Telecommunication network fraud prevention system and method based on big data analysis

Abstract

The invention discloses an anti-telecommunication network fraud system based on big data analysis, and belongs to the technical field of network security supervision, the system comprises an IDC server module, an information tracking module, a network transmission module and a central processing module, the information tracking module comprises an information acquisition unit, a modeling analysis unit and an effect verification unit, a firewall module, a safety management module and a safety operation and maintenance module are arranged between the network transmission module and the central processing module. According to the anti-telecommunication network fraud system based on big data analysis, through deep analysis of big data and real-time supervision and regular patrol of the big data, comprehensive evaluation analysis of network security is carried out, the overall security condition of the network is judged, then the network is managed reasonably, the occurrence of network fraud is reduced, and the security of the network is improved. And meanwhile, an emergency processing scheme is established, so that when network security vulnerabilities occur, security transfer of the data can be quickly completed, and the security of the data is ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security supervision, and specifically relates to an anti-telecom network fraud system and method based on big data analysis. Background Art

[0002] In recent years, the problem of fraudulent calls has continued to be prominent, seriously infringing on the interests of customers, causing very serious negative impacts on society, and attracting very widespread social attention. According to the "Procuratorial organs' work on combating telecommunications network fraud and related crimes (2023)" issued by the Supreme People's Procuratorate, from January to October 2023, the national procuratorate prosecuted more than 34,000 people for telecommunications network fraud crimes, an increase of nearly 52% year-on-year. Fraudulent calls have had a serious impact on the service image of communication operators. As the communication operator with the largest number of users in the world, it is of great significance for basic telecommunications companies to establish and improve effective technical prevention and control measures for fraudulent calls.

[0003] The types of fraudulent phone calls are complex and varied. The public security department has reported 48 types of fraud, including impersonating leaders and acquaintances, impersonating public security, procuratorial and judicial organs, impersonating online shopping customer service, credit loan fraud, investment and financial fraud, ticket change fraud, etc. At the same time, according to the characteristics of the fraudulent numbers, they can be divided into international number fraud, mobile phone number fraud, fixed-line number fraud, fake number fraud, etc. Fraudulent phone calls have complex and varied fraud scenarios and fraudulent behaviors. The technical control and management problems are difficult.

[0004] In the early stage, the basic telecommunications enterprises mainly controlled fraudulent calls by judging whether the calling number had the characteristics of a fake number change, and then identified and handled the suspected number by setting parameters such as the calling frequency threshold and the call dispersion value. This kind of scheme is good at identifying fraudulent calls such as fake number changes and high-frequency calls, but as the real mobile phone number fraud and high-frequency call behavior characteristics have begun to appear in large numbers in the past two years, the original technical identification means are insufficient. Summary of the invention

[0005] The purpose of the present invention is to provide an anti-telecom fraud system and method based on big data analysis, so as to solve the problem raised in the above background technology that as real mobile phone number fraud and high-frequency call behavior characteristics without obvious characteristics have begun to appear in large numbers in the past two years, the original technical identification means are insufficient.

[0006] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: an anti-telecom network fraud system based on big data analysis, comprising an IDC server module, an information tracking module, a network transmission module and a central processing module, the information tracking module comprising an information collection unit, a modeling and analysis unit and an effect verification unit, a firewall module, a security management module and a security operation and maintenance module are arranged between the network transmission module and the central processing module, the central processing module processes the data through the CPU, and the CPU transmits the processed data to the central processing module to complete the integration of big data, the CPU is also connected to an emergency module, a data transfer module, a data backup module and a restoration module, and a storage module is also arranged between the data transfer module, the data backup module and the restoration module.

[0007] In a further embodiment, the firewall module is respectively connected to a virus real-time scanning module and a timer, and the timer is connected to a timed inspection module, and the real-time virus scanning module is used to perform real-time virus scanning on the network device, identify potential security vulnerabilities, mark the number of potential security vulnerabilities as a device vulnerability scanning value, and obtain all configuration information of the network device, check whether the corresponding configuration of the network device complies with the computer network security standard, mark the configuration that does not comply with the computer network security standard as a different configuration, and mark the number of different configurations in the network device as a device configuration detection value;

[0008] The timer sets the inspection interval, and inspects the data in the network device again through the scheduled inspection module, and cooperates with the real-time virus scanning module to realize real-time and scheduled inspection of the data.

[0009] In a further embodiment, the collection unit collects user signaling, call bills and other call behavior data and user contract network access data from the big data center of the basic telecommunications enterprise as a modeling data source, and the user call signaling data, call bill data and user contract information data are all stored in the big data center of the basic telecommunications enterprise.

[0010] In a further embodiment, the modeling and analysis unit: establishes a fraudulent behavior feature set, based on known normal and fraudulent users, forms positive and negative training samples after statistical analysis of the original data according to the feature set, selects a suitable machine learning model for model training, and evaluates and optimizes the test effect of the model.

[0011] In a further embodiment, the effect verification unit: deploys and applies the training model to the existing network, shuts down the fraudulent numbers identified by the model, and verifies the effect of the model on the existing network in combination with subsequent complaint analysis of the shut-down users.

[0012] In a further embodiment, an intrusion prevention unit is provided in the security management module, and a log audit unit and a security audit unit are provided in the security operation and maintenance module.

[0013] In a further embodiment, the currently commonly used machine learning algorithms mainly include classification, regression, clustering, image recognition, etc. Combined with the business characteristics of fraud call analysis, it is necessary to perform user labeling analysis and classification based on the user's call behavior and contract feature data. Therefore, classification and regression algorithms are more suitable for modeling and training application scenarios of fraud call analysis.

[0014] In a further embodiment, commonly used classification and regression algorithms include the following: decision tree algorithms, regression algorithms, and kernel-based algorithms.

[0015] In a further embodiment, the existing network application selects the provincial company of a basic telecommunications enterprise with big data platform capabilities to cooperate with the pilot implementation. Relying on the existing network business environment of the pilot province, the random forest recognition model is deployed to the existing network, and through actual fraud call complaints and governance review data, comparison and verification are carried out to obtain an evaluation of the actual model application effect.

[0016] A method for combating telecommunication network fraud based on big data analysis, the method comprising the following steps:

[0017] Step 1: Collect big data from the IDC server, establish a fraud behavior feature set, and compare and verify the collected data with the established fraud feature set;

[0018] Step 2: The analyzed data is transmitted over the network, and viruses are scanned in real time through the firewall module. Data is inspected regularly, and then the security management module and the security operation and maintenance module are used to defend against invading viruses and maintain data.

[0019] Step 3: The maintained output is transmitted to the central processing module, the data is processed by the CPU, and the processed data is stored to ensure data security;

[0020] Step 4: In case of emergency, the processed data is urgently backed up through the data backup module, and the backed-up data is stored. The stored data is restored to the state before the emergency through the restoration module, and then the data is re-processed by the CPU to improve the overall security of the network.

[0021] Technical effects and advantages of the present invention:

[0022] This anti-telecom network fraud system and method based on big data analysis conducts in-depth analysis of big data and real-time supervision and regular inspections of big data, thereby conducting a comprehensive assessment analysis of network security, judging the overall security of the network, and then reasonably managing the network to reduce the occurrence of network fraud. At the same time, an emergency response plan is established to quickly complete the secure transfer of data and ensure data security when a network security vulnerability occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 It is a system flow chart of the present invention;

[0025] Figure 2 Schematic diagram of the analysis steps of the present invention. DETAILED DESCRIPTION

[0026] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features well known in the art are not described.

[0027] Unless otherwise defined, the up, down, left, right, front, back, inside and outside directions involved in this document are based on the up, down, left, right, front, back, inside and outside directions in the figures shown in the present invention, and are explained here together.

[0028] See also Figure 1 and Figure 2The present invention provides an anti-telecom network fraud system based on big data analysis, including an IDC server module, an information tracking module, a network transmission module and a central processing module. The information tracking module includes an information collection unit, a modeling analysis unit and an effect verification unit. A firewall module, a security management module and a security operation and maintenance module are arranged between the network transmission module and the central processing module. The central processing module processes data through a CPU, and the CPU transmits the processed data to the central processing module to complete the integration of big data. The CPU is also connected to an emergency module, a data transfer module, a data backup module and a restoration module. A storage module is also arranged between the data transfer module, the data backup module and the restoration module. When an emergency occurs, the processed data is urgently backed up through the data backup module, and the backed-up data is stored. The stored data is restored to the state before the emergency through the restoration module, and the data is reprocessed by the CPU to improve the overall security of the network.

[0029] The firewall module is respectively connected to a virus real-time scanning module and a timer, and the timer is connected to a timed inspection module. The virus real-time scanning module performs real-time virus scanning on network devices, identifies potential security loopholes, marks the number of potential security loopholes as a device vulnerability scanning value, obtains all configuration information of network devices, checks whether the corresponding configuration of network devices complies with computer network security standards, marks configurations that do not comply with computer network security standards as abnormal configurations, and marks the number of abnormal configurations in network devices as a device configuration detection value;

[0030] The timer sets the inspection interval, and the data in the network device is inspected again through the scheduled inspection module, and the real-time virus scanning module is used to realize real-time and scheduled inspection of data;

[0031] Collection unit: collects user signaling, call records and other call behavior data as well as user contract and network access data from the big data center of the basic telecommunications enterprise as the data source for modeling. The signaling data, call record data and user contract information data of user calls are all stored in the big data center of the basic telecommunications enterprise. This verification process relies on the relevant data samples of the pilot basic telecommunications enterprise, establishes tenants based on the big data center, and opens the above data resources and computing resources;

[0032] Modeling and analysis unit: Establish a fraud behavior feature set, based on known normal and fraud users, statistically analyze the original data according to the feature set to form positive and negative training samples, select a suitable machine learning model for model training, and evaluate and optimize the model's test results;

[0033] Modeling scheme selection:

[0034] At present, the commonly used machine learning algorithms mainly include classification, regression, clustering, image recognition, etc. Combined with the business characteristics of fraud call analysis, it is necessary to perform labeling analysis and classification of users based on their call behavior and contract feature data. Therefore, classification and regression algorithms are more suitable for modeling and training application scenarios of fraud call analysis. Commonly used classification and regression algorithms are as follows:

[0035] 1. Decision tree algorithm: The decision tree algorithm uses a tree structure to establish a decision model based on the attributes of the data. In order to solve the problem of overfitting of decision trees, the random forest algorithm is usually used as its derivative optimization algorithm;

[0036] 2. Regression algorithm: Regression algorithm attempts to explore the relationship between variables by measuring the error, usually using logistic regression algorithm;

[0037] 3. Kernel-based algorithms: Kernel-based algorithms map the input data to a high-order vector space. In these high-order vector spaces, some classification or regression problems can be solved more easily. Support vector machine (SVM) algorithms are usually used;

[0038] The application scenarios and solutions of the above three types of algorithms are compared as follows:

[0039] 1. The random forest algorithm belongs to a rule-based model. It outputs the rules for classification. The generated rules can be combined with anti-fraud business knowledge to determine whether the model is reasonable and obtain the rule characteristics of fraudulent numbers. The random forest can be understood as a collection of multiple decision trees. It can solve the problem of decision trees being prone to overfitting to a certain extent and is more suitable for the application scenario of anti-fraud model training.

[0040] 2. Logistic regression algorithm belongs to classification model. The output result is the score of the number. The score can be used to identify the risk level of the number being a fraudulent number. At the same time, the coefficients in the logistic regression polynomial represent the important procedures of the model training related variables. The anti-fraud business knowledge and the coefficient value can be combined to judge whether the model is reasonable;

[0041] 3. The learning strategy of support vector machine (SVM) is to maximize the interval. It is also a relatively simple model. SVM can solve the problem of linear inseparability in low dimensions by increasing the dimension. SVM has excellent generalization ability, but is more suitable for small sample training because SVM consumes a lot of memory. If the amount of data is large, the training time will be long. In addition, SVM can get much better results than other algorithms on small samples, but the actual application performance is low.

[0042] In summary, combining the advantages and characteristics of various machine learning algorithms and based on the characteristics of fraud call analysis business, this solution selects decision tree, logistic regression and support vector machine algorithms that have good application effects in algorithm classification business to carry out modeling analysis and verification testing;

[0043] The data that needs to be collected include the following aspects:

[0044] The first category is dynamic data: Fraudsters use mobile communication networks. The signaling data and call record data generated during each call are the core data sources that can reflect user call behavior. Dynamic data coverage includes 2G / 3G / 4G / 5G networks.

[0045] 2G / 3G / 4G / 5G signaling data:

[0046] 1. Signaling involved: ISUP, BICC, SIP, MAP, Diameter, etc.;

[0047] 2. Interfaces involved: A port, Mc port, M port, C / D port, Sh port, N11, N12, etc.;

[0048] User billing data: including call billing bills, SMS billing bills, and traffic billing bills;

[0049] Data scope: call and location update data;

[0050] The second category is static data: static data refers to the basic information of the user's contract, including the user's network access time, package service information, service usage statistics, etc.

[0051] User account opening information: real-name information, account opening time, multiple numbers with one ID, package brand, card opening channel, etc.;

[0052] User consumption information: customer star rating, ARPU value, SMS / traffic usage, etc.;

[0053] The third category is violation data: by extracting data from the signaling call records of various reported numbers, it can be used as the main source of machine learning training samples;

[0054] Data on numbers involved in cases reported by the public security department and data on reports from 12321 users;

[0055] Internet labeled data;

[0056] Sample data dimension feature extraction:

[0057] Dimension feature extraction is an important business combing and calculation preparation work before machine learning modeling. The main work is divided into four aspects:

[0058] 1. Determine optional variables

[0059] Based on the user call bill data and user network contract data prepared in the early stage, based on the business experience of fraud call management, and combined with the actual characteristics of fraudulent behavior, appropriate variables are selected for model training;

[0060] 2. Strategy feature selection

[0061] Based on the identified variable indicators and the characteristics of fraudulent calls, we sorted out the strategy definition plan for the indicators, including strategy definition in multiple dimensions such as time, location, and number characteristics;

[0062] 3. Model feature analysis

[0063] Based on the collected user call data, contract signing and other basic data, combined with optional variables and policy features, data index calculation is performed to obtain the actual and true reflection data of each variable and policy feature in the existing network;

[0064] 4. Data Modeling Strategy

[0065] The indexed data set obtained by model feature analysis is used as the data input for model modeling and for the final machine learning modeling. We can train and formulate different recognition models according to different fraud call scenarios. The data modeling process is as follows:

[0066] 1. Based on the effective reporting data of 12321, extract the call data of the reported number and perform pre-processing operations of data cleaning and filtering;

[0067] 2. Count the call behavior characteristics of fraudulent numbers from the perspective of caller-caller ratio, average call duration, call area dispersion, concentrated time points, and repeated call ratio, and exclude abnormal numbers in the fraud samples whose behaviors are inconsistent with those of the majority of samples, to ensure that the behavior of the samples is as consistent as possible;

[0068] 3. Compare the call behavior characteristics of normal users and fraud numbers, analyze the fraud situations in different scenarios to establish screening conditions, and screen out suspicious numbers whose behaviors are similar to those of fraud numbers but inconsistent with those of normal users from all users, so as to avoid calculating the entire data and improve the efficiency of model detection;

[0069] 4. Build models based on known normal users and fraud samples, evaluate the model’s performance in training and test sets, and test the model’s performance in detecting all suspected numbers that have passed the initial screening in actual operation;

[0070] Test environment modeling process

[0071] This time, we selected model training tools (SPSS, Spark, Weka, etc.) to conduct model training, display, and application;

[0072] The ten-cross method is used to verify the model results. The sample historical data set is split into 10 parts, 9 parts are used as training data, and 1 part is used as verification data. Multiple rounds of training operations are performed to obtain the model accuracy.

[0073] Basic statistics of sample data

[0074] Obtain the original data of historical call records, contract information, etc. of the blacklist and whitelist users in the pilot provinces, perform statistical aggregation and correlation matching on the selected sample data through dimensional feature extraction, and finally form a sample data set as the model input;

[0075] The overall sample is randomly divided into three parts, which are used as training set, evaluation set and test set for model training analysis. The same batch of sample data is applied to the three modeling algorithms of random forest, logistic regression and support vector machine to analyze and evaluate the accuracy of the training results. In the process of applying different algorithms and different rounds of model training, the training set, evaluation set and test set of the current batch of samples are randomly selected. While ensuring that the sample number distribution is relatively uniform, the number of records is fine-tuned to ensure the randomness and rationality of sample selection.

[0076] Machine learning modeling training

[0077] Use the preprocessed model training input data for data modeling machine learning, including model training and evaluation testing. The machine learning modeling process is as follows:

[0078] 1. Model training: Through the model algorithm analysis of input data, we deeply explore the characteristic differences between normal users and fraud call users, as well as the selection and value range of key important variables;

[0079] 2. Model evaluation: After model evaluation of important variables and values ​​obtained through training, the effective model descriptions are sorted and output to obtain the evaluated data model;

[0080] 3. Model pre-testing: Apply the obtained model to the test data set to verify the application effect of the model trained this time. If the effect is good, the model information can be summarized and extracted for subsequent application practice. If the effect is not good, the training process needs to be iterated repeatedly until satisfactory data verification accuracy is achieved;

[0081] Importance analysis of variables

[0082] By analyzing the importance of variables in model training results, we evaluate the rationality and accuracy of different algorithms in selecting variable importance. Combined with manual sorting, adjustment, evaluation and comparison, we select the most reasonable machine learning algorithm for practical application.

[0083] 1. First use all features to build a model, and then select features with higher importance based on the importance of the variables output by the model;

[0084] 2. Selecting only important variables can prevent overfitting and improve the accuracy of prediction of unknown data;

[0085] Through the first round of feature selection and test environment data model training, we obtain dimensions with obvious differentiated features and confidence models. We manually select the strategy features with high confidence for the second time, obtain the dimension features with the greatest influencing factors, and conduct a second round of strategy feature training.

[0086] In the second round of strategy feature training, only the selected strategy features are input into the model, and finally a machine learning model that can be verified on the live network is obtained based on this group of strategy feature combinations;

[0087] Effect verification unit: Deploy the training model to the existing network, shut down the fraudulent numbers identified by the model, and analyze the subsequent complaints from the shut-down users to verify the effect of the model on the existing network. Considering the comprehensiveness and feasibility of the existing network data collection, the provincial company of the basic telecommunications enterprise with big data platform capabilities is selected to cooperate with the pilot implementation of the existing network application of this project. Relying on the existing network business environment of the pilot province, the random forest recognition model is deployed to the existing network, and the actual fraud call complaints and governance audit data are compared and verified to obtain the actual model application effect evaluation;

[0088] Current network effect verification:

[0089] Through in-depth analysis of fraudulent numbers from multiple dimensions, we further discovered that fraudulent numbers mainly present the following characteristics:

[0090] 1. The called numbers are mostly from developed provinces and are relatively concentrated;

[0091] 2. Fraudulent numbers roaming to other places show the characteristics of being concentrated in the roaming places. However, through historical data analysis, the roaming places show a trend of continuous change, indicating that fraudsters constantly change the places of illegal crimes to evade the crackdown by the public security.

[0092] 3. Fraudulent numbers are concentrated on the package types of China Mobile King Card;

[0093] 4. The ARPU value of fraudulent numbers is generally low, which is reflected in the fact that they have been connected to the network for a short time, are concentratedly used for fraudulent activities within a short period of time, and then the cards are abandoned and no longer used;

[0094] 5. The main access channels are self-service websites and third-party channels, which urgently need special rectification and management;

[0095] The security management module is equipped with an intrusion prevention unit, and the security operation and maintenance module is equipped with a log audit unit and a security audit unit. The intrusion prevention unit can defend against abnormal data, and the security operation and maintenance module can integrate abnormal data and form logs. When abnormal data invades later, the log audit unit can compare the new log with the previous log, and then the security audit unit can process the abnormal data to ensure data security, reduce the probability of fraud, and ensure user data security;

[0096] Through the above-mentioned high-tech machine learning experimental process, relatively good application results have been achieved in the accuracy of fraudulent call identification. At the same time, through the data analysis of the model verification process, the deep characteristics of fraudulent behavior can be discovered, which provides data and business analysis optimization guidance for the continuous optimization of subsequent models and the improvement of fraudulent number identification efficiency and accuracy.

[0097] A method for combating telecommunication network fraud based on big data analysis, the method comprising the following steps:

[0098] Step 1: Collect big data from the IDC server, establish a fraud behavior feature set, and compare and verify the collected data with the established fraud feature set;

[0099] Step 2: The analyzed data is transmitted over the network, and viruses are scanned in real time through the firewall module. Data is inspected regularly, and then the security management module and the security operation and maintenance module are used to defend against invading viruses and maintain data.

[0100] Step 3: The maintained output is transmitted to the central processing module, the data is processed by the CPU, and the processed data is stored to ensure data security;

[0101] Step 4: In case of emergency, the processed data is urgently backed up through the data backup module, and the backed-up data is stored. The stored data is restored to the state before the emergency through the restoration module, and then the data is re-processed by the CPU to improve the overall security of the network.

[0102] The present invention conducts in-depth analysis of big data, real-time supervision and regular inspection of big data, thereby conducting a comprehensive assessment analysis of network security, judging the overall security of the network, and then reasonably managing the network to reduce the occurrence of network fraud. At the same time, an emergency response plan is established to quickly complete the safe transfer of data when network security vulnerabilities occur, thereby ensuring data security.

[0103] At the same time, through data analysis during the model verification process, we can discover the deep characteristics of fraudulent behavior, provide data and business analysis optimization guidance for the continuous optimization of subsequent models, and improve the efficiency and accuracy of fraud number identification.

[0104] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An anti-telecom fraud system based on big data analysis, comprising an IDC server module, an information tracking module, a network transmission module and a central processing module, characterized in that: The information tracking module includes an information collection unit, a modeling and analysis unit, and an effect verification unit. A firewall module, a security management module, and a security operation and maintenance module are arranged between the network transmission module and the central processing module. The central processing module processes the data through the CPU, and the CPU transmits the processed data to the central processing module to complete the integration of big data. The CPU is also connected to an emergency module, a data transfer module, a data backup module, and a restoration module. A storage module is also arranged between the data transfer module, the data backup module, and the restoration module.

2. According to the anti-telecom fraud system based on big data analysis according to claim 1, it is characterized by: The firewall module is respectively connected to a virus real-time scanning module and a timer, and the timer is connected to a timed inspection module. The virus real-time scanning module performs real-time virus scanning on network devices, identifies potential security loopholes, marks the number of potential security loopholes as a device vulnerability scanning value, obtains all configuration information of network devices, checks whether the corresponding configuration of network devices complies with computer network security standards, marks configurations that do not comply with computer network security standards as abnormal configurations, and marks the number of abnormal configurations in network devices as a device configuration detection value; The timer sets the inspection interval, and inspects the data in the network device again through the scheduled inspection module, and cooperates with the real-time virus scanning module to realize real-time and scheduled inspection of the data.

3. The anti-telecom fraud system based on big data analysis according to claim 1 is characterized by: Collection unit: collects user signaling, call records and other call behavior data as well as user contract signing data from the big data center of the basic telecommunications enterprise as the data source for modeling. The user's call signaling data, call record data and user contract information data are all stored in the big data center of the basic telecommunications enterprise.

4. The anti-telecom fraud system based on big data analysis according to claim 1 is characterized by: Modeling and analysis unit: Establish a feature set of fraudulent behavior, based on known normal and fraudulent users, perform statistical analysis on the original data according to the feature set to form positive and negative training samples, select a suitable machine learning model for model training, and evaluate and optimize the model's test results.

5. The anti-telecom fraud system based on big data analysis according to claim 1 is characterized by: Effect verification unit: Deploy the training model to the live network, shut down the fraudulent numbers identified by the model, and analyze the subsequent complaints from the shut-down users to verify the effect of the model on the live network.

6. The anti-telecom fraud system based on big data analysis according to claim 1 is characterized by: The security management module is equipped with an intrusion prevention unit, and the security operation and maintenance module is equipped with a log audit unit and a security audit unit.

7. The anti-telecom fraud system based on big data analysis according to claim 4 is characterized by: Currently, commonly used machine learning algorithms mainly include classification, regression, clustering, image recognition, etc. Combined with the business characteristics of fraud call analysis, it is necessary to perform user labeling analysis and classification based on the user's call behavior and contract feature data. Therefore, classification and regression algorithms are more suitable for modeling and training application scenarios of fraud call analysis.

8. The anti-telecom fraud system based on big data analysis according to claim 7 is characterized by: Commonly used classification and regression algorithms are as follows: decision tree algorithms, regression algorithms, and kernel-based algorithms.

9. The anti-telecom fraud system based on big data analysis according to claim 5 is characterized by: For the existing network application, provincial companies of basic telecommunications enterprises with big data platform capabilities were selected to cooperate with the pilot implementation. Relying on the existing network business environment of the pilot province, the random forest recognition model was deployed to the existing network. Through actual fraud call complaints and governance review data, comparison and verification were carried out to obtain an evaluation of the actual model application effect.

10. An anti-telecom fraud method based on big data analysis as claimed in any one of claims 1 to 9, characterized in that: The anti-telecom fraud method comprises the following steps: Step 1: Collect big data from the IDC server, establish a fraud behavior feature set, and compare and verify the collected data with the established fraud feature set; Step 2: The analyzed data is transmitted over the network, and viruses are scanned in real time through the firewall module. Data is inspected regularly, and then the security management module and the security operation and maintenance module are used to defend against invading viruses and maintain data. Step 3: The maintained output is transmitted to the central processing module, the data is processed by the CPU, and the processed data is stored to ensure data security; Step 4: In case of emergency, the processed data is urgently backed up through the data backup module, and the backed-up data is stored. The stored data is restored to the state before the emergency through the restoration module, and then the data is re-processed by the CPU to improve the overall security of the network.

Images