Method and device for identifying abnormal behavior user

Abstract

The invention discloses a method for identifying an abnormal behavior user. The method comprises the steps that according to a black number library and a white number library, training signaling data and testing signaling data are obtained in signaling data of a whole content ticket; first signaling data in the training signaling data is obtained, wherein characteristic values of the first signaling data have higher correlation with that of objects; according to the characteristic values and time granularity of the first signaling data, a first information sheet including derivative indexes is generated; the derivative indexes are subjected to screening by using a first screening strategy, and a second information sheet including evident indexes is generated; the first information sheet and the second information sheet are combined to generate a training information sheet; based on the training information sheet, a first model is built, the first model is subjected to testing by using the testing signaling data, and testing results are obtained; according to the testing results, the first model is subjected to evaluation, and a second model after evaluation and optimization is obtained, so that the abnormal behavior user is identified. The invention further discloses a device for identifying the abnormal behavior user. By adopting the method and device for identifying the abnormal behavior user, adjustment and optimization time after an algorithm model is on line can be reduced.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for identifying users with abnormal behavior. Background technique [0002] In the prior art, when identifying abnormal calling users or fraudulent numbers, generally first establish or collect blacklists through user self-marking, blacklists provided by the police and the Ministry of Information Security, third-party friendly business channels, etc., classify the blacklists, establish a database, and then The current number is compared with the database to identify the current number. This method cannot effectively detect users with abnormal behaviors or numbers involved in fraud in real time. [0003] In another scheme for identifying abnormal calling users or fraudulent numbers, the algorithm is used to analyze user behavior and form an algorithm model. This scheme can test whether the algorithm model is correct through existing data, and gradually after...

AI Technical Summary

Problems solved by technology

This method cannot effectively detect users with abnormal behaviors or numbers involved in fraud in real time

[0003] In another scheme for identifying abnormal calling users or fraudulent numbers, the algorithm is used to analyze user behavior and form an algorithm model. This scheme can test whether the algorithm model is correct through the existing data, and gradually after the algorithm model is actually launched. Adjustment and optimization, but it takes a long time for the algorithm model to go online to run stably, which makes it impossible to identify users with abnormal behavior for a long time

Images