TWI729412B - Fraud phone call detecting method and electronic device - Google Patents

Abstract

A fraud phone call detecting method and an electronic device are provided. The method includes: obtaining a plurality of voice call detail records related to voice; obtaining a plurality of call features of each of a plurality of phone numbers according to the plurality of voice call detail records; inputting the plurality of call features of each of the plurality of phone numbers to a trained model to obtain a determining result; and outputting the determining result, wherein the determining result is used to indicate that phone numbers belongs to a fraud phone call in the plurality of phone numbers.

Description

Fraud phone detection method and electronic device

The present invention relates to a method for detecting fraudulent calls and an electronic device.

Scam calls are a very important part of the current public order prevention and control. However, there is currently no effective method to identify whether a phone number is a fraudulent call. Therefore, how to identify whether a door number is a fraudulent call is one of the problems that those skilled in the art want to solve.

The present invention provides a fraudulent call detection method and electronic device, which can effectively identify the door number of a fraudulent call through a trained model.

The present invention provides a fraudulent call detection method for an electronic device. The method includes: obtaining a plurality of voice communication records related to voice; and obtaining each of the plurality of door numbers according to the plurality of voice communication records. Multiple call features of each of the multiple door numbers; input the multiple call features of each of the multiple door numbers into a trained model to obtain a judgment result; and output the judgment result, wherein the The judgment result is used to point out the door number belonging to a fraudulent call among the plurality of door numbers.

The present invention provides an electronic device. The electronic device includes an input/output circuit and a processor. The processor is used for coupling to the input and output circuit. The input and output circuit obtains multiple voice communication records related to voice. The processor obtains multiple call characteristics of each of the multiple door numbers according to the multiple voice communication records. The processor inputs the plurality of call characteristics of each of the plurality of door numbers into a trained model to obtain a judgment result. The input and output circuit outputs the judgment result, wherein the judgment result is used to indicate the door number belonging to a fraudulent call among the plurality of door numbers.

Based on the above, the fraudulent call detection method and electronic device of the present invention can effectively identify the door number of a fraudulent call through the trained model, thereby preventing the harm caused by the fraudulent call to the public.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

Now referring to the exemplary embodiments of the present invention in detail, examples of the exemplary embodiments are illustrated in the accompanying drawings. In addition, wherever possible, elements/components with the same reference numbers in the drawings and embodiments represent the same or similar parts.

FIG. 1 is a block diagram of an electronic device according to an embodiment of the invention.

Please refer to FIG. 1, the electronic device 100 includes a processor 20, an input/output circuit 22 and a storage circuit 24. Among them, the input/output circuit 22 and the storage circuit 24 are respectively coupled to the processor 20. The electronic device 100 is, for example, an electronic mobile device such as a desktop computer, a server, a mobile phone, a tablet computer, a notebook computer, etc., which is not limited herein.

The processor 20 may be a central processing unit (Central Processing Unit, CPU), or other programmable general-purpose or special-purpose microprocessors (Microprocessor), digital signal processors (Digital Signal Processor, DSP), programmable Integrated circuit (Application Specific Integrated Circuit, ASIC) or other similar components or a combination of the above components.

The input/output circuit 22 is, for example, an input interface or circuit for obtaining relevant data from outside the electronic device 100 or other sources. In addition, the input/output circuit 22 can also transmit the data generated by the electronic device 100 to the output interface or circuit of other electronic devices, which is not limited herein.

The storage circuit 24 can be any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory (flash memory) or similar components Or a combination of the above elements.

In this exemplary embodiment, a plurality of code fragments are stored in the storage circuit 24 of the electronic device 100, and after the above-mentioned code fragments are installed, they will be executed by the processor 20. For example, the storage circuit 24 includes a plurality of modules, and each operation of the fraudulent call detection method applied to the electronic device 100 is executed by these modules, and each module is composed of one or more code fragments. . However, the present invention is not limited to this, and various operations of the electronic device 100 may also be implemented in other hardware forms.

Fig. 2 is a flowchart of the training of a model according to an embodiment of the present invention.

Please refer to FIG. 2, assuming that the electronic device 100 is operating in a telecom operator's computer room. It should be noted that when a phone number provided by the carrier makes a call, a database (also known as the first database) of the carrier will also store a corresponding call detail record (Call Detail). Record, CDR). When training the model, the processor 20 may first obtain, from the first database, a contact record (also referred to as a first contact record) that has been previously (for example, manually) identified as a fraudulent phone number. After that, the processor 20 may perform a feature extraction operation (step S201). In more detail, the communication records may include data related to telephone voice and data related to the Internet. The feature extraction operation here is mainly used to capture the data related to the phone voice in the contact record (also called the voice contact record), and this data can include, for example, the door number, the time point of the call, and the call Information such as the length of time and the base station used during the call.

After extracting the data related to the telephone voice (ie, the voice communication record) from the first communication record, the processor may perform a feature pre-processing operation (step S203). For example, since a phone number generates a contact record when making a call, this step is mainly used to perform data aggregation operations to integrate multiple voice contact records related to the same door number. In this way, multiple call features of the same door number can be obtained. Therefore, the processor 20 may, for example, perform a data aggregation operation on multiple voice communication records identified as fraudulent phone numbers in advance to obtain multiple call characteristics (also known as fraudulent phone numbers). , The first call feature). Among them, the call characteristics may include: the number of calls in a single day for a door number in a period of time (for example, a week), the time period of the call, the average length of a single call, the standard deviation of the length of a single call, and the average total of a single day. At least one of the length of the talk time, the diversity of the receiving number, the number of base stations used, and the third to fourth digits of the calling number.

The number of calls in a single day is, for example, the average number of calls per day in a week. It should be noted that since the number of fraudulent calls in a single day is usually higher than that of ordinary non-fraud calls, in the first call feature mentioned above, the number of single-day calls will be greater than a threshold. (Also referred to as the first threshold), and the present invention is not used to limit the value of the first threshold.

The time period of the call is, for example, the average value of the time of the first call and the time of the last call of a door number in a period of time (for example, a week). It should be noted that since the time of making a fraudulent call is usually between 8 am and 6 pm, in the aforementioned first call feature, the call period will be in a specific time period (for example, from 8 am to 6 pm). Between 6 pm), and the present invention is not used to limit the specific time period.

The average of the length of a single call is, for example, the sum of the length of the call time of each call of a door number in a period of time (for example, a week) divided by the number of calls in the period. It should be noted that the average length of a single call of a fraudulent call is usually lower than the average length of a single call of a general non-fraud call. Therefore, in the aforementioned first call feature, the average length of a single call Will be less than a threshold value (also referred to as the second threshold value), and the present invention is not used to limit the value of the second threshold value.

The standard deviation of the length of a single call is, for example, the calculation of the standard deviation of the length of the call for each call of a door number in a period of time (for example, a week). It should be noted that since the standard deviation of the length of a single call of a fraudulent call is usually lower than the standard deviation of the length of a single call of a general non-fraud call, the length of a single call is therefore The standard deviation of is smaller than a threshold value (also referred to as the third threshold value), and the present invention is not used to limit the value of the third threshold value.

The average total talk time in a single day is, for example, the sum of the talk time of each call of a phone number in a period of time (for example, a week) divided by the number of days in the period of time. It should be noted that the average daily total call time length of fraudulent calls is usually greater than the average daily average total call time length of general non-fraud calls. Therefore, in the aforementioned first call feature, the average single-day total call time length will be It is greater than a threshold value (also referred to as the fourth threshold value), and the present invention is not used to limit the value of the fourth threshold value.

The diversity of the callee number may be the area where the callee number is located or the ethnic group of the owner of the callee number (for example, the number of ethnic groups distinguished by age or occupation). It should be noted that because the diversity of the received numbers of fraudulent calls is usually greater than the diversity of ordinary non-fraud calls, the diversity of the received numbers in the aforementioned first call feature will be greater than a threshold (also It is called the fifth threshold), and the present invention is not used to limit the value of the fifth threshold.

The number of base stations used may be the average number of base stations used by a door number in a period of time (for example, a week). It should be noted that because the computer room of the fraud group is usually fixed at a certain point, the ratio of the base station used by the fraudulent call (for example, the number of calls made and the base station used by the broadcasted call The ratio of the number of base stations) is usually smaller than the number of base stations used by ordinary non-fraud calls. Therefore, in the aforementioned first call feature, the number of base stations used will be less than a threshold (also known as the sixth threshold). ), and the present invention is not used to limit the value of the sixth threshold.

The third to fourth codes of the calling number are, for example, the third and fourth numbers from left to right of the calling number. It should be noted that since fraudulent groups may bid for a large number of door numbers with similar numbers at one time, the third to fourth digits of the phone number used by fraudulent calls usually meet a specific value. However, the present invention is not used to limit the specific value.

After that, the processor 20 trains a model according to the first call feature of each phone number identified as a fraudulent call (step S205) to generate and obtain a trained model (step S207). The model generated in step S207 can be used to predict whether a door number is a fraudulent call.

In more detail, FIG. 3 is a flowchart of the use of the model according to an embodiment of the present invention.

Please refer to FIG. 3. First, referring to FIG. 3, the processor 20 may first obtain the communication record of the door number to be recognized from the first database, for example. After that, the processor 20 may perform a feature extraction operation (step S301). Similar to the foregoing, the communication records may include data related to telephone voice and data related to the Internet. The feature extraction operation here is mainly used to capture the data related to the phone voice in the contact record (also called the voice contact record), and this data can include, for example, the door number, the time point of the call, and the call Information such as the length of time and the base station used during the call. In this embodiment, the processor 20 also stores the retrieved voice communication records in another database (also referred to as a second database) for subsequent processing and analysis.

After performing step S301, the processor 20 may perform feature pre-processing operations (step S303). Similar to the above, since a phone number will generate a contact record when making a call, this step is mainly used to perform data aggregation operations to integrate multiple voice contact records related to the same door number. In this way, multiple call features of the same door number can be obtained. Therefore, the processor 20 may, for example, perform a data aggregation operation on multiple voice communication records of multiple door numbers to be recognized to obtain multiple call characteristics of each door number to be recognized. Similarly, call characteristics can include: the number of calls made in a single day for a door number in a period of time (for example, a week), the time period of the call, the average length of a single call, the standard deviation of the length of a single call, and the average of a single day At least one of the length of the total talk time, the diversity of the receiving number, the number of base stations used, and the third to fourth digits of the calling number.

After that, the processor 20 can input the call characteristics of each door number to be recognized in the foregoing step S303 into the trained model generated in the foregoing FIG. 2 (step S307) to obtain a judgment result. After that, the input/output circuit 22 outputs the aforementioned judgment result, and the judgment result is used to indicate the number of a fraudulent call among the plurality of door numbers used for identification.

It should be noted that the present invention uses a decision tree-based machine learning algorithm (for example, Light GBM) to train the aforementioned model. However, the present invention is not limited to this. In other embodiments, other machine learning or deep learning algorithms can also be used to generate the aforementioned model.

FIG. 4 is a schematic diagram of the accuracy of model prediction according to an embodiment of the present invention.

Please refer to FIG. 4, assuming that in the matrix M1 of FIG. 4, row C1 represents the number of phone numbers predicted (or identified) as fraudulent calls by the aforementioned model. Row C2 represents the number of phone numbers predicted (or identified) as non-fraud calls by the aforementioned model. Column R1 represents the actual number of fraudulent calls. Column R2 represents the actual number of non-fraud calls. Therefore, with rows C1 to C2 and columns R1 to R2, four blocks BK1 to BK4 in the matrix M1 can be formed, and each block includes at least one door number. And the accuracy of model prediction. In this embodiment, it is assumed that 40,545 door numbers are judged. If the model generated by Light GBM is used for prediction, block BK1 will have 205 door numbers, block BK2 will have 141 door numbers, block BK3 will have 97 door numbers, and block BK4 will have 40102 door numbers. . Among all the door numbers, the proportion of the number accurately predicted by the model as fraudulent calls and the number accurately predicted as non-fraud calls can be called Accuracy. The accuracy of the model can be calculated as follows: (205+40102)/(205+40102+97+141)=99.4%. In addition, among the fraudulent calls predicted by the model, the proportion of real fraudulent calls can be called Precision. Therefore, the accuracy of the model can be calculated as follows: (205)/(205+97)=68.6%. In particular, after the present invention has undergone experiments, the model generated by using Light GBM will have higher accuracy and longitude accuracy.

FIG. 5 is a flowchart of a method for detecting fraudulent calls according to an embodiment of the present invention.

Referring to FIG. 5, in step S501, the input/output circuit 22 obtains multiple voice communication records related to voice. In step S503, the processor 20 obtains the call characteristics of each of the plurality of door numbers according to the aforementioned multiple voice communication records. In step S505, the processor 20 inputs the call characteristics of each of the aforementioned door numbers into the trained model to obtain the judgment result. Among them, the result of this judgment is used to indicate the number of a fraudulent call among the aforementioned multiple door numbers. Finally, in step S507, the input/output circuit 22 outputs the aforementioned judgment result.

In summary, the fraudulent call detection method and electronic device of the present invention can effectively identify the door number of a fraudulent call through the trained model, thereby preventing the harm caused by the fraudulent call to the public.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the relevant technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be subject to those defined by the attached patent application scope.

100: electronic device 20: processor 22: Input and output circuit 24: storage circuit S201~S207, S301~S307, S501~S507: steps BK1~BK4: block C1~C2: OK R1~R2: column M1: matrix

FIG. 1 is a block diagram of an electronic device according to an embodiment of the invention. Fig. 2 is a flowchart of the training of a model according to an embodiment of the present invention. Fig. 3 is a flow chart of the use of a model according to an embodiment of the present invention. FIG. 4 is a schematic diagram of the accuracy of model prediction according to an embodiment of the present invention. FIG. 5 is a flowchart of a method for detecting fraudulent calls according to an embodiment of the present invention.

S501~S507: steps

Claims (12)

A method for detecting fraudulent calls is used in an electronic device. The method includes: obtaining a plurality of voice communication records related to voice; and obtaining, according to the plurality of voice communication records, among a plurality of phone numbers provided by a telecommunications company Multiple call characteristics of each door number, wherein the multiple call characteristics include the average number of base stations used by a door number in a week and the third to fourth digits of the calling number; each of the multiple door numbers The plurality of call characteristics of a door number are input to a trained model to obtain a judgment result; and the judgment result is output, wherein the judgment result is used to indicate the door of the plurality of door numbers that is a fraudulent call. number. The fraudulent call detection method according to the first item of the scope of patent application, wherein the step of obtaining the plurality of voice communication records related to voice includes: extracting from the plurality of communication records stored in a first database Obtain the multiple voice communication records related to the voice, and store the multiple voice communication records in a second database. The fraudulent call detection method according to the first item of the scope of patent application, wherein the plurality of calls of each of the plurality of phone numbers provided by the telecommunications company are obtained according to the plurality of voice communication records The feature step includes: performing a feature extraction operation and a data aggregation operation on the plurality of voice communication records to obtain the plurality of door numbers The multiple call characteristics of each door number in. The fraudulent call detection method described in item 1 of the scope of patent application, wherein the multiple call characteristics also include the number of calls per day, the time period of the call, the average length of a single call, and the standard for the length of a single call At least one of the difference, the average length of the total call time in a single day, and the diversity of the number of the call. The fraudulent call detection method according to the first item of the scope of patent application, wherein before the step of inputting the plurality of call features of each of the plurality of door numbers into the trained model, The method further includes: performing a feature extraction operation and a data aggregation operation on a plurality of first voice communication records that are previously identified as fraudulent phone numbers to obtain a plurality of first voice communication records. A call feature; training a model according to the plurality of first call features to obtain the trained model. The fraudulent call detection method as described in item 5 of the scope of patent application, wherein the number of calls in a single day in the plurality of first call characteristics is greater than a first threshold, the call period is within a specific period, and a single call The average length of is less than a second threshold, the standard deviation of the length of a single call is less than a third threshold, the average total call time in a single day is greater than a fourth threshold, and the diversity of received numbers is greater than a fifth threshold Value, the average number of the base stations used is greater than a sixth threshold and/or the third to fourth codes of the calling number meet a specific value. An electronic device comprising: an input and output circuit; and A processor for being coupled to the input and output circuit, wherein the input and output circuit obtains a plurality of voice communication records related to voice, and the processor obtains a plurality of voice communication records provided by the telecommunications company according to the plurality of voice communication records The multiple call characteristics of each of the multiple door numbers, wherein the multiple call characteristics include the average number of base stations used by a door number in a week and the third to fourth digits of the calling number, the processing The device inputs the plurality of call characteristics of each of the plurality of door numbers into a trained model to obtain a judgment result, and the input-output circuit outputs the judgment result, wherein the judgment The result is used to point out the number of a fraudulent call among the plurality of door numbers. The electronic device according to item 7 of the patent application, wherein in the operation of obtaining the plurality of voice communication records related to the voice, the processor obtains the plurality of communication records from the plurality of communication records stored in a first database In the process, the multiple voice communication records related to the voice are captured, and the multiple voice communication records are stored in a second database through the input and output circuit. The electronic device according to item 7 of the scope of patent application, wherein the call characteristics of each of the plurality of phone numbers provided by the telecommunications company are obtained based on the plurality of voice communication records In operation, the processor performs a feature extraction operation and a data aggregation operation on the plurality of voice communication records to obtain all of the plurality of door numbers. Describes multiple call features. As for the electronic device described in item 7 of the scope of patent application, the multiple call characteristics further include the number of calls per day, the time period of the call, the average length of a single call, the standard deviation of the length of a single call, and the number of calls per call. At least one of the average length of the total daily talk time and the diversity of the received number. The electronic device according to claim 7, wherein before inputting the plurality of call features of each of the plurality of door numbers into the operation of the trained model, the processing The device performs a feature extraction operation and a data aggregation operation on a plurality of first voice communication records that are previously identified as fraudulent phone numbers to obtain a plurality of first call features; A model is trained on the plurality of first call features to obtain the trained model. The electronic device described in item 11 of the scope of patent application, wherein the number of calls in a single day in the plurality of first call features is greater than a first threshold, the call period is within a specific period, and the length of a single call The average is less than a second threshold, the standard deviation of the length of a single call is less than a third threshold, the average total call time in a single day is greater than a fourth threshold, the diversity of the received numbers is greater than a fifth threshold, use The average number of the base stations is greater than a sixth threshold and/or the third to fourth codes of the calling number meet a specific value.

Images