Method and system for evaluating anti-fraud index

Abstract

The invention discloses a method and a system for evaluating an anti-fraud index. The method comprises the following steps of: 1, acquiring and processing multi-source heterogeneous data; the multi-source heterogeneous data comprises telecommunication data, a social platform, historical fraud data, a user portrait and a system log; the data processing comprises text cleaning, voice-to-text conversion, image feature extraction and data anonymization; 2, calculating personal risk features, regional risk features and system efficiency features; 3, comprehensively evaluating an anti-fraud index based on the personal risk characteristics, the regional risk characteristics and the system efficiency characteristics; the method is based on a multi-dimensional index system of a personal risk index (PRI), a regional threat index (RTI) and a system efficiency index (SEI), and provides comprehensive support of accurate prevention and control, dynamic response and scientific decision for an anti-fraud system.

Description

Technical Field

[0001] The present invention belongs to the technical field of anti-fraud data processing, and in particular relates to an anti-fraud index evaluation method and system. Background Art

[0002] In recent years, with the rapid development of information technology, telecommunications network fraud methods have become increasingly complex, hidden and intelligent, showing characteristics such as cross-platform collaboration, precise fraud, and rapid iteration of technical tools. The traditional anti-fraud prevention and control system mainly relies on manual experience, rule engine matching and single-dimensional data analysis, and gradually exposes the following technical bottlenecks when dealing with new fraud methods: Traditional methods are mostly based on a single data source (such as call records or text keywords) for analysis, lacking deep integration of multimodal data (voice, text, behavior logs, social networks). For example, it is difficult to identify new fraud techniques that use homophone replacement (such as "transfer" to "transfer") or semantic confusion through keyword matching alone, resulting in a high rate of missed reports. At the same time, the static characteristics of the rule engine cannot adapt to the rapidly changing attack patterns of fraudsters. For example, the emergence of technologies such as deep fake voices and AI-generated phishing emails has made the traditional detection system based on a fixed rule base ineffective. Summary of the invention

[0003] The purpose of the present invention is to provide an anti-fraud index evaluation method and system, which uses a personal risk index (PRI), a regional threat index (RTI) and a system effectiveness index (SEI) to quantify individual fraud risks, regional crime intensity and system prevention and control capabilities, respectively; and then comprehensively evaluates the anti-fraud index.

[0004] To achieve the above object, the present invention adopts the following technical solution:

[0005] An anti-fraud index evaluation method includes the following steps:

[0006] Step 1: Acquisition and processing of multi-source heterogeneous data;

[0007] The multi-source heterogeneous data includes telecommunications data, social platforms, historical fraud data, user portraits and system logs;

[0008] Data processing includes text cleaning, speech-to-text conversion, image feature extraction, and data anonymization;

[0009] Step 2: Calculate individual risk characteristics, regional risk characteristics, and system effectiveness characteristics;

[0010] Personal risk characteristics are used to assess the current risk level of fraud for an individual; regional risk characteristics are used to reflect the level of fraud activity within a geographic area; and system effectiveness characteristics are used to measure the real-time prevention and control capabilities of the anti-fraud system.

[0011] Step 3: Comprehensively evaluate the anti-fraud index based on personal risk characteristics, regional risk characteristics, and system efficiency characteristics;

[0012] The anti-fraud index P = α·PRI + β·RTI + γ·SEI; α, β, and γ are weights; PRI is the personal risk characteristic; RTI is the regional risk characteristic; SEI is the system efficiency characteristic.

[0013] Furthermore, the personal risk characteristic is based on four core dimensions: behavior, psychology, social interaction, and history. Its calculation method is: personal risk characteristic PRI = 0.4 × behavior score + 0.3 × psychology score + 0.2 × social interaction score + 0.1 × history score.

[0014] Furthermore, the behavior score consists of the high-frequency unfamiliar communication index, abnormal behavior activity, and interaction sensitivity.

[0015] The high-frequency unfamiliar communication index refers to the proportion of the number of calls from unfamiliar numbers and the number of received unfamiliar text messages in the past 24 hours to the total number of communications.

[0016] The abnormal behavior activity consists of the time sensitivity score and device fingerprint abnormality. The time sensitivity score w t is the time weight, with a weight of 1.5 from 0 to 5 am and 0.8 for the rest of the time; device fingerprint abnormality refers to the detection of the device replacement frequency. If the device is replaced more than 3 times a month, 20 points are obtained, and there is a mark for using an emulator / virtual environment; if it exists, +15 points are added.

[0017] The interaction sensitivity refers to the link click risk value. The link risk is evaluated based on the URL blacklist library.

[0018] Furthermore, the psychology score refers to the sum of the emotional anxiety index and the cognitive deviation degree.

[0019] The emotional anxiety index is based on voice emotion analysis, and 88-dimensional acoustic features are extracted using the OpenSMILE toolkit; the emotional anxiety index A1 = 0.4 × PRAAT fundamental frequency jitter rate + 0.6 × MFCC energy entropy.

[0020] The cognitive deviation degree refers to the contradiction score of the input text based on the large language model.

[0021] Furthermore, the social interaction score refers to the social network pollution degree and the abnormal activity degree of the community.

[0022] The social network pollution degree refers to the product of the number of blacklisted contacts in direct contacts multiplied by 3 and the proportion of the number of blacklisted contacts in second-degree contacts to the total number of contacts. The data is sourced from the address book, social platform friend list, and group members.

[0023] The abnormal activity level of the community refers to the ratio of the number of fraud reports in the affiliated group to the total number of group members.

[0024] Furthermore, the historical score refers to the composition of the experience of being deceived and the participation in anti-fraud education.

[0025] Furthermore, the regional threat feature is related to the number of fraud cases per unit area, the growth rate of fraud cases per unit time, the diffusion speed of new fraud technologies, and the speed of social networks. The regional threat feature RTI = 0.4 × normalized (number of fraud cases per unit area) + 0.3 × growth rate of fraud cases per unit time + 0.2 × diffusion speed of new fraud technologies + 0.1 × speed of social networks.

[0026] Furthermore, the system effectiveness feature refers to the recognition performance and response performance of the system; the recognition performance refers to the recall rate of fraud information; the response performance refers to the average time taken from recognition to reaching the victim; the system effectiveness feature SEI = (recall rate × 0.6 + response speed score × 0.4) × interception success rate.

[0027] An evaluation system for the anti-fraud index includes a processor and a memory. The memory stores a program that can be processed by the processor, and the program can implement the evaluation method of the anti-fraud index.

[0028] Based on the multi-dimensional index system of the Personal Risk Index (PRI), Regional Threat Index (RTI), and System Effectiveness Index (SEI), the present invention provides comprehensive support for accurate prevention and control, dynamic response, and scientific decision-making of the anti-fraud system. Detailed implementation manners

[0029] The evaluation method of the anti-fraud index provided in this embodiment is a comprehensive index that quantifies and evaluates the fraud risk level of individuals / groups and the prevention and control effectiveness of the anti-fraud system through multi-dimensional data fusion and intelligent analysis.

[0030] An evaluation method of the anti-fraud index includes the following steps:

[0031] Step 1: Acquisition and processing of multi-source heterogeneous data;

[0032] Acquisition of multi-source heterogeneous data: (1) Telecommunication data: call records, text message content, IP addresses, device fingerprints. (2) Social platforms: WeChat / Weibo private message content, link click behavior. (3) Public security data: historical fraud case database (time, location, modus operandi, amount). (4) User portraits: age, occupation, education level, historical deception records. (5) System logs: fraud recognition rate, dissuasion response time, interception success rate.

[0033] Data Processing: Text cleaning (denoising, word segmentation), speech-to-text conversion (ASR), image feature extraction (OCR / CNN). Data anonymization (using differential privacy technology to protect sensitive information);

[0034] Data processing includes: (1) Noise filtering, using regular expressions to match junk information, such as the advertisement template [XX Mall] Your points are about to expire, click the link to redeem; identifying and removing low-quality text such as garbled characters and Martian text through the BERT-CRF model. (2) Entity normalization, using the conditional random field (CRF) model to anonymize personal information, such as replacing Ms. Li's 138****1234 with <Name><Phone>. Unifying timestamps in different time zones into the GMT+8 format and converting address information into longitude and latitude coordinates. (3) Multilingual processing, for multilingual data in cross-border fraud; such as the Chinese-English mixed text [PayPal] Your account has been locked: http: / / fake.link, using the mBERT model for cross-lingual semantic alignment.

[0035] After cleaning, the data availability has been significantly improved; the noise removal rate of SMS data is 92.3% - 99.1%, and the F1 value of social text entity recognition is 85.7 - 93.6.

[0036] Through the construction of the above technical system, the multi-source heterogeneous data processing module can provide high-quality and diverse data support for the generation of upper-layer fraud detection and dissuasion strategies.

[0037] Step 2: Obtain personal risk characteristics, regional risk characteristics, and system efficiency characteristics;

[0038] Personal risk characteristics are used to evaluate the current risk level of an individual being defrauded. Regional risk characteristics are used to reflect the activity level of fraud activities within a geographical area. System efficiency characteristics are used to measure the real-time prevention and control capabilities of the anti-fraud system.

[0039] The quantitative assessment of personal risk characteristics is based on four core dimensions: behavior, psychology, social interaction, and history. The specific calculation method is: Personal Risk Index (PRI) = 0.4 × Behavior Score + 0.3 × Psychology Score + 0.2 × Social Interaction Score + 0.1 × History Score.

[0040] The Behavior Score is composed of the high-frequency strange communication index, abnormal behavior activity, and interaction sensitivity. The high-frequency strange communication index refers to the ratio of the number of calls from strange numbers and the number of received strange text messages in the past 24 hours to the total communication times. If the ratio is greater than 30, it is determined to be a high risk. The abnormal behavior activity is composed of the time sensitivity score and device fingerprint abnormality. The time sensitivity score w tis the time weight, with a weight of 1.5 from 0 to 5 am and 0.8 for the rest of the time. Abnormal device fingerprint refers to detecting the device replacement frequency. If the device is replaced more than 3 times a month, 20 points will be given, and the use of simulator / virtual environment will be marked; if it exists, 15 points will be added. Interaction sensitivity refers to the link click risk value Link risk is evaluated based on the URL blacklist library.

[0041] The psychological score refers to the sum of the emotional anxiety index and the cognitive deviation degree; the emotional anxiety index is based on voice emotion analysis, and 88-dimensional acoustic features are extracted using the OpenSMILE toolkit; the emotional anxiety index A1 = 0.4 × PRAAT fundamental frequency jitter rate + 0.6 × MFCC energy entropy; anxiety level: if A > 0.7, 30 points will be given; the full score is 30. The cognitive deviation degree refers to the contradiction score of the input text based on the large language model (LLM).

[0042] The social score refers to the social network pollution degree and the abnormal community activity degree; the social network pollution degree refers to the number of blacklisted contacts in direct contacts multiplied by 3 and the proportion of blacklisted contacts in second-degree contacts in the total number of contacts, and the data comes from the address book, social platform friend list, and group members. The abnormal community activity degree refers to the number of fraud reports in the group divided by the total number of group members.

[0043] The historical score is composed of the deceived experience and the participation in anti-fraud education. Having a deceived experience adds 1 point, and participating in anti-fraud education events subtracts 1 point.

[0044] By means of quantitative modeling, abstract risks are transformed into actionable numerical indicators, enabling the anti-fraud system to achieve hierarchical early warning and precise intervention.

[0045] The regional threat feature is related to the number of fraud cases per unit area, the growth rate of fraud cases per unit time, the diffusion speed of new fraud technologies, and the social network speed. The regional threat feature RTI = 0.4 × normalized (number of fraud cases per unit area) + 0.3 × growth rate of fraud cases per unit time + 0.2 × diffusion speed of new fraud technologies + 0.1 × social network speed.

[0046] Through the fusion of multi-dimensional spatio-temporal features, the precise quantification and early warning of regional fraud threats are realized. Compared with the traditional manual research and judgment mode, the case discovery efficiency is increased by 8 times, and the accuracy of the prevention and control resource investment is increased by 42%.

[0047] The system effectiveness feature refers to the recognition performance and response performance of the system; the recognition performance refers to the fraud information recall rate; the response performance refers to the average time from recognition to reaching the victim; the system effectiveness feature SEI = (recall rate × 0.6 + response speed score × 0.4) × interception success rate.

[0048] Step 3: Evaluate the anti-fraud index P = α·PRI + β·RTI + γ·SEI based on personal risk characteristics, regional risk characteristics, and system effectiveness characteristics; α, β, and γ are weights, and the weights are dynamically adjusted based on the performance of the weekly validation set.

[0049] The above are only the preferred embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications and substitutions based on the technical solutions and inventive concepts provided by the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for evaluating an anti-fraud index, characterized in that, The steps include: Step 1: Acquisition and processing of multi-source heterogeneous data; The multi-source heterogeneous data includes telecommunications data, social platforms, historical fraud data, user portraits and system logs; Data processing includes text cleaning, speech-to-text conversion, image feature extraction, and data anonymization; Step 2: Calculate individual risk characteristics, regional risk characteristics, and system effectiveness characteristics; Personal risk profiles are used to assess an individual’s current risk level of being defrauded; Regional risk characteristics are used to reflect the level of fraud activity in a geographic area; system effectiveness characteristics are used to measure the real-time prevention and control capabilities of the anti-fraud system; Step 3: Comprehensively evaluate the anti-fraud index based on individual risk characteristics, regional risk characteristics and system effectiveness characteristics; Anti-fraud index P = α·PRI+β·RTI+γ·SEI; α, β, γ are weights; PRI is the individual risk characteristic; RTI is the regional risk characteristic; SEI is the system performance index.

2. The evaluation method of an anti-fraud index according to claim 1, characterized in that The personal risk characteristics are based on four core dimensions: behavior, psychology, social, and history, and are calculated as follows: personal risk characteristics PRI = 0.4×behavioral score + 0.3×psychological score + 0.2×social score + 0.1×historical score.

3. The evaluation method of an anti-fraud index according to claim 2, wherein The behavior score is composed of high-frequency unfamiliar communication index, abnormal behavior activity, and interaction sensitivity. The high-frequency stranger communication index refers to the ratio of the number of calls from strange numbers and the number of strange text messages received to the total number of communications in the past 24 hours; The abnormal behavior activity level is composed of the time sensitivity score and device fingerprint anomalies. The time sensitivity score w t is the time weight, with a weight of 1.5 from 0 to 5 am and 0.8 for the rest of the time; device fingerprint anomalies refer to detecting the device replacement frequency. If the device is replaced more than 3 times a month, 20 points are awarded; for the use of emulators / virtual environments, if present, an additional 15 points are added; Interaction sensitivity refers to the link click risk value, The link risk is evaluated based on the URL blacklist library.

4. The evaluation method of an anti-fraud index according to claim 2, wherein The psychological score refers to the sum of the emotional anxiety index and the cognitive bias degree; The emotional anxiety index is based on speech emotion analysis and uses the OpenSMILE toolkit to extract 88-dimensional acoustic features; Affective anxiety index A1 = 0.4 × PRAAT fundamental frequency jitter rate + 0.6 × MFCC energy entropy; Cognitive bias refers to the contradiction score of the input text based on the large language model.

5. The evaluation method of an anti-fraud index according to claim 2, characterized in that, The social score refers to the degree of social network pollution and abnormal activity of the community; Social network pollution refers to the ratio of the number of blacklisted contacts in direct contacts × 3 and the number of blacklisted contacts in second-degree contacts to the total number of contacts. The data comes from address books, social platform friend lists, and group members. Abnormal community activity refers to the number of fraud reports in the group as a percentage of the total number of people in the group.

6. The evaluation method of an anti-fraud index according to claim 2, wherein The historical score refers to the experience of being deceived and the participation in anti-fraud education.

7. The evaluation method of an anti-fraud index according to claim 1, wherein The regional threat characteristics are related to the number of fraud cases per unit area, the growth rate of fraud cases per unit time, the diffusion rate of new fraud techniques and the speed of social networks. The regional threat characteristics RTI = 0.4 × normalized (number of fraud cases per unit area) + 0.3 × the growth rate of fraud cases per unit time + 0.2 × the diffusion rate of new fraud techniques + 0.1 × social network speed.

8. The evaluation method of an anti-fraud index according to claim 1, characterized in that, The system performance characteristics refer to the recognition performance and response performance of the system; the recognition performance refers to the recall rate of fraudulent information; the response performance refers to the average time from recognition to reaching the victim; the system performance characteristic SEI = (recall rate × 0.6 + response speed score × 0.4) × interception success rate.

9. An evaluation system for anti-fraud index, characterized in that, It comprises a processor and a memory, wherein the memory stores a program that can be processed by the processor, and the program can implement an anti-fraud index evaluation method as described in any one of claims 1-8.

Images