High-risk call identification method and device, computer equipment and storage medium

Abstract

The invention discloses a high-risk call identification method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining a to-be-matched call text, carrying out the preprocessing of the to-be-matched call text, removing called information, and reserving calling information; constructing an event evolution chain based on the calling information, extracting cue words, and calling a large language model to generate a to-be-matched event evolution chain; converting the to-be-matched event evolution chain into a to-be-matched event evolution diagram; based on a preset event evolution graph, performing multi-stage graph analysis processing on the to-be-matched event evolution graph to obtain a key node number, a key node matching rate and key node connectivity; and determining whether the to-be-matched call text is a high-risk call based on the key node number, the key node matching rate and the key node connectivity. According to the method, a large number of positive and negative labeling samples are not needed, the manual labeling cost is reduced, the fraud sequential logic is accurately captured, the limitation of a static map is overcome, and the high-risk call recognition accuracy and practicability are improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer device and storage medium for identifying high-risk calls. Background Technology

[0002] In the field of telecommunications fraud risk identification and prevention, with the rapid iteration of fraud methods, related technical solutions continue to face multiple challenges in terms of accurate identification, cost control, and dynamic adaptation. Existing technologies still have significant limitations in model training paradigms, graph construction methods, and knowledge representation capabilities, as detailed below: Current telecom fraud identification solutions generally adopt supervised learning paradigms. From traditional machine learning models (such as random forest, LightGBM, XGBoost), basic deep learning models (such as multilayer perceptron MLP), to LoRA fine-tuning solutions based on hundreds of billions of large models, all take "a large number of positive and negative labeled samples driving the loss function to decrease" as the core logic. It is necessary to construct a training dataset containing fraudulent calls (black samples) and normal calls (white samples) through manual labeling.

[0003] However, due to the rapid evolution of telecom fraud scenarios and the constant emergence of new scripts, old labels quickly become ineffective. Simultaneously, black samples are scarce, white samples are noisy, and the model is prone to overfitting or bias towards the majority class, making it difficult to balance recall and false positives. In terms of knowledge graph extraction, traditional methods are either limited by the structured information ceiling of constructing triples from static fields in call detail records, or face high domain annotation costs due to the need to extract entity relationships from large labeled corpora using BERT / SBERT. Existing static knowledge graphs, centered on "entity-relationship-entity," have nodes that are mostly objective objects, and edges that only express static associations. They cannot present the causal sequence of fraud scripts and are further fragmented by variations in the same fraud chain, leading to graph expansion and decreased generalization ability. Summary of the Invention

[0004] Therefore, it is necessary to provide a high-risk call identification method, device, computer equipment, and storage medium to address the above-mentioned technical problems and solve at least one of the problems existing in the prior art.

[0005] Firstly, a method for identifying high-risk calls is provided, including: Obtain the call text to be matched, preprocess the call text to be matched, remove the called party information and retain the caller information; Based on the caller information, an event evolution chain is constructed to extract prompt words, and a large language model is called to generate the event evolution chain to be matched. Convert the evolution chain of the events to be matched into an evolution graph of the events to be matched; Based on a preset event evolution graph, a multi-stage graph analysis process is performed on the event evolution graph to be matched to obtain the number of key nodes, the key node matching rate, and the key node connectivity. Based on the number of key nodes, the matching rate of key nodes, and the connectivity of key nodes, it is determined whether the call text to be matched is a high-risk call.

[0006] In one possible implementation, the step of performing multi-stage graph analysis on the event evolution graph to be matched based on a preset event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity includes: The event evolution graph to be matched is matched with a preset event evolution graph to obtain a set of matched nodes; The set of matching nodes is subjected to key node identification to obtain a key node list, the key node list including the number of key nodes; The key node matching rate is determined based on the number of key nodes and the number of nodes to be matched. The connectivity of each key node in the key node list is determined to obtain the connectivity of the key nodes.

[0007] In one possible implementation, the step of performing node matching between the event evolution graph to be matched and a preset event evolution graph to obtain a set of matched nodes includes: Obtain the set of nodes to be matched corresponding to the evolution graph of the event to be matched, and the set of nodes to be matched corresponding to the preset event evolution graph; Calculate the similarity between each node in the set of nodes to be matched and each preset node in the set of preset nodes; Based on the similarity calculation results, a preset number of nodes with the highest similarity are selected from the set of nodes to be matched and added to the initial set of matching nodes; Nodes to be matched that have a similarity greater than a preset similarity threshold are selected from the initial set of matched nodes to form the final set of matched nodes.

[0008] In one possible implementation, the key node identification of the matching node set includes: Determine the out-degree and in-degree of each matching node in the set of matching nodes; Based on the out-degree and in-degree, calculate the total degree corresponding to each matching node; The matching nodes whose total degree is greater than a preset threshold are selected as the key nodes.

[0009] In one possible implementation, determining the connectivity of each key node in the key node list to obtain the key node connectivity includes: Determine the upper limit of the number of edges in the path between adjacent node pairs in the key node sequence; Based on the upper limit of the number of edges, determine the edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence; Aggregate all edge path existence indices to obtain the overall connectivity result; Based on the overall connectivity results, the connectivity of the key nodes is obtained.

[0010] In one possible implementation, before performing multi-stage graph analysis processing on the event evolution graph to be matched based on a preset event evolution graph, the method further includes: Construct a training dataset, which includes multiple training call samples; The training call samples are preprocessed to remove called party information and retain caller information; Based on the caller information, an event evolution chain is constructed to extract prompt words, and a large language model is called to generate a training event evolution chain. The training event evolution chain is converted into a training event evolution graph; Based on the graph merging algorithm, the training event evolution graphs are merged one by one to obtain the preset event evolution graph.

[0011] In one possible implementation, each event in the event evolution chain to be matched is a verb-object phrase, and the step of converting the event evolution chain to be matched into an event evolution graph includes: Based on the preset graph operation tool, a directed graph object is constructed as the basic carrier of the evolution graph of the events to be matched; The event evolution chain to be matched after being converted into verb-object phrases is traversed, and each verb-object phrase is directly used as the node ID in the basic carrier. Using a preset text vector generation tool, each verb-object phrase that serves as a node ID is transformed into a vector, and the vector representation corresponding to the verb-object phrase is obtained as a node attribute; According to the chronological order of events in the event evolution chain to be matched, the nodes corresponding to adjacent events are associated, and unidirectional edges are added between adjacent nodes to form directed edges that reflect the event evolution logic.

[0012] Secondly, a high-risk call identification device is provided, comprising: The call text preprocessing unit is used to obtain the call text to be matched, preprocess the call text to be matched, remove the called information and retain the calling information; The event evolution chain generation unit is used to construct an event evolution chain based on the caller information, extract prompt words, and call a large language model to generate an event evolution chain to be matched. An event evolution graph generation unit is used to convert the event evolution chain to be matched into an event evolution graph to be matched. The graph analysis and processing unit is used to perform multi-stage graph analysis and processing on the event evolution graph to be matched based on a preset event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity. The high-risk call determination unit is used to determine whether the call text to be matched is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity.

[0013] Thirdly, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor, when executing the computer-readable instructions, implements the steps of the high-risk call identification method as described above.

[0014] Fourthly, a readable storage medium is provided, the readable storage medium storing computer-readable instructions, which, when executed by a processor, implement the steps of the high-risk call identification method as described above.

[0015] The aforementioned high-risk call identification method, apparatus, computer equipment, and storage medium, implemented as follows: acquiring the call text to be matched; preprocessing the call text to be matched, removing called party information and retaining caller information; constructing an event evolution chain based on the caller information to extract prompt words; calling a large language model to generate the event evolution chain to be matched; converting the event evolution chain to be matched into an event evolution graph; performing multi-stage graph analysis on the event evolution graph to be matched based on a preset event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity; and determining whether the call text to be matched is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity. In this embodiment, an event evolution chain is generated with caller information as the core, and an event evolution graph is constructed. Multi-stage graph analysis is then performed in conjunction with a pre-set event evolution graph. This approach eliminates the reliance on a large number of positive and negative labeled samples in supervised learning, enabling identification solely through the event distribution extracted from historical fraudulent calls. It avoids the problems of scarce black samples, high noise in white samples, and rapid label invalidation, maintaining robustness even in scenarios with rapidly evolving fraud scripts. Furthermore, it avoids the limitations of traditional graph construction, which is constrained by structured information or high labeling costs. By leveraging a large language model to generate verb-object structured event chains with zero samples, it can be reused across scenarios without manual labeling, significantly reducing manpower while accurately capturing the subtle temporal evolution logic of fraudulent rhetoric. By employing a dynamic graph structure of "event-evolution-event," each fraudulent call is abstracted into an event evolution chain using a large language model. Then, similar nodes are fused through semantic similarity to form a highly compressed and incrementally expandable fraud event evolution graph. This overcomes the shortcomings of static knowledge graphs, which cannot present the causal sequence of fraud and have weak generalization ability. This graph not only retains the causal sequence of "identity impersonation → threats and intimidation → inducement to transfer money," but also completes risk assessment in seconds through key node connectivity detection. Ultimately, in the scenario of telecommunications fraud prevention and control with few samples, cold start, and continuous drift, a balance between recall and false alarm rate is achieved, significantly improving the accuracy and practicality of high-risk call identification, as well as the precision and generalization ability of the fraud call identification model. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of an application environment for a high-risk call identification method according to one embodiment of this application; Figure 2This is a flowchart illustrating a high-risk call identification method in one embodiment of this application; Figure 3 This is a schematic diagram of an event evolution chain in one embodiment of this application; Figure 4 This is a partial structural schematic diagram of an event evolution graph in one embodiment of this application; Figure 5 This is a schematic diagram of a high-risk call identification device according to an embodiment of this application; Figure 6 This is a schematic diagram of a computer device according to one embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] The high-risk call identification method provided in this embodiment can be applied to, for example... Figure 1 In the application environment, it may include a data preprocessing stage, an event evolution chain extraction stage, a pre-set event graph (such as a fraud event graph) construction stage, and a high-risk (such as fraud) call identification stage. In the data processing stage, a large language model (such as DeepSeek-V3.1-Chat) can be used to filter the original call content, separating fraudulent and non-fraudulent calls. In the event evolution chain extraction stage, the same large language model (such as DeepSeek-V3.1-Chat) is used to generate an event evolution chain with a verb-object structure from the caller's call. When constructing the event evolution graph, based on the generated event evolution chain, a pre-defined graph manipulation tool (such as NetworkX) is used to construct the graph structure, and then tools such as All-MiniLM-L6-v2 are used to obtain node vector representations (as node attributes, providing features for subsequent matching). In the high-risk call identification stage, tools such as Nearest2 are used for node similarity matching, combined with Neo4j's node centrality and path matching functions, to identify key nodes and determine connectivity, ultimately outputting the fraudulent call identification result, achieving efficient automation and intelligence throughout the entire process from call content to risk assessment.

[0020] In one embodiment, such as Figure 2 As shown, a method for identifying high-risk calls is provided, including the following steps: In step S110, the call text to be matched is obtained, and the call text to be matched is preprocessed to remove the called party information and retain the calling party information. Optionally, the complete call record text to be matched is first obtained (including the complete speech-to-text content of both the caller and the called party); then, it is filtered using a rule engine or heuristic regular expression matching method: all information related to the called party is removed (including the called party's number, the called party's response, the called party's background noise, etc.); at the same time, all the caller's statements are retained, specifically including the caller's number, identity statement (such as "I am a courier customer service representative"), core statements (such as "Your package is lost and can be compensated"), operation instructions (such as "Click the link to fill in the information"), etc.; finally, the retained caller information is cleaned (redundant interjections are removed and transcription errors are corrected), and finally a structured caller statement text is formed, providing high-quality input for subsequent event evolution chain extraction.

[0021] In step S120, an event evolution chain is constructed based on the calling information to extract prompt words, and a large language model is called to generate the event evolution chain to be matched. Optionally, for pre-processed caller information, a dedicated prompt template can be constructed using a zero-shot approach based on task requirements. The task is clearly defined as identifying core phrases from the caller's speech, abstracting them into events with verb-object phrase structures, and connecting them in chronological order into an event evolution chain of no more than 10 steps. For example: ["claiming to be e-commerce customer service", "informing about order-brushing commission", "requiring download of the APP", "explaining the rules for advance payment", "guiding high-commission orders", "demanding tax payment", "explaining the necessity", "urging payment of the security deposit", "promising a refund", "urging settlement"].

[0022] This zero-shot event evolution chain extraction method effectively maps the caller's intent and dialogue content into a series of verb-object structured event nodes, thus forming an abstract, highly generalizable, and temporally logical evolutionary process. Compared with direct text-based analysis methods, EEC not only more intuitively reflects the phased progression characteristics of fraudulent dialogue but also provides standardized input for subsequent event evolution graph construction. The prompt template details the task objectives, output requirements (including event type examples: identity declaration, cause explanation, etc.), and strict list format specifications. By calling a large language model (such as DeepSeek-V3.1-Chat) and inputting a structured prompt filled with caller information, the model automatically extracts key events in chronological order. This zero-shot event evolution chain extraction method effectively extracts the caller's intent and dialogue in verb-object phrase structure, forming an abstract, generalized, and sequentially evolving process that can be reused across scenarios without manual annotation.

[0023] For example, the prompt template can be as follows:

Task

[0024] 2. Abstract and generalize these statements into semantically complete verb-object phrase structures (events).

[0025] 3. String the events together in chronological order of the call to create an event evolution list that depicts the development of the caller's intentions.

[0026]

Require

[0027] 2. Each chain should contain no more than 10 events; only key turning points should be retained.

[0028] 3. Common event types include: *Identity Declaration (Proclaiming Your Identity) *Explanation of the cause (information on the problem / reason) * A demand is made (requiring a certain action). *Motivational explanation (explaining the reasons / emphasizing the necessity) * Outcome commitment (commitment to solving the problem / bringing benefits) *Action Guide (Guides the next steps) 4. Strictly adhere to the output format and do not include irrelevant content.

[0029] Output Format ["Event 1 (verb-object phrase)", "Event 2 (verb-object phrase)", "Event 3 (verb-object phrase)"] [Caller ID] {{content}} It's important to note that Large Language Models (LLMs) are pre-trained language models with hundreds of billions to trillion parameters based on Transformers. They learn unsupervised on massive amounts of text through autoregressive or autoencoder objectives, possessing zero-shot / few-shot understanding and generation capabilities. After instruction fine-tuning, RLHF alignment, and tool-invoking extensions, they can perform tasks such as question answering, summarizing, inference, and code generation, and support efficient inference (quantization, pruning). In fraud detection, LLMs have been used for text vectorization, zero-shot classification, dialogue summarization, and speech extraction, with models including GPT-4, Llama-2, DeepSeek-V3.1-Chat, and DeepSeek-Coder.

[0030] In step S130, the evolution chain of the event to be matched is converted into an evolution graph of the event to be matched; Optionally, based on a pre-defined graph tool (such as NetworkX, Neo4j, etc.) as the framework for graph operations, the evolution chain of the events to be matched is converted into a graph structure: an empty directed graph object is initialized, each verb-object phrase in the evolution chain of the events to be matched is traversed, and it is added to the graph as a node ID; at the same time, a pre-defined text vector generation tool (such as Sentence-BERT) is used to convert each verb-object phrase into a vector, which is stored as a node attribute, and then, according to the time order of the event evolution chain, unidirectional edges are established for the nodes corresponding to adjacent events in sequence, thereby constructing a set of directed edges that reflect the temporal evolution relationship of the events. After all nodes and edges are added, the evolution graph of the events to be matched with a directed graph as the carrier is obtained.

[0031] For example, if the event evolution chain to be matched is ["claiming to be e-commerce customer service", "informing customers of abnormal order-brushing commission", "requiring them to download the APP", "explaining the rules for advance payment", "guiding customers to place high-commission orders", "demanding tax payment", "explaining the necessity"], the transformed event evolution diagram to be matched is as follows: Figure 3 As shown, the "self-proclaimed e-commerce customer service" node points to the "notify of abnormal order commission" node via a one-way edge; the "notify of abnormal order commission" node points to the "request to download APP" node via a one-way edge; the "request to download APP" node points to the "explain the advance payment rules" node via a one-way edge; the "explain the advance payment rules" node points to the "guide high commission orders" node via a one-way edge; the "guide high commission orders" node points to the "demand tax payment" node via a one-way edge; and the "demand tax payment" node points to the "explain necessity" node via a one-way edge. Each node has a corresponding verb-object phrase vector as an attribute.

[0032] In step S140, based on a preset event evolution graph, a multi-stage graph analysis is performed on the event evolution graph to be matched to obtain the number of key nodes, the key node matching rate, and the key node connectivity. Optionally, using a preset event evolution graph as a reference, the constructed event evolution graph to be matched is analyzed and processed in multiple stages. First, specific operations such as node matching are performed to filter out nodes that match the preset graph, and then key nodes are identified and their numbers are counted. Next, the key node matching rate is calculated based on the total number of nodes in the event evolution graph to be matched. At the same time, the overall connection between key nodes is analyzed to determine whether they are connected according to a reasonable temporal logic. Finally, key indicators such as the number of key nodes, the key node matching rate, and the key node connectivity are obtained, providing a basis for subsequent determination of whether the call to be matched is a high-risk call.

[0033] It should be noted that the Preset Event Evolution Graph (FEEG) can be viewed as a compressed and fused result of a set of fraud event evolution chains, providing a unified model for the evolution paths of multiple fraudulent tactics. Compared to a single event evolution chain, this graph not only possesses highly compressed representation capabilities but also supports continuous updates with new samples, thus exhibiting good scalability and dynamic evolutionary characteristics. It can solidify a benchmark reference framework for the typical evolutionary logic of events in a graph structure. Its nodes correspond to key units in event evolution (mostly verb-object phrases containing attributes such as ID and vectors), and edges reflect the temporal and causal evolutionary relationships between events. The graph also carries global configurations such as key node definitions and connectivity requirements. Its construction requires four core steps: defining business objectives, sorting out typical event chains, technical modeling, and dynamic iterative optimization. Subsequently, it can serve as a reference for performing node matching, key indicator calculation, and other operations on the event evolution graphs to be analyzed, providing a unified benchmark for risk assessment (such as high-risk call identification) and solving the problem of judgment bias caused by the lack of standards during the analysis process.

[0034] In step S150, based on the number of key nodes, the key node matching rate, and the key node connectivity, it is determined whether the call text to be matched is a high-risk call.

[0035] Optionally, a judgment logic is formed by combining three core indicators: the number of key nodes, the key node matching rate, and the key node connectivity. If the number of key nodes matched in the evolution graph of the event to be matched does not reach the preset minimum value (e.g., it does not meet the requirement of "at least 2 high-risk core nodes"), the possibility of high risk can be initially ruled out. The key node matching rate (the ratio of the number of key nodes to the total number of nodes to be matched) is used to judge the matching coverage. If the matching rate is lower than the preset threshold (e.g., lower than 60%), it indicates that the match between the call to be matched and the preset fraud evolution logic is insufficient. If the key nodes do not form effective connectivity in the preset graph according to the sequence of "identity impersonation → inducement operation → demand for money" (e.g., the missing "inducement operation" node causes the link to break), it is judged as an atypical risk link. Only when all three indicators meet the preset qualification standards (e.g., the number of key nodes ≥ 3, the matching rate ≥ 25%, and the connectivity meets the standard) can the call text to be matched be finally determined to be a high-risk call, avoiding false alarms or missed alarms caused by a single indicator judgment. Without relying on negative samples, high-risk call determination can be achieved in seconds through event evolution chain extraction, key node degree threshold filtering, matching rate calculation and connectivity detection.

[0036] High-risk calls refer to calls in which the caller uses specific scripts to convey false information with the intention of causing the recipient to have a mistaken understanding and take actions that harm their rights, such as transferring or recharging money or leaking their privacy.

[0037] In this embodiment, by generating an event evolution chain and constructing an event evolution graph with caller information as the core, and combining it with a preset event evolution graph for multi-stage graph analysis, this approach eliminates the dependence of supervised learning on a large number of positive and negative labeled samples. Identification can be achieved solely through the event distribution extracted from historical fraudulent calls, avoiding the problems of scarce black samples, high noise in white samples, and rapid label expiration. It also maintains robustness in scenarios where fraudulent scripts evolve rapidly. Furthermore, it avoids the limitations of traditional graph construction, which is constrained by structured information or high labeling costs, by leveraging a large language model to generate verb-object pairs with zero samples. The structured event chain can be reused across scenarios without manual annotation, significantly reducing manpower input while accurately capturing the subtle temporal evolution logic of fraudulent rhetoric. Moreover, through the dynamic graph structure of "event-evolution-event", it overcomes the shortcomings of static knowledge graphs, which cannot present the causal sequence of fraud and have weak generalization ability. It can accurately reconstruct the complete fraud chain and achieve efficient risk assessment through key node analysis. Ultimately, in the telecommunications fraud prevention and control scenarios with few samples, cold start, and continuous drift, it achieves a balance between recall rate and false alarm rate, significantly improving the accuracy and practicality of high-risk call identification.

[0038] In one embodiment of this application, the step of performing multi-stage graph analysis on the event evolution graph to be matched based on a preset event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity includes: The event evolution graph to be matched is matched with a preset event evolution graph to obtain a set of matched nodes; The set of matching nodes is subjected to key node identification to obtain a key node list, the key node list including the number of key nodes; The key node matching rate is determined based on the number of key nodes and the number of nodes to be matched. The connectivity of each key node in the key node list is determined to obtain the connectivity of the key nodes.

[0039] Optionally, firstly, based on node vector similarity, the evolution graph of the event to be matched is matched with a preset event evolution graph at the node level, and nodes with semantic similarity are selected to form a set of matching nodes. Next, based on the node centrality rule in graph theory, key nodes that meet preset criteria (such as a total degree exceeding a threshold) are identified from this set, forming a list of key nodes containing the number of key nodes. Then, the key node matching rate is calculated by the ratio of the number of key nodes to the total number of nodes in the evolution graph of the event to be matched. Finally, connectivity is checked on adjacent node pairs arranged chronologically in the key node list to determine whether they have valid paths in the preset graph that meet the upper limit of edge count and temporal logic, and the overall connectivity results are aggregated as the key node connectivity. Through the above operations, the system can quantify the degree of fit between the event to be matched and the preset risk evolution pattern from three dimensions: matching degree, number of key nodes, and logical coherence.

[0040] For example, the number of key nodes is represented as:

[0041] The key node matching rate is expressed as: ; Key node connectivity representation:

[0042] The final evaluation will be based on a comprehensive assessment of the above three indicators:

[0043] Where m can be 3 and r can be 0.275. That is, under the premise that all key nodes are connected, a call is considered high-risk if the number of key nodes is greater than or equal to 3 and the key node matching rate is greater than 0.275.

[0044] It should be noted that the effectiveness of the method was validated based on 3715 evaluation samples, including 1890 positive samples and 1825 negative samples. Under the conditions that the minimum number of matches m≥3 and the matching rate is higher than the threshold r>0.25, the final experimental results are: precision 93.48%, recall 89.52%, and F1 score 91.46%.

[0045] In one embodiment of this application, the step of performing node matching between the event evolution graph to be matched and a preset event evolution graph to obtain a set of matched nodes includes: Obtain the set of nodes to be matched corresponding to the evolution graph of the event to be matched, and the set of nodes to be matched corresponding to the preset event evolution graph; Calculate the similarity between each node in the set of nodes to be matched and each preset node in the set of preset nodes; Based on the similarity calculation results, a preset number of nodes with the highest similarity are selected from the set of nodes to be matched and added to the initial set of matching nodes; Nodes to be matched that have a similarity greater than a preset similarity threshold are selected from the initial set of matched nodes to form the final set of matched nodes.

[0046] Optionally, firstly, all nodes in the evolution graph of the event to be matched are extracted as the set of nodes to be matched, and at the same time, all nodes in the preset event evolution graph are extracted as the preset node set. Then, based on the node vector, the semantic similarity between each node to be matched and each preset node is calculated. Next, based on the similarity results, a preset number (e.g., 3) of the preset nodes with the highest similarity are selected from each node to be matched and included in the initial matching node set. Finally, nodes to be matched that have a similarity to the corresponding preset node exceeding a preset threshold (e.g., 0.7) are filtered out from the initial set to form the final matching node set. This ensures that the matching results include the most relevant nodes and that the matching quality is guaranteed by threshold control.

[0047] For example, let the nodes of the graph g to be matched be Its set of node vectors is The set of nodes in the preset event evolution graph G vector index is: The similarity function is (For example, cosine similarity), with a similarity threshold of τ.

[0048] The set of matching nodes is as follows: ; For each query vector, find the Top-K (1 is recommended) most similar nodes in the index; Threshold filtering: ; Nodes are filtered based on a threshold τ, retaining only nodes with similarity higher than the threshold; Final output That is, the set of nodes that meet the conditions.

[0049] In one embodiment of this application, the key node identification of the matching node set includes: Determine the out-degree and in-degree of each matching node in the set of matching nodes; Based on the out-degree and in-degree, calculate the total degree corresponding to each matching node; The matching nodes whose total degree is greater than a preset threshold are selected as the key nodes.

[0050] Optionally, for matched nodes, it is necessary to filter and retain the more important nodes while removing the less important ones. First, the out-degree (the number of edges from that node to other nodes) and in-degree (the number of edges from other nodes to that node) of each node in the matched node set are calculated. Then, the total number of connections for each matched node is determined using the formula "total degree = out-degree + in-degree". A higher total degree usually indicates a stronger correlation between the node and the event's evolution. Finally, a preset threshold for the total degree is set (e.g., a threshold of 5 means the total number of connections must exceed 5), and matched nodes with a total degree greater than this threshold are selected as key nodes. This allows for precise identification of nodes that play a core role in the event's evolution. By filtering solely through the node degree threshold, core dialogue nodes such as "asking for verification codes" and "inducing app downloads" can be automatically identified. This allows for accurate identification of fraudulent intent without the need for additional models, simultaneously improving interpretability and robustness.

[0051] Specifically, the Degree Centrality key node identification method can be used to identify key nodes, as shown below: ; in, Let v be the in-degree of node v. Let v be the out-degree and the total degree. It is calculated as in-degree + out-degree. This method is generally used to measure the "connectivity" of nodes in a network and is often used to discover highly connected nodes (such as high-risk accounts, popular products, key intermediary nodes, etc.).

[0052] Iterate through each node in the sequence, calculate the sum of its in-degree and out-degree as the degree of that node, and add it to the degree list accordingly. Finally, return the degree result of the entire sequence. Nodes with a total degree greater than d are output as KeyNodes, as shown below: ; In one embodiment of this application, the step of determining the connectivity of each key node in the key node list to obtain the connectivity of the key nodes includes: Determine the upper limit of the number of edges in the path between adjacent node pairs in the key node sequence; Based on the upper limit of the number of edges, determine the edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence; Aggregate all edge path existence indices to obtain the overall connectivity result; Based on the overall connectivity results, the connectivity of the key nodes is obtained.

[0053] Optionally, the core of the key node connectivity determination process lies in logically verifying the validity of the temporal association between nodes step by step: First, based on the rules of the preset event evolution graph, determine the upper limit of the number of edges in the path between adjacent node pairs in the key node sequence (i.e., the maximum number of hops allowed between adjacent key nodes; for example, setting the upper limit of the number of edges to 2 means that there can be at most one non-key node between two nodes (i.e., connected by 2 edges)); then, based on this upper limit of the number of edges, check one by one whether each pair of adjacent key nodes has an actual valid path in the event evolution graph to be matched that meets the edge limit, and generate "there is a valid path (e.g., a valid path exists)". The existence index of edge paths is denoted as 1) or 0) indicating "no valid path exists". Then, the existence indexes of all adjacent node pairs are aggregated (e.g., using the "full satisfaction" rule: only when all indices are 1 is it considered as overall connectivity, or using the "majority satisfaction" rule: more than 50% of the indices are 1 is considered as partial connectivity) to obtain the overall connectivity result. Finally, the final connectivity of the key nodes is determined based on the overall connectivity result (if the overall connectivity is met, the connectivity is considered to be up to standard; if the overall connectivity is not met, the connectivity is considered to be down to standard), thereby verifying whether the key nodes form a complete evolutionary link according to a reasonable temporal logic.

[0054] For example, for the key node sequence Maximum number of hops h (e.g., 4); Edge path existence: For adjacent nodes in the sequence Boolean variables can be defined. for: ; By performing a logical AND operation on the connectivity of all adjacent node pairs, the overall result is obtained: ; Where ∧ represents logical AND.

[0055] Final output: .

[0056] like If the sequence of key nodes is connected in the graph, then the sequence of key nodes is considered to be connected in the graph; otherwise, it is considered to be disconnected. This can effectively assess the temporal reachability of key nodes in the evolution graph of fraud events, and provide a structured basis for subsequent identification of high-risk calls.

[0057] In one embodiment of this application, before performing multi-stage graph analysis processing on the event evolution graph to be matched based on a preset event evolution graph, the method further includes: Construct a training dataset, which includes multiple training call samples; The training call samples are preprocessed to remove called party information and retain caller information; Based on the caller information, an event evolution chain is constructed to extract prompt words, and a large language model is called to generate a training event evolution chain. The training event evolution chain is converted into a training event evolution graph; Based on the graph merging algorithm, the training event evolution graphs are merged one by one to obtain the preset event evolution graph.

[0058] Optionally, high-risk call data can be collected, such as the summary report from CCL23-Eval Task 6, which may include 102,762 telecom fraud case records from the anti-fraud big data platform, providing a basic sample for subsequent model building. Additionally, multiple (e.g., 200) anonymized normal call records can be obtained from telecom operators for subsequent evaluation of the identification model (as "negative samples," compared with "positive samples" of fraudulent calls to verify the model's distinguishing ability). Taking fraudulent calls as an example, since the task focuses on "fraudulent call identification," it is necessary to accurately filter out report information related to telephone fraud from the original CCL23-Eval case data. This is done using a "heuristic regular expression filtering" method, divided into the following two steps: Remove irrelevant information: Delete content containing the word "telephone" but unrelated to telephone fraud, such as "telephone report" (the core is the act of "reporting to the police," not the fraudulent call itself), "contact number" (only a contact method, without fraudulent attributes), "the call received by the person reporting the crime" (describes the act of receiving the call, without indicating fraud), "telephone number" (a simple number, without fraudulent intent), etc.

[0059] Retain target information: "Retain the report information that matches the regular expression '(.)?Received (?:.?) call'"** (that is, the content describing "receiving a certain type of call", which is more in line with "fraudulent call scenario".

[0060] After final screening, multiple results were obtained, such as 15,312 pieces of information on telephone fraud cases, which provided accurate material for generating fraudulent call content in the future.

[0061] From 15,312 selected telephone fraud cases, 4,900 records were randomly selected. A large language model (DeepSeek - V3.1 - Chat) was used to simulate and generate the initial conversation script of the fraudster. By designing specific prompts, the model was able to generate conversation text consistent with fraud logic based on the "telephone fraud case background," thereby expanding the "fraud call sample library." This addresses the problems of scarce fraud call data and high annotation costs in real-world scenarios, providing sufficient simulated data for the training or testing of subsequent "fraud call identification models."

[0062] The specific report information and the prompt for forwarding the first call to the scam call are as follows:

Role

[0063]

Task

[0064]

Require

[0065] 2. If the case information does not reflect telephone fraud, return directly to "Non-telephone fraud".

[0066] 3. The content of the call at that time was accurately reproduced.

[0067] 4. The output only contains the simulated call, without any explanation or additional information. [Case Information] {{content}} Simultaneously, all 200 real call records were anonymized and rewritten using a large language model (DeepSeek-V3.1-Chat) for use as negative samples in subsequent evaluation. The specific anonymization and rewriting prompt is as follows:

Task

[0068]

Require

[0069] 2. If only the caller's call information is available, simulate and supplement the called party's call content.

[0070] 3. While ensuring that the tone and logic of the conversation are true and natural, try to reproduce the actual content of the conversation as much as possible.

[0071] 4. Sensitive information must be anonymized (including but not limited to: name, mobile phone number, ID card number, address, bank card number, company name, etc.).

[0072] 5. The output should only contain the rewritten call text and should not include explanations, summaries or other additional content.

[0073] [Call Content] {{content}} Ultimately, a training and evaluation corpus was formed. The training sample consisted of 4,684 entries (including 26 cases that the large model judged to be non-fraudulent calls), and the evaluation sample consisted of 400 entries (200 fraudulent calls and 200 regular calls).

[0074] Then, based on the training and evaluation corpus constructed above, event evolution chains are extracted. An event evolution chain is a set of events used to abstractly describe a fraudster's fraudulent rhetoric. This set of events is organized into a list in chronological order. The specific construction method is as follows: The original call content in the constructed training corpus was filtered, retaining only the caller's (fraudster's) information and removing the called party's (victim's) information. The purpose of this is to focus only on the fraudster's statements in the subsequent "fraud script extraction," because the core of fraud identification is "how the fraudster guides the victim through scripts," while the called party's response is relatively secondary. Retaining the caller's information can more accurately capture the fraudster's intentions and guidance process.

[0075] Based on the preprocessed "caller's call content", a special prompt is designed, and then the large language model (DeepSeek-V3.1-Chat) is called to generate an event evolution chain of no more than 10 steps. For example: ["claiming to be e-commerce customer service", "informing about order-brushing commission", "requiring download of APP", "explaining the rules for advance payment", "guiding high-commission orders", "demanding tax payment", "explaining the necessity", "urging payment of deposit", "promising refund", "urging settlement"].

[0076] This zero-sample event evolution chain extraction method effectively extracts the caller's intent and rhetoric in the form of verb-object phrases, forming an abstract, generalized, and sequential evolutionary process. The semantic abstraction paradigm of the verb-object phrases corresponds to the event type enumeration (identity declaration, cause explanation, request statement, motivation explanation, result commitment, action guidance).

[0077] The detailed prompt template extracted is as follows:

Task

[0078] 2. Abstract and generalize these statements into semantically complete verb-object phrase structures (events).

[0079] 3. String the events together in chronological order of the call to create an event evolution list that depicts the development of the caller's intentions.

[0080]

Require

[0081] 2. Each chain should contain no more than 10 events; only key turning points should be retained.

[0082] 3. Common event types include: *Identity Declaration (Proclaiming Your Identity) *Explanation of the cause (information on the problem / reason) * A demand is made (requiring a certain action). *Motivational explanation (explaining the reasons / emphasizing the necessity) * Outcome commitment (commitment to solving the problem / bringing benefits) *Action Guide (Guides the next steps) 4. Strictly adhere to the output format and do not include irrelevant content.

[0083] Output Format ["Event 1 (verb phrase)", "Event 2 (verb phrase)", "Event 3 (verb phrase)"] [Caller ID] {{content}} The evolutionary chain of all the extracted fraudulent call events is converted into an evolutionary graph. Similar event nodes are merged through semantic similarity to form a highly compressed and incrementally expandable dynamic graph. This allows multiple variations of the same fraudulent script to be unified into the same main branch, achieving zero-sample generalization of new variations.

[0084] Next, each evolution graph is merged one by one to obtain a complete fraud event evolution graph, which serves as the preset event evolution graph. The fraud event evolution graph is a highly compressed and incrementally expandable collection of fraud event evolution chains. Its nodes are events represented by verb-object phrases, and the edges represent the temporal relationships of event evolution. Using "event-evolution-event" as the framework, multiple zero-sample extracted event chains are fused through semantic similarity, node merging, and vector updates to form an incrementally expandable dynamic graph, solving the problems of staticity, redundancy, and poor generalization in traditional KG graphs.

[0085] The evolutionary graph G of fraud events can be represented as: ; , representing a set of nodes Where (u,v) represents a directed edge from u to v. Define attributes for nodes (such as event, embedding).

[0086] It should be noted that merging the event evolution graph is a recursive process. First, the initial event evolution graph is constructed using the method described above. Then, each time a new graph is read, the graph merging algorithm is called to merge it again with the already merged large graph based on a similarity threshold. This process continuously expands and integrates existing graph structures, ultimately forming a unified graph. The core graph merging algorithm is as follows: Input: Two graphs , Similarity threshold τ.

[0087] Specifically, this can be achieved through pre-defined graph manipulation tools, such as the Compose algorithm based on NetworkX. Merge nodes with the same ID in g1 and g2 into a larger graph. , where nodes .

[0088] For each node of g1 and each node of g2 ,like Get the embedding attribute values ​​of nodes u and v, and calculate the cosine similarity: ; like Then Merging u and v nodes in the code: And update the embedding vector of the merged node to the average of the embeddings of the two nodes: ; The merged diagram This process, starting with g1, continues until all graphs are merged into a single large graph G.

[0089] Finally, the constructed preset event evolution graph can be stored in memory. Here, the complete graph needs to be written to the Neo4j database for persistence, providing support for subsequent graph searches. First, a new vector index (fraud_embedding_idx) is created, enabling the node's embedding attribute to have cosine similarity-based retrieval capabilities. Then, the input event evolution graph G is traversed, each node is written to Neo4j, and assigned a label Fraud and attributes (node ​​ID and corresponding vector embedding). Finally, the edges in the graph are traversed, establishing NEXT-type directed relationships for related nodes in Neo4j to represent the temporal evolution dependencies between events, thus completing the writing and reconstruction of the entire graph structure from NetworkX to Neo4j. Below is a partial example of the graph searched using the Explore tool after writing to Neo4j, such as... Figure 4 As shown.

[0090] At this point, the entire evolution map of the fraud incident has been constructed, based solely on a single sample of fraudulent phone calls, without requiring legitimate phone calls for modeling.

[0091] In one embodiment of this application, each event in the event evolution chain to be matched is a verb-object phrase, and the step of converting the event evolution chain to be matched into an event evolution graph includes: Based on the preset graph operation tool, a directed graph object is constructed as the basic carrier of the evolution graph of the events to be matched; The event evolution chain to be matched after being converted into verb-object phrases is traversed, and each verb-object phrase is directly used as the node ID in the basic carrier. Using a preset text vector generation tool, each verb-object phrase that serves as a node ID is transformed into a vector, and the vector representation corresponding to the verb-object phrase is obtained as a node attribute; According to the chronological order of events in the event evolution chain to be matched, the nodes corresponding to adjacent events are associated, and unidirectional edges are added between adjacent nodes to form directed edges that reflect the event evolution logic.

[0092] Optionally, based on graph construction requirements, an empty directed graph object is created using a pre-defined graph manipulation tool (such as NetworkX or Deep GraphLibrary) as the basic carrier for carrying event relationships. Then, the evolution chain of events to be matched, which has been converted into verb-object phrases (such as "self-proclaimed customer service"), is traversed, and each phrase is directly used as the unique ID of a node in the basic carrier, ensuring that nodes and events correspond one-to-one at the semantic level. Next, a pre-defined text vector generation tool (such as Sentence-BERT) is used to convert the verb-object phrase corresponding to each node ID into a vector representation and store it in the graph as a node attribute, providing feature support for subsequent node matching. Finally, according to the chronological order of events in the evolution chain of events to be matched, the nodes corresponding to adjacent events are associated, and unidirectional edges are added between the preceding and following nodes, thereby forming an evolution graph of events to be matched that can intuitively reflect the complete evolution logic of events from "initial intent" to "final behavior".

[0093] In this embodiment, by generating an event evolution chain and constructing an event evolution graph with caller information as the core, and combining it with a preset event evolution graph for multi-stage graph analysis, this approach eliminates the dependence of supervised learning on a large number of positive and negative labeled samples. Identification can be achieved solely through the event distribution extracted from historical fraudulent calls, avoiding the problems of scarce black samples, high noise in white samples, and rapid label expiration. It maintains robustness even in scenarios where fraudulent scripts evolve rapidly. Furthermore, it avoids the limitations of traditional graph construction, which is constrained by structured information or high labeling costs. By leveraging a large language model to generate verb-object structured event chains with zero samples, it can be reused across scenarios without manual labeling, significantly reducing manpower while accurately capturing the subtle temporal evolution logic of fraudulent rhetoric. By employing a dynamic graph structure of "event-evolution-event," each fraudulent call is abstracted into an event evolution chain using a large language model. Then, similar nodes are fused through semantic similarity to form a highly compressed and incrementally expandable fraud event evolution graph. This overcomes the shortcomings of static knowledge graphs, which cannot present the causal sequence of fraud and have weak generalization ability. This graph not only retains the causal sequence of "identity impersonation → threats and intimidation → inducement to transfer money," but also completes risk assessment in seconds through key node connectivity detection. Ultimately, in the scenario of telecommunications fraud prevention and control with few samples, cold start, and continuous drift, a balance between recall and false alarm rate is achieved, significantly improving the accuracy and practicality of high-risk call identification, as well as the precision and generalization ability of the fraud call identification model.

[0094] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0095] In one embodiment, a high-risk call identification device is provided, which corresponds one-to-one with the high-risk call identification method described in the above embodiments. For example... Figure 5 As shown, the high-risk call identification device includes a call text preprocessing unit 10, an event evolution chain generation unit 20, an event evolution graph generation unit 30, a graph analysis and processing unit 40, and a high-risk call determination unit 50. Detailed descriptions of each functional module are as follows: The call text preprocessing unit 10 is used to obtain the call text to be matched, preprocess the call text to be matched, remove the called information and retain the calling information; The event evolution chain generation unit 20 is used to construct an event evolution chain based on the calling information, extract prompt words, and call a large language model to generate an event evolution chain to be matched. The event evolution graph generation unit 30 is used to convert the event evolution chain to be matched into an event evolution graph to be matched; The graph analysis and processing unit 40 is used to perform multi-stage graph analysis and processing on the event evolution graph to be matched based on a preset event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity. The high-risk call determination unit 50 is used to determine whether the call text to be matched is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity.

[0096] In one embodiment of this application, the graph analysis and processing unit 40 is further configured to: The event evolution graph to be matched is matched with a preset event evolution graph to obtain a set of matched nodes; The set of matching nodes is subjected to key node identification to obtain a key node list, the key node list including the number of key nodes; The key node matching rate is determined based on the number of key nodes and the number of nodes to be matched. The connectivity of each key node in the key node list is determined to obtain the connectivity of the key nodes.

[0097] In one embodiment of this application, the graph analysis and processing unit 40 is further configured to: Obtain the set of nodes to be matched corresponding to the evolution graph of the event to be matched, and the set of nodes to be matched corresponding to the preset event evolution graph; Calculate the similarity between each node in the set of nodes to be matched and each preset node in the set of preset nodes; Based on the similarity calculation results, a preset number of nodes with the highest similarity are selected from the set of nodes to be matched and added to the initial set of matching nodes; Nodes to be matched that have a similarity greater than a preset similarity threshold are selected from the initial set of matched nodes to form the final set of matched nodes.

[0098] In one embodiment of this application, the graph analysis and processing unit 40 is further configured to: Determine the out-degree and in-degree of each matching node in the set of matching nodes; Based on the out-degree and in-degree, calculate the total degree corresponding to each matching node; The matching nodes whose total degree is greater than a preset threshold are selected as the key nodes.

[0099] In one embodiment of this application, the graph analysis and processing unit 40 is further configured to: Determine the upper limit of the number of edges in the path between adjacent node pairs in the key node sequence; Based on the upper limit of the number of edges, determine the edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence; Aggregate all edge path existence indices to obtain the overall connectivity result; Based on the overall connectivity results, the connectivity of the key nodes is obtained.

[0100] In one embodiment of this application, the device further includes a preset event evolution map construction unit, which is further used for: Construct a training dataset, which includes multiple training call samples; The training call samples are preprocessed to remove called party information and retain caller information; Based on the caller information, an event evolution chain is constructed to extract prompt words, and a large language model is called to generate a training event evolution chain. The training event evolution chain is converted into a training event evolution graph; Based on the graph merging algorithm, the training event evolution graphs are merged one by one to obtain the preset event evolution graph.

[0101] In one embodiment of this application, each event in the event evolution chain to be matched is a verb-object phrase, and the event evolution graph generation unit 30 is further configured to: Based on the preset graph operation tool, a directed graph object is constructed as the basic carrier of the evolution graph of the events to be matched; The event evolution chain to be matched after being converted into verb-object phrases is traversed, and each verb-object phrase is directly used as the node ID in the basic carrier. Using a preset text vector generation tool, each verb-object phrase that serves as a node ID is transformed into a vector, and the vector representation corresponding to the verb-object phrase is obtained as a node attribute; According to the chronological order of events in the event evolution chain to be matched, the nodes corresponding to adjacent events are associated, and unidirectional edges are added between adjacent nodes to form directed edges that reflect the event evolution logic.

[0102] In this embodiment, by generating an event evolution chain and constructing an event evolution graph with caller information as the core, and combining it with a preset event evolution graph for multi-stage graph analysis, this approach eliminates the dependence of supervised learning on a large number of positive and negative labeled samples. Identification can be achieved solely through the event distribution extracted from historical fraudulent calls, avoiding the problems of scarce black samples, high noise in white samples, and rapid label expiration. It maintains robustness even in scenarios where fraudulent scripts evolve rapidly. Furthermore, it avoids the limitations of traditional graph construction, which is constrained by structured information or high labeling costs. By leveraging a large language model to generate verb-object structured event chains with zero samples, it can be reused across scenarios without manual labeling, significantly reducing manpower while accurately capturing the subtle temporal evolution logic of fraudulent rhetoric. By employing a dynamic graph structure of "event-evolution-event," each fraudulent call is abstracted into an event evolution chain using a large language model. Then, similar nodes are fused through semantic similarity to form a highly compressed and incrementally expandable fraud event evolution graph. This overcomes the shortcomings of static knowledge graphs, which cannot present the causal sequence of fraud and have weak generalization ability. This graph not only retains the causal sequence of "identity impersonation → threats and intimidation → inducement to transfer money," but also completes risk assessment in seconds through key node connectivity detection. Ultimately, in the scenario of telecommunications fraud prevention and control with few samples, cold start, and continuous drift, a balance between recall and false alarm rate is achieved, significantly improving the accuracy and practicality of high-risk call identification, as well as the precision and generalization ability of the fraud call identification model.

[0103] Specific limitations regarding high-risk call identification devices can be found in the limitations of high-risk call identification methods described above, and will not be repeated here. Each module in the aforementioned high-risk call identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0104] In one embodiment, a computer device is provided, which may be a terminal device, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, and network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a readable storage medium storing computer-readable instructions. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer-readable instructions implement a high-risk call identification method. The readable storage medium provided in this embodiment includes both non-volatile and volatile readable storage media.

[0105] In this application embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, it implements the steps of the high-risk call identification method described above.

[0106] In this application embodiment, a readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, they implement the steps of the high-risk call identification method described above.

[0107] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0108] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0109] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for identifying high-risk calls, characterized in that, The method includes: Obtain the call text to be matched, preprocess the call text to be matched, remove the called party information and retain the caller information; Based on the caller information, an event evolution chain is constructed to extract prompt words, and a large language model is called to generate the event evolution chain to be matched. Convert the evolution chain of the events to be matched into an evolution graph of the events to be matched; Based on a preset event evolution graph, a multi-stage graph analysis process is performed on the event evolution graph to be matched to obtain the number of key nodes, the key node matching rate, and the key node connectivity. Based on the number of key nodes, the matching rate of key nodes, and the connectivity of key nodes, it is determined whether the call text to be matched is a high-risk call.

2. The high-risk call identification method as described in claim 1, characterized in that, The process involves performing multi-stage graph analysis on the event evolution graph to be matched, based on a preset event evolution graph, to obtain the number of key nodes, the key node matching rate, and the key node connectivity, including: The event evolution graph to be matched is matched with a preset event evolution graph to obtain a set of matched nodes; The set of matching nodes is subjected to key node identification to obtain a key node list, the key node list including the number of key nodes; The key node matching rate is determined based on the number of key nodes and the number of nodes to be matched. The connectivity of each key node in the key node list is determined to obtain the connectivity of the key nodes.

3. The high-risk call identification method as described in claim 2, characterized in that, The step of performing node matching between the event evolution graph to be matched and the preset event evolution graph to obtain a set of matched nodes includes: Obtain the set of nodes to be matched corresponding to the evolution graph of the event to be matched, and the set of nodes to be matched corresponding to the preset event evolution graph; Calculate the similarity between each node in the set of nodes to be matched and each preset node in the set of preset nodes; Based on the similarity calculation results, a preset number of nodes with the highest similarity are selected from the set of nodes to be matched and added to the initial set of matching nodes; Nodes to be matched that have a similarity greater than a preset similarity threshold are selected from the initial set of matched nodes to form the final set of matched nodes.

4. The high-risk call identification method as described in claim 2, characterized in that, The key node identification of the matching node set includes: Determine the out-degree and in-degree of each matching node in the set of matching nodes; Based on the out-degree and in-degree, calculate the total degree corresponding to each matching node; The matching nodes whose total degree is greater than a preset threshold are selected as the key nodes.

5. The high-risk call identification method as described in claim 2, characterized in that, The step of determining the connectivity of each key node in the key node list to obtain the connectivity of the key nodes includes: Determine the upper limit of the number of edges in the path between adjacent node pairs in the key node sequence; Based on the upper limit of the number of edges, determine the edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence; Aggregate all edge path existence indices to obtain the overall connectivity result; Based on the overall connectivity results, the connectivity of the key nodes is obtained.

6. The high-risk call identification method according to any one of claims 1-5, characterized in that, Before performing multi-stage graph analysis processing on the event evolution graph to be matched based on the preset event evolution graph, the process also includes: Construct a training dataset, which includes multiple training call samples; The training call samples are preprocessed to remove called party information and retain caller information; Based on the caller information, an event evolution chain is constructed to extract prompt words, and a large language model is called to generate a training event evolution chain. The training event evolution chain is converted into a training event evolution graph; Based on the graph merging algorithm, the training event evolution graphs are merged one by one to obtain the preset event evolution graph.

7. The high-risk call identification method according to any one of claims 1-5, characterized in that, Each event in the event evolution chain to be matched is a verb-object phrase. Converting the event evolution chain to a matching event evolution graph includes: Based on the preset graph operation tool, a directed graph object is constructed as the basic carrier of the evolution graph of the events to be matched; The event evolution chain to be matched after being converted into verb-object phrases is traversed, and each verb-object phrase is directly used as the node ID in the basic carrier. Using a preset text vector generation tool, each verb-object phrase that serves as a node ID is transformed into a vector, and the vector representation corresponding to the verb-object phrase is obtained as a node attribute; According to the chronological order of events in the event evolution chain to be matched, the nodes corresponding to adjacent events are associated, and unidirectional edges are added between adjacent nodes to form directed edges that reflect the event evolution logic.

8. A high-risk call identification device, characterized in that, The device includes: The call text preprocessing unit is used to obtain the call text to be matched, preprocess the call text to be matched, remove the called information and retain the calling information; The event evolution chain generation unit is used to construct an event evolution chain based on the caller information, extract prompt words, and call a large language model to generate an event evolution chain to be matched. An event evolution graph generation unit is used to convert the event evolution chain to be matched into an event evolution graph to be matched. The graph analysis and processing unit is used to perform multi-stage graph analysis and processing on the event evolution graph to be matched based on a preset event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity. The high-risk call determination unit is used to determine whether the call text to be matched is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity.

9. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, characterized in that, When the processor executes the computer-readable instructions, it implements the steps of the high-risk call identification method as described in any one of claims 1-7.

10. A readable storage medium storing computer-readable instructions, characterized in that, When the computer-readable instructions are executed by a processor, they implement the steps of the high-risk call identification method as described in any one of claims 1-7.

Images