Abnormal number detection method and device, equipment and storage medium

Abstract

The invention discloses an abnormal number detection method and device, equipment and a storage medium, and belongs to the field of telecommunication network security. According to the method, the anti-fraud effect can be effectively improved, and the occurrence probability of the problems of misrecognition and missed recognition in the telecommunication fraud recognition process is reduced. In detail, the scheme completes abnormal number detection based on an abnormal detection model. Wherein the anomaly detection model is a hybrid expert model comprising a gating mechanism and a plurality of detection sub-models, and the machine learning architecture based on the ensemble learning thought not only realizes dynamic routing of input data, that is, the gating mechanism distributes the input data to the most suitable one or more detection sub-models for processing according to data characteristics, but also realizes dynamic routing of the input data; and the abnormal number detection task is executed by integrating a plurality of detection sub-models, so that the learning and prediction effects of the models can be optimized, and the detection accuracy of telecommunication fraud calls is further ensured.

Description

Technical Field

[0001] The present application relates to the field of telecommunication network security, and in particular to an abnormal number detection method, device, equipment and storage medium. Background Art

[0002] With the development and progress of society, telecommunications fraud carried out with the help of communication tools such as mobile phones and landlines has spread rapidly, causing great losses to the people. Among them, telecommunications fraud, also known as telecommunications network fraud, refers to the act of defrauding public or private property by remote and contactless means using telecommunications network technology for the purpose of illegal possession.

[0003] In order to effectively intercept or identify telecommunications and Internet fraud, help suspected victims recognize the true face of fraudsters, and remind suspected victims not to be deceived, various anti-fraud measures have emerged.

[0004] However, although there are many anti-fraud measures available, they mainly rely on manual experience, with poor results and problems of misidentification and missed identification. Summary of the invention

[0005] The embodiment of the present application provides a method, device, equipment and storage medium for detecting abnormal numbers. The technical solution is as follows:

[0006] On the one hand, a method for detecting abnormal numbers is provided, the method comprising:

[0007] Acquiring communication data to be detected, and performing data preprocessing on the communication data to be detected;

[0008] Inputting the preprocessed communication data into an anomaly detection model; wherein the anomaly detection model includes a gating sub-model and a plurality of detection sub-models;

[0009] Calling the gated sub-model, and determining at least one detection sub-model for processing the current input of the model from among the multiple detection sub-models according to the data type currently input to the model;

[0010] Calling the at least one detection sub-model to perform abnormal number detection on the current input of the model;

[0011] inputting the output of the at least one detection sub-model into a classification model;

[0012] The classification model is called to generate an abnormal number detection result based on the output of the at least one detection sub-model, wherein the abnormal number detection result is used to indicate whether there is an abnormal number in the current input of the model.

[0013] In some embodiments, the performing data preprocessing on the communication data to be detected includes:

[0014] Performing feature extraction on the communication data to be detected;

[0015] Performing feature selection among the extracted features to obtain the preprocessed communication data;

[0016] The extracted features include at least one of the following:

[0017] A time feature, wherein the time feature includes at least one of a communication duration or a communication time;

[0018] Object behavior characteristics related to communication;

[0019] Network characteristics, wherein the network characteristics are used to characterize communication quality;

[0020] A label feature, wherein the label feature is used to indicate whether the communication number history to be detected is marked as an abnormal number;

[0021] The subject's speech characteristics during the communication process;

[0022] Text features, the text features including keywords extracted from the speech recognition text; the speech recognition text is obtained by performing speech recognition on the communication speech;

[0023] Additional features, the additional features including at least one of the emotion type or abnormality degree of the speech recognition text.

[0024] In some other embodiments, the acquiring the communication data to be detected includes:

[0025] In response to monitoring a new communication, using the communication data generated by this communication as the communication data to be detected; or,

[0026] The historical communication data is collected periodically, and the newly collected historical communication data is used as the communication data to be detected.

[0027] In some other embodiments, the method further comprises:

[0028] Based on the local interpretable model, obtaining explanatory information of the abnormal number detection result;

[0029] outputting the explanatory information;

[0030] Among them, the local interpretable model is a local approximation of the anomaly detection model and the classification model; the explanatory information is used to describe the decision basis for generating the abnormal number detection result.

[0031] In some other embodiments, the training process of the local interpretable model includes:

[0032] Acquire a first training sample set; wherein the first training sample set includes the current input of the model and the abnormal number detection result generated based on the disturbance data; the disturbance data is obtained by disturbance sampling in the neighborhood of the current input of the model;

[0033] Model training is performed based on the first training sample set to obtain the local interpretable model.

[0034] In some other embodiments, the training process of the anomaly detection model includes:

[0035] Acquire a second training sample set and historical communication data for a target task;

[0036] The second training sample set is larger in data size than the historical communication data; the target task is a task related to abnormal number detection;

[0037] Based on the second training sample set, training the expert model in the hybrid expert model to obtain a pre-trained hybrid expert model;

[0038] Based on the historical communication data, the pre-trained hybrid expert model is retrained to obtain the anomaly detection model.

[0039] In some other embodiments, the training process of the anomaly detection model includes:

[0040] Obtain historical communication data and target training parameters;

[0041] Dividing the historical communication data into a plurality of data subsets, and distributing the plurality of data subsets to different computing nodes; wherein the computing nodes are used to obtain the gradient of the network parameters of the anomaly detection model according to the received data subsets;

[0042] Receiving the gradient of the current network parameter of the anomaly detection model returned by the first computing node;

[0043] Based on the gradient of the current network parameters of the anomaly detection model and the target training parameters, updating the current network parameters of the anomaly detection model;

[0044] Sending the updated network parameters to a second computing node other than the first computing node;

[0045] The second computing node is used to replace the network parameters of the anomaly detection model currently stored locally with the updated network parameters.

[0046] In some other embodiments, the training process of the anomaly detection model includes:

[0047] Acquire historical communication data, and divide the historical communication data into N mutually disjoint subsets of equal size; N is a positive integer greater than 1;

[0048] In the current training process, N-1 subsets of the N subsets are used as training sets for model training, and the remaining subset is used as a test set to test the model obtained by the current training to obtain the current test result;

[0049] Repeat the steps of selecting N-1 subsets as the training sets for model training and using the remaining subset as the test set for testing until the number of repetitions reaches N times; wherein a different subset is used as the test set in each training process;

[0050] Based on the N test results obtained, obtain the model performance evaluation results under the current network parameters;

[0051] The network parameters are optimized based on the model performance evaluation results to obtain the anomaly detection model.

[0052] In some other embodiments, the updating process of the anomaly detection model includes:

[0053] In the case of newly added communication data, updating the network parameters of the anomaly detection model based on the newly added communication data to obtain an updated anomaly detection model; or,

[0054] In the case of newly added communication data, the network parameters of the anomaly detection model are updated based on the historical communication data and the newly added communication data to obtain an updated anomaly detection model.

[0055] In some other embodiments, the updating process of the anomaly detection model includes:

[0056] Obtaining user feedback data; wherein the user feedback data is used to describe the user's feedback on the generated abnormal number detection result;

[0057] Based on the user feedback data, the network parameters of the anomaly detection model are updated to obtain an updated anomaly detection model.

[0058] In some other embodiments, the method further comprises:

[0059] Performing model performance monitoring on the anomaly detection model and the classification model;

[0060] In response to the model performance indicator falling below a preset threshold, an alarm message is output.

[0061] On the other hand, an abnormal number detection device is provided, the device comprising:

[0062] An acquisition module, configured to acquire communication data to be detected;

[0063] A preprocessing module, configured to perform data preprocessing on the communication data to be detected, and input the preprocessed communication data into an anomaly detection model; wherein the anomaly detection model includes a gating sub-model and a plurality of detection sub-models;

[0064] The first detection module is configured to call the gated sub-model, determine at least one detection sub-model for processing the current input of the model from the multiple detection sub-models according to the data type of the current input of the model; and call the at least one detection sub-model to perform abnormal number detection on the current input of the model; and input the output of the at least one detection sub-model into the classification model;

[0065] The second detection module is configured to call the classification model and generate an abnormal number detection result based on the output of the at least one detection sub-model, wherein the abnormal number detection result is used to indicate whether there is an abnormal number in the current input of the model.

[0066] In some embodiments, the preprocessing module is configured to:

[0067] Performing feature extraction on the communication data to be detected;

[0068] Performing feature selection among the extracted features to obtain the preprocessed communication data;

[0069] The extracted features include at least one of the following:

[0070] A time feature, wherein the time feature includes at least one of a communication duration or a communication time;

[0071] Object behavior characteristics related to communication;

[0072] Network characteristics, wherein the network characteristics are used to characterize communication quality;

[0073] A label feature, wherein the label feature is used to indicate whether the communication number history to be detected is marked as an abnormal number;

[0074] The subject's speech characteristics during the communication process;

[0075] Text features, the text features including keywords extracted from the speech recognition text; the speech recognition text is obtained by performing speech recognition on the communication speech;

[0076] Additional features, the additional features including at least one of the emotion type or abnormality degree of the speech recognition text.

[0077] In some other embodiments, the acquisition module is configured to:

[0078] In response to monitoring a new communication, using the communication data generated by this communication as the communication data to be detected; or,

[0079] The historical communication data is collected periodically, and the newly collected historical communication data is used as the communication data to be detected.

[0080] In some other embodiments, the device further comprises:

[0081] An explanation module is configured to obtain explanatory information of the abnormal number detection result based on a local interpretable model; and output the explanatory information;

[0082] Among them, the local interpretable model is a local approximation of the anomaly detection model and the classification model; the explanatory information is used to describe the decision basis for generating the abnormal number detection result.

[0083] In some other embodiments, the training process of the local interpretable model includes:

[0084] Acquire a first training sample set; wherein the first training sample set includes the current input of the model and the abnormal number detection result generated based on the disturbance data; the disturbance data is obtained by disturbance sampling in the neighborhood of the current input of the model;

[0085] Model training is performed based on the first training sample set to obtain the local interpretable model.

[0086] In some other embodiments, the training process of the anomaly detection model includes:

[0087] Acquire a second training sample set and historical communication data for a target task;

[0088] The second training sample set is larger in data size than the historical communication data; the target task is a task related to abnormal number detection;

[0089] Based on the second training sample set, training the expert model in the hybrid expert model to obtain a pre-trained hybrid expert model;

[0090] Based on the historical communication data, the pre-trained hybrid expert model is retrained to obtain the anomaly detection model.

[0091] In some other embodiments, the training process of the anomaly detection model includes:

[0092] Obtain historical communication data and target training parameters;

[0093] Dividing the historical communication data into a plurality of data subsets, and distributing the plurality of data subsets to different computing nodes; wherein the computing nodes are used to obtain the gradient of the network parameters of the anomaly detection model according to the received data subsets;

[0094] Receiving the gradient of the current network parameter of the anomaly detection model returned by the first computing node;

[0095] Based on the gradient of the current network parameters of the anomaly detection model and the target training parameters, updating the current network parameters of the anomaly detection model;

[0096] Sending the updated network parameters to a second computing node other than the first computing node;

[0097] The second computing node is used to replace the network parameters of the anomaly detection model currently stored locally with the updated network parameters.

[0098] In some other embodiments, the training process of the anomaly detection model includes:

[0099] Acquire historical communication data, and divide the historical communication data into N mutually disjoint subsets of equal size; N is a positive integer greater than 1;

[0100] In the current training process, N-1 subsets of the N subsets are used as training sets for model training, and the remaining subset is used as a test set to test the model obtained by the current training to obtain the current test result;

[0101] Repeat the steps of selecting N-1 subsets as the training sets for model training and using the remaining subset as the test set for testing until the number of repetitions reaches N times; wherein a different subset is used as the test set in each training process;

[0102] Based on the N test results obtained, obtain the model performance evaluation results under the current network parameters;

[0103] The network parameters are optimized based on the model performance evaluation results to obtain the anomaly detection model.

[0104] In some other embodiments, the updating process of the anomaly detection model includes:

[0105] In the case of newly added communication data, updating the network parameters of the anomaly detection model based on the newly added communication data to obtain an updated anomaly detection model; or,

[0106] In the case of newly added communication data, the network parameters of the anomaly detection model are updated based on the historical communication data and the newly added communication data to obtain an updated anomaly detection model.

[0107] In some other embodiments, the updating process of the anomaly detection model includes:

[0108] Obtaining user feedback data; wherein the user feedback data is used to describe the user's feedback on the generated abnormal number detection result;

[0109] Based on the user feedback data, the network parameters of the anomaly detection model are updated to obtain an updated anomaly detection model.

[0110] In some other embodiments, the device further comprises:

[0111] The alarm module is configured to monitor the model performance of the anomaly detection model and the classification model; in response to the model performance indicator falling below a preset threshold, output alarm information.

[0112] On the other hand, a computer device is provided, the device comprising a processor and a memory, the memory storing at least one program code, the at least one program code being loaded and executed by the processor to implement the above abnormal number detection method.

[0113] On the other hand, a computer-readable storage medium is provided, wherein at least one program code is stored in the storage medium, and the at least one program code is loaded and executed by a processor to implement the above-mentioned abnormal number detection method.

[0114] On the other hand, a computer program product or a computer program is provided, which includes a computer program code, the computer program code is stored in a computer-readable storage medium, a processor of a computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device performs the above-mentioned abnormal number detection method.

[0115] The abnormal number detection solution provided in the embodiment of the present application can effectively improve the anti-fraud effect and reduce the probability of misidentification and missed identification problems during the telecommunications fraud identification process.

[0116] In detail, the solution completes abnormal number detection based on anomaly detection models and classification models. Among them, the anomaly detection model is a hybrid expert model that includes a gating mechanism and multiple detection sub-models. This machine learning architecture based on the idea of ​​ensemble learning not only realizes the dynamic routing of input data, that is, the gating mechanism will assign the input data to the most suitable one or more detection sub-models for processing according to the data characteristics, but also optimizes the learning and prediction effects of the model by integrating multiple detection sub-models to perform abnormal number detection tasks, thereby ensuring the accuracy of telecommunications fraud phone detection. In addition, the solution integrates the outputs of different detection sub-models through a classification model to achieve the final category prediction, further improving the accuracy of telecommunications fraud phone detection.

[0117] In summary, this solution can effectively detect telecommunications fraud calls, which plays an important role in preventing telecommunications fraud. BRIEF DESCRIPTION OF THE DRAWINGS

[0118] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0119] Figure 1 It is a schematic diagram of an implementation environment of an abnormal number detection method provided in an embodiment of the present application;

[0120] Figure 2 is a flow chart of an abnormal number detection method provided by an embodiment of the present application;

[0121] Figure 3 This is a flowchart of model training and optimization provided by an embodiment of the present application;

[0122] Figure 4 It is a structural schematic diagram of an abnormal number detection device provided in an embodiment of the present application;

[0123] Figure 5 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0124] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0125] In this application, the terms "first", "second", etc. are used to distinguish the same or similar items with substantially the same role and function. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there a limitation on the quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms.

[0126] These terms are only used to distinguish one element from another element. For example, without departing from the scope of various examples, a first element can be referred to as a second element, and similarly, a second element can also be referred to as a first element. Both the first element and the second element can be elements, and in some cases, can be separate and different elements.

[0127] Here, at least one means one or more than one, for example, at least one element can be one element, two elements, three elements, or any other integer greater than or equal to one. And multiple means two or more than two, for example, multiple elements can be two elements, three elements, or any other integer greater than or equal to two.

[0128] The "and / or" mentioned in this article indicates that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship.

[0129] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant regions. For example, the communication data involved in this application are all obtained with full authorization.

[0130] Figure 1 It is a schematic diagram of an implementation environment of an abnormal number detection method provided in an embodiment of the present application.

[0131] See also Figure 1 The implementation environment includes: a terminal device 101, an abnormal number detection system 102 and a data source 103.

[0132] Among them, the terminal device 101 is located on the user side, and the abnormal number detection system 102 is located on the server side. The data source 103 is used to provide communication data, that is, after collecting the communication data from the data source 103, the model training is performed based on the collected communication data. In some embodiments, the trained model includes an abnormal detection model (such as a hybrid expert model) and a classification model (such as a logistic regression model), and then the abnormal number detection system 102 performs the abnormal number detection task based on the trained above model.

[0133] In addition, the terminal devices on the user side include the terminal devices used by the calling user (the fraudster) and the terminal devices used by the called user (the person who may be deceived). Figure 1 The terminal device 101 is used as an example for the terminal device used by the called user. In the embodiment of the present application, a target application (Application, APP) is installed on the terminal device 101. For example, the target application is an anti-fraud APP, which can preach anti-fraud knowledge, issue fraud warnings to users based on abnormal numbers detected by the abnormal number detection system 102, etc., and the present application does not limit this.

[0134] In other embodiments, the terminal device 101 is a smart phone, and the abnormal number detection system 102 is a server. Exemplarily, the abnormal number detection system 102 can be at least one of a server, multiple servers, a cloud computing platform, and a virtualization center, which is not limited in this application. In addition, the abnormal number detection system 102 is connected to the terminal device 101 via a wireless network or a wired network.

[0135] In addition, the number of the above servers can be more or less, and this application does not limit this. Of course, in addition to the abnormal number detection system 102, other functional servers can also be included to provide more comprehensive and diversified services.

[0136] Figure 2 is a flowchart of an abnormal number method provided by an embodiment of the present application. The execution subject of the method is a computer device, such as Figure 1 The abnormal number detection system in . Figure 2 The method flow includes:

[0137] 201. The computer device obtains communication data to be detected, and performs data preprocessing on the communication data to be detected.

[0138] This step is used to collect communication data and preprocess data. In this article, communication data can be either call data or short message data, and this application does not limit this. For the task of detecting telecommunications fraud calls, the abnormal number mentioned in this article refers to the communication number that has telecommunications fraud.

[0139] For the telecommunications industry, detection needs may include real-time detection and batch detection. Real-time detection refers to real-time analysis of newly received calls or newly received short messages, while batch detection refers to batch analysis of collected historical communication data. In addition, considering the large amount of data, batch prediction can use cloud computing resources for large-scale processing; while real-time prediction requires the design of a low-latency system, which may involve lightweight models or the use of dedicated real-time prediction services.

[0140] Based on the above description, the communication data to be detected is obtained in the following two ways, including but not limited to:

[0141] 2011. In response to monitoring a new communication, the communication data generated by this communication is used as the communication data to be detected.

[0142] 2012. Periodically collect historical communication data, and use the newly collected historical communication data as communication data to be detected.

[0143] Exemplarily, communication data may be collected from telecommunications operators, and the communication data may involve multi-source data such as call records, call voices, and short message texts.

[0144] In some embodiments, data preprocessing is performed on the communication data to be detected, including the following steps:

[0145] First, feature extraction is performed on the communication data to be detected, wherein feature extraction is used to extract meaningful features from the communication data to be detected.

[0146] Next, feature selection is performed among the extracted features to obtain preprocessed communication data.

[0147] For example, when performing feature selection, the most relevant features can be selected using the RFE (Recursive Feature Elimination) method or the LASSO (Least Absolute Shrinkage and Selection Operator) method to optimize the model input and reduce the model complexity.

[0148] In some other embodiments, in addition to feature extraction and feature selection, data preprocessing also includes steps such as data cleaning and data normalization, which are not limited in this application. In addition, the features extracted from the communication data to be detected include at least one of the following:

[0149] 1. Time characteristics, wherein the time characteristics include at least one of the communication duration or communication time (for example, daytime, nighttime or holidays) of each communication.

[0150] 2. Object behavior characteristics related to communication, such as calling frequency (or average calling frequency), answering frequency (or average answering frequency), or specific patterns of interaction (such as frequent short calls).

[0151] 3. Network characteristics: Network characteristics are used to characterize communication quality, such as signal strength, number of call interruptions, etc.

[0152] 4. Label feature, wherein the label feature is used to indicate whether the communication number to be detected has been marked as an abnormal number. This step is to use the existing reporting data or marking data to determine the fraud history of the communication number to be detected.

[0153] 5. Voice features of the object in the communication process, such as the language, intonation, pronunciation features or timbre features.

[0154] 6. Text features, wherein the text features include keywords extracted from the speech recognition text, and the speech recognition text is obtained by performing speech recognition on the communication speech.

[0155] 7. Additional features, wherein the additional features include at least one of the emotion type or abnormality degree of the speech recognition text. The abnormality degree is used to indicate the suspiciousness degree of the speech recognition text.

[0156] Exemplarily, a large pre-trained language model can be used to perform sentiment analysis tasks and abnormality analysis tasks on speech recognition texts, but this application does not limit this.

[0157] It should be noted that in the model prediction process, after the communication data to be detected is preprocessed, the preprocessed communication data (the feature data remaining after the feature selection operation) will be input into the model (which has been trained and strictly verified), see the following step 202 for details.

[0158] 202. The computer device inputs the preprocessed communication data into an anomaly detection model; wherein the anomaly detection model includes a gating sub-model and multiple detection sub-models; the gating sub-model is called to determine at least one detection sub-model for processing the current input of the model from the multiple detection sub-models according to the data type currently input to the model; and, at least one detection sub-model is called to perform abnormal number detection on the current input of the model.

[0159] In some embodiments, the anomaly detection model is a hybrid expert model including a gating mechanism and multiple expert models. The hybrid expert model is a machine learning architecture based on the idea of ​​ensemble learning, which usually includes two parts: a gating network (also referred to as a gating sub-model in this article) and multiple expert networks (also referred to as detection sub-models in this article).

[0160] The gating network is responsible for dynamically routing data to the most relevant one or more expert models for processing based on the type of data currently input to the model. In other words, the gating network is responsible for deciding which expert network or networks should process the input data. It dynamically allocates input data to at least one expert network for processing based on the characteristics of the input data, thereby optimizing the learning and prediction effects of the entire model. Among them, commonly used gating networks include Softmax gating networks and GatingTree gating networks. In addition, the output of the gating network is usually a probability vector, which is used to represent the probability of each expert network being selected.

[0161] The expert network is the part of the hybrid expert model that actually processes data. The hybrid expert model can include any number of expert networks, and each expert network is an independent neural network.

[0162] Exemplarily, each expert network is trained to process a specific type of data, for example, using CNN (Convolutional Neural Networks) to process speech features, using RNN (Recurrent Neural Network) to process time series features, and using Transformer model to process text features, which is not limited in this application.

[0163] In summary, this machine learning architecture based on ensemble learning can process high-dimensional, complex and heterogeneous data, and is particularly suitable for processing communication data with text features, voice features, and object behavior features. In other words, in the scenario of telecommunications anti-fraud, the use of a hybrid expert model can improve the accuracy of detecting telecommunications fraud calls.

[0164] In other embodiments, the preprocessed communication data may be input into the anomaly detection model in the following manner: the preprocessed communication data may be input into the anomaly detection model in batches. The basis for the batching may be: according to the data type, the feature data remaining after the feature selection operation is divided into blocks, and then each data block is input into the anomaly detection model separately, which is not limited in the present application.

[0165] Among them, determining at least one detection sub-model for processing the current input of the model from multiple detection sub-models based on the data type of the current input of the model means: based on the type of input data, determining one or more detection sub-models from multiple detection sub-models that are most suitable for processing such input data.

[0166] In addition, performing abnormal number detection on the current input of the model means processing the feature data of the input model for the purpose of detecting whether there are abnormal numbers in the input data.

[0167] It should be noted that the output of at least one detection sub-model is not the final detection result. The embodiment of the present application uses a classification model to fuse the output of at least one detection sub-model and output the final detection result. See the following step 203 for details.

[0168] 203. The computer device inputs the output of at least one detection sub-model into the classification model; calls the classification model, and generates an abnormal number detection result based on the output of at least one detection sub-model, wherein the abnormal number detection result is used to indicate whether there is an abnormal number in the current input of the model.

[0169] Exemplarily, the anomaly detection result will provide the detected abnormal numbers and the probability that these numbers are abnormal numbers, which is not limited in this application.

[0170] In some embodiments, the classification model is a logistic regression model, that is, the embodiment of the present application uses a logistic regression model to classify features. The mathematical formula of the logistic regression model is as follows:

[0171] P(y=1|x)=1 / (1+e^(-(β0+β1x1)+...+β n x n ))

[0172] Where P(y=1|x) is the distance from feature x1 to feature x. n , the probability that the communication number included in the current input of the model is an abnormal number; β0, β1, ...., β n are the parameters of the logistic regression model and need to be optimized during the model training process. In addition, feature x1 to feature x n Here, it refers to the output of at least one detection sub-model. In addition, the value of n is related to the number of the at least one detection sub-model, and the value of n is a positive integer.

[0173] In the telecommunications anti-fraud scenario, the interpretability of the model is particularly important. It can help the subject understand the reasons for the model's decision, enhance the interpretability of the system, and facilitate users and regulators to understand and trust the system's judgment. For example, LIME (Local Interpretable Model-agnostic Explanations) or SHAP (SHapley Additive Explanations) methods can be used to provide explanations for the final detection results, and this application does not limit this. Among them, explanatory technology can provide transparency in the system's decision-making process, allowing users and regulators to understand which factors have the greatest impact on the system's judgment of telecommunications fraud calls.

[0174] Taking the application of a local interpretable model to provide an explanation for the final detection result as an example, the method provided by the present application also includes: obtaining explanatory information of the abnormal number detection result based on the local interpretable model; outputting the explanatory information; wherein the local interpretable model is a local approximation of the abnormal detection model and the classification model; the explanatory information is used to describe the decision basis for generating the abnormal number detection result. In other embodiments, the local interpretable model can be trained in the following manner:

[0175] First, a first training sample set is obtained, which includes the current input of the model and the abnormal number detection results generated based on the perturbation data; wherein the perturbation data is obtained by perturbation sampling in the neighborhood of the current input of the model. Then, the model is trained based on the first training sample set to obtain a local interpretable model.

[0176] In summary, the abnormal number detection solution provided in the embodiment of the present application can effectively improve the anti-fraud effect and reduce the probability of misidentification and missed identification problems during the telecommunications fraud identification process.

[0177] In detail, the solution completes abnormal number detection based on anomaly detection models and classification models. Among them, the anomaly detection model is a hybrid expert model that includes a gating mechanism and multiple detection sub-models. This machine learning architecture based on the idea of ​​ensemble learning not only realizes the dynamic routing of input data, that is, the gating mechanism will assign the input data to the most suitable one or more detection sub-models for processing according to the data characteristics, but also optimizes the learning and prediction effects of the model by integrating multiple detection sub-models to perform abnormal number detection tasks, thereby ensuring the accuracy of telecommunications fraud phone detection. In addition, the solution integrates the outputs of different detection sub-models through a classification model to achieve the final category prediction, further improving the accuracy of telecommunications fraud phone detection.

[0178] In summary, this solution can effectively detect telecommunications fraud calls, which plays an important role in preventing telecommunications fraud.

[0179] Combine the following Figure 3 This paper introduces the training process of the anomaly detection model.

[0180] like Figure 3 As shown, in order to train the anomaly detection model, historical communication data is first collected. During the model training process, the historical communication data also needs to be preprocessed (an important step in data mining and analysis). That is, the historical communication data used for model training needs to be processed as shown in the aforementioned step 201 to ensure the consistency of the model prediction process and the input of the model training process.

[0181] In some embodiments, after the model is built, the following training methods can be used to train the anomaly detection model.

[0182] Method 1: Pre-train the detection sub-model in the anomaly detection model on related tasks, and then use the collected historical communication data to fine-tune the model to make it suitable for telecommunications anti-fraud scenarios.

[0183] Exemplarily, for this method, the training process of the anomaly detection model includes the following steps:

[0184] 1-1. Obtain a second training sample set and historical communication data for a target task;

[0185] Generally, the second training sample set is larger in data size than the acquired historical communication data. The target task is a task related to abnormal number detection.

[0186] 1-2. Based on the second training sample set, the expert model in the hybrid expert model is trained to obtain a pre-trained hybrid expert model;

[0187] 1-3. Based on the acquired historical communication data, the pre-trained hybrid expert model is retrained, that is, the pre-trained hybrid expert model is fine-tuned to obtain an anomaly detection model.

[0188] Method 2: Since training anomaly detection models requires a large amount of communication data, it will take up a lot of computing resources. In order to improve training efficiency, distributed training can also be used for model training.

[0189] Among them, the distributed training method includes but is not limited to: intra-layer parallel training method, data parallel training method and model parallel training method. Taking the data parallel training method as an example, the training process of the anomaly detection model includes the following steps:

[0190] 2-1. Obtain historical communication data and target training parameters.

[0191] For example, data parallelism can be achieved through a parameter server, that is, the network parameters are stored in a centralized parameter server, and the computing nodes are only responsible for obtaining the gradients of the network parameters. After starting the training, the training can be started based on the acquired historical communication data. In addition, the training parameters can be configured as needed.

[0192] 2-2. Divide the acquired historical communication data into multiple data subsets, and distribute the multiple data subsets to different computing nodes.

[0193] For example, the data subsets can be evenly divided according to the number of computing nodes, and each computing node is ultimately guaranteed to receive a data subset. The number of computing nodes is related to the scale of the anomaly detection model and the computing power of the computing nodes.

[0194] 2-3. Each computing node obtains the gradient of the network parameters of the anomaly detection model based on the received data subset.

[0195] Exemplarily, each computing node may obtain the gradient of the network parameters of the anomaly detection model in the following manner: construct a target loss function based on the received data subset, and obtain the gradient of the network parameters of the anomaly detection model based on the target loss function.

[0196] 2-4. Receive the gradient of the current network parameters of the anomaly detection model returned by the first computing node; based on the gradient of the current network parameters of the anomaly detection model and the target training parameters, update the current network parameters of the anomaly detection model.

[0197] The first computing node is any one of the above-mentioned multiple computing nodes. Exemplarily, the parameter server uses a neural network parameter optimizer to complete the global network parameter update.

[0198] 2-5. Send the updated network parameters to the second computing node other than the first computing node.

[0199] Exemplarily, the parameter server sends the updated network parameters to the second computing node by broadcasting.

[0200] 2-6. The second computing node replaces the network parameters of the anomaly detection model currently stored locally with the updated network parameters.

[0201] Repeat steps 2-3 to 2-6 to complete the training of the anomaly detection model.

[0202] Since the training is carried out in parallel based on multiple computing nodes, the probability and speed of exploring the optimal strategy are accelerated, which greatly speeds up the training. In addition, since the model training process is dispersed on multiple computing nodes, the centralized storage of communication data is avoided, and privacy protection is strengthened.

[0203] Method 3: Optimize the anomaly detection model through cross-validation to improve the generalization ability of the model.

[0204] Exemplarily, for this method, the training process of the anomaly detection model includes the following steps:

[0205] 3-1. Obtain historical communication data, and divide the acquired historical communication data into N mutually disjoint subsets of the same size.

[0206] Wherein, N is a positive integer greater than 1; mutually non-intersecting means that the communication data included in each subset is different and there is no intersection.

[0207] 3-2. In the current training process, N-1 subsets of the N subsets are used as training sets for model training, and the remaining subset is used as a test set to test the model obtained by the current training to obtain the current test result.

[0208] The training process is divided into N rounds, and different subsets are used as test sets in each training process, that is, the test sets used in each training process are different. For any round of training process, in addition to the subset selected as the test set, the remaining N-1 subsets are used as training sets.

[0209] 3-3. Repeat the steps of selecting N-1 subsets as training sets for model training and the remaining subset as a test set for testing until the number of repetitions reaches N times.

[0210] Since the training process is divided into N rounds, N test results will be obtained after the number of training times reaches N. Next, parameter optimization is performed based on the N test results obtained.

[0211] 3-4. Based on the N test results obtained, obtain the model performance evaluation results under the current network parameters; optimize the network parameters based on the model performance evaluation results to obtain the anomaly detection model.

[0212] The test results can evaluate the performance of the model on different test sets. For example, the model performance can be evaluated by precision, recall, F1 score, ROC (Receiver Operating Characteristic Curve) curve or AUC (Area Under Curve) value, etc., which is not limited in this application.

[0213] It should be noted that precision measures the proportion of samples predicted as positive that are actually positive, while recall refers to the proportion of all positive samples predicted as positive by the model. The F1 score is the harmonic mean of precision and recall. The ROC curve shows the classification performance of the model under different thresholds through the relationship between the true positive rate and the false positive rate. The AUC value, as the area under the ROC curve, can more intuitively reflect the quality of the model. Among them, the closer the AUC value is to 1, the better the classification effect of the model.

[0214] In addition, network parameter optimization can be performed through grid search, random search, automatic parameter adjustment tools or Bayesian optimization, which is not limited in this application.

[0215] In addition, the data scale of the historical communication data used in each training mode may be the same or different, and this application does not limit this.

[0216] The optimization process of the model is introduced below.

[0217] After the model is deployed, the model should be designed with the ability to fine-tune for continuous learning, and to adapt to the evolution of telecommunications fraud methods through online learning or regular model fine-tuning to ensure long-term prediction performance. In other words, the anomaly detection model can also be updated and continuously optimized after deployment. The good detection performance and good scalability enable the trained anomaly detection model and classification model to be suitable for telecommunications fraud call detection in the telecommunications industry. Exemplarily, the embodiment of the present application deploys anomaly detection models on cloud computing or privatized platforms to ensure real-time response and processing capabilities.

[0218] In other embodiments, the embodiments of the present application also implement a user feedback closed loop, that is, the solution collects user feedback and uses it as a reference for subsequent iterative training.

[0219] In other words, the anomaly detection model can be updated as follows:

[0220] Obtain user feedback data; wherein the user feedback data is used to describe the user's feedback on the generated abnormal number detection result; based on the obtained user feedback data, update the network parameters of the anomaly detection model to obtain an updated anomaly detection model.

[0221] In other embodiments, the model is designed with a continuous learning fine-tuning capability, which can dynamically adjust the model's network parameters based on newly collected communication data.

[0222] In other words, the anomaly detection model can also be updated in the following ways:

[0223] Method 1: Use the old network as the basis and only use new data to update the network.

[0224] For this method, when new communication data is added, the network parameters of the anomaly detection model are updated based on the new communication data, thereby obtaining an updated anomaly detection model.

[0225] Method 2: Use the old network as the basis and use the old data and new data to update the network.

[0226] For this method, that is, when new communication data is added, the network parameters of the anomaly detection model are updated based on the historical communication data collected above and the new communication data, thereby obtaining an updated anomaly detection model.

[0227] In other embodiments, the embodiments of the present application will continue to monitor the model performance to ensure the stability of the model performance. In addition, an alarm mechanism is also set. If the model performance index drops below a preset threshold, an alarm is issued in time to facilitate developers to make timely decisions on whether to retrain or adjust the model.

[0228] In other words, the method provided in the embodiment of the present application also includes: monitoring the model performance of the anomaly detection model and the classification model; and outputting an alarm message in response to the model performance indicator falling below a preset threshold.

[0229] The following is an introduction to the training process of the classification model.

[0230] In terms of data scale, the historical communication data used in training classification models is usually smaller than the historical communication data used in training anomaly detection models.

[0231] Taking the classification model as a logistic regression model as an example, the logistic regression model training is performed based on the collected historical communication data, that is, to find the optimal parameters β0, β1, ..., β n In addition, during the training process, regularization technology can also be used to prevent the model from overfitting. For example, both L1 regularization and L2 regularization can be used, and this application does not limit this.

[0232] In some embodiments, the optimization goal during the logistic regression model training process is:

[0233]

[0234] Among them, λ is the regularization parameter, β is the parameter that needs to be optimized during training, p=1 refers to L1 regularization, p=2 refers to L2 regularization, N refers to the number of samples, and y i refers to the actual label of sample i, p i Refers to the model's prediction result for sample i.

[0235] Figure 4 is a structural diagram of an abnormal number detection device provided in an embodiment of the present application. Figure 4 , the device comprises:

[0236] The acquisition module 401 is configured to acquire communication data to be detected;

[0237] A preprocessing module 402 is configured to perform data preprocessing on the communication data to be detected, and input the preprocessed communication data into an anomaly detection model; wherein the anomaly detection model includes a gating sub-model and a plurality of detection sub-models;

[0238] The first detection module 403 is configured to call the gated sub-model, determine at least one detection sub-model for processing the current input of the model from the multiple detection sub-models according to the data type of the current input of the model; and call the at least one detection sub-model to perform abnormal number detection on the current input of the model; and input the output of the at least one detection sub-model into the classification model;

[0239] The second detection module 404 is configured to call the classification model and generate an abnormal number detection result based on the output of the at least one detection sub-model, wherein the abnormal number detection result is used to indicate whether there is an abnormal number in the current input of the model.

[0240] The abnormal number detection scheme provided in the embodiment of the present application can effectively improve the anti-fraud effect and reduce the probability of misidentification and missed identification problems in the process of telecommunications fraud identification. In detail, the scheme completes abnormal number detection based on anomaly detection model and classification model. Among them, the anomaly detection model is a hybrid expert model including a gating mechanism and multiple detection sub-models. This machine learning architecture based on the idea of ​​ensemble learning not only realizes the dynamic routing of input data, that is, the gating mechanism will allocate the input data to the most suitable one or more detection sub-models for processing according to the data characteristics, but also optimizes the learning and prediction effects of the model by integrating multiple detection sub-models to perform abnormal number detection tasks, thereby ensuring the accuracy of detection of telecommunications fraud calls. In addition, the scheme integrates the outputs of different detection sub-models through a classification model to achieve the final category prediction, which further improves the accuracy of detection of telecommunications fraud calls. In summary, the scheme can effectively detect telecommunications fraud calls, which plays an important role in preventing telecommunications fraud.

[0241] In some embodiments, the preprocessing module is configured to:

[0242] Performing feature extraction on the communication data to be detected;

[0243] Performing feature selection among the extracted features to obtain the preprocessed communication data;

[0244] The extracted features include at least one of the following:

[0245] A time feature, wherein the time feature includes at least one of a communication duration or a communication time;

[0246] Object behavior characteristics related to communication;

[0247] Network characteristics, wherein the network characteristics are used to characterize communication quality;

[0248] A label feature, wherein the label feature is used to indicate whether the communication number history to be detected is marked as an abnormal number;

[0249] The subject's speech characteristics during the communication process;

[0250] Text features, the text features including keywords extracted from the speech recognition text; the speech recognition text is obtained by performing speech recognition on the communication speech;

[0251] Additional features, the additional features including at least one of the emotion type or abnormality degree of the speech recognition text.

[0252] In some other embodiments, the acquisition module is configured to:

[0253] In response to monitoring a new communication, using the communication data generated by this communication as the communication data to be detected; or,

[0254] The historical communication data is collected periodically, and the newly collected historical communication data is used as the communication data to be detected.

[0255] In some other embodiments, the device further comprises:

[0256] An explanation module is configured to obtain explanatory information of the abnormal number detection result based on a local interpretable model; and output the explanatory information;

[0257] Among them, the local interpretable model is a local approximation of the anomaly detection model and the classification model; the explanatory information is used to describe the decision basis for generating the abnormal number detection result.

[0258] In some other embodiments, the training process of the local interpretable model includes:

[0259] Acquire a first training sample set; wherein the first training sample set includes the current input of the model and the abnormal number detection result generated based on the disturbance data; the disturbance data is obtained by disturbance sampling in the neighborhood of the current input of the model;

[0260] Model training is performed based on the first training sample set to obtain the local interpretable model.

[0261] In some other embodiments, the training process of the anomaly detection model includes:

[0262] Acquire a second training sample set and historical communication data for a target task;

[0263] The second training sample set is larger in data size than the historical communication data; the target task is a task related to abnormal number detection;

[0264] Based on the second training sample set, training the expert model in the hybrid expert model to obtain a pre-trained hybrid expert model;

[0265] Based on the historical communication data, the pre-trained hybrid expert model is retrained to obtain the anomaly detection model.

[0266] In some other embodiments, the training process of the anomaly detection model includes:

[0267] Obtain historical communication data and target training parameters;

[0268] Dividing the historical communication data into a plurality of data subsets, and distributing the plurality of data subsets to different computing nodes; wherein the computing nodes are used to obtain the gradient of the network parameters of the anomaly detection model according to the received data subsets;

[0269] Receiving the gradient of the current network parameter of the anomaly detection model returned by the first computing node;

[0270] Based on the gradient of the current network parameters of the anomaly detection model and the target training parameters, updating the current network parameters of the anomaly detection model;

[0271] Sending the updated network parameters to a second computing node other than the first computing node;

[0272] The second computing node is used to replace the network parameters of the anomaly detection model currently stored locally with the updated network parameters.

[0273] In some other embodiments, the training process of the anomaly detection model includes:

[0274] Acquire historical communication data, and divide the historical communication data into N mutually disjoint subsets of equal size; N is a positive integer greater than 1;

[0275] In the current training process, N-1 subsets of the N subsets are used as training sets for model training, and the remaining subset is used as a test set to test the model obtained by the current training to obtain the current test result;

[0276] Repeat the steps of selecting N-1 subsets as the training sets for model training and using the remaining subset as the test set for testing until the number of repetitions reaches N times; wherein a different subset is used as the test set in each training process;

[0277] Based on the N test results obtained, obtain the model performance evaluation results under the current network parameters;

[0278] The network parameters are optimized based on the model performance evaluation results to obtain the anomaly detection model.

[0279] In some other embodiments, the updating process of the anomaly detection model includes:

[0280] In the case of newly added communication data, updating the network parameters of the anomaly detection model based on the newly added communication data to obtain an updated anomaly detection model; or,

[0281] In the case of newly added communication data, the network parameters of the anomaly detection model are updated based on the historical communication data and the newly added communication data to obtain an updated anomaly detection model.

[0282] In some other embodiments, the updating process of the anomaly detection model includes:

[0283] Obtaining user feedback data; wherein the user feedback data is used to describe the user's feedback on the generated abnormal number detection result;

[0284] Based on the user feedback data, the network parameters of the anomaly detection model are updated to obtain an updated anomaly detection model.

[0285] In some other embodiments, the device further comprises:

[0286] The alarm module is configured to monitor the model performance of the anomaly detection model and the classification model; in response to the model performance indicator falling below a preset threshold, output alarm information.

[0287] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0288] It should be noted that: the abnormal number detection device provided in the above embodiment only uses the division of the above functional modules as an example when performing abnormal number detection. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the abnormal number detection device provided in the above embodiment and the abnormal number detection method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0289] Figure 5It is a structural diagram of a computer device provided in an embodiment of the present application. The computer 500 may be a server. The computer device 500 may have relatively large differences due to different configurations or performances, and includes one or more processors (Central Processing Units, CPU) 501 and one or more memories 502, wherein at least one program code is stored in the memory 502, and the at least one program code is loaded and executed by the processor 501 to implement the above-mentioned abnormal number detection method. Of course, the computer device 500 also has components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The computer device 500 also includes other components for realizing device functions, which will not be repeated here.

[0290] In an exemplary embodiment, a computer-readable storage medium is also provided, such as a memory including a program code, and the program code can be executed by a processor in a computer device to complete the above-mentioned abnormal number detection method. For example, the computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk, and an optical data storage device.

[0291] In an exemplary embodiment, a computer program product or a computer program is also provided, which includes a computer program code, which is stored in a computer-readable storage medium. A processor of a computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device executes the above-mentioned abnormal number detection method.

[0292] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0293] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting abnormal numbers, characterized in that: The method comprises: Acquiring communication data to be detected, and performing data preprocessing on the communication data to be detected; Inputting the preprocessed communication data into an anomaly detection model; wherein the anomaly detection model includes a gating sub-model and a plurality of detection sub-models; Calling the gated sub-model, and determining at least one detection sub-model for processing the current input of the model from among the multiple detection sub-models according to the data type currently input to the model; Calling the at least one detection sub-model to perform abnormal number detection on the current input of the model; inputting the output of the at least one detection sub-model into a classification model; The classification model is called to generate an abnormal number detection result based on the output of the at least one detection sub-model, wherein the abnormal number detection result is used to indicate whether there is an abnormal number in the current input of the model.

2. The method according to claim 1, characterized in that: The performing data preprocessing on the communication data to be detected includes: Performing feature extraction on the communication data to be detected; Performing feature selection among the extracted features to obtain the preprocessed communication data; The extracted features include at least one of the following: A time feature, wherein the time feature includes at least one of a communication duration or a communication time; Object behavior characteristics related to communication; Network characteristics, wherein the network characteristics are used to characterize communication quality; A label feature, wherein the label feature is used to indicate whether the communication number history to be detected is marked as an abnormal number; The subject's speech characteristics during the communication process; Text features, the text features including keywords extracted from the speech recognition text; the speech recognition text is obtained by performing speech recognition on the communication speech; Additional features, the additional features including at least one of the emotion type or abnormality degree of the speech recognition text.

3. The method according to claim 1, characterized in that The acquiring of the communication data to be detected comprises: In response to monitoring a new communication, using the communication data generated by this communication as the communication data to be detected; or, The historical communication data is collected periodically, and the newly collected historical communication data is used as the communication data to be detected.

4. The method according to claim 1, characterized in that: The method further comprises: Based on the local interpretable model, obtaining explanatory information of the abnormal number detection result; outputting the explanatory information; Among them, the local interpretable model is a local approximation of the anomaly detection model and the classification model; the explanatory information is used to describe the decision basis for generating the abnormal number detection result.

5. The method according to claim 4, characterized in that The training process of the local interpretable model includes: Acquire a first training sample set; wherein the first training sample set includes the current input of the model and the abnormal number detection result generated based on the disturbance data; the disturbance data is obtained by disturbance sampling in the neighborhood of the current input of the model; Model training is performed based on the first training sample set to obtain the local interpretable model.

6. The method according to claim 1, characterized in that The training process of the anomaly detection model includes: Acquire a second training sample set and historical communication data for a target task; The second training sample set is larger in data size than the historical communication data; the target task is a task related to abnormal number detection; Based on the second training sample set, training the expert model in the hybrid expert model to obtain a pre-trained hybrid expert model; Based on the historical communication data, the pre-trained hybrid expert model is retrained to obtain the anomaly detection model.

7. The method according to claim 1, characterized in that The training process of the anomaly detection model includes: Obtain historical communication data and target training parameters; Dividing the historical communication data into a plurality of data subsets, and distributing the plurality of data subsets to different computing nodes; wherein the computing nodes are used to obtain the gradient of the network parameters of the anomaly detection model according to the received data subsets; Receiving the gradient of the current network parameter of the anomaly detection model returned by the first computing node; Based on the gradient of the current network parameters of the anomaly detection model and the target training parameters, updating the current network parameters of the anomaly detection model; Sending the updated network parameters to a second computing node other than the first computing node; The second computing node is used to replace the network parameters of the anomaly detection model currently stored locally with the updated network parameters.

8. The method according to claim 1, characterized in that The training process of the anomaly detection model includes: Acquire historical communication data, and divide the historical communication data into N mutually disjoint subsets of equal size; N is a positive integer greater than 1; In the current training process, N-1 subsets of the N subsets are used as training sets for model training, and the remaining subset is used as a test set to test the model obtained by the current training to obtain the current test result; Repeat the steps of selecting N-1 subsets as the training sets for model training and using the remaining subset as the test set for testing until the number of repetitions reaches N times; wherein a different subset is used as the test set in each training process; Based on the N test results obtained, obtain the model performance evaluation results under the current network parameters; The network parameters are optimized based on the model performance evaluation results to obtain the anomaly detection model.

9. The method according to any one of claims 6 to 8, characterized in that: The updating process of the anomaly detection model includes: In the case of newly added communication data, updating the network parameters of the anomaly detection model based on the newly added communication data to obtain an updated anomaly detection model; or, In the case of newly added communication data, the network parameters of the anomaly detection model are updated based on the historical communication data and the newly added communication data to obtain an updated anomaly detection model.

10. The method according to any one of claims 6 to 8, characterized in that: The updating process of the anomaly detection model includes: Obtaining user feedback data; wherein the user feedback data is used to describe the user's feedback on the generated abnormal number detection result; Based on the user feedback data, the network parameters of the anomaly detection model are updated to obtain an updated anomaly detection model.

11. The method according to claim 1, characterized in that: The method further comprises: Performing model performance monitoring on the anomaly detection model and the classification model; In response to the model performance indicator falling below a preset threshold, an alarm message is output.

12. An abnormal number detection device, characterized in that: The device comprises: An acquisition module, configured to acquire communication data to be detected; A preprocessing module, configured to perform data preprocessing on the communication data to be detected, and input the preprocessed communication data into an anomaly detection model; wherein the anomaly detection model includes a gating sub-model and a plurality of detection sub-models; The first detection module is configured to call the gated sub-model, determine at least one detection sub-model for processing the current input of the model from the multiple detection sub-models according to the data type of the current input of the model; and call the at least one detection sub-model to perform abnormal number detection on the current input of the model; and input the output of the at least one detection sub-model into the classification model; The second detection module is configured to call the classification model and generate an abnormal number detection result based on the output of the at least one detection sub-model, wherein the abnormal number detection result is used to indicate whether there is an abnormal number in the current input of the model.

13. A computer device, characterized in that: The device comprises a processor and a memory, wherein at least one program code is stored in the memory, and the at least one program code is loaded and executed by the processor to implement the abnormal number detection method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The storage medium stores at least one program code, and the at least one program code is loaded and executed by a processor to implement the abnormal number detection method according to any one of claims 1 to 11.

15. A computer program product or a computer program, characterized in that The computer program product or computer program includes a computer program code, which is stored in a computer-readable storage medium. A processor of a computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device executes the abnormal number detection method as claimed in any one of claims 1 to 11.

Images