CN110222992A - A kind of network swindle method for early warning and device based on group's portrait of being deceived - Google Patents
A kind of network swindle method for early warning and device based on group's portrait of being deceived Download PDFInfo
- Publication number
- CN110222992A CN110222992A CN201910500870.8A CN201910500870A CN110222992A CN 110222992 A CN110222992 A CN 110222992A CN 201910500870 A CN201910500870 A CN 201910500870A CN 110222992 A CN110222992 A CN 110222992A
- Authority
- CN
- China
- Prior art keywords
- network
- early
- swindle
- deceived
- warning
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 40
- 238000012549 training Methods 0.000 claims abstract description 50
- 238000012360 testing method Methods 0.000 claims abstract description 40
- 239000000284 extract Substances 0.000 claims abstract description 10
- 230000015654 memory Effects 0.000 claims description 25
- 238000004590 computer program Methods 0.000 claims description 12
- 238000000605 extraction Methods 0.000 claims description 12
- 238000011156 evaluation Methods 0.000 claims description 8
- 238000010276 construction Methods 0.000 claims description 4
- 238000004891 communication Methods 0.000 claims description 3
- 238000005192 partition Methods 0.000 claims description 3
- 238000012545 processing Methods 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 3
- 230000006870 function Effects 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 238000002790 cross-validation Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 235000013399 edible fruits Nutrition 0.000 description 2
- 230000005611 electricity Effects 0.000 description 2
- 239000004615 ingredient Substances 0.000 description 2
- 210000000056 organ Anatomy 0.000 description 2
- 239000013589 supplement Substances 0.000 description 2
- 230000009469 supplementation Effects 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000000151 deposition Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 238000006073 displacement reaction Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000010365 information processing Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 238000004900 laundering Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- ZRHANBBTXQZFSP-UHFFFAOYSA-M potassium;4-amino-3,5,6-trichloropyridine-2-carboxylate Chemical compound [K+].NC1=C(Cl)C(Cl)=NC(C([O-])=O)=C1Cl ZRHANBBTXQZFSP-UHFFFAOYSA-M 0.000 description 1
- 238000004579 scanning voltage microscopy Methods 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000012706 support-vector machine Methods 0.000 description 1
- 208000011580 syndromic disease Diseases 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Systems or methods specially adapted for specific business sectors, e.g. utilities or tourism
- G06Q50/10—Services
- G06Q50/26—Government or public services
-
- G06Q50/40—
Abstract
The invention discloses a kind of network swindle method for early warning and device based on group's portrait of being deceived, and method includes: to obtain network fraud case merit sample, extract in network swindle case by deceitful information；It will treated is divided into test feature and training characteristics by deceitful information；It constructs initial network and swindles Early-warning Model, initial network swindle Early-warning Model is trained according to training characteristics, and verifying assessment is carried out to initial network swindle Early-warning Model according to test feature；After detecting that verifying assessment result meets preset requirement, generates target network and swindle model；The personal information for obtaining user swindles whether model prediction user is deceived according to target network, is deceived if predicting user, generates swindle early warning.The present invention swindles Early-warning Model by analyzing the target network that generated by deceitful information that a large amount of existing network is swindled in case, and target network swindles Early-warning Model and carries out early warning to the situation of being deceived of ordinary user, and effectively prevents the financial losses of user.
Description
Technical field
The present invention relates to technical field of network security more particularly to a kind of network based on group's portrait of being deceived to swindle early warning
Method and device.
Background technique
With the fast development of computer network and mobile communication, personal computer, smart phone and other with upper
The mobile device of net function has become people and lives and indispensable tool in work, but the network security problem of behind
Increasingly severe, network swindle is exactly one of.Currently, network swindle has become the main danger of people's economy and property loss
Evil mode.The a variety of imperial examinations of means of network swindle, swindle molecule is by Email, SMS, phone, wechat etc. to killed
Person sends the content containing fraud information, such as the link containing wooden horse, suspicious account even deceptive information data, has big
The masses of amount are deceived.
Network fraud analysis method in the prior art is generally by determining whether suspicious information is fraud information, in turn
User is prompted, user is prevented to be deceived.But determine whether suspicious information is network fraud information, needs to sentence one by one
Disconnected, heavy workload, it is low that the network in real life swindles detection efficiency.
Therefore, the existing technology needs to be improved and developed.
Summary of the invention
In view of above-mentioned deficiencies of the prior art, the purpose of the present invention is to provide a kind of networks based on group's portrait of being deceived
Swindle method for early warning and device, it is intended to solve in the prior art network fraud analysis method generally by determining that suspicious information is
No is fraud information, and then prompts user, and user is prevented to be deceived.But determine whether suspicious information is network fraud information,
It needs to judge one by one, heavy workload, the low problem of the network swindle detection efficiency in real life.
Technical scheme is as follows:
A kind of network swindle method for early warning based on group's portrait of being deceived, which comprises
Network fraud case merit sample is obtained, after handling merit sample, extracts being deceived in network swindle case
People's information；
It, will treated is divided into test feature and training characteristics by deceitful information after being handled by deceitful information；
It constructs initial network and swindles Early-warning Model, initial network swindle Early-warning Model is trained according to training characteristics,
And verifying assessment is carried out to initial network swindle Early-warning Model according to test feature；
Verifying assessment result is obtained, after detecting that verifying assessment result meets preset requirement, generates target network swindleness
Deceive model；
The personal information for obtaining user swindles whether model prediction user is deceived according to target network, if predicting user
It is deceived, then generates swindle early warning.
Optionally, the acquisition network fraud case merit sample after handling merit sample, extracts network fraud case
In part by deceitful information, comprising:
Network fraud case merit sample is obtained, participle, the stop words of network fraud case merit sample are removed, extracts network swindleness
Deceive the keyword of case merit sample；
According in keyword extraction network fraud case by deceitful information.
Optionally, described pair handled by deceitful information after, will treated is divided into test feature by deceitful information
And training characteristics, comprising:
Acquisition is pre-processed by deceitful information, will is test data and instruction according to preset ratio cut partition by deceitful information
Practice data；
Test data and training data are carried out to feature extraction respectively and Feature Selection operation generates corresponding test feature
And training characteristics.
Optionally, the construction initial network swindles Early-warning Model, swindles early warning mould to initial network according to training characteristics
Type is trained, and carries out verifying assessment to initial network swindle Early-warning Model according to test feature, comprising:
Smart network's model is constructed as initial network and swindles Early-warning Model；
Training characteristics are obtained, initial network swindle Early-warning Model is trained according to training characteristics；
Initial network swindle Early-warning Model is tested according to test feature；
Verifying assessment is carried out to initial network swindle Early-warning Model using evaluation index according to test result.
Optionally, assessment result is verified in the acquisition, after detecting that verifying assessment result meets preset requirement, is generated
Target network swindles model, comprising:
Verifying assessment result is obtained, judges to verify whether assessment result meets preset requirement；
If verifying assessment result meets preset requirement, the initial network swindle Early-warning Model after current training is made
Model is swindled for target network；
If verifying assessment result is unsatisfactory for preset requirement, the initial network after training is cheated according to training characteristics again
It deceives Early-warning Model to be trained, after verifying assessment result meets preset requirement, then initial network is swindled into Early-warning Model
Model is swindled as target network.
Optionally, the personal information for obtaining user swindles whether model prediction user is deceived according to target network, if
It predicts user to be deceived, then generates swindle early warning, comprising:
The personal information for obtaining user carries out data prediction to the personal information of user, and to pretreated personal letter
Breath carries out feature extraction and Feature Selection operation, generates personal information feature；
Personal information feature input target network is swindled into Early-warning Model, obtains target network swindle Early-warning Model output knot
Fruit；
If target network swindle Early-warning Model prediction user is deceived, swindle early warning is generated.
Optionally, preset to require to be accuracy > 0.9 if the evaluation index is accuracy and precision, accurately
Degree > 0.6.
Further embodiment of this invention additionally provides a kind of network swindle prior-warning device based on group's portrait of being deceived, the dress
It sets including at least one processor；And
The memory being connect at least one described processor communication；Wherein,
The memory is stored with the instruction that can be executed by least one described processor, and described instruction is by described at least one
A processor executes, so that at least one described processor is able to carry out the above-mentioned network swindle based on group's portrait of being deceived in advance
Alarm method.
Another embodiment of the present invention additionally provides a kind of non-volatile computer readable storage medium storing program for executing, described non-volatile
Computer-readable recording medium storage has computer executable instructions, and the computer executable instructions are by one or more processors
When execution, one or more of processors may make to execute the above-mentioned network based on group's portrait of being deceived and swindle the pre- police
Method.
Another embodiment of the invention provides a kind of computer program product, and the computer program product includes depositing
The computer program on non-volatile computer readable storage medium storing program for executing is stored up, the computer program includes program instruction, works as institute
When stating program instruction and being executed by processor, so that the processor is executed the above-mentioned network based on group's portrait of being deceived and swindle early warning
Method.
The utility model has the advantages that the invention discloses a kind of networks based on group's portrait of being deceived to swindle method for early warning and device, phase
Than in the prior art, the embodiment of the present invention swindles case by analyzing a large amount of existing network, swindled in case according to network
By deceitful information generate target network swindle Early-warning Model, target network swindle Early-warning Model to ordinary user be deceived situation into
Row early warning effectively prevents the financial losses of user.
Detailed description of the invention
Present invention will be further explained below with reference to the attached drawings and examples, in attached drawing:
Fig. 1 is the flow chart that a kind of network based on group's portrait of being deceived of the present invention swindles method for early warning preferred embodiment；
Fig. 2 is the hardware configuration that a kind of network based on group's portrait of being deceived of the present invention swindles prior-warning device preferred embodiment
Schematic diagram.
Specific embodiment
To make the purpose of the present invention, technical solution and effect clearer, clear and definite, below to the present invention further specifically
It is bright.It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, it is not intended to limit the present invention.Below
The embodiment of the present invention is introduced in conjunction with attached drawing.
Referring to Fig. 1, Fig. 1 is that a kind of network based on group's portrait of being deceived of the present invention swindles method for early warning preferred embodiment
Flow chart.As shown in Figure 1, itself comprising steps of
Step S100, network fraud case merit sample is obtained, after handling merit sample, network is extracted and swindles case
In by deceitful information；
Step S200, after to being handled by deceitful information, will treated by deceitful information be divided into test feature and
Training characteristics；
Step S300, construction initial network swindles Early-warning Model, swindles Early-warning Model to initial network according to training characteristics
It is trained, and verifying assessment is carried out to initial network swindle Early-warning Model according to test feature；
Step S400, verifying assessment result is obtained, after detecting that verifying assessment result meets preset requirement, generates mesh
It marks network and swindles model；
Step S500, the personal information for obtaining user swindles whether model prediction user is deceived according to target network, if in advance
It measures user to be deceived, then generates swindle early warning.
When it is implemented, needing to collect a large amount of network fraud case merit sample in the embodiment of the present invention in advance, in order to protect
The accuracy of model of a syndrome, network fraud case merit sample are no less than 5000 network swindle case samples.There is new net subsequent
After network swindles case, new network can be swindled case and be added in network fraud case merit sample.
After obtaining a large amount of network fraud case merit sample, propose from sample by deceitful information, by deceitful packet
Include but be limited to by deceitful name, the age, address, gender, occupation, program of receiving an education, by swindle way etc..
The human information processing of being deceived that will acquire at the test feature and training characteristics that can be carried out model training, use by training characteristics
It is trained in initial network swindle Early-warning Model, and test feature is used to survey initial network swindle Early-warning Model
Examination.And verifying assessment is carried out to test result, meet preset requirement when verifying assessment result, illustrates current initial network swindle
Model can be used as target network swindle model.
According to target network swindle model to the personal information of the user not occurred in network fraud case merit sample into
Row prediction generates swindle early warning if prediction user is deceived.Generating swindle warning information can be transmitted to user, to mention for user
For being vigilant, financial loss is prevented.
In further carrying out example, network fraud case merit sample is obtained, after handling merit sample, extracts net
Network swindle case in by deceitful information, comprising:
Network fraud case merit sample is obtained, participle, the stop words of network fraud case merit sample are removed, extracts network swindleness
Deceive the keyword of case merit sample；
According in keyword extraction network fraud case by deceitful information.
When it is implemented, obtaining network fraud case merit sample, network fraud case merit sample generally uses textual form.
If network fraud case merit sample is picture mode, image processing algorithm is used, picture is identified, text shape is identified as
Formula.The network fraud case merit sample of textual form is segmented, stop words processing, is removed in network fraud case merit sample
Participle and stop words, to obtain each sentence trunk ingredient of network fraud case, trunk ingredient is mainly the notional word portion in sentence
Point.It is carried out later by deceitful information extraction.For example, that extracts is as follows by deceitful information: Zhang San, 26 years old, the area XX, the city XX, XX province,
Male, programmer, undergraduate course, by swindle way: pretending to be public security organs' swindle, (offender pretends to be public security organs staff to dial Zhang San's electricity
Words are accused of crime of laundering and serve as reasons, it is desirable that its fund is transferred to national account cooperation investigation so that its identity information is stolen).
Further, after to being handled by deceitful information, will treated by deceitful information be divided into test feature and
Training characteristics, comprising:
Acquisition is pre-processed by deceitful information, will is test data and instruction according to preset ratio cut partition by deceitful information
Practice data；
Test data and training data are carried out to feature extraction respectively and Feature Selection operation generates corresponding test feature
And training characteristics.
When it is implemented, pre-processed to by deceitful information, mainly will by blank in deceitful information, exception information into
Row is deleted, and carries out supplement process to the information required supplementation with.Then it is used to test data two parts are divided by deceitful information
It constructs initial network and swindles Early-warning Model.Preferably, preset ratio is 2:8, i.e., will be by 20% data in deceitful information
As test data, training data will be used as by 80% in deceitful information.
Feature Engineering processing is carried out to test data and training data, generates test feature and training characteristics.Feature Engineering
It is the data that cannot be used for calculating to be carried out characterization and screen several groups of features maximum to model.Specifically, feature work
Journey is divided into two parts: first is that feature extraction is carrying out model training and test since text information cannot be directly used to calculate
When first have to test and training dataset be quantified as feature vector；Second is that Feature Selection, since the feature of redundancy will not be right
Model training has more contributions, also will increase the calculating pressure of CPU, and undesirable feature can also reduce the accurate of model prediction
Degree.The characteristic set for embodying model optimum performance can be found using the method for Feature Selection device and cross validation.
Further, construction initial network swindles Early-warning Model, swindles Early-warning Model to initial network according to training characteristics
It is trained, and verifying assessment is carried out to initial network swindle Early-warning Model according to test feature, comprising:
Smart network's model is constructed as initial network and swindles Early-warning Model；
Training characteristics are obtained, initial network swindle Early-warning Model is trained according to training characteristics；
Initial network swindle Early-warning Model is tested according to test feature；
Verifying assessment is carried out to initial network swindle Early-warning Model using evaluation index according to test result.
When it is implemented, selecting smart network's model to swindle Early-warning Model as initial network, wherein manually
Intelligent network model includes but is not limited to SVM, support vector machines, decision tree, neural network and integrated model.It is generated before obtaining
Training characteristics, by training characteristics input initial network swindle Early-warning Model be trained, obtain training complete initial network
Early-warning Model is swindled, input test feature is tested in the initial network swindle Early-warning Model that training is completed, according to test
As a result verifying assessment is carried out to the initial network swindle model that training is completed using evaluation index.Evaluation index includes but is not limited to
Accuracy, accuracy, recall rate and PRC.Wherein PRC refers to that (Precision Recall Cross, Chinese translation are accuracy
Accuracy cross validation)
Further, verifying assessment result is obtained, after detecting that verifying assessment result meets preset requirement, generates mesh
It marks network and swindles model, comprising:
Verifying assessment result is obtained, judges to verify whether assessment result meets preset requirement；
If verifying assessment result meets preset requirement, the initial network swindle Early-warning Model after current training is made
Model is swindled for target network；
If verifying assessment result is unsatisfactory for preset requirement, the initial network after training is cheated according to training characteristics again
It deceives Early-warning Model to be trained, after verifying assessment result meets preset requirement, then initial network is swindled into Early-warning Model
Model is swindled as target network.
When it is implemented, if preset requirement is accuracy > 0.9, accurately when evaluation index is accuracy and precision
Degree > 0.6.Accuracy (Recall) refers to that correctly predicted being deceived is with number/sum of not being deceived, accuracy (Precision)
Refer to correctly predicted number of being deceived/be predicted as the sum be deceived.Accuracy and precision is the measurement of conflict, when a side is high
Another can be relatively low, and the network swindle Early-warning Model in the application requires as much as possible predict by deceiving people, so can sacrifice
Some accuracy exchange higher accuracy for, so the index request of model is, set reasonable accuracy threshold (such as
0.6) and in the case where accuracy threshold value (0.9), the higher model of accuracy is selected.
If verifying assessment result meets accuracy > 0.9, accuracy > 0.6 then will be first after the current training met the requirements
Beginning network swindles Early-warning Model as target network and swindles model；
If verifying assessment result is unsatisfactory for accuracy > 0.9, accuracy > 0.6 then continues to swindle early warning mould to initial network
Type is trained, after verifying assessment result meets preset requirement, then using initial network swindle Early-warning Model as target
Network swindles model.
Further, the personal information for obtaining user swindles whether model prediction user is deceived according to target network, if in advance
It measures user to be deceived, then generates swindle early warning, comprising:
The personal information for obtaining user carries out data prediction to the personal information of user, and to pretreated personal letter
Breath carries out feature extraction and Feature Selection operation, generates personal information feature；
Personal information feature input target network is swindled into Early-warning Model, obtains target network swindle Early-warning Model output knot
Fruit；
If target network swindle Early-warning Model prediction user is deceived, swindle early warning is generated.
When it is implemented, obtaining the personal information of user to be predicted, the personal information of user is subjected to data prediction,
Blank, exception information in personal information are deleted by deceitful information mostly in reference to pretreated, and to requiring supplementation with
Information carry out supplement process after, carry out feature extraction and Feature Selection operation, generate for input target network swindle early warning
The personal information feature of model；
By personal information feature input target network swindle Early-warning Model, target network swindle Early-warning Model output as a result,
It as a result is to be deceived and be not deceived two kinds.
If target network swindle Early-warning Model prediction user is deceived, swindle early warning is generated, prompts the user that may be deceived,
Pay attention to data relevant to finance on network.
Another embodiment of the present invention provides a kind of networks based on group's portrait of being deceived to swindle prior-warning device, as shown in Fig. 2,
Device 10 includes:
One or more processors 110 and memory 120 are introduced in Fig. 2 by taking a processor 110 as an example, are located
Reason device 110 can be connected with memory 120 by bus or other modes, in Fig. 2 for being connected by bus.
Processor 110 is used for the various control logics of finishing device 10, can be general processor, Digital Signal Processing
Device (DSP), specific integrated circuit (ASIC), field programmable gate array (FPGA), single-chip microcontroller, ARM (Acorn RISC
) or other programmable logic device, discrete gate or transistor logic, discrete hardware component or these components Machine
Any combination.In addition, processor 110 can also be any conventional processors, microprocessor or state machine.Processor 110 can also
To be implemented as calculating the combination of equipment, for example, the combination of DSP and microprocessor, multi-microprocessor, one or more micro- places
Manage device combination DSP core or any other this configuration.
Memory 120 is used as a kind of non-volatile computer readable storage medium storing program for executing, can be used for storing non-volatile software journey
Sequence, non-volatile computer executable program and module, such as the network based on group's portrait of being deceived in the embodiment of the present invention
Swindle the corresponding program instruction of method for early warning.The non-volatile software journey that processor 110 is stored in memory 120 by operation
Sequence, instruction and unit, thereby executing the various function application and data processing of device 10, i.e. realization above method embodiment
In based on be deceived group portrait network swindle method for early warning.
Memory 120 may include storing program area and storage data area, wherein storing program area can store operation dress
It sets, application program required at least one function；Storage data area, which can be stored, uses created data etc. according to device 10.
It can also include nonvolatile memory in addition, memory 120 may include high-speed random access memory, for example, at least one
A disk memory, flush memory device or other non-volatile solid state memory parts.In some embodiments, memory 120 can
Choosing includes the memory remotely located relative to processor 110, these remote memories can pass through network connection to device 10.
The example of above-mentioned network includes but is not limited to internet, intranet, local area network, mobile radio communication and combinations thereof.
One or more unit is stored in memory 120, when being executed by one or more processor 110, is held
The network based on group's portrait of being deceived in the above-mentioned any means embodiment of row swindles method for early warning, for example, executing above description
Fig. 1 in method and step S100 to step S500.
The embodiment of the invention provides a kind of non-volatile computer readable storage medium storing program for executing, computer readable storage medium is deposited
Computer executable instructions are contained, which is executed by one or more processors, for example, executing above retouch
Method and step S100 to step S500 in the Fig. 1 stated.
As an example, non-volatile memory medium can include that read-only memory (ROM), programming ROM (PROM), electricity can
Programming ROM (EPROM), electrically erasable ROM (EEPROM) or flash memory.Volatile memory can include as external high speed
The random access memory (RAM) of buffer memory.By illustrate it is beautiful unrestricted, RAM can with such as synchronous random access memory (SRAM),
Dynamic ram, (DRAM), synchronous dram (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM
(ESDRAM), many forms of Synchlink DRAM (SLDRAM) and directly Rambus (Lan Basi) RAM (DRRAM) etc
It obtains.The disclosed memory assembly or memory of operating environment described herein be intended to include these and/or it is any
Other are suitble to one or more of the memory of type.
Another embodiment of the invention provides a kind of computer program product, and computer program product includes being stored in
Computer program on non-volatile computer readable storage medium storing program for executing, computer program include program instruction, when program instruction quilt
When processor executes, the network based on group's portrait of being deceived for making the processor execute above method embodiment swindles the pre- police
Method.For example, executing the method and step S100 to step S500 in Fig. 1 described above.
Embodiments described above is only schematical, wherein as illustrated by the separation member unit can be or
It may not be and be physically separated, component shown as a unit may or may not be physical unit, it can
It is in one place, or may be distributed over multiple network units.Can select according to actual needs part therein or
Person's whole module achieves the purpose of the solution of this embodiment.
By the description of above embodiment, those skilled in the art can be understood that each embodiment can be by
Software adds the mode of general hardware platform to realize, naturally it is also possible to pass through hardware realization.Based on this understanding, above-mentioned technology
Scheme substantially in other words can be embodied in the form of software products the part that the relevant technologies contribute, the computer
Software product can reside in computer readable storage medium, such as ROM/RAM, magnetic disk, CD, including some instructions to
So that a computer electronic equipment (can be personal computer, server or network electronic devices etc.) executes each reality
The method for applying certain parts of example or embodiment.
Among other things, such as " can ', " energy ", " possibility " or " can be with " etc conditional statement unless in addition specific
Ground is stated or is otherwise understood in context as used, is otherwise generally intended to convey particular implementation energy
Including (however other embodiments do not include) special characteristic, element and/or operation.Therefore, such conditional statement is generally
It is not intended to imply that feature, element and/or operation are all needed one or more embodiments or one anyway
Or multiple embodiments must include for determining these features, element in the case where being with or without student's input or prompt
And/or the logic whether operation is included or will be performed in any particular implementation.
The content described in the present description and drawings herein includes being capable of providing based on group's portrait of being deceived
Network swindle method for early warning and device example.Certainly, it can not be retouched for the purpose of the various features of the description disclosure
The combination that each of element and/or method are envisioned that is stated, it can be appreciated that, many other groups of disclosed feature
It closes and displacement is possible., it will thus be apparent that without departing from the scope or spirit of the present disclosure can be to this
It is open to make various modifications.In addition, or in alternative solution, the other embodiments of the disclosure are examined to the specification and drawings
It may be obvious in worry and the practice of the disclosure as presented herein.It is intended that in the specification and drawings
The example proposed is considered illustrative and not restrictive in all respects.Although using specific art herein
Language, but they are used and are not used in the purpose of limitation in general and descriptive sense.
Claims (10)
1. a kind of network based on group's portrait of being deceived swindles method for early warning, it is characterised in that, the described method includes:
Obtain network fraud case merit sample, after handling merit sample, extract network swindle case in by deceitful letter
Breath；
It, will treated is divided into test feature and training characteristics by deceitful information after being handled by deceitful information；
It constructs initial network and swindles Early-warning Model, initial network swindle Early-warning Model is trained according to training characteristics, and root
Verifying assessment is carried out to initial network swindle Early-warning Model according to test feature；
Verifying assessment result is obtained, after detecting that verifying assessment result meets preset requirement, target network is generated and swindles mould
Type；
The personal information for obtaining user swindles whether model prediction user is deceived according to target network, is deceived if predicting user,
Then generate swindle early warning.
2. the network according to claim 1 based on group's portrait of being deceived swindles method for early warning, which is characterized in that described to obtain
Take network fraud case merit sample, after handling merit sample, extract in network swindle case by deceitful information, packet
It includes:
Network fraud case merit sample is obtained, participle, the stop words of network fraud case merit sample are removed, extracts network fraud case
The keyword of merit sample；
According in keyword extraction network fraud case by deceitful information.
3. according to claim 1 based on be deceived group portrait network swindle method for early warning, which is characterized in that described pair by
It, will treated is divided into test feature and training characteristics by deceitful information after deceitful information is handled, comprising:
Acquisition is pre-processed by deceitful information, will is test data and training number according to preset ratio cut partition by deceitful information
According to；
Test data and training data are carried out to feature extraction respectively and Feature Selection operation generates corresponding test feature and instruction
Practice feature.
4. the network according to claim 3 based on group's portrait of being deceived swindles method for early warning, which is characterized in that the construction
Initial network swindles Early-warning Model, is trained according to training characteristics to initial network swindle Early-warning Model, and special according to test
Sign carries out verifying assessment to initial network swindle Early-warning Model, comprising:
Smart network's model is constructed as initial network and swindles Early-warning Model；
Training characteristics are obtained, initial network swindle Early-warning Model is trained according to training characteristics；
Initial network swindle Early-warning Model is tested according to test feature；
Verifying assessment is carried out to initial network swindle Early-warning Model using evaluation index according to test result.
5. the network according to claim 1 based on group's portrait of being deceived swindles method for early warning, which is characterized in that described to obtain
Verifying assessment result is taken, after detecting that verifying assessment result meets preset requirement, target network is generated and swindles model, packet
It includes:
Verifying assessment result is obtained, judges to verify whether assessment result meets preset requirement；
If verifying assessment result meets preset requirement, using the initial network swindle Early-warning Model after current training as mesh
It marks network and swindles model；
If verifying assessment result is unsatisfactory for preset requirement, the initial network after training is swindled according to training characteristics again pre-
Alert model is trained, after verifying assessment result meets preset requirement, then using initial network swindle Early-warning Model as
Target network swindles model.
6. the network according to claim 1 based on group's portrait of being deceived swindles method for early warning, which is characterized in that described to obtain
The personal information for taking family swindles whether model prediction user is deceived according to target network, is deceived, generates if predicting user
Swindle early warning, comprising:
The personal information for obtaining user carries out data prediction to the personal information of user, and to pretreated personal information into
Row feature extraction and Feature Selection operation, generate personal information feature；
Personal information feature input target network is swindled into Early-warning Model, target network swindle Early-warning Model is obtained and exports result；
If target network swindle Early-warning Model prediction user is deceived, swindle early warning is generated.
7. the network according to claim 5 based on group's portrait of being deceived swindles method for early warning, which is characterized in that if described
It is when evaluation index is accuracy and precision, then preset to require to be accuracy > 0.9, accuracy > 0.6.
8. a kind of network based on group's portrait of being deceived swindles prior-warning device, which is characterized in that described device includes at least one
Processor；And
The memory being connect at least one described processor communication；Wherein,
The memory is stored with the instruction that can be executed by least one described processor, and described instruction is by described at least one
It manages device to execute, so that at least one described processor is able to carry out, claim 1-7 is described in any item to be drawn based on the group that is deceived
The network of picture swindles method for early warning.
9. a kind of non-volatile computer readable storage medium storing program for executing, which is characterized in that the non-volatile computer readable storage medium
Matter is stored with computer executable instructions, when which is executed by one or more processors, may make institute
It states the described in any item networks based on group's portrait of being deceived of one or more processors perform claim requirement 1-7 and swindles the pre- police
Method.
10. a kind of computer program product, which is characterized in that the computer program product includes being stored in non-volatile calculating
Computer program on machine readable storage medium storing program for executing, the computer program include program instruction, when described program instruction is processed
When device executes, making the processor perform claim require 1-7 described in any item, the network swindle based on group's portrait of being deceived is pre-
Alarm method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910500870.8A CN110222992A (en) | 2019-06-11 | 2019-06-11 | A kind of network swindle method for early warning and device based on group's portrait of being deceived |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910500870.8A CN110222992A (en) | 2019-06-11 | 2019-06-11 | A kind of network swindle method for early warning and device based on group's portrait of being deceived |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110222992A true CN110222992A (en) | 2019-09-10 |
Family
ID=67816464
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910500870.8A Pending CN110222992A (en) | 2019-06-11 | 2019-06-11 | A kind of network swindle method for early warning and device based on group's portrait of being deceived |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110222992A (en) |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110619527A (en) * | 2019-09-27 | 2019-12-27 | 中国银行股份有限公司 | Fraud early warning information generation method and device |
| CN112579864A (en) * | 2020-12-25 | 2021-03-30 | 北京明朝万达科技股份有限公司 | Anti-fraud processing method and device |
| CN112669187A (en) * | 2020-12-31 | 2021-04-16 | 深圳云天励飞技术股份有限公司 | Identity recognition method and device, electronic equipment and related products |
| CN112818249A (en) * | 2021-03-04 | 2021-05-18 | 中南大学 | Multi-dimensional image construction method and system for crowd with specific tendency |
| CN112887985A (en) * | 2021-02-23 | 2021-06-01 | 深圳市安络科技有限公司 | Method, device and equipment for early warning telecommunication fraud |
| CN113630495A (en) * | 2020-05-07 | 2021-11-09 | 中国电信股份有限公司 | Training method and device for fraud-related order prediction model and order prediction method and device |
| CN114581219A (en) * | 2022-04-29 | 2022-06-03 | 弘沣智安科技(北京)有限公司 | Anti-telecommunication network fraud early warning method and system |
| CN115689298A (en) * | 2022-12-30 | 2023-02-03 | 北京码牛科技股份有限公司 | Telecommunication fraud risk prediction method, system, equipment and readable storage medium |
| CN117614743A (en) * | 2024-01-22 | 2024-02-27 | 北京中科网芯科技有限公司 | Phishing early warning method and system thereof |
| CN117614743B (en) * | 2024-01-22 | 2024-04-12 | 北京中科网芯科技有限公司 | Phishing early warning method and system thereof |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109429230A (en) * | 2017-08-28 | 2019-03-05 | 中国移动通信集团浙江有限公司 | A kind of communication swindle recognition methods and system |
| CN109447180A (en) * | 2018-11-14 | 2019-03-08 | 山东省通信管理局 | A kind of fooled people's discovery method of the telecommunication fraud based on big data and machine learning |
-
2019
- 2019-06-11 CN CN201910500870.8A patent/CN110222992A/en active Pending
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109429230A (en) * | 2017-08-28 | 2019-03-05 | 中国移动通信集团浙江有限公司 | A kind of communication swindle recognition methods and system |
| CN109447180A (en) * | 2018-11-14 | 2019-03-08 | 山东省通信管理局 | A kind of fooled people's discovery method of the telecommunication fraud based on big data and machine learning |
Cited By (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110619527A (en) * | 2019-09-27 | 2019-12-27 | 中国银行股份有限公司 | Fraud early warning information generation method and device |
| CN113630495B (en) * | 2020-05-07 | 2022-08-02 | 中国电信股份有限公司 | Training method and device for fraud-related order prediction model and order prediction method and device |
| CN113630495A (en) * | 2020-05-07 | 2021-11-09 | 中国电信股份有限公司 | Training method and device for fraud-related order prediction model and order prediction method and device |
| CN112579864A (en) * | 2020-12-25 | 2021-03-30 | 北京明朝万达科技股份有限公司 | Anti-fraud processing method and device |
| CN112579864B (en) * | 2020-12-25 | 2022-09-16 | 北京明朝万达科技股份有限公司 | Anti-fraud processing method and device |
| CN112669187A (en) * | 2020-12-31 | 2021-04-16 | 深圳云天励飞技术股份有限公司 | Identity recognition method and device, electronic equipment and related products |
| CN112669187B (en) * | 2020-12-31 | 2024-04-02 | 深圳云天励飞技术股份有限公司 | Identity recognition method and device, electronic equipment and related products |
| WO2022142903A1 (en) * | 2020-12-31 | 2022-07-07 | 深圳云天励飞技术股份有限公司 | Identity recognition method and apparatus, electronic device, and related product |
| CN112887985A (en) * | 2021-02-23 | 2021-06-01 | 深圳市安络科技有限公司 | Method, device and equipment for early warning telecommunication fraud |
| CN112818249A (en) * | 2021-03-04 | 2021-05-18 | 中南大学 | Multi-dimensional image construction method and system for crowd with specific tendency |
| CN112818249B (en) * | 2021-03-04 | 2022-06-21 | 中南大学 | Multi-dimensional image construction method and system for crowd with specific tendency |
| CN114581219A (en) * | 2022-04-29 | 2022-06-03 | 弘沣智安科技(北京)有限公司 | Anti-telecommunication network fraud early warning method and system |
| CN115689298A (en) * | 2022-12-30 | 2023-02-03 | 北京码牛科技股份有限公司 | Telecommunication fraud risk prediction method, system, equipment and readable storage medium |
| CN117614743A (en) * | 2024-01-22 | 2024-02-27 | 北京中科网芯科技有限公司 | Phishing early warning method and system thereof |
| CN117614743B (en) * | 2024-01-22 | 2024-04-12 | 北京中科网芯科技有限公司 | Phishing early warning method and system thereof |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110222992A (en) | A kind of network swindle method for early warning and device based on group's portrait of being deceived | |
| US20210257066A1 (en) | Machine learning based medical data classification method, computer device, and non-transitory computer-readable storage medium | |
| WO2019196546A1 (en) | Method and apparatus for determining risk probability of service request event | |
| CN103279868B (en) | A kind of method and apparatus of automatic identification swindle order | |
| CN109241711A (en) | User behavior recognition method and device based on prediction model | |
| CN110163478A (en) | A kind of the risk checking method and device of contract terms | |
| CN108629413A (en) | Neural network model training, trading activity Risk Identification Method and device | |
| CN112860841B (en) | Text emotion analysis method, device, equipment and storage medium | |
| CN106296195A (en) | A kind of Risk Identification Method and device | |
| CN109242740A (en) | Identity information risk assessment method, apparatus, computer equipment and storage medium | |
| CN110010156A (en) | The sound event of modeling based on the sequence to event subdivision detects | |
| CN109783785B (en) | Method and device for generating experiment detection report and computer equipment | |
| CN108491406B (en) | Information classification method and device, computer equipment and storage medium | |
| CN110262965A (en) | A kind of test method and equipment of application program | |
| CN107092827A (en) | A kind of Android malware detection method based on improvement forest algorithm | |
| CN109063984A (en) | Risk passenger method, apparatus, computer equipment and storage medium | |
| CN109087205A (en) | Prediction technique and device, the computer equipment and readable storage medium storing program for executing of public opinion index | |
| CN109325118A (en) | Uneven sample data preprocess method, device and computer equipment | |
| CN110135943A (en) | Products Show method, apparatus, computer equipment and storage medium | |
| CN110968664A (en) | Document retrieval method, device, equipment and medium | |
| CN114881711A (en) | Method for carrying out anomaly analysis based on request behavior and electronic equipment | |
| CN108596094A (en) | Personage's style detecting system, method, terminal and medium | |
| CN112836041A (en) | Personnel relationship analysis method, device, equipment and storage medium | |
| CN116151965B (en) | Risk feature extraction method and device, electronic equipment and storage medium | |
| CN111523604A (en) | User classification method and related device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190910 |