CN116796200A

CN116796200A - Identification method, identification device, electronic equipment and computer readable storage medium

Info

Publication number: CN116796200A
Application number: CN202310759390.XA
Authority: CN
Inventors: 杨成效; 蔡骏潇; 梁彧; 傅强; 王杰; 杨满智; 尚程; 黄晓青
Original assignee: Eversec Beijing Technology Co Ltd; China United Network Communications Corp Ltd Liaoning Branch
Current assignee: Eversec Beijing Technology Co Ltd; China United Network Communications Corp Ltd Liaoning Branch
Priority date: 2023-06-26
Filing date: 2023-06-26
Publication date: 2023-09-22

Abstract

The invention discloses an identification method, an identification device, electronic equipment and a computer readable storage medium. The identification method comprises the steps of determining candidate results output by an identification model included in a set of identification models based on detailed information and the set of identification models; determining a recognition result of the detail list information based on the candidate result and a matching result of the detail list information corresponding to the candidate result; the recognition model set comprises a plurality of recognition models, and different recognition models are used for recognizing risks under different scenes. The technical problem of low accuracy in identifying fraud calls is solved.

Description

Identification method, identification device, electronic equipment and computer readable storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to an identification method, an identification device, an electronic device, and a computer readable storage medium.

Background

With the rapid development of information society, crime structures have been deeply changed, traditional contact crimes have been continuously reduced, and new crimes represented by telecommunication phishing have been continuously highly developed, facing the current severe phishing situation. The identification of telecommunication fraud calls places higher demands.

The current fraud recognition method is used for recognizing fraud telephones based on call data, and the recognition accuracy is low.

Disclosure of Invention

The invention provides an identification method, an identification device, electronic equipment and a computer readable storage medium, which are used for solving the technical problem of low identification accuracy of fraud telephones.

According to an aspect of the present invention, there is provided an identification method including:

determining candidate results output by the recognition models included in the recognition model set based on the detailed information and the recognition model set;

determining a recognition result of the detail list information based on the candidate result and a matching result of the detail list information corresponding to the candidate result;

the recognition model set comprises a plurality of recognition models, and different recognition models are used for recognizing risks under different scenes.

According to another aspect of the present invention, there is provided an identification device comprising:

the first determining module is used for determining candidate results output by the identification models included in the identification model set based on the detailed list information and the identification model set;

the second determining module is used for determining the identification result of the detail list information based on the candidate result and the matching result of the detail list information corresponding to the candidate result;

According to another aspect of the present invention, there is provided an electronic apparatus including:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein, the liquid crystal display device comprises a liquid crystal display device,

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the method of any one of the embodiments of the present invention.

According to another aspect of the invention, there is provided a computer readable storage medium storing computer instructions for causing a processor to perform the method according to any of the embodiments of the invention.

According to the technical scheme, candidate results output by the identification model are determined, wherein the candidate results are included in the identification model set and are based on detailed information and the identification model set; determining a recognition result of the detail list information based on the candidate result and a matching result of the detail list information corresponding to the candidate result; the recognition model set comprises a plurality of recognition models, different recognition models are used for recognizing risks in different scenes, the technical problem of low recognition accuracy of fraud calls is solved, risks of detailed information in different scenes can be recognized through detailed information and the recognition model set, and recognition accuracy is improved.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the invention or to delineate the scope of the invention. Other features of the present invention will become apparent from the description that follows.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flow chart of an identification method provided according to an embodiment of the present invention;

FIG. 2 is a logic flow diagram of a first recognition model provided in accordance with an embodiment of the present invention;

FIG. 3 is a logic flow diagram of a second recognition model provided in accordance with an embodiment of the present invention;

FIG. 4 is a logic flow diagram of a third recognition model provided in accordance with an embodiment of the present invention;

FIG. 5 is a schematic logic flow diagram of a fifth recognition model provided in accordance with an embodiment of the present invention;

FIG. 6 is a logic flow diagram of a sixth recognition model provided in accordance with an embodiment of the present invention;

FIG. 7 is a logic flow diagram of a seventh recognition model provided in accordance with an embodiment of the present invention;

fig. 8 is a schematic structural view of an identification device according to an embodiment of the present invention;

fig. 9 is a schematic structural diagram of an electronic device implementing an identification method according to an embodiment of the present invention.

Detailed Description

In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

The technical scheme of the invention obtains, stores, uses, processes and the like the data, which all meet the relevant regulations of national laws and regulations. The invention relates to the acquisition, storage, use, processing and the like of information related to individuals, which inform users according to the rules of laws and regulations and obtain the authorization of the users.

Fig. 1 is a flowchart of an identification method according to an embodiment of the present invention, where the method may be applied to risk identification of detailed information, and the method may be performed by an identification device, where the identification device may be implemented in hardware and/or software, and the identification device may be configured in an electronic device, such as a mobile phone, a computer, or other devices.

As shown in fig. 1, the method includes:

s110, determining candidate results output by the recognition models included in the recognition model set based on the detailed list information and the recognition model set.

The detailed information may be considered as call detail records, also known as tickets. The acquisition, storage, use, processing, etc. of the detailed information informs and characterizes the authorization of the corresponding user.

The recognition model set comprises a plurality of recognition models, and different recognition models are used for recognizing risks under different scenes. The identification model may be considered as a model for risk identification of the detailed information.

The candidate result may be a result output by the recognition model, and may be a candidate suspected risky telephone number.

The step may input the detailed information to a plurality of recognition models included in the recognition model set, and obtain candidate results output by each recognition model, respectively. The step can also be that the detailed list information is input into a plurality of recognition models included in the recognition model set after feature extraction, so as to obtain candidate results output by each recognition model, and the extracted features corresponding to each recognition model are not identical.

S120, determining the identification result of the detail list information based on the candidate result and the matching result of the detail list information corresponding to the candidate result.

The matching result may indicate a result of the matching of the detail information and the candidate result. The identification result may be a result obtained after the detailed information is identified, and the identification result may indicate whether the detailed information has a fraud risk, and if so, under which scenario.

After determining the candidate result, the step may match the candidate result with corresponding detailed information, where the detailed information may include the phone number of the calling party and the phone number of the called party. The candidate result may be a telephone number suspected of fraud. For each recognition model, each of the detail information may correspond to a candidate result, for which it may be determined whether the candidate result is contained within the detail information, and if so, the candidate result may be considered to match the detail information.

When the matching result indicates that the candidate result is matched with the detailed list information, the identification result can be considered as the risk of the detailed list information under the scene that the identification model corresponding to the matched candidate result belongs to.

After the candidate result of each recognition model is obtained, each candidate result can be respectively matched with the detailed list information, and if the detailed list information is matched, the risk of the scene to which the matched recognition model belongs can be considered, so that the recognition result is obtained.

By way of example, the identification model 1 may identify a risk. The recognition model 2 can recognize the b risk. After the detailed list information is respectively input into the recognition model 1 and the recognition model 2, candidate results of the recognition model 1 and candidate results of the recognition model 2 are respectively obtained, and matching results of the detailed list information and the candidate results are respectively determined by determining whether the candidate results are contained in the detailed list information. If the detail information matches the candidate result corresponding to the recognition model 2, the recognition result may indicate that the detail information has a risk b corresponding to the recognition model 2.

In one embodiment, the determining, based on the detailed information and the set of recognition models, candidate results of recognition model outputs included in the set of recognition models includes:

And inputting the detailed list information into the recognition models included in the recognition model set to obtain candidate results output by each recognition model, wherein the candidate results indicate candidate risk numbers.

The risk number may be considered as a fraud number. Such as fraudulent telephone numbers. The detailed information can be input into all the recognition models to obtain candidate results output by each recognition model. The recognition internals may perform feature extraction and feature analysis for obtaining candidate results.

The embodiment of the invention provides an identification method, which is characterized in that candidate results output by an identification model are determined on the basis of detailed information and the identification model set; determining a recognition result of the detail list information based on the candidate result and a matching result of the detail list information corresponding to the candidate result; the recognition model set comprises a plurality of recognition models, different recognition models are used for recognizing risks in different scenes, the technical problem of low recognition accuracy of fraud calls is solved, risks of detailed information in different scenes can be recognized through detailed information and the recognition model set, and recognition accuracy is improved.

On the basis of the above embodiments, modified embodiments of the above embodiments are proposed, and it is to be noted here that only the differences from the above embodiments are described in the modified embodiments for the sake of brevity of description.

In one embodiment, each recognition model is trained based on a history list under a scene to which the recognition model belongs, and the training operation of the recognition model includes:

acquiring a history detail list;

extracting characteristic variables in the history detail list;

analyzing the characteristic variable based on an analysis strategy corresponding to a scene corresponding to the identification model;

determining a reserved characteristic variable based on the analysis result;

training the recognition model based on the feature variables.

Different recognition models may correspond to different scenarios, such as to different fraud scenarios. Correspondingly, the recognition model can be obtained through historical detail training under the scene. The history details may be considered as history ticket. The history details may include both fraud and non-fraud tickets.

The feature variables may be features extracted based on historical detail. The content of the feature variables is not limited herein, and different scenes may correspond to different feature variables. Exemplary feature variables may include one or more of the following:

Calling duty cycle; number of calling party in the same day; average calling call duration of each time; cell identification number; the longest contact days in the dialed number; the number of contacts in common use; a telephone business mode; the total calling time of the day; average call charge per day; the place of the called party; a calling number; number of callers; the calling time length is compared with the duty ratio of the total call time length; the number of times a number is called; the total duration of the call on the same day; communication means; the first call duration; a called calling number; the call duration of the called party and the called number; a calling number; single call duration; the same calling and called call total duration; a talk time; a called number; the number of times the calling number is dialed back; setting the duty ratio of the dialed digit number in the first set duration; the date of the detail list; average telephone charge; the duty ratio of the called first set rule number; the number of calling numbers in the same day; average call duration of the day; the calling duty ratio with the set bit number in the second set time length; the ratio of calling call with the mobile phone user in the third set time length; telephone charge; liveness; number of incoming calls; the home location of the calling opposite terminal is the proportion of the home location of the home terminal; the attribution of the calling opposite terminal is the proportion of the local terminal; calling times in a third set duration are counted; the number of times the calling party sets the rule number second.

An analysis strategy may be considered as a strategy for analyzing characteristic variables. Different analysis strategies are corresponding to different scenes. After the feature variables are determined, the variables can be analyzed based on the analysis strategy under the corresponding scene, and whether the corresponding historical detail list is the detail list with risk under the scene can be determined.

The analysis results indicate the results of analyzing the feature variables based on the analysis strategy. The present embodiment can perform screening of feature variables based on the analysis result. To preserve the feature variables used to train the recognition model, where the preserved feature variables are not defined, such as preserving the feature variables significantly. Whether or not significant can be verified in reverse based on the feature variables and corresponding historical details.

After the feature variables are retained, training of the recognition model may be performed based on the retained feature variables. The retained feature variables may also have labels indicating whether the corresponding historical detail has a risk for adjusting parameters of the recognition model.

Fig. 2 is a logic flow diagram of a first recognition model according to an embodiment of the present invention, referring to fig. 2, the recognition model is taken as an example of the first recognition model in this embodiment. The first recognition model may be considered a recognition model in a fake leader acquaintance scenario. Logic to identify the model may include sample extraction; sample ticket extraction; feature expansion; establishing a model; optimizing the model; the model is put on line.

The feature expansion may be feature variable extraction based on features of the scene, and then feature analysis based on a corresponding analysis strategy. The analysis can be used for model training.

The scene can be further subdivided into a long-distance scene and a diffuse scene. The called user in this scenario is typically not the user of the calling number location or home location.

The scene to which the first recognition model belongs typically has the following behavior characteristics:

the calling party of the fraud number is high, usually more than 80%;

fraud number the number of calling numbers on the day is generally 160 or less;

the average calling call duration of the fraud number is between 20 and 100 seconds;

most of the fraud numbers are in roaming call;

the number of the current day Location Area Code (LAC) Cell Identification (CI) of the fraud number is small, and the fraud number is not frequently moved;

the fraud number basically has no international long-distance call;

the number dialed by the fraud number is usually 2 days for the longest number of contact days, and no contact is commonly used.

General users open cards locally and fraudulently outsiders locally for a subdivided long distance scenario, which has the following features:

the calling party accounts for more than 80% of the current day;

the number of calling opposite terminal numbers is more on the same day;

The total calling duration of the calling party on the same day is longer;

the position of the cheat is relatively fixed for a plurality of days;

the multi-balance call cost per day is high, and is generally a low-value package user.

For a diffuse scene, the user diffuses into a fixed place and starts to fraudster the foreign people. The scene has the following characteristics:

the fraudster is often roaming, typically to an out-of-province area.

Fraud often does not dial a flourish local person telephone.

The calling number of the user on the same day is higher than 80%.

The average calling duration of the user on the same day is between 20 and 100 seconds, which is relatively short.

The user has relatively fixed position within a plurality of days, and the moving range is not large.

The features or characteristics of each scene of the present invention may be automatically identified, such as by a feature model, and are not limited herein.

The above-described features may correspond to feature vectors and analysis strategies in the present embodiment. And determining the feature vector to be extracted and an analysis strategy for analyzing the feature vector under different scenes based on the features of the scenes.

In one embodiment, the recognition model includes a first recognition model, and the analysis strategy corresponding to the first recognition model is determined based on one or more of the following parameters:

calling duty cycle; number of calling party in the same day; average calling call duration of each time; cell identification number; the longest contact days in the dialed number; the number of contacts in common use; a telephone business mode; the total calling time of the day; average call charge per day; the called party is located.

The parameters corresponding to the analysis strategies can be feature variables, the corresponding analysis strategies are determined based on the corresponding feature variables, and if the feature variables are calling duty ratios, the corresponding analysis strategies can be whether the calling duty ratio of the fraud number is more than 80% or not so as to respond to the features in different scenes.

The calling party duty cycle may be considered as the duty cycle of the number calling party and the called party. The average calling call duration per call may be an average of calling call durations per call in a set period of time. The number of cell identities may be used to determine whether to move frequently. Telephone service modes may include roaming calls and international long distance calls. The total length of the caller call on the day may be the total length of the caller call on the day when the risk occurs. The average daily call charge may be an average of the daily call charges over a period of time. The called party location may be the called subscriber location.

The second recognition model can correspond to the recognition model in the counterfeit official method scene. The first recognition model supports recognition of scene risks such as group call class, 114 inquiry class, tail number same class and the like of mobile phones.

Aiming at a mobile phone group call scene, the primary screening characteristics are as follows:

the number of caller numbers of a fraudster may be in a range of classes, typically greater than 0 and less than 80, with caller numbers greater than 3.

The calling time of the cheater accounts for more than 9 times of the total call time.

The fraudster has multiple caller records with at least one number.

The cheater only calls the mobile phone number and the fixed phone, and the cheater is the mobile phone number.

The total duration of the fraudster day call is greater than 1500 seconds.

The 114 query scene has the following features:

spoofer a will typically first use overseas or non-canonical numbers to induce the spoofed party to dial 114 a number to verify a certain public security number. Typically the first call duration of the spoofer a' S call with the spoofed person is longer, and will exceed 1200S.

The spoofed person will actively dial 114 numbers, typically non-native 114 numbers, of 3-7 digits in length, and call duration typically within 5 minutes.

The fraudster B changes the tail number to a certain public security number just verified by the fraudster, and contacts the fraudster immediately after the fraudster dials 114 the number. The single call duration is typically greater than 1 hour, or the total call duration is greater than 2 hours.

The tail number same class scene features are as follows:

the fraudsters and the fraudsters typically have only call records on the day, and no call records for the past 5 days.

Among such cases, the fraud number is usually 2 or more.

Typically one of the fraud numbers is an overseas or non-canonical number at the beginning of 00, which will be the number of the caller actively calling the spoofed person and the call duration is long.

After the victim finishes the call with the first fraud number, the victim will actively dial a fraud number with the same last 8 digits as the first fraud number but different prefixes, usually with a shorter duration, usually within 5 MIN.

The characteristics of impersonation of a main pipe gate are as follows:

fraud numbers usually start with a 00+ international area code or fictional international area code as the number, end with a certain number as the number, and the number itself does not conform to the normal international incoming call structure.

Fraud numbers usually only have calling behavior, and basically no callback phenomenon exists.

If the time of the fraud number talking with a spoofed number exceeds a certain time, the probability of the spoofed number being spoofed to transfer accounts is obviously improved.

The recognition model comprises a second recognition model, and an analysis strategy corresponding to the second recognition model is determined based on one or more of the following parameters:

a calling number; number of callers; the calling time length is compared with the duty ratio of the total call time length; the number of times a number is called; the total duration of the call on the same day; communication means; the first call duration; a called calling number; the call duration of the called party and the called number; a calling number; single call duration; the same calling and called call total duration; a talk time; a called number; the number of times the calling number is dialed back.

The number of calling numbers may be considered as the number of calling numbers. The number of callers may be considered the number of callers. The ratio of the calling time length compared with the total call time length can be regarded as the ratio of the calling time length to the total call time length. The number of times a number is called may be considered as the number of times a certain number is called. The number of times a number is called may be within a set time period, and the set time period may be one or more days without limitation.

The day is not limited and may be the day on which the risk may occur. The total duration of the call on the day may be the total duration of the call on the day where the risk occurs. The communication means may include mobile communication and fixed telephone communication.

The first call duration may be the duration of the first call between the two communicating parties that are at risk.

The called call number may be the number of the active call of the called at risk.

The call duration of the called party and the called number can be the call duration of the called party and the called number, and the call duration can be single call duration or accumulated call duration.

The calling number may be the number of the subscriber for which the caller is at risk, such as the number corresponding to the calling subscriber.

The single call duration may be the duration of one call of both parties.

The same total duration of the calling and called calls may be the same total duration of the calling and called calls. If the two parties of the call are the a user and the b user, the total duration of the call of the a user and the b user is summarized as the total duration of the call of the same calling party and the called party.

The talk time may be considered as the time of communication between the two parties, and the frequency of communication between the two parties may be determined based on the time of communication, such as determining whether the two parties have a talk log on the day only. The day may be the day that is judged to determine whether there is a risk or the day that a risk occurs.

The recognition model comprises a third recognition model, and an analysis strategy corresponding to the third recognition model is determined based on one or more of the following parameters:

setting the duty ratio of the dialed digit number in the first set duration; a called number; the date of the detail list; cell identification number; average telephone charge; the duty ratio of the called first set rule number.

The third recognition model may correspond to an online shopping scenario. The scene has the following behavior characteristics:

the ratio of the dialed digits of the digits number set in the first set duration corresponding to the short number (short number: 3 digits number with phone2Type 0) which is not dialed in 8 days;

the numbers which are 3, 8, 11, 14, 16 and 18 and do not dial phone2type in 8 days correspond to called numbers;

The machine is a mobile phone: phone1type is 2 or 9, excluding dummy (number at the beginning of 170, 171, 165, 167);

the date appearing in the B-field ticket in 8 days fully contains the date in the O-field ticket corresponding to the detail date;

the number of lacs which are not divided into the calling party and the called party within 8 days is less than or equal to the number of the corresponding cell identifications of 4;

the 8 balance average telephone charge is more than 10 yuan (no difference between calling and called and original unit is li) (total telephone charge/active days);

the frequency ratio of the calling phone2_type of 8 days to the calling phone2_type of 9 is more than or equal to 0.95, and the frequency ratio corresponds to the duty ratio of the first set rule number of the called.

The phone2type is also called phone2_type and phone1type may be used to identify the type that is a phone number.

The duration of the first set duration is not limited, and may be determined according to practical situations, for example, 8 days. The number of bits to be set is not limited and may be determined according to practical situations, for example, 3 bits. And determining whether the short number is dialed or not based on the dialed duty ratio of the number of the set digits in the first set duration.

It may be determined whether the number of the first set rule has been dialed based on the called number. The duty ratio of the called first set rule number can be the ratio of the number conforming to the first set rule number to the number of the called numbers in the called.

The number of the first setting rule is not limited, and the number of digits and/or the number included in the number may be determined based on the first rule. The detail date may be a date of the detail information. Such as a detailed list of month 4 of a certain year, the detailed date is month 4 of a certain year.

The average telephone charge may be an average of telephone charges over a period of time, such as the sum of n days of telephone charges divided by n. n is a positive integer.

The recognition model comprises a fourth recognition model, and an analysis strategy corresponding to the fourth recognition model is determined based on one or more of the following parameters:

the number of calling numbers in the same day; average call duration of the day; the calling duty ratio with the set bit number in the second set time length; a telephone business mode; the ratio of calling call with the mobile phone user in the third set time length; telephone charge; liveness; the number of contacts in common use; number of incoming calls.

The fourth recognition model may recognize a counterfeit winning scenario. The behavior characteristics under the scene are as follows:

fraud number the current day caller number is typically greater than 3;

the average call time of the fraud number is 15 seconds to 240 seconds;

the fraud number does not make a call with the short number within 8 days (corresponding to the duty ratio of the called number of digits in the second set duration), and the international long distance is not available;

The fraud number is mainly used for calling with the mobile phone user within 8 days, and the ratio of the fraud number to the mobile phone user for calling within a third set duration corresponds to the ratio of the fraud number to the mobile phone user;

the fraud number package has a lower grade, but is more active, and the average telephone charge per day is more than 10 yuan;

the fraud number does not have a common contact person, and the fraud number does not contact the same person frequently, and corresponds to the number of the common contact person;

the fraud number is not always called, mainly called, and corresponds to the number of times of calling.

The day may be a risk day, such as a fraud day. The number of the calling numbers on the day may be the number of the calling numbers on the day of risk. The average call length of the day may be an average of call lengths per call on the risk day. The duration of the second set duration is not limited, and may be determined according to actual conditions. The number of bits of the set number of bits is not limited, and may be determined based on the scene. The call ratio with the called party with the set bit number in the second set time length can determine whether to call with the called party with the set bit number in the second set time length.

Telephone service modes include international long distance or roaming. The duration of the third set duration is not limited, and may be determined based on actual conditions, such as 8 days. The ratio of the number of calls with the mobile phone user in the third set time period to the number of calls with the mobile phone user in the third set time period can be the ratio of the number of calls with the mobile phone user in the third set time period to the number of calls in the third set time period. The telephone charge may be a monthly telephone charge, or a daily telephone charge. Liveness may be the liveness of a communication. The measure of liveness is not limited, as may be based on the number of calls received or placed. The number of frequent contacts may be used to gauge whether a frequent contact exists. The number of incoming calls may be the number of incoming calls and may be used to determine the probability of being a called party.

Specific numerical values in the present invention are only examples, and can be adaptively adjusted according to practical situations, for example, the adjustment is performed for 8 days to 5 days, or 7 days.

The recognition model comprises a fifth recognition model, and an analysis strategy corresponding to the fifth recognition model is determined based on one or more of the following parameters:

the home location of the calling opposite terminal is the proportion of the home location of the home terminal; the attribution of the calling opposite terminal is the proportion of the local terminal; calling times in a third set duration are counted; the number of times the calling party sets the rule number second.

The fifth recognition model may correspond to a silent card scenario where it corresponds to a new open time in tens of days, the number lifecycle being "open card-silent period (no talk activity for multiple days) -test card-silent period-active high frequency talk (suspected to start fraud) -fraud success post-discard card (no talk after the date of the report). The features in this scenario are as follows:

the number proportion of the home location of the calling opposite terminal is less than or equal to 0.2, and the corresponding home location of the calling opposite terminal is the proportion of the home location of the home terminal;

the number proportion of the home location of the calling opposite terminal is less than or equal to 0.2, and the corresponding home location of the calling opposite terminal is the proportion of the home location of the calling opposite terminal;

The ratio of calling times in two days is larger than 0.7 (corresponding to the ratio of calling times in the third set duration), or the number of times of calling phone2_type of 7 is larger than 1, corresponding to the number of times of calling the second set rule number;

detecting that no call is made before 8 am on the same day;

the number of the places is more than or equal to 2, for example, the number of the places with fraud numbers is more than or equal to 2.

The proportion of the home of the calling party to the home of the home party can be regarded as the duty ratio of the home of the called party to the home of the calling party.

The proportion of the home location of the calling party to the home location of the home party can be regarded as the duty ratio of the home location of the called party to the home location of the calling party.

The duration of the third set duration is not limited, and may be set based on actual conditions, and the ratio of the number of calls in the third set duration to the number of calls in the third set duration may be a ratio of the number of calls in the third set duration. The number of calls includes the number of calls and the number of calls.

The second set rule number may be a number satisfying the second set rule, and the second set rule may be determined according to a corresponding scenario, for example, based on a number mantissa or a number included in the number. The second setting rule may be that phom2_type is 7.

The scene corresponding to the sixth recognition model may be a network friend-making scene, and the friend-making fraud number is a positive sample. And (3) establishing a preliminary screening condition and feature expansion based on the call features, establishing a machine learning algorithm model, detecting and outputting the network friend-making fraud number of the b-domain ticket data, and performing processing such as stopping the detected number or prompting risks to potential victims. Through the preliminary screening condition, the interference sample is filtered, only samples with obvious fraud characteristics are reserved, for example, through a data detection source, most numbers accord with the characteristics of professional network wedding fraud, for example, the users can roam in different places within three months of a new account, and the cheating people are also concentrated in underdeveloped places; the system sets a threshold value and only keeps the number extraction characteristics that the number of call records is larger than a certain number.

The scene corresponding to the sixth recognition model has the following characteristics (the following characteristics can be used as an analysis strategy to analyze characteristic variables):

the roaming proportion of the fraud users is higher, and more than 95% of users are in a roaming state.

The fraud user fraud positions are relatively fixed, and the activity positions on the basic fraud day are very small.

Most of the fraud users are new account opening users, and the proportion of the new account opening users in one year is as high as 87%.

The difference between the locations of the fraud users and the opposite terminal numbers is high.

The analysis strategy corresponding to the sixth recognition model is determined based on one or more of the following parameters:

roaming proportion; a location; account opening time; the caller is located; the called party is located.

The roaming proportion may be the proportion of roaming calls to all calls. The location may be the geographic location of the fraudster or the geographic location of the fraudster. The time of opening an account can be the time of opening an account by a mobile phone card and is used for determining whether the user is a new user of opening an account.

The seventh recognition model may correspond to a network credit scenario, which includes a credit card scenario with the following basic features:

the activity level is low in 30 days of history;

the occupation of roaming call in the same day is higher;

the average of the total duration of 7 days of history is low;

The roaming proportion of the fraud users is high, and the call roaming proportion of the fraud day is as high as 80%;

the user is not very active before fraud, and the activity ratio is lower than 40% thirty days before detection;

the average value of the total duration of each day for a plurality of days before fraud is less than or equal to 1885 seconds.

liveness; the duty ratio of the roaming call in the same day; and a mean value of total call duration of each day in a fifth set duration.

Liveness may be determined by the number of calls or frequency. The duty cycle of the current day roaming call may be the duty cycle of the fraud current day roaming call and all the calls of the current day. The duration of the fifth set duration is not limited. The roaming proportion can be the current day roaming proportion, the period roaming proportion, or the number full life cycle roaming proportion. The numerical values in the invention are all examples, and can be adjusted according to practical conditions, for example, 1885 seconds can be 1900 seconds.

In one embodiment, obtaining the history details includes:

acquiring risk information within a set date range;

acquiring a history detail list of a service domain corresponding to the risk information;

aiming at the numbers in the history detail list, determining whether the current day details and the details in the set time length of the numbers meet the set index; if yes, acquiring a history detail list of the number.

The date of the setting may be determined based on the scene, such as the end of the month, the beginning of the month, or the middle of the month. The risk information may correspond to iq data, to a ticket in the presence of fraud, such as a telephone number including fraud time, fraud, etc.

The manner of acquiring the risk information is not limited, and the risk information may be input by a user or transmitted by a system storing the risk information.

After the risk information is determined, historical detail information of the risk information may be obtained. If the risk information may include fraud time and fraud telephone numbers, after the risk information is determined, a ticket to the fraud telephone number may be obtained, and a time range of the ticket may be determined based on the fraud time. Such as historical details 8 days before the fraud time.

After the history details of the service domain are obtained, the numbers can be grouped, and whether the details of the day (i.e. the ticket of the fraud day) and the details in the set time period (i.e. the ticket in 8 days) of the numbers included in the history details meet the set index is determined. The setting index may be determined based on the characteristics of the scene without limitation. If the set index is met, a history list of numbers can be obtained for model training.

FIG. 3 is a logic flow diagram of a second recognition model provided in accordance with an embodiment of the present invention, see FIG. 3, where iq date may be a spoofed date. The iq data can be regarded as risk information. And carrying out index statistics and correspondence by using the phone bill of the current day to determine whether the current day details of the number meet the set index. The setting index may be determined based on the following parameters: 4 hours on the day of LACCI duplicate removal number, 4 hours on the day of opposite end duplicate removal number, 4 hours on the day of total duration and 4 hours on the day of calling number ratio. Wherein the total duration may be a total call duration. The laci deduplication number may be the number of cell identities after deduplication. The number of opposite terminal de-duplicated numbers in 4 hours can be regarded as the number of called numbers after de-duplicated in 4 hours.

And analyzing and correspondingly determining whether details in the set time length meet the set index or not by using the total 8-day ticket statistical index. The corresponding setting index may be determined based on the following parameters: average calling contact days in 8 days, roaming proportion in 8 days, account opening days, and call times proportion of mobile phone numbers at opposite ends in 8 days.

Wherein, average calling contact days in 8 days and average contact days of the dialed telephone number in 8 days. If the number of days of contact with the first telephone number is 3 days and the number of days of contact with the second telephone number is 2 days within 8 days, the average number of calling contact days within 8 days may be 2.5.

The number of times of the mobile phone number at the opposite terminal in 8 days can be considered as the ratio of the number of times of the mobile phone number at the opposite terminal in 8 days to all the number of times of the mobile phone number in 8 days.

Feature expansion in fig. 3 may be performed based on features corresponding to the scene for feature extraction and analysis. The special peer number may be the correct non-fraudulent peer number. Such as the correct telephone number that was imitated.

Fig. 4 is a logic flow diagram of a third recognition model provided according to an embodiment of the present invention, referring to fig. 4, when the model is built, feature variable extraction and analysis may be performed to perform variable feature extraction and analysis based on features of the corresponding scene.

In one embodiment, obtaining the history details includes:

acquiring a history detail list of a service domain;

the history details are filtered based on the time of opening an account.

Fig. 5 is a logic flow diagram of a fifth recognition model provided according to an embodiment of the present invention, referring to fig. 5, in a silence scenario, a history list may be filtered based on an account opening time. The time of opening an account may be the time of opening an account of a cell phone number.

The embodiment can acquire all the history details of the service domain, and then extract the sample ticket from the history details with the account opening time smaller than the set days. Feature variable extraction and analysis may be based on features of the corresponding scene.

Fig. 6 is a logic flow diagram of a sixth recognition model provided according to an embodiment of the present invention, referring to fig. 6, in a network friend-making scene, feature expansion may be performed based on features in the scene. Such as feature extraction and analysis. After training the model, the characteristics of the detailed information can be determined and then model prediction can be performed.

In one embodiment, obtaining the history details includes:

acquiring the number of a calling party in the service domain on the same day;

based on the number proportion of the telephone bill in the first set number of days, account opening time, the daily roaming occupation ratio, the average value of the total daily call duration and the number of opposite terminal numbers in the second set number of days, and filtering the numbers;

And acquiring a history detail list of the filtered numbers.

The number of days of the first set number of days is not limited, and may be 30 days, for example. The ratio of the number of days of the ticket in the first set number of days may be a ratio of the number of days of the ticket in the first set number of days to the first set number of days. The time of opening an account may be the time of opening an account of the mobile phone number. The current day roaming duty cycle may be a duty cycle of the current day roaming number of calls to the total number of calls. The number of the second set number of days is not limited. The number of opposite numbers may be the number of numbers called and/or incoming.

The present embodiment is not limited to the filtering means.

Fig. 7 is a logic flow diagram of a seventh recognition model provided in accordance with an embodiment of the present invention, and referring to fig. 7, in the network lending scenario, the univariate anomaly threshold may be a threshold of a corresponding parameter, such as a threshold of the number of opposite terminal numbers in 8 days, and a threshold of the number of calling opposite terminal numbers in the same day. Feature extension may be based on features of the corresponding scene. Such as feature extraction and analysis.

The identification method provided by the invention can be regarded as a method for identifying suspected fraud telephones based on telecom operator data, and the acquisition, storage, use and the like of the data related by the invention are used for obtaining the consent and authorization of all people. The invention identifies suspected fraud calls in real time based on call behavior and service data. Through the business domain (business support system, B domain), the operation domain (operat ion support system, O domain), the management domain (management support system, M domain) data, the fraud telephone is accurately identified by combining the business angle and the typical fraud scene, and the alarm is monitored in time and an interception blocking mechanism is formed. The set of recognition models has fraud recognition capabilities for a variety of scenarios. The IMEI blacklist of the import terminal is supported, monitoring is carried out based on the O domain signaling, and a plurality of corresponding suspected fraud numbers are found; while outputting content support for one-by-one presentation of data for suspected telephone numbers, suspected fraud, fraud types, etc.

Fig. 8 is a schematic structural diagram of an identification device according to an embodiment of the present invention, as shown in fig. 3, the device includes:

a first determining module 810, configured to determine, based on the detailed information and the set of recognition models, candidate results output by the recognition models included in the set of recognition models;

a second determining module 820, configured to determine an identification result of the detailed information based on the candidate result and a matching result of the detailed information corresponding to the candidate result;

Optionally, the identification module includes: each recognition model is obtained based on historical detail training under a scene to which the recognition model belongs, and the device further comprises a training module, which comprises:

the acquisition unit is used for acquiring the history detail list;

the extracting unit is used for extracting characteristic variables in the history detail list;

the analysis unit is used for analyzing the characteristic variables based on an analysis strategy corresponding to the scene corresponding to the identification model;

a determining unit configured to determine a retained feature variable based on the analysis result;

and the training unit is used for training the identification model based on the characteristic variable.

Optionally, the obtaining unit is further configured to:

acquiring risk information within a set date range;

Optionally, the obtaining unit is further configured to:

acquiring a history detail list of a service domain;

the history details are filtered based on the time of opening an account.

Optionally, the obtaining unit is further configured to:

acquiring the number of a calling party in the service domain on the same day;

and acquiring a history detail list of the filtered numbers.

Optionally, the recognition model includes a first recognition model, and an analysis strategy corresponding to the first recognition model is determined based on one or more of the following parameters:

calling duty cycle; number of calling party in the same day; average calling call duration of each time; cell identification number; the longest contact days in the dialed number; the number of contacts in common use; a telephone business mode; the total calling time of the day; average call charge per day; the place of the called party;

Optionally, the first determining module 810 is specifically configured to:

The identification device provided by the embodiment of the invention can execute the identification method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

Fig. 9 is a schematic structural diagram of an electronic device implementing an identification method according to an embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.

As shown in fig. 9, the electronic device 10 includes at least one processor 11, and a Memory, such as a Read-Only Memory (ROM) 12, a random access Memory (Random Access Memory, RAM) 13, etc., communicatively connected to the at least one processor 11, wherein the Memory stores a computer program executable by the at least one processor 11, the computer program being executed by the at least one processor 11 to enable the at least one processor 11 to perform the method provided by the present invention.

The processor 11 may perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM) 12 or a computer program loaded from a storage unit 18 into a Random Access Memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM 12 and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.

Various components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, etc.; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.

The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU), various dedicated artificial intelligence (Artificial Intell igence, AI) computing chips, various processors running machine learning model algorithms, digital signal processors (Digital Signal Process, DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as method XXX.

In some embodiments, the method may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. One or more steps of the methods described above may be performed when the computer program is loaded into RAM 13 and executed by processor 11. Alternatively, in other embodiments, the processor 11 may be configured to perform the identification method in any other suitable way (e.g. by means of firmware).

Various implementations of the systems and techniques described here above can be implemented in digital electronic circuitry, integrated circuit systems, field programmable gate arrays (Field Programmable Gate Array, FPGAs), application specific integrated circuits (Application Specific Integrated Circuit, ASICs), application specific standard products (Application Specific Standard Parts, ASSPs), systems On Chip (SOC), complex programmable logic devices (Complex Programmable logic device, CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of the present invention, a computer-readable storage medium storing computer instructions for causing a processor to execute the computer-readable storage medium provided … … by the present invention may be a tangible medium that can contain, or store, a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-Only Memory (ROM), an erasable programmable read-Only Memory (Erasable Programmable Read-Only Memory, EPROM or flash Memory), an optical fiber, a compact disc read-Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: other types of devices may also be used to provide interaction with the user, for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback), and input from the user may be received in any form (including acoustic input, speech input, or tactile input).

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local area network (Local Area Network, LAN), wide area network (Wide Area Network, WAN), blockchain network, and the internet.

The computing system may include clients and servers. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical host and virtual special server (Virtual Private Server, VPS) service are overcome.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.

The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.

Claims

1. A method of identification, comprising:

2. The method of claim 1, wherein each of the recognition models is trained based on historical details of a scene to which the recognition model belongs, the training operation of the recognition model comprising:

acquiring a history detail list;

extracting characteristic variables in the history detail list;

determining a reserved characteristic variable based on the analysis result;

training the recognition model based on the feature variables.

3. The method of claim 2, wherein obtaining the history details comprises:

acquiring risk information within a set date range;

4. The method of claim 2, wherein obtaining the history details comprises:

acquiring a history detail list of a service domain;

the history details are filtered based on the time of opening an account.

5. The method of claim 2, wherein obtaining the history details comprises:

acquiring the number of a calling party in the service domain on the same day;

and acquiring a history detail list of the filtered numbers.

6. The method of claim 2, wherein the recognition model comprises a first recognition model, and wherein an analysis strategy corresponding to the first recognition model is determined based on one or more of the following parameters:

7. The method of claim 1, wherein the determining candidate results for the recognition model output included in the recognition model set based on the detailed information and the recognition model set comprises:

8. An identification device, comprising:

9. An electronic device, the electronic device comprising:

at least one processor; and

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A computer readable storage medium storing computer instructions for causing a processor to perform the method of any one of claims 1-7.