WO2022107241A1

WO2022107241A1 - Processing device, processing method, and program

Info

Publication number: WO2022107241A1
Application number: PCT/JP2020/042976
Authority: WO
Inventors: 渉太遠藤
Original assignee: 日本電信電話株式会社
Priority date: 2020-11-18
Filing date: 2020-11-18
Publication date: 2022-05-27

Abstract

A processing device 1 comprises: an acquisition unit 21 for acquiring voice data from a fraud suspect in a call between the fraud suspect and a user; an inference unit 22 for inferring a fraud trick used by the fraud suspect by comparing, with utterances in the voice data, pattern data 12 for associating an identifier for trick utilizing calls, the fraud suspect's spoofing target during the trick, and keywords used in the fraud suspect's utterances during the trick; a calculation unit 23 for referencing priority level data that associates the identifier for the trick, an identifier for analysis scheme for analyzing the possibility that a call is fraudulent, and priority levels for analyzing with the analysis scheme the possibility that the call is a trick, and calculates, as a risk level, the possibility of fraud analyzed by using the analysis scheme with a high priority level from among the analysis schemes associated with the inferred trick; and a notification unit 24 for notifying the calculated risk level.

Description

Processing equipment, processing methods and programs

The present invention relates to a processing device, a processing method and a program.

There is an increasing number of special frauds that use calls to impersonate users' close relatives or employees of any organization, such as city hall employees, and commit fraud to users. There is a device that analyzes voice data in a call to detect special fraud, and various analysis methods have been proposed. For example, in Patent Document 1, the text data of voice data is compared with a trained model to calculate the accuracy corresponding to a specific call, and if the calculated accuracy is equal to or higher than a predetermined value, the predetermined terminal is notified. ..

Japanese Unexamined Patent Publication No. 2019-153961

However, due to the diversification and sophistication of special fraud techniques, it may not be possible to discriminate special fraud with a single analysis method. Even if there are many analysis methods, the effective analysis method may differ depending on the method. In such a situation, it is difficult to properly determine the possibility that the call is fraudulent.

The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a technique capable of appropriately determining the possibility that a call is fraudulent.

The processing device according to one aspect of the present invention includes an acquisition unit that acquires voice data of the fraudulent suspect in a call between the fraudulent suspect and the user, an identifier of the fraudulent method using the call, and the above-mentioned method in the method. An estimation unit that estimates the fraudulent method by the fraudulent suspect by comparing the pattern data that associates the fraudulent suspect's spoofing target with the keywords used in the fraudulent suspect's speech with the speech in the voice data. Refer to the priority data that associates the identifier of the technique with the identifier of the analysis method for analyzing the possibility that the call is fraud and the priority for analyzing the possibility that the call is the method by the analysis method. Then, among the analysis methods associated with the estimated method, the calculation unit that calculates the possibility of fraud analyzed by the analysis method with high priority as the risk level and the calculated risk level are notified. It has a notification unit.

In one aspect of the processing method of the present invention, a computer acquires voice data of the fraudulent suspect in a call between the fraudulent suspect and a user, and the computer obtains an identifier of a fraudulent technique using the call and an identifier. The fraudulent method by the fraudulent suspect is compared with the pattern data in which the spoofing target of the fraudulent suspect in the technique is associated with the keyword used in the speech of the fraudulent suspect in the technique and the speech in the voice data. Estimate and associate the computer with the tactical identifier, the identifier of the analysis method that analyzes the possibility that the call is fraudulent, and the priority of analyzing the possibility that the call is the tactic. With reference to the priority data, the possibility of fraud analyzed by the high-priority analysis method among the analysis methods associated with the estimated method is calculated as the risk level, and the computer is calculated. Notify the degree of danger.

One aspect of the present invention is a program that causes a computer to function as the above-mentioned processing device.

According to the present invention, it is possible to provide a technique capable of appropriately determining the possibility that a call is fraudulent.

FIG. 1 is a diagram illustrating a functional block of a processing system according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a data structure of call data. FIG. 3 is a diagram illustrating an example of a data structure of pattern data. FIG. 4 is a diagram illustrating an example of a data structure of priority data. FIG. 5 is a diagram illustrating an example of a data structure of voiceprint data. FIG. 6 is a diagram illustrating an example of a data structure of number data. FIG. 7 is a flowchart illustrating an example of the calculation process by the calculation unit. FIG. 8 is a diagram illustrating a functional block of the sentiment analysis unit. FIG. 9 is a diagram illustrating an example of a data structure of tactical emotions. FIG. 10 is a diagram illustrating an example of a data structure of speech emotion data. FIG. 11 is a flowchart illustrating an example of emotion analysis processing by the emotion analysis unit. FIG. 12 is a diagram illustrating a hardware configuration of a computer used in a processing device.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

(Processing device)
The processing apparatus 1 according to the embodiment of the present invention will be described with reference to FIG. The processing device 1 outputs the possibility of fraud using a call as a risk level. Call fraud is a special fraud in which a fraudster impersonates a specific person and tricks the other party. Call fraud includes, for example, oleore fraud that impersonates a close relative of the other party, and refund fraud that impersonates an organization such as a city hall employee or a bank employee.

The processing device 1 acquires data related to a call between the calling terminal 61 and the receiving terminal 62 from the call system 6 and calculates the degree of risk. Of the two callers of the calling terminal 61 and the receiving terminal 62, one is a user who uses the risk notification service by the processing device 1, and the other is a fraud suspect who is suspected of fraud. In the embodiment of the present invention, a caller different from the user is referred to as a fraud suspect. The fraud suspect is a target for outputting a risk level indicating whether or not a special fraud is committed in a call with a user. The suspected fraud may or may not actually commit fraud. If the suspect is likely to be fraudulent, the risk is high, and if the suspect is not fraudulent, the risk is low.

The processing device 1 includes call data 11, pattern data 12, priority data 13, voiceprint data 14, number data 15, acquisition unit 21, estimation unit 22, calculation unit 23, notification unit 24, and feedback unit 25. The call data 11, the pattern data 12, the priority data 13, the voice print data 14, and the number data 15 are data stored in the memory 902, the storage 903, or the like. The acquisition unit 21, the estimation unit 22, the calculation unit 23, the notification unit 24, and the feedback unit 25 are functions implemented in the CPU 901.

The call data 11 is data related to a call for which the degree of danger is calculated. The call data 11 is used by the processing device 1 to calculate the risk of fraud due to a call. As shown in FIG. 2, the call data 11 includes the telephone number and voice data of the calling terminal 61 and the telephone number and voice data of the incoming terminal 62. The call data 11 may include at least voice data of the utterance of the suspected fraud, a telephone number, and the like.

The pattern data 12 associates the identifier of the fraudulent technique using a call with the spoofing target of the fraudulent suspect in the technique and the keyword used in the utterance of the fraudulent suspect in the technique. The pattern data 12 is used to identify a fraudulent method that is presumed when the call to be processed is a special fraud from the combination of the spoofing target and the keyword of the fraud suspect. A plurality of fraudulent suspects' spoofing targets or a plurality of utterances may be associated with the identifier of one method.

In the pattern data 12 shown in FIG. 3, the identifier of the technique is "Oreore fraud", and the data set of the fraud suspect's spoofing target "son" and the keyword "accident" is associated with it. Data of the method identifier "refund fraud", the data set of the fraud suspect's spoofing target "bank clerk" and the keyword "account", the fraud suspect's spoofing target "city hall employee", and the keyword "medical expenses" Two datasets in the set are associated.

The priority data 13 associates the identifier of the method, the identifier of the analysis method for analyzing the possibility that the call is fraud, and the priority for analyzing the possibility that the call is the method. The priority data 13 is used to calculate the degree of risk by weighting the analysis method suitable for the technique. The priority means that it is possible to know whether or not it is a fraud when the method associated with the priority in the priority data 13 is analyzed by the analysis method associated with the priority. If the priority is high, analyzing the technique with the analysis method is likely to reveal whether it is a fraud or not. If the priority is low, it is unlikely that even if the method is analyzed by the analysis method, it can be determined whether it is a fraud or not.

As shown in FIG. 4, the priority data 13 associates the high-priority analysis method with the low-priority analysis method to the identifier of the technique. In the priority data 13, whether or not the priority is high for each method is set for each analysis method implemented by the processing device 1. In the example shown in FIG. 4, for the oleore fraud, the priority of each analysis method of number analysis and voiceprint analysis by individual whitelist is high, and the priority of sentiment analysis is low.

In the example shown in FIG. 4, the priority data 13 indicates the priority as two values of "high" or "low", but the priority is not limited to this. The priority may be set by any numerical value or any number of indexes (labels) as long as it can be converted into the weight of each analysis method. In the priority data 13, when the priority is set for each method and each analysis method, the priority may be set as high or low based on whether or not the priority is equal to or higher than a predetermined threshold value.

The voiceprint data 14 is referred to in order to identify the identity of the suspected fraud from the voiceprint. As shown in FIG. 5, the voiceprint data 14 includes an individual whitelist and a shared blacklist.

The individual whitelist includes voiceprint data of each user's son, daughter, and other close relatives of the user who are the targets of fraudulent suspects. The individual whitelist is generated for each individual user such as user A and user B. When the voiceprint data 14 is used for the call to be processed, the individual whitelist of the user in the call is referred to.

The shared blacklist contains fraudster's voiceprint data. Shared blacklists are provided by public authorities such as the police. Each fraudster's identifier on the shared blacklist is associated with a fraud potential and score. The score is updated by the feedback of each user described later, and the possibility of fraud is set from the score.

The number data 15 is referred to for identifying the identity of the telephone number used by the fraudulent suspect. As shown in FIG. 6, the number data 15 includes a shared whitelist, an individual whitelist, and a shared blacklist.

The shared whitelist includes the phone numbers of people who are the target of fraudulent suspects, such as police stations and banks, or the phone numbers of the organizations to which they belong.

The individual whitelist includes the phone numbers of each user's sons, daughters, and other close relatives of the user who are the targets of fraudulent suspects. The individual whitelist is generated for each individual user such as user A and user B. When the number data 15 is used for the call to be processed, the individual whitelist of the user in the call is referred to.

The shared blacklist includes the fraudster's phone number. Shared blacklists are provided by public authorities such as the police. Each fraudster's identifier on the shared blacklist is associated with a fraud potential and score. The score is updated by the feedback of each user described later, and the possibility of fraud is set from the score.

The acquisition unit 21 acquires the voice data, telephone number, etc. of the fraudulent suspect in the call between the fraudulent suspect and the user, and generates the call data 11. The acquisition unit 21 acquires data related to a call from the terminal used by the user among the calling terminal 61 and the incoming terminal 62, or from the call control system 55 that controls the call between the calling terminal 61 and the incoming terminal 62. The acquisition unit 21 may notify that the voice is acquired in the call.

The estimation unit 22 compares the pattern data 12 with the utterances in the voice data, and estimates the method of fraud by the suspected fraud. The estimation unit 22 converts the voice data into text data by the voice recognition system, and extracts the keyword of the remark of the suspected fraud from the text data by natural language processing. The estimation unit 22 estimates that the extracted keyword is a fraudulent technique used in the target call by using the identifier of the technique included in the keyword column of the pattern data 12. The estimation unit 22 may presume that the identifier of the method included in the keyword field of the pattern data 12 is the method of fraud that is working in the target call, as with the keyword, even if the synonym of the extracted keyword is used. .. When the keywords extracted over a plurality of techniques are included, the estimation unit 22 may presume that the technique containing more keywords is a fraudulent technique.

The calculation unit 23 refers to the priority data 13 and determines the possibility of fraud analyzed by the analysis method having a higher priority among the analysis methods associated with the methods estimated by the estimation unit 22. Calculated as. In the embodiment of the present invention, the calculation unit 23 includes a priority acquisition unit 31, an emotion analysis unit 32, a voiceprint analysis unit 33, and a number analysis unit 34. Each of the sentiment analysis unit 32, the voiceprint analysis unit 33, and the number analysis unit 34 analyzes the possibility that the call is fraudulent. In the embodiment of the present invention, three analysis methods are implemented, but two analysis methods may be used, or four or more analysis methods may be used.

The priority acquisition unit 31 acquires the priority of each analysis method implemented by the processing device 1 with reference to the priority data 13 for the analysis method associated with the method estimated by the estimation unit 22. For example, if the method estimated by the estimation unit 22 is an oleore fraud, the priority acquisition unit 31 acquires number analysis and voiceprint analysis by an individual whitelist as an analysis method with a high priority, and as an analysis method with a low priority. , Get sentiment analysis. In the priority data 13, when the weight of the analysis method is set by a numerical value or an index, the priority acquisition unit 31 acquires the numerical value or the index of each analysis method.

Further, the calculation unit 23 causes each of the emotion analysis unit 32, the voiceprint analysis unit 33, and the number analysis unit 34 to analyze the call data 11 and calculate the possibility of fraud.

The voiceprint analysis unit 33 compares the voiceprint of the suspected fraud in the call data 11 with each voiceprint of the voiceprint data 14, and if it matches the voiceprint of the whitelist, the possibility of fraud is set to zero, and the voiceprint of the blacklist is used. If there is a match, get the possibility of fraud associated with that matching voiceprint. The possibility of fraud may be adjusted according to the degree of similarity between the voiceprint registered in the voiceprint data 14 and the voiceprint of the suspected fraud. For example, the voiceprint analysis unit 33 calculates the similarity between the voiceprint of the suspected fraud and the voiceprint of the blacklist, and multiplies the possibility of fraud associated with the voiceprint of the blacklist by the similarity. It may be output as a possibility. The voiceprint analysis unit 33 may calculate the similarity between the voiceprint of the suspected fraud and the voiceprint of the whitelist, and output a value having a negative correlation with the calculated similarity as the possibility of fraud.

The number analysis unit 34 compares the telephone number of the suspected fraud in the call data 11 with each telephone number of the number data 15, and if the telephone number matches the telephone number in the white list, the possibility of fraud is set to zero and the black list is set. If it matches your phone number, you get the possibility of fraud associated with that matching phone number.

The sentiment analysis unit 32 analyzes the emotions of the fraudulent suspect from the voice data of the fraudulent suspect in the call data 11, and can be fraudulent because of a match with the emotion at the time of fraud or a contradiction with the emotion of the non-fraud suspect. Calculate the sex. The processing of the sentiment analysis unit 32 will be described in detail later.

The calculation unit 23 calculates the degree of risk in a call from the possibility of fraud calculated by each of the priority acquisition unit 31, the emotion analysis unit 32, the voiceprint analysis unit 33, and the number analysis unit 34.

For example, the calculation unit 23 refers to the priority data and risks fraud analyzed by the analysis method having a higher priority among the analysis methods associated with the methods estimated by the estimation unit 22. Calculated as a degree. When the method estimated by the estimation unit 22 is an oleore fraud and the priority acquisition unit 31 acquires the number analysis and the voice print analysis by the individual white list as the analysis method with high priority, the calculation unit 23 is the number analysis unit. The possibility of fraud based on the collation result with the individual white list in 34 and the possibility of fraud based on the collation result with the voiceprint data 14 in the voiceprint analysis unit 33 are acquired, and the risk level is calculated from the possibility of these frauds. do. The degree of risk may be the average of the possibilities of these frauds. The method of calculating the risk level only from the possibility of fraud calculated by the analysis method with high priority has been explained, but the method is not limited to this. The calculation unit 23 sets the weight of the possibility of fraud calculated by the high-priority analysis method high and the weight of the possibility of fraud calculated by the low-priority analysis method low, and calculates the degree of risk. You may.

When the priority is set for each technique and each analysis method in the priority data 13, the priority acquisition unit 31 is associated with the method estimated by the estimation unit 22 with reference to the priority data 13. Get the priority of each analysis method. The calculation unit 23 calculates the degree of risk by weighting the priority of each analysis method with the possibility of fraud obtained by each analysis method. For example, if the method estimated by the estimation unit 22 is an oleore fraud, the priority acquisition unit 31 refers to the priority data 13 and refers to the priority of the individual whitelist number analysis, the priority of the voiceprint analysis, and the sentiment in the oleore fraud. Get the analysis priority. The calculation unit 23 multiplies and adds the priority acquired by the priority acquisition unit 31 to each of the possibility of fraud by individual whitelist number analysis, the possibility of fraud by voiceprint analysis, and the possibility of fraud by sentiment analysis. , Calculate the degree of risk.

The method of calculating the degree of risk calculated by the calculation unit 23 is not limited to this, but the possibility of fraud output by each analysis method is weighted according to the priority of each analysis method set for each method of fraud. It should be done.

With reference to FIG. 7, the processing of the calculation unit 23 according to the embodiment of the present invention will be described. The process shown in FIG. 7 is an example and is not limited to this.

In step S101, the calculation unit 23 refers to the priority data 13 and determines the priority of each analysis means of the method estimated by the estimation unit 22.

In step S102, the calculation unit 23 calculates the possibility of fraud by sentiment analysis. In step S103, the calculation unit 23 calculates the possibility of fraud by voiceprint analysis. In step S104, the calculation unit 23 calculates the possibility of fraud by number analysis.

In step S105, the calculation unit 23 calculates the risk of the call according to the priority acquired in step S101. The calculation unit 23 may calculate the degree of risk from the possibility of fraud by a high-priority analysis method. Alternatively, the calculation unit 23 may calculate the degree of risk by weighting the possibility of fraud by each analysis method calculated in steps S102 to S104 with the priority acquired in step S101.

The notification unit 24 outputs the degree of risk calculated by the calculation unit 23. The degree of danger may be displayed on the user's telephone, for example, or may be notified by voice so that only the user can hear it. The degree of risk may be notified to the telephone number, e-mail address, SNS (Social Networking Service) account, or the like of another person or another terminal registered in advance as the user's contact information.

The notification unit 24 does not have to notify the degree of danger if it can be collated with the voiceprint or number of the whitelist. Further, the notification method may be changed depending on whether or not the risk level is higher than the threshold value. For example, when the risk level is higher than the threshold value, the notification unit 24 notifies by a highly immediate notification means such as calling a pre-registered telephone number to notify the user, and when the risk level is lower than the threshold value, the notification unit 24 is registered in advance. You may notify by a notification means with low immediacy such as notifying to the e-mail address.

The feedback unit 25 causes the user to input the evaluation of the fraudulent suspect who is the other party of the call, and updates the blacklist scores of the voice print data 14 and the number data 15 according to the input evaluation. When a bad evaluation is input from the user, such as the suspected fraud being considered a fraudster, the feedback unit 25 counts up the score corresponding to the suspected fraud. If the user inputs a good evaluation, such as thinking that the fraudulent suspect is not a fraudster, the feedback unit 25 counts down the score corresponding to the fraudulent suspect. The feedback unit 25 refers to the score of each fraudster in the blacklist of the voiceprint data 14 and the number data 15 at a predetermined timing, and updates the value of the possibility of fraud of each fraudster.

If the data of the suspected fraud is not registered in the voice print data 14 and the number data 15, the feedback unit 25 may add the data of the suspected fraud to the voice print data 14 and the number data 15. Further, the feedback unit 25 may update the voiceprint data 14 and the number data 15 based on the information obtained from a public institution such as the police.

According to such a processing device 1, the fraudulent method is estimated from the remarks of the fraudulent suspect in the call, the weight of the analysis method is changed according to the estimated fraudulent method, and the risk of fraud is calculated. Since the processing device 1 according to the embodiment of the present invention calculates the degree of risk by giving light weight to the possibility of fraud output by the analysis method according to the presumed method, the possibility that the call is fraud is appropriate. It becomes possible to judge.

(Sentiment analysis department)
The sentiment analysis unit 32 will be described with reference to FIG. The emotion analysis unit 32 includes a call data 11, an emotion score data 41, a technique emotion data 42, a speech emotion data 43, a score calculation unit 51, a feature detection unit 52, a contradiction detection unit 53, and an emotion analysis output unit 54. The call data 11, the emotion score data 41, the trick emotion data 42, and the spoken emotion data 43 are data stored in the memory 902, the storage 903, or the like. The score calculation unit 51, the feature detection unit 52, the contradiction detection unit 53, and the sentiment analysis output unit 54 are functions implemented in the CPU 901.

The call data 11 is as described with reference to FIGS. 1 and 2.

The method emotion data 42 is data in which the identifier of the method of fraud using a call is associated with the tendency of the emotion score of the suspected fraud in the method. As shown in FIG. 9, in the technique emotion data 42, the tendency of each emotion type is associated with the identifier of the technique as the tendency of the emotion score. The tendency of the emotion score in the technique emotion data 42 may include a temporal change of the emotion score, such as when an incoming call is received or when a specific utterance is made. In the example shown in FIG. 9, regarding the oleore fraud, the emotional score of joy is high at the time of incoming call, and the emotional score of calmness is low at the time of confession such as an accident. Considering that there are a plurality of patterns in one technique, the technique emotion data 42 may associate the identifier of one technique with the tendency of a plurality of emotion scores.

The utterance emotion data 43 is data in which a keyword is associated with the characteristics of the emotion score of the non-fraud suspect when the keyword is issued. The utterance emotion data 43 identifies the emotion when a general person who is not a fraud suspect utters a keyword. As shown in FIG. 10, the utterance emotion data 43 associates the keyword with the tendency of the emotion score. In the example shown in FIG. 9, it is shown that the emotional score of joy tends to be low for the keyword “accident”.

The score calculation unit 51 calculates the emotional score of the fraudulent suspect in the voice data of the call data 11. In the embodiment of the present invention, the score calculation unit 51 calculates emotion scores for four emotion types: joy, anger, sadness, and calm. The score calculation unit 51 sequentially calculates the emotion score with the passage of time of the utterance of the suspected fraud. The score calculation unit 51 may calculate the emotional score of the fraudulent suspect by a general method.

The feature detection unit 52 refers to the tactical emotion data 42, and if the emotional score of the fraudulent suspect matches the tendency of the emotional score associated with the tactic estimated by the estimation unit 22, the call is a tactic. Detect as likely. The feature detection unit 52 determines the possibility of fraud based on whether or not the characteristic of the specific fraud technique estimated by the estimation unit 22 appears in the emotion score of the fraud suspect. The feature detection unit 52 determines that the call to be processed has a high possibility of fraud when the estimated feature of the technique appears, and when the feature of the estimated technique does not appear, the feature detection unit 52 determines that the call to be processed has a high possibility of fraud. Judge that the possibility of fraud is low. For example, in the feature detection unit 52, the emotion score calculated by the score calculation unit 51 has a high joyful emotional score at the time of incoming call and a low calm emotional score at the time of confession such as an accident, as shown in the example shown in FIG. If so, it is determined that there is a high possibility of fraud.

The feature detection unit 52 may calculate the possibility of fraud based on the similarity between the emotional tendency of the technique registered in the emotional data 42 and the emotional score tendency calculated by the score calculation unit 51. When the characteristic detection unit 52 has a high degree of similarity between the emotional tendency of the technique registered in the emotional data 42 and the emotional score tendency calculated by the score calculation unit 51, the feature detection unit 52 calculates the possibility of fraud with high probability. If the similarity is low, the possibility of fraud is calculated low.

Since the feature detection unit 52 can change the viewpoint of analyzing the emotions of the fraud suspect depending on the presumed method, the possibility of fraud can be appropriately calculated.

The contradiction detection unit 53 refers to the utterance emotion data 43, and when the characteristics of the emotion score calculated by the score calculation unit 51 and the emotion score of the non-fraud suspect in the utterance emotion data 43 are inconsistent, the call is fraudulent. Detects that there is a high possibility. The contradiction detection unit 53 determines the possibility of fraud based on whether or not the emotion score of the fraud suspect tends to contradict the emotional tendency of the general public who is not the fraud suspect. The contradiction detection unit 53 determines that there is a high possibility of fraud for the call to be processed if it tends to contradict the emotional tendency of the general public, and if there is a similar tendency, the possibility of fraud for the call to be processed. Is determined to be low. For example, the contradiction detection unit 53 determines that the possibility of fraud is low when the score calculated by the score calculation unit 51 has a low feeling of joy as shown by the keyword “accident” in the example shown in FIG. If the emotion is high, it is judged that there is a high possibility of fraud.

The contradiction detection unit 53 may calculate the possibility that the call is fraudulent from the dissimilarity between the emotion score calculated by the score calculation unit 51 and the tendency of the emotion score specified by the utterance emotion data 43. The contradiction detection unit 53 determines that the call is likely to be fraudulent when the dissimilarity between the emotion score calculated by the score calculation unit 51 and the tendency of the emotion score specified by the utterance emotion data 43 is high. If the dissimilarity is low, it is determined that the call is unlikely to be fraudulent.

The sentiment analysis output unit 54 outputs the possibility of fraud from each analysis method of the feature detection unit 52 and the contradiction detection unit 53. The sentiment analysis output unit 54 outputs, for example, the average of the possibility of fraud determined by the feature detection unit 52 and the possibility of fraud determined by the inconsistency detection unit 53 as the possibility of fraud by emotion analysis. .. The emotion analysis output unit 54 may output the possibility of fraud by emotion analysis from the possibility of fraud of at least one of the feature detection unit 52 and the inconsistency detection unit 53, and the calculation method is not limited. do not have.

The emotion analysis process by the emotion analysis unit 32 will be described with reference to FIG. The process shown in FIG. 11 is an example and is not limited to this.

First, in step S201, the sentiment analysis unit 32 initializes the possibility of fraud by sentiment analysis. In step S202, the sentiment analysis unit 32 calculates the score of each emotion from the voice data of the suspected fraud.

In step S203, the emotion analysis unit 32 determines whether or not the score of each emotion calculated in step S202 has a tendency of the emotion of the technique estimated in the technique emotion data 42. If there is a tendency, in step S204, the sentiment analysis unit 32 raises the possibility of fraud by sentiment analysis. If there is no tendency, in step S205, the sentiment analysis unit 32 reduces the possibility of fraud by sentiment analysis.

In step S206, the emotion analysis unit 32 refers to the utterance emotion data 43 and determines whether or not there is a contradiction between the content of the fraudulent suspect's remark and the emotion score at the time of remark. If there is a contradiction, in step S207, the sentiment analysis unit 32 raises the possibility of fraud by sentiment analysis. If there is no contradiction, in step S208, the sentiment analysis unit 32 reduces the possibility of fraud by sentiment analysis.

In step S209, the sentiment analysis unit 32 outputs the possibility of fraud by the sentiment analysis obtained in the processes of steps S201 to S209.

Since the sentiment analysis unit 32 analyzes the possibility of fraud based on whether or not the estimated characteristics of the technique appear in the voice data of the suspected fraud, it is appropriate to use the sentiment analysis to determine the possibility that the call is fraudulent. Can be determined. Further, since the sentiment analysis unit 32 analyzes the possibility of fraud depending on whether or not the emotion in the utterance of the voice data of the suspected fraud is different from the emotion in the utterance of the general public, the call is fraudulent using the sentiment analysis. The possibility can be judged appropriately.

The processing device 1 of the present embodiment described above includes, for example, a CPU (Central Processing Unit, processor) 901, a memory 902, a storage 903 (HDD: Hard Disk Drive, SSD: Solid State Drive), and a communication device 904. , A general purpose computer system including an input device 905 and an output device 906 is used. In this computer system, each function of the processing device 1 is realized by executing a predetermined program loaded on the memory 902 by the CPU 901.

The processing device 1 may be mounted on one computer or may be mounted on a plurality of computers. Further, the processing device 1 may be a virtual machine mounted on a computer.

The program of the processing device 1 can be stored in a computer-readable recording medium such as an HDD, SSD, USB (Universal Serial Bus) memory, CD (Compact Disc), DVD (Digital Versatile Disc), or distributed via a network. You can also do it.

The present invention is not limited to the above embodiment, and many modifications can be made within the scope of the gist thereof.

1 Processing device 6 Call system 11 Call data 12 Pattern data 13 Priority data 14 Voice pattern data 15 Number data 21 Acquisition unit 22 Estimate unit 23 Calculation unit 24 Notification unit 25 Feedback unit 31 Priority acquisition unit 32 Emotion analysis unit 33 Voice pattern analysis unit 34 Number analysis unit 41 Emotion score data 42 Technique emotion data 43 Speech emotion data 51 Score calculation unit 52 Feature detection unit 53 Inconsistency detection unit 54 Emotion analysis output unit 55 Call control system 61 Calling terminal 62 Incoming terminal 901 CPU
902 Memory 903 Storage 904 Communication device 905 Input device 906 Output device

Claims

An acquisition unit that acquires voice data of the fraudulent suspect in a call between the fraudulent suspect and the user,
Comparing the speech in the voice data with the pattern data that associates the identifier of the fraudulent technique using the call with the spoofing target of the fraudulent suspect in the technique and the keyword used in the speech of the fraudulent suspect in the technique. Then, the estimation unit that estimates the method of fraud by the suspected fraud,
Refer to the priority data that associates the identifier of the technique with the identifier of the analysis method for analyzing the possibility that the call is fraud and the priority for analyzing the possibility that the call is the method by the analysis method. , A calculation unit that calculates the possibility of fraud analyzed by a high-priority analysis method as a risk level among the analysis methods associated with the estimated method,
A processing device equipped with a notification unit that notifies the calculated risk level.
The calculation unit refers to the priority data, acquires the priority of each analysis method associated with the estimated method, and sets the priority of each analysis method to the possibility obtained by each analysis method. The processing apparatus according to claim 1, wherein the degree of risk is calculated by weighting the above.
The computer acquires the voice data of the fraudulent suspect in the call between the fraudulent suspect and the user, and obtains the voice data of the fraudulent suspect.
The computer associates the identifier of the fraudulent technique using the call with the spoofing target of the fraudulent suspect in the technique and the keyword used in the speech of the fraudulent suspect in the technique, and the voice data. By comparing the speeches in the above, the method of fraud by the suspected fraud was estimated.
Priority data in which the computer associates the identifier of the technique with the identifier of the analysis method for analyzing the possibility that the call is fraud and the priority for analyzing the possibility that the call is the method by the analysis method. The possibility of fraud analyzed by the high-priority analysis method among the analysis methods associated with the estimated method is calculated as the risk level.
A processing method in which the computer notifies the calculated degree of danger.
A program for making a computer function as the processing device according to claim 1 or 2.