CN110856115A - Identification method and identification device for fraud organization offence area and electronic equipment - Google Patents
Identification method and identification device for fraud organization offence area and electronic equipment Download PDFInfo
- Publication number
- CN110856115A CN110856115A CN201911194479.6A CN201911194479A CN110856115A CN 110856115 A CN110856115 A CN 110856115A CN 201911194479 A CN201911194479 A CN 201911194479A CN 110856115 A CN110856115 A CN 110856115A
- Authority
- CN
- China
- Prior art keywords
- base station
- suspect
- numbers
- determining
- initial
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/02—Services making use of location information
- H04W4/029—Location-based management or tracking services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M3/00—Automatic or semi-automatic exchanges
- H04M3/22—Arrangements for supervision, monitoring or testing
- H04M3/2281—Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M3/00—Automatic or semi-automatic exchanges
- H04M3/42—Systems providing special services or facilities to subscribers
- H04M3/42348—Location-based services which utilize the location information of a target
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/02—Services making use of location information
- H04W4/021—Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
Abstract
The application provides a method, a device and an electronic device for identifying a fraud organization offence area, which are characterized in that a plurality of numbers to be screened, and a base station track and call information of each number to be screened are obtained; screening a plurality of initial suspect numbers which only contain one base station identifier in a corresponding base station track within a preset time period from a plurality of numbers to be screened; determining at least one target suspect number from the plurality of initial suspect numbers according to the base station tracks corresponding to the plurality of initial suspect numbers and the call information; and finally, determining members of the same fraud organization and a criminal case area of the fraud organization according to the base station track of the target suspect number. Therefore, the numbers to be screened are subjected to multistage screening based on the base station tracks and the call information of the numbers to be screened, the organization members and the crime regions of the fraud organization can be more accurately determined, the investment of police resources is reduced, and the fraud organization is more timely and comprehensively prevented.
Description
Technical Field
The present application relates to the field of information processing technologies, and in particular, to a method and an apparatus for identifying a fraud organization committing area, and an electronic device.
Background
Telecommunication fraud is a novel criminal manipulation which is started in recent years, has the characteristics of zero contact, long distance and large harm, and brings serious economic loss and mental injury to the masses. The public security organ continuously increases the striking force, but due to flexible and variable manipulations and cross-regional crime and even cross-border and cross-country behavior characteristics, the public security organ brings troubles that fixed evidence is difficult and capturing and ferrying are more difficult.
Due to the contradiction between the increasing number of cases and the limited police resources, fraud calls can be prevented and tracked only according to the reports of people (for example, the phone numbers of fraud calls are marked as 'fraud calls') at present, but the phenomenon of random reporting occurs in the reporting process of people, and the group organization and the crime place of the fraud organization cannot be determined only according to the report information of people, so that the fraud organization cannot be prevented timely and comprehensively.
Disclosure of Invention
In view of the above, an object of the present application is to provide a method, an apparatus and an electronic device for identifying a fraud organization criminal offending area, wherein at least one initial suspected number is screened from a plurality of numbers to be screened based on information of a plurality of dimensions of the numbers to be screened, and the criminal organization criminal offending area is determined according to a base station identifier of the initial suspected number. Therefore, the numbers to be screened are subjected to multistage screening based on the base station tracks and the call information of the numbers to be screened, the organization members and the crime regions of the fraud organization can be more accurately determined, the police resource investment is reduced, and the fraud organization is more timely and comprehensively prevented.
The embodiment of the application provides a method for identifying a fraud organization offence area, which comprises the following steps:
acquiring a plurality of numbers to be screened, and a base station track and call information of each number to be screened, wherein the base station track comprises a base station identifier corresponding to at least one base station;
screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened;
determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information;
and dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining the criminal case area of the fraud organization according to the base station identification in the base station track.
Further, after determining at least one target suspect number from the plurality of initial suspect numbers based on the base station trajectories and the call information corresponding to the plurality of initial suspect numbers, the identification method further includes:
determining at least one non-suspect number with associated social information or residence information from the at least one target suspect number;
and determining the number except the at least one non-suspect number in the at least one target suspect number as the updated target suspect number.
Further, the determining at least one target suspect number from the plurality of initial suspect numbers based on the base station trajectories and the call information corresponding to the plurality of initial suspect numbers includes:
determining at least one candidate suspect number with abnormal call information from the plurality of initial suspect numbers based on the call information corresponding to the plurality of initial suspect numbers;
and for each candidate suspect number in at least one candidate suspect number, determining the candidate suspect number as a target suspect number when the base station track of the candidate suspect number is the same as the base station tracks of other candidate suspect numbers except the candidate suspect number in the at least one candidate suspect number.
Further, the abnormal condition includes at least one of an abnormal calling and called proportion, an abnormal call duration and an abnormal call area;
the abnormal calling and called proportion is that the proportion of the active call in a preset monitoring time exceeds a preset call proportion threshold;
the abnormal call duration is that the ratio of the call times with the call duration smaller than a preset threshold value to the total call times in a preset monitoring time period exceeds a preset call ratio threshold value;
the abnormal call area is that the ratio of the number of the calls of the different-place calls to the total number of the calls in the preset monitoring time period exceeds a preset area ratio threshold value.
Further, the determining a crime area of the fraud organization according to the base station identifier in the base station trajectory includes:
and determining the position of the base station corresponding to the base station identifier according to the base station identifier in the base station track, and determining a region within a preset range as a crime region of the fraud organization by taking the position of the base station as a center.
The embodiment of the present application further provides an identification apparatus for a fraud organization committing area, the identification apparatus includes:
the system comprises an acquisition module, a selection module and a selection module, wherein the acquisition module is used for acquiring a plurality of numbers to be screened, and a base station track and call information of each number to be screened, wherein the base station track comprises a base station identifier corresponding to at least one base station;
the screening module is used for screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened;
a first determining module, configured to determine at least one target suspect number from the multiple initial suspect numbers based on the base station trajectories and call information corresponding to the multiple initial suspect numbers;
and the second determining module is used for dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization and determining the criminal case area of the fraud organization according to the base station identification in the base station track.
Further, the identification apparatus further includes a third determining module, where the third determining module is configured to:
determining at least one non-suspect number with associated social information or residence information from the at least one target suspect number;
and determining the number except the at least one non-suspect number in the at least one target suspect number as the updated target suspect number.
Further, when the first determining module is configured to determine at least one target suspect number from the multiple initial suspect numbers based on the base station trajectories and the call information corresponding to the multiple initial suspect numbers, the first determining module is specifically configured to:
determining at least one candidate suspect number with abnormal call information from the plurality of initial suspect numbers based on the call information corresponding to the plurality of initial suspect numbers;
and for each candidate suspect number in at least one candidate suspect number, determining the candidate suspect number as a target suspect number when the base station track of the candidate suspect number is the same as the base station tracks of other candidate suspect numbers except the candidate suspect number in the at least one candidate suspect number.
Further, the abnormal condition includes at least one of an abnormal calling and called proportion, an abnormal call duration and an abnormal call area;
the abnormal calling and called proportion is that the proportion of the active call in a preset monitoring time exceeds a preset call proportion threshold;
the abnormal call duration is that the ratio of the call times with the call duration smaller than a preset threshold value to the total call times in a preset monitoring time period exceeds a preset call ratio threshold value;
the abnormal call area is that the ratio of the number of the calls of the different-place calls to the total number of the calls in the preset monitoring time period exceeds a preset area ratio threshold value.
Further, when the second determining module determines the offending area of the fraud organization according to the base station identifier in the base station trajectory, the second determining module is specifically configured to:
and determining the position of the base station corresponding to the base station identifier according to the base station identifier in the base station track, and determining a region within a preset range as a crime region of the fraud organization by taking the position of the base station as a center.
An embodiment of the present application further provides an electronic device, including: a processor, a memory and a bus, the memory storing machine-readable instructions executable by the processor, the processor and the memory communicating over the bus when the electronic device is running, the machine-readable instructions when executed by the processor performing the steps of the method of fraud organization committing area as described above.
Embodiments of the present application also provide a computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, performs the steps of the method for identifying a fraud organization committing area as described above.
The identification method, the identification device and the electronic equipment for the fraud organization offence area provided by the embodiment of the application acquire a plurality of numbers to be screened, and a base station track and call information of each number to be screened, wherein the base station track comprises a base station identifier corresponding to at least one base station; screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened; determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information; and dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining the criminal case area of the fraud organization according to the base station identification in the base station track.
Therefore, at least one target suspected number can be determined from the plurality of numbers to be screened through the obtained base station tracks of the numbers to be screened and the call information, the target suspected numbers with the same base station track are divided into the same fraud organization, and the criminal case area of the fraud organization is determined according to at least one base station identifier in the base station tracks. Therefore, the numbers to be screened are subjected to multistage screening based on the base station tracks and the call information of the numbers to be screened, the organization members and the crime regions of the fraud organization can be more accurately determined, the police resource investment is reduced, and the fraud organization is more timely and comprehensively prevented.
In order to make the aforementioned objects, features and advantages of the present application more comprehensible, preferred embodiments accompanied with figures are described in detail below.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained from the drawings without inventive effort.
FIG. 1 is a diagram of a system architecture in one possible application scenario;
FIG. 2 is a flowchart of a method for identifying a fraud organization committing area provided by an embodiment of the present application;
FIG. 3 is a flow chart of a method for identifying a fraud organization committing area provided by another embodiment of the present application;
FIG. 4 is a schematic structural diagram of an identification apparatus for a fraud organization offence area according to an embodiment of the present application;
FIG. 5 is a second schematic structural diagram of an identification apparatus for fraud organization offence area provided in the embodiment of the present application;
fig. 6 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments. The components of the embodiments of the present application, generally described and illustrated in the figures herein, can be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the present application, presented in the accompanying drawings, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. Every other embodiment that can be obtained by a person skilled in the art without making creative efforts based on the embodiments of the present application falls within the protection scope of the present application.
First, an application scenario to which the present application is applicable will be described. The application can be applied to the technical field of information processing. Referring to fig. 1, fig. 1 is a system architecture diagram in a possible application scenario. As shown in fig. 1, the system includes an information storage device and an identification device, the identification device obtains a base station track of numbers to be screened and call information from the information storage device, screens out a plurality of initial suspected numbers only including one base station identifier from the base station track within a preset time period from the plurality of numbers to be screened, determines at least one target suspected number from the plurality of initial suspected numbers, and determines a fraud organization and a criminal case area of the fraud organization according to the base station track of the target suspected number.
Research shows that fraud calls can be prevented and tracked only according to reports of people (such as the reports are marked through mobile phone software, and the telephone number of the fraud call is marked as a 'fraud call'), but people can report randomly in the reporting process, and a group organization cannot be determined only according to the reporting information of people, so that the crime place of the fraud organization is difficult to determine, and the fraud organization cannot be prevented comprehensively.
Based on this, the embodiment of the application provides a method for identifying a fraud organization offence area, which can more accurately determine organization members and offence areas of fraud organizations, reduce police resource investment, and simultaneously realize more timely and comprehensive prevention of fraud organizations.
Referring to fig. 2, fig. 2 is a flowchart illustrating a method for identifying a fraud organization committing area according to an embodiment of the present application. As shown in fig. 2, the identification method of a fraud organization committing area provided by the embodiment of the application includes:
s201, obtaining a plurality of numbers to be screened, and a base station track and call information of each number to be screened, wherein the base station track comprises a base station identification corresponding to at least one base station.
In the step, when a plurality of numbers to be screened need to be screened, a base station track and call information corresponding to each number to be screened are acquired from an information storage device, wherein the base station track comprises a base station identifier corresponding to at least one base station.
The track of the base station refers to the track of the base station through which signals are transmitted when the number to be screened is in communication; a Base Station, i.e. a Base Station Subsystem (BSS), is short for GSM network, and includes a Base Transceiver Station (BTS) and a Base Station Controller (BSC). A base station controller may control tens to tens of base transceiver stations. While in WCDMA and like systems similar concepts are referred to as NodeB and RNC.
For example, when the user a communicates with the user B, if a signal is to be transmitted from the location where the user a is located to the location where the user B is located, the signal needs to be transmitted from the base station C to the base station D, and then from the base station D to the base station E in the area where the user B is located, and then the base station trajectory is C-D-E.
S202, screening a plurality of initial suspected numbers which only contain one base station identification in the corresponding base station track in a preset time period from the plurality of numbers to be screened.
In this step, a plurality of initial suspected numbers including only one base station identifier in the base station trajectory are screened from the plurality of numbers to be screened based on the obtained base station trajectory corresponding to the numbers to be screened, that is, if one number to be screened only has one base station trajectory in a preset time period and the one base station trajectory only includes one base station identifier, it is indicated that the number to be screened only makes a call in one place in the preset time period.
The preset time period may be set according to human experience, or may be set according to the conditions of different regions, and is not limited herein.
S203, determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information.
In the step, on the basis of determining a plurality of initial suspected numbers, at least one target suspected number is further determined from the plurality of initial suspected numbers according to the base station track corresponding to each initial suspected number and the call information.
In this way, by performing multi-level screening on a plurality of numbers to be screened, the target suspect number can be accurately determined from the plurality of numbers to be screened.
S204, dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining a crime area of the fraud organization according to the base station identification in the base station track.
In this step, based on the base station track of the target suspect number, the persons corresponding to the target suspect number having the same base station track are classified into the same fraud organization, that is, the base station tracks in one fraud organization are the same, so that the specific position of the base station can be determined according to the base station identifier in the base station track, and the crime area of the fraud organization can be further determined according to the position of the base station.
According to the identification method of the fraud organization offence area provided by the embodiment of the application, a plurality of numbers to be screened, and the base station track and the call information of each number to be screened are obtained, wherein the base station track comprises a base station identifier corresponding to at least one base station; screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened; determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information; and dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining the criminal case area of the fraud organization according to the base station identification in the base station track.
Therefore, a plurality of initial suspected numbers only containing one base station identifier in the corresponding base station track information within a preset time period can be determined from the obtained base station tracks and the call information of the numbers to be screened, then at least one target suspected number is determined again according to the base station tracks and the call information, finally the target suspected numbers with the same base station tracks are divided into the same fraud organization, and the crime area of the fraud organization is determined according to at least one base station identifier in the base station tracks. Therefore, the numbers to be screened are subjected to multistage screening based on the base station tracks and the call information of the numbers to be screened, the organization members and the crime regions of the fraud organization can be more accurately determined, the police resource investment is reduced, and the fraud organization is more timely and comprehensively prevented.
Referring to fig. 3, fig. 3 is a flowchart of a method for identifying a fraud organization committing area according to another embodiment of the present application. As shown in fig. 3, the identification method of a fraud organization committing area provided by the embodiment of the application includes:
s301, a plurality of numbers to be screened, and a base station track and call information of each number to be screened are obtained, wherein the base station track comprises a base station identifier corresponding to at least one base station.
S302, screening out a plurality of initial suspected numbers which only contain one base station identification in the corresponding base station track in a preset time period from the plurality of numbers to be screened.
And S303, determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information.
S304, determining at least one non-suspect number of the social information or the residence information with the correlation from the at least one target suspect number.
In this step, after at least one target suspect number is determined, the at least one target suspect number may be further screened, and specifically, a target suspect number having social information or a target suspect number having residence information in the at least one target suspect number is determined as a non-suspect number.
Specifically, whether the target suspect number is registered or used is detected according to social information corresponding to the target suspect number, and if the social APP which needs to be registered in real name is registered or used, the target suspect number can be regarded as a non-suspect number; if the target suspected number is determined to be registered or the social APP is used, whether the person corresponding to the target suspected number has residence information, such as a local resident account or a local temporary residence permit, can be further verified, and if the residence information exists, the target suspected number can be determined to be a non-suspected number.
The social contact information is whether a social contact APP is registered or not, and the social contact APP is authenticated according to the identity information of the social contact APP, such as ticket booking software, takeaway software, communication software and the like. The residence information is that the residence is owned by a local residence or is a local residence certificate and the like.
S305, determining the number except the at least one non-suspect number in the at least one target suspect number as the updated target suspect number.
In this step, after determining at least one target suspect number and at least one non-suspect number, the at least one non-suspect number may be deleted from the at least one target suspect number, that is, a number of the at least one target suspect number except the at least one non-suspect number is determined as an updated target suspect number.
S306, dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining a crime area of the fraud organization according to the base station identification in the base station track.
The descriptions of S301 to S303 and S306 may refer to the descriptions of S101 to S104, and the same technical effects can be achieved, which are not described in detail.
Further, step S303 includes: determining at least one candidate suspect number with abnormal call information from the plurality of initial suspect numbers based on the call information corresponding to the plurality of initial suspect numbers; and for each candidate suspect number in at least one candidate suspect number, determining the candidate suspect number as a target suspect number when the base station track of the candidate suspect number is the same as the base station tracks of other candidate suspect numbers except the candidate suspect number in the at least one candidate suspect number.
In the step, according to the obtained call information corresponding to the plurality of initial suspect numbers, at least one candidate suspect number which does not meet a preset condition, namely the call information is abnormal, is determined from the plurality of initial suspect numbers; and for each candidate suspect number in the at least one candidate suspect number, determining the candidate suspect number as the target suspect number when the candidate suspect number is the same as the base station track of other candidate suspect numbers except the candidate suspect number in the at least one candidate suspect number.
For example, for one initial suspect number a of a plurality of initial suspect numbers, if the call information of the initial suspect number a is abnormal, the initial suspect number a may be determined as a candidate suspect number, and it is detected whether the initial suspect number a has the same base station track with other initial suspect numbers except the initial suspect number a among the plurality of initial suspect numbers, and if the initial suspect number a has the same base station track with other initial suspect numbers except the initial suspect number a among the plurality of initial suspect numbers, the initial suspect number a is determined as a target suspect number; and by analogy, traversing each initial suspect number in the plurality of initial suspect numbers to determine at least one target suspect number.
The abnormal condition comprises at least one of abnormal calling and called proportion, abnormal call duration and abnormal call area;
the abnormal calling and called proportion is that the proportion of the active call in a preset monitoring time period exceeds a preset call proportion threshold.
For example, in a preset monitoring time period, for example, in a week, if the number finds that the proportion of the number of active calls to the total number of calls reaches more than 90%, the number has an abnormal proportion of calling to called.
The abnormal call duration is that the ratio of the call times of which the call duration is less than a preset threshold value to the total call times exceeds a preset call ratio threshold value in a preset monitoring time period.
Illustratively, a number is found within a preset monitoring time period, for example, within a week, and if the proportion of the number of calls whose call duration does not exceed 1 minute to the total number of calls exceeds 90%, the number has a condition that the call duration is abnormal.
The abnormal call area is that the ratio of the number of the calls of the different-place calls to the total number of the calls in the preset monitoring time period exceeds a preset area ratio threshold value.
For example, a number is found within a preset monitoring time period, for example, within a week, and the ratio of the number of the off-site calls to the total number of the calls exceeds 90%, so that the number has a call area abnormality.
Further, step S306 includes: and determining the position of the base station corresponding to the base station identifier according to the base station identifier in the base station track, and determining a region within a preset range as a crime region of the fraud organization by taking the position of the base station as a center.
In this step, according to the base station identifier in the base station trajectory, the base station corresponding to the base station identifier is determined, and the specific position of the base station can be determined according to the GPS and the like, so that the area within the preset range centered on the specific position of the base station can be determined as the crime area of the fraud organization.
The preset range can be preset according to experience, and can be specifically set according to the environment around the base station and the coverage range of the base station, for example, it is determined that the base station is located in a remote village, the coverage range of the base station is 1km, the preset range can be properly increased due to rare personnel, and conversely, if the position of the base station is located in a city, the preset range can be further reduced due to dense personnel in the city.
According to the identification method of the fraud organization offence area provided by the embodiment of the application, a plurality of numbers to be screened, and the base station track and the call information of each number to be screened are obtained, wherein the base station track comprises a base station identifier corresponding to at least one base station; screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened; determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information; determining at least one non-suspect number with associated social information or residence information from the at least one target suspect number; determining the number except the at least one non-suspect number in the at least one target suspect number as an updated target suspect number; and dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining a crime area of the fraud organization according to at least one base station identifier in the base station track.
Therefore, a plurality of initial suspected numbers only containing one base station identifier in the corresponding base station track information within a preset time period can be determined from the obtained base station track and the call information of the numbers to be screened, then at least one target suspected number is determined again according to the base station track and the call information, meanwhile, at least one target suspected number can be screened and updated again according to the social information and the residence information, finally, the target suspected numbers with the same base station track are divided into the same fraud organization, and a crime area of the fraud organization is determined according to the base station identifier in the base station track. Therefore, the numbers to be screened are subjected to multistage screening based on the base station tracks and the call information of the numbers to be screened, the organization members and the crime regions of the fraud organization can be more accurately determined, the police resource investment is reduced, and the fraud organization is more timely and comprehensively prevented.
Referring to fig. 4 and 5, fig. 4 is a schematic structural diagram of an identification device of a fraud organization offence area provided in the embodiment of the present application, and fig. 5 is a second schematic structural diagram of an identification device of a fraud organization offence area provided in the embodiment of the present application. As shown in fig. 4, the identification means 400 of the fraud organization committing area comprises:
an obtaining module 410, configured to obtain a plurality of numbers to be screened, and a base station trajectory and call information of each number to be screened, where the base station trajectory includes a base station identifier corresponding to at least one base station;
a screening module 420, configured to screen out, from the multiple numbers to be screened, multiple initial suspect numbers that only include one base station identifier in a corresponding base station trajectory within a preset time period;
a first determining module 430, configured to determine at least one target suspect number from the multiple initial suspect numbers based on the base station trajectories and call information corresponding to the multiple initial suspect numbers;
the second determining module 440 is configured to divide the persons corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determine a crime area of the fraud organization according to the base station identifier in the base station track.
Further, as shown in fig. 5, the recognition apparatus 400 further includes a third determining module 450, where the third determining module 450 is configured to:
determining at least one non-suspect number with associated social information or residence information from the at least one target suspect number;
and determining the number except the at least one non-suspect number in the at least one target suspect number as the updated target suspect number.
Further, when the first determining module 430 is configured to determine at least one target suspect number from the multiple initial suspect numbers based on the base station trajectories and the call information corresponding to the multiple initial suspect numbers, the first determining module 430 is specifically configured to:
determining at least one candidate suspect number with abnormal call information from the plurality of initial suspect numbers based on the call information corresponding to the plurality of initial suspect numbers;
and for each candidate suspect number in at least one candidate suspect number, determining the candidate suspect number as a target suspect number when the base station track of the candidate suspect number is the same as the base station tracks of other candidate suspect numbers except the candidate suspect number in the at least one candidate suspect number.
Further, the abnormal condition includes at least one of an abnormal calling and called proportion, an abnormal call duration and an abnormal call area;
the abnormal calling and called proportion is that the proportion of the active call in a preset monitoring time exceeds a preset call proportion threshold;
the abnormal call duration is that the ratio of the call times with the call duration smaller than a preset threshold value to the total call times in a preset monitoring time period exceeds a preset call ratio threshold value;
the abnormal call area is that the ratio of the number of the calls of the different-place calls to the total number of the calls in the preset monitoring time period exceeds a preset area ratio threshold value.
Further, when the second determining module 440 determines the offending area of the fraud organization according to the base station identifier in the base station trajectory, the second determining module 440 is specifically configured to:
and determining the position of the base station corresponding to the base station identifier according to the base station identifier in the base station track, and determining a region within a preset range as a crime region of the fraud organization by taking the position of the base station as a center.
The identification device for the fraud organization offence area provided by the embodiment of the application acquires a plurality of numbers to be screened, and a base station track and call information of each number to be screened, wherein the base station track comprises a base station identifier corresponding to at least one base station; screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened; determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information; and dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining the criminal case area of the fraud organization according to the base station identification in the base station track.
Therefore, a plurality of initial suspected numbers only containing one base station identifier in the corresponding base station track information within a preset time period can be determined from the obtained base station tracks and the call information of the numbers to be screened, then at least one target suspected number is determined again according to the base station tracks and the call information, finally the target suspected numbers with the same base station tracks are divided into the same fraud organization, and the crime area of the fraud organization is determined according to at least one base station identifier in the base station tracks. Therefore, the numbers to be screened are subjected to multistage screening based on the base station tracks and the call information of the numbers to be screened, the organization members and the crime regions of the fraud organization can be more accurately determined, the police resource investment is reduced, and the fraud organization is more timely and comprehensively prevented.
Referring to fig. 6, fig. 6 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure. As shown in fig. 6, the electronic device 600 includes a processor 610, a memory 620, and a bus 630.
The memory 620 stores machine-readable instructions executable by the processor 610, when the electronic device 600 runs, the processor 610 communicates with the memory 620 through the bus 630, and when the machine-readable instructions are executed by the processor 610, the steps of the method for identifying a fraud organization committing area in the embodiment of the method shown in fig. 2 and fig. 3 can be executed.
An embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method for identifying a fraud organization committing case region in the method embodiments shown in fig. 2 and fig. 3 may be executed.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions when actually implemented, and for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or units through some communication interfaces, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a non-volatile computer-readable storage medium executable by a processor. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read-only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.
Finally, it should be noted that: the above-mentioned embodiments are only specific embodiments of the present application, and are used for illustrating the technical solutions of the present application, but not limiting the same, and the scope of the present application is not limited thereto, and although the present application is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: any person skilled in the art can modify or easily conceive the technical solutions described in the foregoing embodiments or equivalent substitutes for some technical features within the technical scope disclosed in the present application; such modifications, changes or substitutions do not depart from the spirit and scope of the exemplary embodiments of the present application, and are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (10)
1. A method of identifying a fraud organization offence area, the method comprising:
acquiring a plurality of numbers to be screened, and a base station track and call information of each number to be screened, wherein the base station track comprises a base station identifier corresponding to at least one base station;
screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened;
determining at least one target suspect number from the plurality of initial suspect numbers based on the base station tracks corresponding to the plurality of initial suspect numbers and the call information;
and dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization, and determining the criminal case area of the fraud organization according to the base station identification in the base station track.
2. The method according to claim 1, wherein after determining at least one target suspect number from the plurality of initial suspect numbers based on the base station trajectories corresponding to the plurality of initial suspect numbers and call information, the method further comprises:
determining at least one non-suspect number with associated social information or residence information from the at least one target suspect number;
and determining the number except the at least one non-suspect number in the at least one target suspect number as the updated target suspect number.
3. The identification method according to claim 1, wherein the determining at least one target suspect number from the plurality of initial suspect numbers based on the base station trajectories corresponding to the plurality of initial suspect numbers and call information comprises:
determining at least one candidate suspect number with abnormal call information from the plurality of initial suspect numbers based on the call information corresponding to the plurality of initial suspect numbers;
and for each candidate suspect number in at least one candidate suspect number, determining the candidate suspect number as a target suspect number when the base station track of the candidate suspect number is the same as the base station tracks of other candidate suspect numbers except the candidate suspect number in the at least one candidate suspect number.
4. The identification method according to claim 3, wherein the abnormal condition comprises at least one of an abnormal calling and called ratio, an abnormal call duration and an abnormal call area;
the abnormal calling and called proportion is that the proportion of the active call in a preset monitoring time exceeds a preset call proportion threshold;
the abnormal call duration is that the ratio of the call times with the call duration smaller than a preset threshold value to the total call times in a preset monitoring time period exceeds a preset call ratio threshold value;
the abnormal call area is that the ratio of the number of the calls of the different-place calls to the total number of the calls in the preset monitoring time period exceeds a preset area ratio threshold value.
5. The method as claimed in claim 1, wherein said determining a committing area of said fraud organization according to the base station identification in the base station track comprises:
and determining the position of the base station corresponding to the base station identifier according to the base station identifier in the base station track, and determining a region within a preset range as a crime region of the fraud organization by taking the position of the base station as a center.
6. An identification device of a fraud organization offence area, characterized in that the identification device comprises:
the system comprises an acquisition module, a selection module and a selection module, wherein the acquisition module is used for acquiring a plurality of numbers to be screened, and a base station track and call information of each number to be screened, wherein the base station track comprises a base station identifier corresponding to at least one base station;
the screening module is used for screening a plurality of initial suspect numbers which only contain one base station identifier in the corresponding base station track within a preset time period from the plurality of numbers to be screened;
a first determining module, configured to determine at least one target suspect number from the multiple initial suspect numbers based on the base station trajectories and call information corresponding to the multiple initial suspect numbers;
and the second determining module is used for dividing the personnel corresponding to the target suspect numbers with the same base station track into the same fraud organization and determining the criminal case area of the fraud organization according to the base station identification in the base station track.
7. The apparatus according to claim 6, wherein the apparatus further comprises a third determining module, the third determining module is configured to:
determining at least one non-suspect number with associated social information or residence information from the at least one target suspect number;
and determining the number except the at least one non-suspect number in the at least one target suspect number as the updated target suspect number.
8. The apparatus according to claim 6, wherein when the first determining module is configured to determine at least one target suspect number from the plurality of initial suspect numbers based on the base station trajectories corresponding to the plurality of initial suspect numbers and call information, the first determining module is specifically configured to:
determining at least one candidate suspect number with abnormal call information from the plurality of initial suspect numbers based on the call information corresponding to the plurality of initial suspect numbers;
and for each candidate suspect number in at least one candidate suspect number, determining the candidate suspect number as a target suspect number when the base station track of the candidate suspect number is the same as the base station tracks of other candidate suspect numbers except the candidate suspect number in the at least one candidate suspect number.
9. An electronic device, comprising: a processor, a memory and a bus, said memory storing machine-readable instructions executable by said processor, said processor and said memory communicating over said bus when an electronic device is running, said machine-readable instructions when executed by said processor performing the steps of the method of identifying a fraud organization committing area according to any one of claims 1-5.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium has stored thereon a computer program which, when being executed by a processor, performs the steps of the method of identifying a fraud organization committing area as recited in any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911194479.6A CN110856115B (en) | 2019-11-28 | 2019-11-28 | Identification method and identification device for fraud organization offence area and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911194479.6A CN110856115B (en) | 2019-11-28 | 2019-11-28 | Identification method and identification device for fraud organization offence area and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110856115A true CN110856115A (en) | 2020-02-28 |
| CN110856115B CN110856115B (en) | 2021-02-12 |
Family
ID=69605949
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911194479.6A Active CN110856115B (en) | 2019-11-28 | 2019-11-28 | Identification method and identification device for fraud organization offence area and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110856115B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112866192A (en) * | 2020-12-30 | 2021-05-28 | 绿盟科技集团股份有限公司 | Method and device for identifying abnormal aggregation behaviors |
| CN113518152A (en) * | 2020-04-09 | 2021-10-19 | 中国移动通信集团广东有限公司 | Telephone number identification method and system and electronic equipment |
| WO2022267455A1 (en) * | 2021-06-22 | 2022-12-29 | 平安科技（深圳）有限公司 | Method, apparatus and device for predicting area in which fraudulent users are concentrated, and storage medium |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5504810A (en) * | 1993-09-22 | 1996-04-02 | At&T Corp. | Telecommunications fraud detection scheme |
| CN105205155A (en) * | 2015-09-25 | 2015-12-30 | 珠海世纪鼎利科技股份有限公司 | Big data criminal accomplice screening system and method |
| CN105404890A (en) * | 2015-10-13 | 2016-03-16 | 广西师范学院 | Criminal gang discrimination method considering locus space-time meaning |
| CN105636047A (en) * | 2014-10-29 | 2016-06-01 | 中兴通讯股份有限公司 | Fraud user detecting method, fraud user detecting device and fraud user detecting system |
| CN106339428A (en) * | 2016-08-16 | 2017-01-18 | 东方网力科技股份有限公司 | Identity identification method and device for suspects based on large video data |
| CN107819747A (en) * | 2017-10-26 | 2018-03-20 | 上海欣方智能系统有限公司 | A kind of telecommunication fraud correlation analysis system and method based on communication event sequence |
| EP3324607A1 (en) * | 2016-11-18 | 2018-05-23 | iBasis, Inc. | Fraud detection on a communication network |
| CN108156332A (en) * | 2017-12-26 | 2018-06-12 | 中国联合网络通信集团有限公司 | The acquisition methods and device of fraudulent call |
| CN108156334A (en) * | 2018-02-01 | 2018-06-12 | 天津市国瑞数码安全系统股份有限公司 | A kind of control system that swindle scene is obtained based on internet |
| CN109191281A (en) * | 2018-08-21 | 2019-01-11 | 重庆富民银行股份有限公司 | A kind of group's fraud identifying system of knowledge based map |
| CN110415107A (en) * | 2019-07-26 | 2019-11-05 | 同盾控股有限公司 | Data processing method, device, storage medium and electronic equipment |
-
2019
- 2019-11-28 CN CN201911194479.6A patent/CN110856115B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5504810A (en) * | 1993-09-22 | 1996-04-02 | At&T Corp. | Telecommunications fraud detection scheme |
| CN105636047A (en) * | 2014-10-29 | 2016-06-01 | 中兴通讯股份有限公司 | Fraud user detecting method, fraud user detecting device and fraud user detecting system |
| CN105205155A (en) * | 2015-09-25 | 2015-12-30 | 珠海世纪鼎利科技股份有限公司 | Big data criminal accomplice screening system and method |
| CN105404890A (en) * | 2015-10-13 | 2016-03-16 | 广西师范学院 | Criminal gang discrimination method considering locus space-time meaning |
| CN106339428A (en) * | 2016-08-16 | 2017-01-18 | 东方网力科技股份有限公司 | Identity identification method and device for suspects based on large video data |
| EP3324607A1 (en) * | 2016-11-18 | 2018-05-23 | iBasis, Inc. | Fraud detection on a communication network |
| CN107819747A (en) * | 2017-10-26 | 2018-03-20 | 上海欣方智能系统有限公司 | A kind of telecommunication fraud correlation analysis system and method based on communication event sequence |
| CN108156332A (en) * | 2017-12-26 | 2018-06-12 | 中国联合网络通信集团有限公司 | The acquisition methods and device of fraudulent call |
| CN108156334A (en) * | 2018-02-01 | 2018-06-12 | 天津市国瑞数码安全系统股份有限公司 | A kind of control system that swindle scene is obtained based on internet |
| CN109191281A (en) * | 2018-08-21 | 2019-01-11 | 重庆富民银行股份有限公司 | A kind of group's fraud identifying system of knowledge based map |
| CN110415107A (en) * | 2019-07-26 | 2019-11-05 | 同盾控股有限公司 | Data processing method, device, storage medium and electronic equipment |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113518152A (en) * | 2020-04-09 | 2021-10-19 | 中国移动通信集团广东有限公司 | Telephone number identification method and system and electronic equipment |
| CN112866192A (en) * | 2020-12-30 | 2021-05-28 | 绿盟科技集团股份有限公司 | Method and device for identifying abnormal aggregation behaviors |
| CN112866192B (en) * | 2020-12-30 | 2022-11-04 | 绿盟科技集团股份有限公司 | Method and device for identifying abnormal aggregation behaviors |
| WO2022267455A1 (en) * | 2021-06-22 | 2022-12-29 | 平安科技（深圳）有限公司 | Method, apparatus and device for predicting area in which fraudulent users are concentrated, and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110856115B (en) | 2021-02-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110856115B (en) | Identification method and identification device for fraud organization offence area and electronic equipment | |
| CN108513301B (en) | Illegal user identification method and device | |
| CA2799170C (en) | System and method for monitoring an area using nfc tags | |
| US10134262B2 (en) | System and method for prediction of threatened points of interest | |
| CN112235712A (en) | Vehicle driving early warning method, system, device and equipment | |
| CN109446936A (en) | A kind of personal identification method and device for monitoring scene | |
| US20210326563A1 (en) | Electronic fingerprint device for identifying perpetrators and witnesses of a crime and method thereof | |
| CN110493476B (en) | Detection method, device, server and storage medium | |
| CN112734973A (en) | Point location patrol method and point location patrol system | |
| CN111985428A (en) | Security detection method and device, electronic equipment and storage medium | |
| CN113160509A (en) | Risk sensing method and system suitable for communities and construction sites | |
| WO2017215553A1 (en) | Short message monitoring method, device and monitoring center | |
| CN113077354B (en) | Insurance application verification method and device for electronic equipment | |
| CN111079524A (en) | Target identity recognition method and system based on operator base station | |
| EP3866501A1 (en) | Method and device for handling pseudo base station, mobile terminal, and storage medium | |
| CN110874582A (en) | Telecommunication fraud determination method and device, storage medium and electronic device | |
| CN110557722A (en) | target group partner identification method and related device | |
| KR20150131846A (en) | Method and System for preventing Login ID theft using captcha | |
| CN113723694A (en) | Police officer control method, device, equipment and storage medium | |
| CN109785617B (en) | Method for processing traffic control information | |
| CN110225298B (en) | Method, device and system for providing image information in Internet of vehicles | |
| CN112642162A (en) | User login management method and device, computer equipment and storage medium | |
| WO2016150516A1 (en) | Optimizing data detection in communications | |
| CN106454776B (en) | Pseudo base station protection method and device | |
| CN112498269B (en) | Abnormality recognition method and device for vehicle-mounted terminal, server and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20210913 Address after: 100000 room 650, 6th floor, building 11, Huashan Garden Cultural Media Industrial Park, 1376 folk culture street, Gaobeidian village, Gaobeidian Township, Chaoyang District, Beijing Patentee after: Beijing Zhizhi Heshu Technology Co.,Ltd. Address before: No.310, building 4, courtyard 8, Dongbei Wangxi Road, Haidian District, Beijing Patentee before: MININGLAMP SOFTWARE SYSTEMS Co.,Ltd. |
|
| TR01 | Transfer of patent right |