | |
| CN112351429B (en) | Harmful information detection method and system based on deep learning | |
| CN104915355B (en) | A kind of user classification method, device and server | |
| CN100405870C (en) | System for collecting and using user characteristic data to identify user, and method thereof | |
| CN106933934B (en) | Data table connection method and device | |
| CN208656882U (en) | Call center's traffic administration system | |
| CN114064445A (en) | Test method, device, equipment and computer readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |