Abnormal wireless bridge identification method, system and device and medium
By comparing the latitude and longitude of the Internet user record data and the IP information comparison, the traceability obtains the risk broadband account, and combines the fixed network DPI data to build an identification model to solve the problem of low recognition efficiency of wireless network bridge fraud in the border area. Realize higher recognition accuracy and governance efficiency.
Patent Information
- Application Number
- CN202411476284.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-22
- Publication Date
- 2025-01-28
AI Technical Summary
The prior art is inefficient in identifying wireless bridge frauds built by private broadband in border areas, requiring a lot of manpower and material resources, and the governance effect is not ideal.
By obtaining Internet user record data for latitude and longitude, extract access to IP information, and compare with the home width IP address information, trace the source of the risk broadband account, combine the fixed network DPI data to build an abnormal network bridge recognition model, to achieve precise identification of wireless network bridges Essence
Improve the accuracy of the identification of wireless network bridge fraud, reduce the needs of manual investigation, and improve the efficiency of governance.
Smart Images
Figure CN119383617A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communications, and in particular to a method, system, device and medium for identifying an abnormal wireless bridge. Background Art
[0002] Currently, telecommunications network fraud often occurs in border areas. Since telecommunications network fraud requires the use of high-bandwidth, stable Internet services, the Internet infrastructure in border areas is backward, and it is often necessary to rely on domestic IP dedicated lines and ordinary broadband to provide wireless Internet access services to overseas telecommunications fraud parks by setting up wireless bridges, so as to assist fraudsters in the fraud parks to access the Internet normally and then further carry out fraud.
[0003] Currently, such scenarios are mainly managed by manual on-site inspections. This method is inefficient, requires a lot of manpower and material resources, and the management effect is not ideal. The above problems need to be solved. Summary of the invention
[0004] In order to accurately identify the fraud of privately pulling broadband and setting up wireless bridges in border areas and improve the accuracy of identification, this application provides an abnormal wireless bridge identification method, system, device and medium, which adopts the following technical solutions:
[0005] In a first aspect, the present application provides a method for identifying an abnormal wireless bridge, comprising:
[0006] Obtaining the first Internet user record data, determining the latitude and longitude of the first Internet user record data, and extracting information from the first Internet user record data when determining that the number is an overseas number, to obtain access IP information;
[0007] Obtain the home broadband IP address information, and determine whether the access IP information belongs to an abnormal wireless bridge based on the home broadband IP address information. If it belongs to an abnormal wireless bridge, trace the source to obtain the risky broadband account;
[0008] According to the risky broadband account, the corresponding fixed-line DPI data is matched, and an abnormal bridge identification model is built according to the risky broadband account and the fixed-line DPI data to obtain the wireless bridge identification result.
[0009] Preferably, it also includes:
[0010] Get the broadband optical modem status;
[0011] When the broadband optical modem is in the state of deploying a personalized probe, obtain the broadband optical modem analysis data, match the second Internet user record data according to the broadband optical modem analysis data, perform longitude and latitude judgment on the second Internet user record data, and obtain abnormal analysis data;
[0012] Based on the anomaly analysis data, the risky broadband account can be traced back.
[0013] Preferably, the specific steps of obtaining the first Internet user record data are:
[0014] Obtain user mobile phone number, application usage information, user longitude data, user latitude data and access IP information.
[0015] Preferably, the specific steps of determining the longitude and latitude of the first Internet user record data are:
[0016] Obtain overseas longitude and latitude range data, and determine the location of the user longitude data and the user latitude data in the first Internet user record data based on the overseas longitude and latitude range data; when both the user longitude data and the user latitude data are covered by the overseas longitude and latitude range data, determine the user mobile phone number in the first Internet user record data to be an overseas number.
[0017] Preferably, the specific steps of obtaining the broadband optical modem analysis data are:
[0018] Get the MCA address information, mobile device identification code, and user phone number.
[0019] Preferably, the abnormal bridge identification model adopts the LightGBM algorithm.
[0020] In a second aspect, the present application provides an abnormal wireless bridge identification system, comprising:
[0021] An overseas number determination module is used to obtain the first Internet user record data, perform latitude and longitude determination on the first Internet user record data, and extract information from the first Internet user record data when it is determined to be an overseas number to obtain access IP information;
[0022] The abnormality judgment module is used to obtain the home broadband IP address information, and judge whether the access IP information belongs to an abnormal wireless bridge according to the home broadband IP address information. If it belongs to an abnormal wireless bridge, the risky broadband account is traced back;
[0023] The model analysis module is used to match the corresponding fixed-line DPI data according to the risky broadband account, build an abnormal bridge identification model according to the risky broadband account and the fixed-line DPI data, and obtain the wireless bridge identification result.
[0024] Preferably, it also includes:
[0025] Broadband optical modem data judgment module, used to obtain the status of broadband optical modem;
[0026] When the broadband optical modem is in the state of deploying a personalized probe, obtain the broadband optical modem analysis data, match the second Internet user record data according to the broadband optical modem analysis data, perform longitude and latitude judgment on the second Internet user record data, and obtain abnormal analysis data;
[0027] Based on the anomaly analysis data, the risky broadband account can be traced back.
[0028] In a third aspect, the present application provides an abnormal wireless bridge identification device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the abnormal wireless bridge identification method as described above.
[0029] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the abnormal wireless bridge identification method as described above when running.
[0030] In summary, compared with the prior art, the technical solution provided by this application has at least the following beneficial effects:
[0031] Without relying on the optical modem probe data, the present application obtains the first Internet user record data to perform longitude and latitude judgment, so as to further judge whether the user's mobile phone number is an overseas number. If it is judged to be an overseas number, the access IP information is extracted, and the access IP information is compared with the home broadband IP address information. If the comparison result is that it belongs to an abnormal wireless bridge, the risky broadband account is obtained by tracing the access IP information, and an abnormal bridge identification model is constructed based on the risky broadband account and fixed-line DPI data. The wireless bridge identification result is accurately identified, thereby realizing the accurate identification of fraud of privately pulling broadband and setting up wireless bridges in border areas, and improving the identification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] Figure 1 It is a flow chart of an abnormal wireless bridge identification method described in an embodiment of the present application.
[0033] Figure 2 It is a module diagram of an abnormal wireless bridge identification system described in an embodiment of the present application.
[0034] Description of reference numerals:
[0035] 1. Overseas number judgment module; 2. Abnormal judgment module; 3. Model analysis module. DETAILED DESCRIPTION
[0036] The following combination Figure 1-Figure 2 The present application is described in further detail. The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments and are not intended to be limiting.
[0037] Reference Figure 1 , the present application involves an abnormal wireless bridge identification method, specifically comprising:
[0038] Step S1: obtaining the first Internet user record data, determining the latitude and longitude of the first Internet user record data, and extracting information from the first Internet user record data when determining that the number is an overseas number, to obtain access IP information;
[0039] Step S2: Obtain the home broadband IP address information, and determine whether the access IP information belongs to an abnormal wireless bridge according to the home broadband IP address information. If it belongs to an abnormal wireless bridge, trace the source to obtain the risky broadband account;
[0040] Step S3: Match the corresponding fixed network DPI data according to the risky broadband account, build an abnormal bridge identification model according to the risky broadband account and the fixed network DPI data, and obtain the wireless bridge identification result.
[0041] Specifically, since the fraudsters in overseas electronic fraud parks often use mobile Internet apps such as WeChat, QQ, Douyin, Kuaishou, etc., whether they are work accounts or personal accounts, it is necessary to find the Internet company corresponding to the application, and first filter out the access IPs in the border and overseas areas based on the mobile phone user's APP usage records and GPS positioning information. If the IP corresponding to the mobile phone IP is the home broadband IP, then the triplet, specifically time + IP + port, is traced to the operator to trace the risky broadband account. The present application obtains the first Internet user record data on the Internet enterprise side without relying on the optical modem probe data, and performs latitude and longitude judgment on the first Internet user record data, so as to further judge whether the user's mobile phone number is an overseas number. When it is judged to be an overseas number, the information in the first Internet user record data is extracted to obtain the access IP information, and the access IP information is compared with the home broadband IP address information. When the comparison result is that it belongs to an abnormal wireless bridge, the access IP information is traced to the telecommunications operator enterprise side to obtain the risky broadband account, and an abnormal bridge identification model is constructed according to the risky broadband account and fixed-line DPI data, so as to accurately identify the wireless bridge identification result, realize the accurate identification of the fraud of privately pulling broadband and setting up wireless bridges in border areas, and improve the identification accuracy.
[0042] As one implementation method, the specific steps of obtaining the first Internet user record data are:
[0043] Obtain user mobile phone number, application usage information, user longitude data, user latitude data and access IP information.
[0044] Specifically, the embodiments of the present application obtain corresponding data when a user uses an APP on the Internet enterprise side, including application usage information, that is, the corresponding APP name, the user's mobile phone number of the mobile device using the APP, the user's longitude data when using the APP, that is, the GPS longitude, and the user's latitude data when using the APP, that is, the GPS latitude, and also includes access IP information.
[0045] As one implementation method, the specific steps of determining the longitude and latitude of the first Internet user record data are as follows:
[0046] Obtain overseas longitude and latitude range data, and determine the location of the user longitude data and the user latitude data in the first Internet user record data based on the overseas longitude and latitude range data; when both the user longitude data and the user latitude data are covered by the overseas longitude and latitude range data, determine the user mobile phone number in the first Internet user record data to be an overseas number.
[0047] Specifically, when the first Internet user record data is obtained, the user longitude data and user latitude data therein are analyzed according to the overseas longitude and latitude range data. Specifically, the GPS longitude and latitude are judged in combination with the latitude and longitude electronic fence information of the overseas border area to determine whether the user is using the application overseas at this time. If it is determined to be an overseas number, the access IP information corresponding to the user's mobile phone number is obtained for further processing.
[0048] In one embodiment, the GPS longitude and latitude (90.2098, 9.5745) of number A is within the country, and the GPS longitude and latitude (92.2097, 10.5741) of number B is outside the country, that is, the number corresponding to number B is determined to be an overseas number, and the access IP information of number B is obtained for further analysis and judgment.
[0049] As one implementation mode, it also includes:
[0050] Get the broadband optical modem status;
[0051] When the broadband optical modem is in the state of deploying a personalized probe, obtain the broadband optical modem analysis data, match the second Internet user record data according to the broadband optical modem analysis data, perform longitude and latitude judgment on the second Internet user record data, and obtain abnormal analysis data;
[0052] Based on the anomaly analysis data, the risky broadband account can be traced back.
[0053] Specifically, this solution targets the deployment of personalized probes on broadband optical modems in border areas. It makes judgments by obtaining the status of broadband optical modems. It has the ability to monitor MAC / IMEI / IMSI / QQ numbers under optical modems. Customized plug-ins can identify MAC / IMEI / IMSI / QQ numbers and provide them to Internet companies to obtain GPS location information to determine whether they are overseas. If yes, it means that the optical modem provides network services for mobile phone numbers in overseas areas and is a target of crackdown. It privately connects IP dedicated lines and ordinary broadband to overseas areas and provides network services for the electronic fraud park, thereby tracing the risky optical modem and the corresponding broadband account information.
[0054] As one implementation method, the specific steps of obtaining the broadband optical modem analysis data are as follows:
[0055] Get the MCA address information, mobile device identification code, and user phone number.
[0056] Specifically, the embodiment of the present application obtains the broadband optical modem personalized probe parsing data from the telecommunications operator side, that is, the broadband optical modem parsing data, which is specifically a data table containing several telephone numbers and their corresponding remaining data. The corresponding data also includes MAC address information, including IMEI, International Mobile Equipment Identity, that is, International Mobile Equipment Identity, including IMSI, International Mobile Subscriber Identity, International Mobile User Identity, including user mobile phone number and QQ number, etc. After obtaining the broadband optical modem parsing data, the user's mobile phone number is used as an index to extract the corresponding second Internet user record data under the corresponding broadband optical modem usage scenario, including the user's mobile phone number, application usage information, user longitude data, user latitude data and access IP information. By determining whether the longitude and latitude of the second Internet user record data are abnormal, and if it is judged to be abnormal, the abnormal number and corresponding information of the broadband optical modem parsing data are separated to obtain abnormal parsing data, and then the abnormal parsing data is further indexed and traced to the risky broadband account.
[0057] Based on the screened MAC or IMEI information of the optical modem, using the MAC or IMEI of the optical modem as an index, the operator's home broadband account information data can be traced back to the risky broadband account; based on the risky broadband account, the location of the broadband can be locked and a crackdown can be carried out.
[0058] As one of the implementation methods, the abnormal bridge identification model adopts the LightGBM algorithm.
[0059] Specifically, in the embodiment of the present application, when a risky broadband account is obtained through tracing, an AI risk model is constructed according to the corresponding features of the initially screened risky broadband account information involving fraud.
[0060] First, we construct feature engineering for labeling positive and negative samples. The key indicators for constructing feature engineering are shown in Table 1:
[0061] Serial number Feature indicators Considerations 1 Characteristics of high-risk apps Factor A 2 Using high-risk domain characteristics Factor B 3 Broadband account traffic usage characteristics Factor C 4 Multiple machines at the same site Factor D 5 Broadband installation location characteristics Factor E
[0062] Factor A is to consider the use of high-risk apps under WIFI, which has a high risk of fraud. High-risk apps include but are not limited to: remote control software apps, secret chat software apps, shared conference software, etc.
[0063] Factor B takes into account that fraudsters often visit the management backend domain name addresses of fraudulent websites, including but not limited to: the management backend domain name addresses of fake investment and financial management websites, the management backend domain name addresses of phishing websites, etc.
[0064] The traffic of broadband accounts used for telecommunications network fraud is often very large, because after being transmitted to the fraud park through a wireless bridge, it is centrally used by a group of fraud gangs. Therefore, factor C includes broadband accounts with large traffic.
[0065] In order to provide high-traffic network services, domestic fraud accomplices often apply for multiple broadbands at the same address at the same time, so factor D refers to the situation where multiple broadbands are applied for at the same address at the same time.
[0066] The location where the wireless bridge is set up is often near the edge, high-rise building or open area, within 3 kilometers away from the fraud park. It is calculated by combining the installation address with the latitude and longitude information of the border area. Therefore, factor E is near the edge, high-rise building or open area, within 3 kilometers away from the fraud park.
[0067] Positive samples are fraudulent broadband accounts, and such fraudulent broadband accounts that have been successfully cracked down are obtained as positive samples. Negative samples are non-fraudulent broadband accounts, and non-fraudulent broadband accounts are obtained as negative samples. Since the timeliness requirements of the embodiment scheme of the present application are not high, the data set used contains 100,000 labeled samples, and the positive-negative sample ratio is about 1:10, and each sample includes the above multiple features. The data set is divided into two parts: 80% training set and 20% test set. The training set is used for model training and parameter adjustment, and the test set is used for the final model evaluation.
[0068] The embodiments of the present application select appropriate machine learning algorithms based on data characteristics and problem types. Common algorithms include GBDT, logistic regression, random forest, LightGBM, neural networks, etc. LightGBM uses a histogram-based decision tree algorithm, which has advantages in memory usage and computing speed, and can achieve faster training efficiency, lower memory consumption, and support for high-dimensional data and large-scale data. In the embodiments of the present application, massive data from the first 6 months were used for training. The huge amount of data requires faster training efficiency. LightGBM is suitable for predicting fraudulent broadband account users in massive data.
[0069] The specific parameter adjustment and selection process of the LightGBM model in this application embodiment is as follows:
[0070] Based on the preliminary experimental results, a set of basic parameters were set for preliminary training, including the number of trees n_estimators = 1000, the maximum depth of the tree max_depth = 5, the learning rate learning_rate = 0.27, and the number of leaf nodes num_leaves = 61.
[0071] Adjust num_leaves and class_weights. Experiment with the number of num_leaves and different class_weights to explore the sensitivity of the model to imbalanced classes. For example, we tried num_leaves of 128 and different class weight ratios, such as [1,150] to [1,300], to observe the changes in recognition accuracy and false positive rate.
[0072] Adjust learning_rate and max_depth. By fine-tuning this key parameter, try to find the optimal model complexity and learning speed. In some configurations, adjust learning_rate slightly, such as from 0.3 to 0.4 or 0.2, and test the impact on model performance.
[0073] Perform model evaluation. After each parameter adjustment, use the same training and validation sets to evaluate the model's accuracy, precision, false positive rate, and recall. These indicators help understand the performance and generalization ability of the model under different parameter configurations.
[0074] After multiple rounds of parameter adjustment and model evaluation, when n_estimators = 1000, max_depth = 5, learning_rate = 0.27, num_leaves = 61, and class_weights = [1,300] were set, the model achieved a relatively balanced optimal result in terms of accuracy and recall, with an accuracy of 95.18% and a recall of 94.53%, as shown in Table 2:
[0075]
[0076] Through the above process, the embodiment of the present application not only optimizes the parameters of the model, but also ensures the robustness and efficiency of the model when processing unbalanced data, thereby realizing accurate identification of frauds of privately pulling broadband and setting up wireless bridges in border areas and improving identification accuracy.
[0077] The embodiment of this application can accurately identify frauds in border areas where private broadband is used to build wireless bridges. Compared with traditional telecommunications network fraud prevention methods, this application screens risky home broadband accounts in border areas through the initial screening of fraud scenarios, and then builds an AI model based on fixed-line DPI data to accurately identify fraudulent home broadband accounts. The integration of Internet enterprise data and telecommunications operator data has achieved collaborative linkage between industries and exerted the greatest anti-telecom fraud effect.
[0078] Reference Figure 2 , an abnormal wireless bridge identification system is provided for an embodiment of the present application, the system comprising:
[0079] An overseas number determination module is used to obtain the first Internet user record data, perform latitude and longitude determination on the first Internet user record data, and extract information from the first Internet user record data when it is determined to be an overseas number to obtain access IP information;
[0080] The abnormality judgment module is used to obtain the home broadband IP address information, and judge whether the access IP information belongs to an abnormal wireless bridge according to the home broadband IP address information. If it belongs to an abnormal wireless bridge, the risky broadband account is traced back;
[0081] The model analysis module is used to match the corresponding fixed-line DPI data according to the risky broadband account, build an abnormal bridge identification model according to the risky broadband account and the fixed-line DPI data, and obtain the wireless bridge identification result.
[0082] As one implementation mode, it also includes a broadband optical modem data judgment module, which is used to obtain the broadband optical modem status;
[0083] When the broadband optical modem is in the state of deploying a personalized probe, obtain the broadband optical modem analysis data, match the second Internet user record data according to the broadband optical modem analysis data, perform longitude and latitude judgment on the second Internet user record data, and obtain abnormal analysis data;
[0084] Based on the anomaly analysis data, the risky broadband account can be traced back.
[0085] An embodiment of the present application provides an abnormal wireless bridge identification device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the abnormal wireless bridge identification method as described above.
[0086] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the abnormal wireless bridge identification method as described above when running.
[0087] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and product can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0088] In several embodiments provided in this application, it should be understood that the disclosed methods, systems, devices and program products may be implemented in other ways.
[0089] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0090] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A method for identifying an abnormal wireless bridge, characterized in that: include: Obtaining the first Internet user record data, determining the latitude and longitude of the first Internet user record data, and extracting information from the first Internet user record data when determining that the number is an overseas number, to obtain access IP information; Obtain the home broadband IP address information, and determine whether the access IP information belongs to an abnormal wireless bridge based on the home broadband IP address information. If it belongs to an abnormal wireless bridge, trace the source to obtain the risky broadband account; According to the risky broadband account, the corresponding fixed-line DPI data is matched, and an abnormal bridge identification model is built according to the risky broadband account and the fixed-line DPI data to obtain the wireless bridge identification result.
2. The abnormal wireless bridge identification method according to claim 1, characterized in that: Also includes: Get the broadband optical modem status; When the broadband optical modem is in the state of deploying a personalized probe, obtain the broadband optical modem analysis data, match the second Internet user record data according to the broadband optical modem analysis data, perform longitude and latitude judgment on the second Internet user record data, and obtain abnormal analysis data; Based on the anomaly analysis data, the risky broadband account can be traced back.
3. The abnormal wireless bridge identification method according to claim 1, characterized in that: The specific steps of obtaining the first Internet user record data are: Obtain user mobile phone number, application usage information, user longitude data, user latitude data and access IP information.
4. The abnormal wireless bridge identification method according to claim 3, characterized in that: The specific steps of determining the longitude and latitude of the first Internet user's recorded data are: Obtain overseas longitude and latitude range data, and determine the location of the user longitude data and the user latitude data in the first Internet user record data based on the overseas longitude and latitude range data; when both the user longitude data and the user latitude data are covered by the overseas longitude and latitude range data, determine the user mobile phone number in the first Internet user record data to be an overseas number.
5. The abnormal wireless bridge identification method according to claim 2, characterized in that: The specific steps of obtaining the broadband optical modem parsing data are as follows: Get the MCA address information, mobile device identification code, and user phone number.
6. The abnormal wireless bridge identification method according to claim 1, characterized in that: The abnormal bridge identification model adopts the LightGBM algorithm.
7. An abnormal wireless bridge identification system, characterized in that: include: An overseas number determination module is used to obtain the first Internet user record data, perform latitude and longitude determination on the first Internet user record data, and extract information from the first Internet user record data when it is determined to be an overseas number to obtain access IP information; The abnormality judgment module is used to obtain the home broadband IP address information, and judge whether the access IP information belongs to an abnormal wireless bridge according to the home broadband IP address information. If it belongs to an abnormal wireless bridge, the risky broadband account is traced back; The model analysis module is used to match the corresponding fixed-line DPI data according to the risky broadband account, build an abnormal bridge identification model according to the risky broadband account and the fixed-line DPI data, and obtain the wireless bridge identification result.
8. The abnormal wireless bridge identification system according to claim 7, characterized in that: Also includes: Broadband optical modem data judgment module, used to obtain the status of broadband optical modem; When the broadband optical modem is in the state of deploying a personalized probe, obtain the broadband optical modem analysis data, match the second Internet user record data according to the broadband optical modem analysis data, perform longitude and latitude judgment on the second Internet user record data, and obtain abnormal analysis data; Based on the anomaly analysis data, the risky broadband account can be traced back.
9. An abnormal wireless bridge identification device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the abnormal wireless bridge identification method according to any one of claims 1 to 6.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the abnormal wireless bridge identification method according to any one of claims 1 to 6 when running.