Overseas illegal worker early warning method and related device

Abstract

The invention discloses an overseas illegal worker early warning method and a related device, which are used for carrying out identification and early warning on workers possibly having illegal departure worker behaviors. The method comprises the following steps: acquiring user signaling data; obtaining overseas illegal work behavior characteristic values according to the user signaling data; obtaining an early warning score according to the overseas illegal worker behavior characteristic value; and carrying out early warning on illegal workers according to the early warning score.

Description

TECHNICAL FIELD

[0001] The present application relates to the fields of communication and big data analysis, and particularly relates to a method for early warning of illegal foreign workers and related devices. BACKGROUND

[0002] Illegal foreign workers refer to the behavior of foreign nationals engaging in labor in the country without obtaining legal work permits or beyond the scope of work permits. The core significance of identifying illegal foreign workers at least includes maintaining national security, combating cross-border crime, and ensuring labor market order.

[0003] At present, how to effectively discover possible illegal foreign work behaviors and give early warnings is a problem to be solved. SUMMARY

[0004] The present application provides a method for early warning of illegal foreign workers to solve the problem of how to effectively discover possible illegal foreign work behaviors and give early warnings in the prior art.

[0005] In a first aspect, a method for early warning of illegal foreign workers is provided. The method includes: obtaining user signaling data; obtaining an illegal foreign work behavior characteristic value according to the user signaling data; obtaining a warning score according to the illegal foreign work behavior characteristic value; and giving an early warning of illegal foreign workers according to the warning score.

[0006] The method described above considers that mobile phone signaling, as a product of modern communication technology, has a wide coverage, strong real-time data, and can accurately reflect the mobile trajectory and behavior pattern of individual users, such as the data of mobile phone signaling of illegal foreign workers (user signaling data) can reveal the activity rules, migration path and possible hiding places of these people, etc. Therefore, the illegal foreign work behavior characteristic value is determined based on the user signaling data, and then the warning score of whether the user has illegal foreign work behavior is obtained according to the characteristic value, so as to realize effective identification and early warning of illegal foreign workers, and solve the problem of how to effectively discover possible illegal foreign work behaviors and give early warnings in the prior art.

[0007] In combination with the first aspect, in some possible implementation manners of the first aspect, the user signaling data is obtained by: obtaining mobile phone signaling source data of a to-be-identified user near a location of an enterprise in a border city and performing data filtering, classification and storage; and performing data extraction on the mobile phone signaling source data to obtain the user signaling data, the user signaling data including at least one of: The mobile trajectory data is used for identifying an activity area of the user; the location information data is used for marking a geographical position of the user; the roaming state data is used for recording a roaming time period and a location of the user; and the base station interaction record data is used for recording an interaction record of the user with a base station, including but not limited to a connected base station ID, a signal strength, and a handover record.

[0008] With reference to the first aspect, in some possible implementation modes of the first aspect, the illegal foreign worker behavior feature values comprise: a first illegal foreign worker behavior feature value representing a probability of living in a work site or a surrounding area of the work site; a second illegal foreign worker behavior feature value representing a probability of performing high-frequency foreign communication behavior; a third illegal foreign worker behavior feature value representing a probability of performing abnormal time communication behavior; and a fourth illegal foreign worker behavior feature value representing a probability of performing abnormal cross-border behavior.

[0009] With reference to the first aspect, in some possible implementation modes of the first aspect, the method further comprises: The first illegal foreign worker behavior feature value is obtained according to an actual distance between a work site and a residence site of the user and a pre-set distance threshold value; the second illegal foreign worker behavior feature value is obtained according to a total number of foreign calls of the user and a total number of all telephone communications of the user in a corresponding period; the third illegal foreign worker behavior feature value is obtained according to a total number of calls of the user in an abnormal time period and a total number of calls of the user in the corresponding period; and the fourth illegal foreign worker behavior feature value is obtained according to a cross-border number of the user and a number of times that the user deviates from the work site of the enterprise.

[0010] With reference to the first aspect, in some possible implementation modes of the first aspect, the method further comprises: obtaining a warning score according to the illegal foreign worker behavior feature values, comprising: calculating a weighted sum of the first illegal foreign worker behavior feature value, the second illegal foreign worker behavior feature value, the third illegal foreign worker behavior feature value, and the fourth illegal foreign worker behavior feature value as the warning score.

[0011] With reference to the first aspect, in some possible implementation modes of the first aspect, the method further comprises: performing illegal worker warning according to the warning score, comprising: when the warning score exceeds a pre-set score threshold value, triggering a corresponding level of warning, sending a notification of a corresponding level according to the warning level, and recording warning details in a log; wherein the score threshold value is set as a low-risk threshold value, a medium-risk threshold value, and a high-risk threshold value; the low-risk threshold value is used to identify a slightly abnormal behavior; the medium-risk threshold value is used to identify a behavior with a relatively high potential risk; and the high-risk threshold value is used to identify a highly abnormal behavior.

[0012] Secondly, an early warning device for illegal overseas workers is provided. The device includes: a signaling data acquisition module for acquiring user signaling data; a feature value acquisition module for obtaining feature values ​​of illegal overseas work behavior based on user signaling data; an early warning score acquisition module for obtaining an early warning score based on the feature values ​​of illegal overseas work behavior; and an early warning module for issuing early warnings for illegal workers based on the early warning score.

[0013] Thirdly, an early warning device for illegal overseas workers includes: a processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to perform any of the methods described above.

[0014] Fourthly, a computer program product comprising: a computer program, wherein the computer program, when executed by a processor, implements the method of any of the above aspects.

[0015] Fifthly, a computer-readable storage medium for storing a computer program that causes a computer to perform the methods described in any of the preceding aspects. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the first method for early warning of illegal overseas workers provided in the embodiments of this application. Figure 2 This is a flowchart illustrating the second method for early warning of illegal overseas workers provided in the embodiments of this application. Figure 3 This is a flowchart illustrating the third method for early warning of illegal overseas workers provided in the embodiments of this application. Figure 4 This is a flowchart illustrating the fourth method for early warning of illegal overseas workers provided in the embodiments of this application. Figure 5 This is a schematic diagram of an early warning device for illegal overseas workers provided in the embodiments of this application. Detailed Implementation To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to the device embodiments or system embodiments. In the description of this application, unless otherwise stated, "multiple" means two or more.

[0017] In the various embodiments of this application, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of different embodiments are consistent and can be referenced by each other. The technical features of different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0018] The terms "first," "second," "third," "fourth," and other various terminology (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] To facilitate understanding of the embodiments of this application, the terminology involved in the embodiments of this application will be briefly explained below.

[0020] User signaling data refers to the interaction information between user equipment and base stations collected through mobile communication networks, including location information, call records, SMS records, data connection records, etc., which are used to reflect the user's activity trajectory, communication behavior and geographical location information.

[0021] Overseas illegal work behavior characteristic value: refers to a series of quantitative indicators calculated based on user signaling data, used to characterize the possibility of a user engaging in illegal work behavior, such as the probability of residing in the workplace or surrounding areas, the probability of high-frequency overseas communication, the probability of communication at abnormal times, and the probability of abnormal cross-border behavior, etc.

[0022] Warning score: A comprehensive score calculated based on multiple characteristics of illegal overseas employment and their corresponding weights, used to determine whether a user is at risk of illegal employment.

[0023] AHP (Analog-Hybrid Hierarchical Analysis) is a multi-criteria decision analysis method that constructs a judgment matrix and calculates the relative weights of each indicator to determine the importance of different behavioral characteristics in early warning scoring, thereby achieving a scientific and reasonable weight allocation.

[0024] Data collection module: used to collect raw mobile signaling data, clean and standardize it, and then store it in the database to provide a structured and high-quality data foundation for subsequent data analysis.

[0025] Based on this, this application provides a method and device for early warning of illegal overseas workers, in order to solve the problem of how to effectively detect and warn of potential illegal overseas workers in the existing technology.

[0026] Figure 1 This is a flowchart illustrating the first method for early warning of illegal overseas workers included in the embodiments of this application.Figure 1 As shown, the method includes steps S101, S102, S103, and S104. Step S101: Obtain user signaling data. In some implementations, a data acquisition device (which may be a signaling acquisition server or other device with the function of acquiring mobile phone signaling from telecom operators, but is not limited in this embodiment) acquires mobile phone signaling source data of users to be identified near the location of enterprises in border cities, and filters, classifies, and stores the acquired mobile phone signaling source data from telecom operators; data extraction is performed on the processed mobile phone signaling source data to obtain user signaling data, which includes one or more of the following: movement trajectory data, location information data, roaming status data, base station interaction record data, and communication record data, thereby more accurately identifying the user's activity area, geographical location, roaming status, base station interaction record, and communication behavior data, and improving the accuracy of subsequent analysis.

[0027] In some implementations, mobile trajectory data is used to identify the user's activity area; location information data is used to mark the user's geographical location; roaming status data is used to record the user's roaming time period and location; base station interaction record data is used to record the user's interaction records with the base station, including the connected base station ID, signal strength, and handover records; and communication record data is used to record the user's call records, SMS sending / receiving records, data connection records, and other communication behavior data.

[0028] Step S102: Obtain the characteristic value of illegal overseas employment behavior based on user signaling data. The characteristic value of illegal overseas employment refers to the characteristic value that can, to a certain extent, indicate whether a user has engaged in illegal overseas employment. For example, in some implementations, the characteristic value of illegal overseas employment includes one or more of the following characteristic values: The first characteristic value of illegal overseas employment behavior represents the probability that the user resides in the place of work or its surrounding area; The second overseas illegal work behavior characteristic value represents the probability that a user will engage in high-frequency overseas communication behavior; The third characteristic value of illegal overseas employment behavior represents the probability of a user engaging in abnormal time communication behavior; The fourth characteristic value for illegal overseas employment behavior represents the probability that a user will engage in abnormal cross-border behavior.

[0029] This allows for a comprehensive reflection of users' potential illegal employment patterns and enhances the early warning system's identification capabilities.

[0030] In some implementations, the first characteristic value of illegal overseas employment is obtained based on the actual distance between the user's workplace and residence, as well as a pre-set distance threshold; the second characteristic value of illegal overseas employment is obtained based on the user's total number of overseas calls and the user's total number of telephone communications within the corresponding period; the third characteristic value of illegal overseas employment is obtained based on the user's total number of calls during abnormal time periods and the user's total number of calls within the corresponding period; and the fourth characteristic value of illegal overseas employment is obtained based on the user's cross-border number of times and the number of times the user's location deviates from their workplace.

[0031] Step S103: Obtain a warning score based on the characteristics of illegal overseas employment activities. In one optional implementation, when the characteristic values ​​of illegal overseas employment include a first characteristic value, a second characteristic value, a third characteristic value, and a fourth characteristic value, a weighted sum of the first characteristic value, the second characteristic value, the third characteristic value, and the fourth characteristic value can be calculated as a warning score.

[0032] In practical applications, by reasonably allocating weights, a comprehensive assessment of the user's overall risk level can be achieved, thereby improving the credibility of the early warning results.

[0033] Step S104: Issue warnings for illegal workers based on the warning score. In some implementations, when the warning score exceeds a preset threshold, a warning of the corresponding level is triggered. A notification of the appropriate level is sent based on the warning level, and the warning details are logged. The thresholds are set as low-risk, medium-risk, and high-risk. The low-risk threshold identifies slightly abnormal behavior; the medium-risk threshold identifies behavior with higher potential risk; and the high-risk threshold identifies highly abnormal behavior. This achieves tiered warnings, allowing users at different risk levels to take appropriate action.

[0034] Figure 2 This is a flowchart illustrating the second method for early warning of illegal overseas workers provided in this application embodiment, as follows: Figure 2 As shown, step S101 can be achieved through the following steps: Step S201: Location, Communication, and Connection Data Collection. Mobile signaling data is obtained from telecommunications operators. This data includes user location updates, call logs, SMS sending / receiving, and data connection information. Simultaneously, the geographical locations of employers in border cities are determined, such as latitude and longitude coordinates, and a geographical radius around each employer is defined, for example, a radius of 500 meters or 1 kilometer, to obtain user signaling data within this range.

[0035] Step S202: Data filtering and classification storage. User data located near the employing company is filtered based on GPS positioning, base station location, Wi-Fi access point, and other information. Signaling data is further filtered according to specific time periods (such as working hours or cross-border time periods), and each user's signaling data is identified using unique identifiers such as device ID and IMSI, and then classified and stored. Signaling data is classified and stored according to the company's geographical location, and users are divided into normal and abnormal behaviors based on behavioral characteristics, and into high-frequency and low-frequency users based on frequency. Normal behavior refers to signaling data of users appearing near the company during normal time periods (e.g., daytime working hours), while abnormal behavior refers to signaling data of users appearing near the company during abnormal time periods (e.g., nighttime or cross-border time periods). High-frequency users are those who frequently appear near the company's location, and low-frequency users are those who occasionally appear near the company's location. The specific normal / abnormal time periods and high / low frequency thresholds can be adjusted according to actual conditions and are not limited in this embodiment.

[0036] Subsequently, a suitable database is selected to store the data, such as a relational database (MySQL, PostgreSQL) or a NoSQL database (MongoDB, Cassandra). The specific database type is not limited in this embodiment. A location table, a user signaling table, and a behavior classification table are then created, and indexes are created for commonly used query fields (such as user ID, timestamp, enterprise ID, etc.) to improve query efficiency. Specifically, the location table stores the enterprise's location information (enterprise ID, name, latitude and longitude), the user signaling table stores user signaling data (user ID, device ID, timestamp, latitude and longitude, signaling type, base station ID, etc.), and the behavior classification table stores user behavior classification information (user ID, enterprise ID, behavior type, frequency of occurrence, anomaly markers, etc.).

[0037] Sensitive information is encrypted during data transmission and storage, access permissions are strictly controlled to ensure compliance with relevant laws and regulations, and user privacy is protected from being leaked or misused.

[0038] Step S203: Data Preprocessing and Extraction Analysis. The collected data is preprocessed, including noise and outlier removal, format standardization, and deduplication. Motion trajectory data is extracted to form time-series geographic coordinate data (timestamp + latitude and longitude). User IDs are used for aggregation to extract all location information for each user within a specific time period, forming trajectory paths. Spatiotemporal clustering analysis is performed on the motion trajectories to identify areas where users frequently operate (e.g., residence, workplace). Location information is extracted by extracting latitude and longitude information from signaling data, marking the user's geographic location, and combining this with map data to perform reverse geocoding of the location information, converting it into specific addresses or area names. Roaming status is identified by analyzing the user's SIM card country code (MCC) and the country code of the base station, recording the user's roaming time and location. Base station interaction records are extracted from signaling data, including the connected base station ID, signal strength, and handover records. By matching the base station ID with the base station location database, the geographical location information of the base station is obtained, identifying the user's handover frequency and path between different base stations, and analyzing the switching patterns between base stations. Communication records are extracted from the user's call records, SMS sending / receiving records, data connection records, etc., analyzing timestamps, call / SMS recipient numbers, call duration, SMS content length, etc., to analyze the user's social network and behavioral patterns and identify abnormal communication behavior. Mobile trajectory analysis involves spatiotemporal analysis of the user's mobile trajectory to identify frequently visited locations, regular routes, and abnormal movement patterns (such as abnormal travel times and abnormal cross-border behavior). Temporal series analysis and trajectory clustering algorithms are used to identify the user's daily activity patterns. By analyzing the user's location information, the user's activity range is determined, and frequently occurring geographical areas are identified. The user's location information is compared with known border areas and risk areas to identify potential abnormal activities. By analyzing the frequency and duration of roaming status, we can identify users' cross-border behavior and determine whether they are engaging in abnormal cross-border roaming activities. Combined with user location information, we can determine the user's activity area and trajectory during roaming. Analyzing the frequency of handovers between different base stations identifies high-frequency handovers and low-signal areas. Combining geographic information, we analyze handover paths between base stations to identify user movement patterns and base station coverage areas. Analyzing user communication frequency, recipients, and time identifies abnormal communication behaviors (such as frequent late-night communications and frequent communications from overseas numbers). Through social network analysis, we identify users' communication networks and potential risk relationships.

[0039] Step S204: Data Storage and Result Output. The analyzed data is stored in the database according to categories, such as trajectory data tables, location information tables, roaming status tables, base station interaction tables, and communication record tables. An index is created for each data category to facilitate subsequent querying and analysis. Reports and visualization charts are generated based on the analysis results, such as movement trajectory maps, base station interaction heatmaps, and communication frequency maps. Through these steps, user signaling data such as movement trajectories, location information, roaming status, base station interaction records, and communication records can be effectively analyzed and filtered, providing data support for subsequent user behavior identification and risk assessment.

[0040] In some embodiments, this invention provides a method for early warning of illegal overseas workers. The method first acquires mobile signaling source data of users to be identified near the location of employers in border cities through a data collection module, and then classifies and stores the data. Specifically, this includes collecting signaling data from telecommunications operators, determining the geographical location of employers and setting a geographical range, filtering user data within this range, and classifying and storing the data based on time, location, and behavioral characteristics. The collected data undergoes preprocessing, including data cleaning, format conversion, and deduplication, to ensure data accuracy and consistency. Subsequently, key information such as movement trajectories, location information, roaming status, base station interaction records, and communication records are extracted from the signaling data, and spatiotemporal analysis is performed to identify users' daily activity patterns and potential abnormal behaviors.

[0041] The following describes how step S102 obtains the characteristic value of illegal overseas employment based on user signaling data: When the characteristics of illegal overseas employment include the first to fourth characteristics, four characteristics can be calculated based on user signaling data. The first characteristic represents the probability of residing in or around the workplace; the second characteristic represents the probability of engaging in high-frequency overseas communication; the third characteristic represents the probability of engaging in communication at abnormal times; and the fourth characteristic represents the probability of engaging in abnormal cross-border activities. The specific calculation method is as follows: 1. The calculation of the characteristic value of the first overseas illegal work behavior is divided into the following five steps: Step 1: Data preprocessing; Taking a user's UI as an example, assuming the nighttime period is defined as 8 PM to 7 AM the following day, then for the acquired signaling data (user signaling data) of this user's UI, all signaling data falling within the aforementioned nighttime period can be filtered according to the timestamp of the signaling data, denoted as Tij1. The timestamp of the user signaling data, also known as the timestamp of the user's mobile phone signaling, refers to the data collection time point with a precise time stamp recorded by the operator's system during the communication process. It is usually expressed in seconds or milliseconds calculated from Greenwich Mean Time (UTC) January 1, 1970, 00:00:00, corresponding one-to-one with the time of mobile phone communication.

[0042] Suppose Tij1 contains signaling data belonging to "nighttime periods of different time cycles", for example: Signaling data X belongs to the nighttime period of the time cycle of "24 hours from January 1, 2025"; Signaling data Y belongs to the nighttime period of the 24-hour period of January 2, 2025; Signaling data Z belongs to the nighttime period of the time cycle of "24 hours from January 3, 2025";...

[0043] Then, based on the timestamps of the signaling data in Tij1, the signaling data in Tij1 can be matched to the nighttime period of the corresponding cycle, thereby constructing a nighttime data set B. This set consists of multiple subsets, denoted as B = {Bi,1, Bi,2, ..., Bi,m}, where Bi,m specifically refers to the set of signaling data of user Ui during the nighttime period of the m-th time cycle.

[0044] Similarly, if the daytime period is defined as 9 AM to 6 PM, for user Ui's signaling data, based on the timestamp of the signaling data, all data records falling within the aforementioned daytime period can be filtered out, denoted as Tij2. Using a similar method, the signaling data in Tij2 can be matched to the corresponding daytime period based on the timestamp of Tij2, thereby constructing a daytime data set C. This set consists of multiple subsets, denoted as C = {Ci,1, Ci,2, ..., Ci,m}, where Ci,m specifically refers to the set of signaling data of user Ui within the daytime period of the m-th time cycle.

[0045] Step 2: Identify the location of residence; To determine the nighttime residence of user Ui, firstly, based on the nighttime data set B, the connection status and dwell time of the user with each base station's cell DISTij during the nighttime period of the 1st to mth time periods are determined respectively. Then, based on the connection status and dwell time of the user and the cell DISTij of each base station during the nighttime period of the 1st to mth time periods, the cumulative nighttime dwell time of the user in the cell of the same base station within a set period is calculated; for example, a time period consisting of the 1st to mth time periods can be used as the set period. Subsequently, by comparing these cumulative dwell times, the cell to which the base station with the longest dwell time belongs is selected as the user's nighttime residence, and the location information of the cell is obtained—such as the latitude and longitude coordinates X1 and Y1 of the cell's centroid.

[0046] This residence is labeled ADDj=(X1,Y1), where X1 and Y1 correspond to the longitude and latitude coordinates of the residence, respectively, specifically the centroid location of the cell to which the base station with the longest nighttime dwell time belongs.

[0047] It should be noted that, in this embodiment of the application, the specific cell to which the user's mobile phone is connected, the specific connection time, and the duration of stay in the cell can be determined based on the signaling data set Bi,m corresponding to the m-th nighttime period, in the following way: The signaling data includes a Cell ID field, which uniquely identifies the cell to which the user's mobile phone was connected at the time the signaling event occurred. By parsing the Cell ID in the signaling data, it can be determined which specific cell the user's mobile phone was connected to.

[0048] The timestamp field in the signaling data records the time when a signaling event occurs. When a user's mobile phone establishes a connection with a base station cell, a corresponding signaling event is generated, and the timestamp of this signaling event is the specific time when the user's mobile phone connected to the cell.

[0049] The methods for determining a user's dwell time in a cell include: First, grouping the signaling records of the same user at different time points based on the user identifier ID and the cell ID of the base station data. Then, for each group, obtaining the earliest and latest signaling record times for that user in that cell; the time difference between these two times is the user's dwell time in that cell. If a user has multiple connection and disconnection events within the cell, it is necessary to determine and calculate based on the specific signaling event type. For example, if location update signaling exists, the dwell time can be calculated based on the location update time interval.

[0050] Step 3: Work location identification; To determine user Ui's daytime work location, the daytime data set C is used as the object of study, with particular attention paid to the connection status and dwell time between the user and the enterprise DISTij to which each base station belongs during the daytime periods of the 1st to mth time periods. Here, the enterprise to which the base station belongs can refer to any enterprise within the signal coverage area of ​​the base station.

[0051] Then, the cumulative daytime dwell time of the user within the same enterprise to which the base station belongs is calculated within a set period. Similar to the previous description, for example, a time period consisting of the 1st to mth time periods can be used as the set period.

[0052] Subsequently, by comparing these cumulative daytime dwell times, the enterprise to which the base station has the longest cumulative dwell time is selected as the user's daytime work location, and the location information of the enterprise to which the base station belongs is obtained—such as the latitude and longitude coordinates X2 and Y2 of the centroid of the enterprise to which the base station belongs. This work location is marked as ADDg=(X2,Y2), where X2 and Y2 correspond to the longitude and latitude coordinates of the work location, respectively, specifically the centroid of the enterprise to which the base station has the longest daytime dwell time belongs.

[0053] The location information of the enterprise to which the base station belongs can be input into a computing device by technicians. It should be noted that a typical application scenario of this application embodiment is to identify whether people in border cities are illegally working. Since there are often fewer and more concentrated employers in border cities, it is relatively easy to obtain the location information of the locations where these employers are concentrated, which can then be used as the location information of the enterprise to which the base station belongs.

[0054] In one alternative implementation, if the coverage area of ​​a base station is small, such as a 5G base station, its coverage radius is typically between 300 and 500 meters. In this case, the location of the base station can be approximated as the centroid location of the enterprise (the enterprise to which the base station belongs) within the base station's signal coverage area. The computing device can then obtain the base station's location information from a pre-stored parameter table as the centroid location information of the enterprise to which the base station belongs.

[0055] Step 4: Calculate the distance between your residence and workplace; Calculate the actual distance D between user Ui's residence and workplace, based on the latitude and longitude coordinates (X1, Y1) of user Ui's nighttime residence and (X2, Y2) of user Ui's workplace. For example, D can be calculated using the Euclidean distance method.

[0056] Step 5: Characterize the "behavioral characteristics index of residing in the workplace or its surrounding area", that is, the first overseas illegal work behavior characteristic value: AREA=(D / I)*100 calculation.

[0057] The 'I' mentioned in step 5 refers to a pre-set distance threshold. Specifically, to identify potential illegal employment situations, a maximum limit value 'I' can be pre-set as the distance threshold between the place of residence and the place of work. 'I' can be flexibly set according to actual application needs and is not limited to the specific value in this embodiment.

[0058] As can be seen from the physical meaning of the calculation method of the first overseas illegal work behavior characteristic value, the magnitude of the characteristic value is positively correlated with the actual distance D between the user Ui's workplace and residence, and negatively correlated with the limited distance threshold I.

[0059] Taking the question of "whether there are multiple individuals to be identified illegally working abroad" as an example, when calculating the first characteristic value of these individuals' illegal overseas employment behavior based on the same threshold I, if the actual distance between an individual's workplace and residence is large, then according to the calculation method above, the first characteristic value of this individual's illegal overseas employment behavior will be larger. In other words, the greater the distance this individual travels to work (potentially indicating abnormal behavior), the higher the probability of them engaging in illegal overseas employment. Conversely, if the actual distance between an individual's workplace and residence is small, then the first characteristic value of this individual's illegal overseas employment behavior will be smaller. In other words, the less the distance this individual travels to work (behavior is relatively normal), the lower the probability of them engaging in illegal overseas employment. Therefore, it can be seen that the first characteristic value of illegal overseas employment behavior calculated using the calculation method provided in this invention can effectively characterize whether a user is likely to engage in illegal overseas employment.

[0060] 2. The calculation of the second characteristic value of illegal overseas employment is as follows: Due to the characteristics of illegal employment activities, such as cross-border contacts and secret transactions, participants tend to frequently use mobile phones for overseas communication. This behavior pattern contrasts sharply with the communication habits of normal users. The characteristic index representing "high-frequency overseas communication," also known as the second characteristic value of illegal overseas employment, is calculated using the formula: COMM = (t / n) * 100. Where t refers to the total number of overseas calls made by user Ui within period Ti, and n refers to the cumulative sum of all telephone communications made by user Ui within period Ti. Ti can be set according to actual needs, such as 24 hours. Alternatively, Ti can be a time period consisting of the 1st to mth time periods mentioned above.

[0061] It should be noted that, in one optional implementation, for user Ui, the total number of overseas calls made by user Ui within the period Ti can be determined based on the "signaling event type, called number location (MCC / MNC), signaling timestamp, and call status" in the user's signaling data.

[0062] In one alternative implementation, the number of all telephone communications of user Ui within period Ti can be determined based on the "signaling timestamp" and "unique call identifier (such as Call ID, a unique code in the signaling used to associate the same call, which can be used for call deduplication)" in the user's signaling data.

[0063] As can be seen from the physical meaning of the calculation method of the second overseas illegal work behavior characteristic value, the magnitude of this characteristic value is positively correlated with the total number of overseas calls made by user Ui within the period Ti, and negatively correlated with the cumulative total of all telephone communications made by user Ui within the period Ti.

[0064] Taking the question of "whether there are multiple individuals suspected of illegally working abroad" as an example, assuming that the cumulative total number of all telephone communications within a given period Ti is roughly the same, if an individual has a significantly higher total number of overseas calls within that period, then, according to the calculation method described above, this individual's second characteristic value for illegal overseas employment will be larger. In other words, this individual frequently makes overseas calls (potentially exhibiting abnormal behavior) and is more likely to be engaged in illegal overseas employment. Conversely, if an individual has a smaller total number of overseas calls within that period, then this individual's second characteristic value for illegal overseas employment will be smaller. In other words, this individual makes fewer overseas calls (behavior is relatively normal) and is less likely to be engaged in illegal overseas employment. Therefore, it is evident that the second characteristic value for illegal overseas employment calculated using the method provided in this invention can effectively characterize whether a user is likely to be engaged in illegal overseas employment.

[0065] 3. The characteristic values ​​of illegal overseas employment activities are calculated as follows: Studies have shown that, in order to circumvent peak regulatory periods and ensure the secrecy of their communications, undocumented workers tend to choose non-traditional times such as late night and early morning for their communication activities. Therefore, the period of abnormal evening communication is defined as 11 PM to 6 AM the following day.

[0066] Based on this definition, the characteristic index representing "abnormal time communication" behavior, also known as the characteristic value of illegal overseas employment behavior, can be calculated using the following formula: TEL=(c / k)*100. Here, taking user Ui as an example, c represents the total number of calls made by user Ui during the abnormal communication period at night within period Ti, while k represents the total number of calls made by user Ui throughout the entire period Ti.

[0067] It should be noted that, in one optional implementation, for user Ui, the total number of calls made by user Ui during the abnormal communication period at night within the period Ti, and the total number of calls made by user Ui throughout the entire Ti, can be determined based on the "Event Type, Timestamp, and Call Status" in the user's signaling data.

[0068] Based on the physical meaning of the calculation method of the characteristic value of illegal overseas employment behavior, it can be seen that the magnitude of the characteristic value is positively correlated with the total number of calls made by user Ui during the abnormal communication period at night within the period Ti, and negatively correlated with the total number of calls made by user Ui throughout the entire Ti.

[0069] Taking the question of "whether there are multiple individuals suspected of illegally working abroad" as an example, assuming that the total number of calls made by these individuals within a period Ti is not significantly different, if an individual makes a significantly larger total number of calls during the abnormal communication period at night within period Ti, then, according to the calculation method described above, this individual's third characteristic value for illegal overseas employment will be larger. In other words, this individual is making frequent calls during the abnormal communication period at night (potentially exhibiting abnormal behavior), and the likelihood of them engaging in illegal overseas employment is higher. Conversely, if an individual makes a smaller total number of calls during the abnormal communication period at night within period Ti, then this individual's third characteristic value for illegal overseas employment will be smaller. In other words, this individual is making virtually no calls during the abnormal communication period at night (behavior is relatively normal), and the likelihood of them engaging in illegal overseas employment is lower. Therefore, it can be seen that the third characteristic value for illegal overseas employment calculated using the method provided in this invention can effectively characterize whether a user is likely to be engaged in illegal overseas employment.

[0070] 4. The calculation of the characteristic value of the fourth type of illegal overseas employment behavior is divided into the following four steps: Step 1: Data preprocessing; Assuming an abnormal cross-border period is defined, covering the time range from 7 PM of the current day to 7 AM of the next day, and still taking user Ui as an example, the signaling data (user signaling data) of the acquired user Ui can be filtered according to the timestamp of the signaling data to select all signaling data within each of the aforementioned abnormal cross-border periods in the period Ti, denoted as Tij3.

[0071] Suppose Tij3 contains signaling data belonging to "abnormal cross-border time periods of different time periods", for example: Signaling data 1 belongs to the "abnormal cross-border period of the time cycle of 'January 1, 2025'"; Signaling data 2 belongs to the "abnormal cross-border period of the time cycle of '24 hours from January 2, 2025'"; Signaling data 3 belongs to the "abnormal cross-border period of the 24-hour period of January 3, 2025";...

[0072] Then, based on the timestamp of Tij3, the signaling data in Tij3 can be matched to the abnormal cross-border time period of the corresponding period, thereby constructing an abnormal cross-border time period data set D. This set consists of multiple subsets, represented as D = {Di,1, Di,2, ..., Di,k}, where Di,m specifically refers to the set of signaling data of user Ui in the abnormal cross-border time period of the k-th time period.

[0073] Step 2: User activity location identification; To determine the location of user Ui, firstly, based on the abnormal cross-border time period data set D, the dwell time of user Ui in the connected base station during the abnormal cross-border time periods of the 1st to kth time periods is calculated respectively. Then, by accumulating statistics on the dwell time of base stations within a certain period, the main activity area of ​​user Ui can be identified and recorded as ADDg.

[0074] The "certain period" mentioned here could be, for example, a time period covered by the 1st to kth time periods.

[0075] Here, ADDg could refer to a set of latitude and longitude coordinates of several locations where the user's UI stays for a duration exceeding a preset threshold.

[0076] In one alternative implementation, the primary activity area ADDg of user Ui can be determined, for example, in the following manner: First, from the abnormal cross-border time period data set D, filter the control plane data of user Ui in the 4G / 5G mobile communication network, including the unique identifier of the cell where the user resides, the duration of the residency, etc. Based on the above control plane data, determine the dwell time of the user's UI in different cells; Based on the determined dwell time, cells with dwell time exceeding the preset duration threshold are identified as target cells; Obtain the latitude and longitude coordinates of each target cell (e.g., from the engineering parameter table); Based on the obtained latitude and longitude coordinates of each target cell, a set ADDg consisting of the latitude and longitude coordinates of each target cell is constructed.

[0077] Step 3: Compare the activity location with border areas and work locations; The specific implementation process of step 3 includes: First, calculate the distance M between the latitude and longitude coordinates of user Ui's main activity area ADDg and the boundary line. q (q) [1, Q]), where Q is the total number of latitude and longitude coordinates contained in ADDg; Compare M respectively q (q) [1, Q]) and the pre-set maximum distance limit value L1; L1 can be flexibly set according to the needs of the actual application scenario, and its specific value is not rigidly defined in this example; Statistics M q (q) The number of distance values ​​less than L1 in [1, Q], which represents the number of times the user approaches the boundary line within a certain period Ti, is denoted as L1. l ; Then, determine the number of times the user's location deviates from the location of their workplace within a certain period Ti, denoted as R.

[0078] The methods for determining R can include: First, calculate the distance U between each latitude and longitude coordinate in user Ui's main activity area ADDg and the location of the company where user Ui works (which can be represented by latitude and longitude coordinates). q (q) [1, Q]); Secondly, compare the calculated distances U respectively. q (q) [1, Q]) and the pre-set maximum distance limit value L2; L2 can be flexibly set according to the needs of the actual application scenario, and its specific value is not hard-defined in this example; Finally, statistics U q (q) The number of distance values ​​greater than L2 in [1, Q] is taken as the number of times R in which the user's location deviates from the location of the company where they work.

[0079] The latitude and longitude coordinates of the location of the company where User Ui works can be obtained by technicians through offline means and then manually entered into the computing device that executes the method provided in this application embodiment; or, considering that the location of User Ui's activity is very likely to be a border location, if User Ui is going to work, it is very likely to work in a business district near that border location, so the latitude and longitude coordinates of the base station whose signal covers the business district can be obtained as the latitude and longitude coordinates of the location of the company where User Ui works.

[0080] Step 4: Calculation of the "behavioral characteristic indicators of abnormal cross-border behavior", also known as the fourth characteristic value of illegal overseas employment behavior.

[0081] In one optional implementation, the specific calculation formula can be: CROSS=( l / R)*100.

[0082] The physical meaning of the calculation method of the fourth characteristic value of illegal overseas employment behavior shows that the magnitude of the characteristic value is positively correlated with the number of times the user approaches the border line within a certain period, and negatively correlated with the number of times the user's location deviates from the location of the company where he / she works within the same period.

[0083] Taking the question of "whether there are multiple individuals suspected of illegally working abroad" as an example, if the number of times each individual's location deviates from the location of their workplace within a certain period is similar, then if an individual approaches the border more frequently within that period, according to the calculation method described above, this individual's fourth characteristic value for illegal overseas employment will be larger. In other words, this individual is more likely to cross the border to work (potentially engaging in illegal border crossing), and the probability of engaging in illegal overseas employment is higher. Conversely, if an individual approaches the border less frequently or even zero times within a certain period, then this individual's fourth characteristic value for illegal overseas employment will be smaller or even zero, meaning the probability of this individual engaging in illegal overseas employment is lower. Therefore, it is evident that the fourth characteristic value for illegal overseas employment calculated using the method provided in this invention can effectively characterize whether a user is likely to engage in illegal overseas employment.

[0084] Figure 3 This is a flowchart illustrating the third method for early warning of illegal overseas workers provided in this application embodiment, as follows: Figure 3 As shown, step S103 can be achieved through the following steps: Assuming the characteristic value for the first type of illegal overseas employment is AREA, the characteristic value for the second type is COMM, the characteristic value for the third type is TEL, and the characteristic value for the fourth type is CROSS, with weights of Q1, Q2, Q3, and Q4 respectively, then the warning score S for illegal workers is: S=AREA*Q1+COMM*Q2+TEL*Q3+CROSS*Q4.

[0085] The weights corresponding to the four characteristics of illegal overseas employment can be calculated using empirical values ​​and weight analysis algorithms, or they can be obtained by training a machine learning model on actual data. For example, the initial values ​​of Q1, Q2, Q3, and Q4 can be set to 0.3, 0.3, 0.2, and 0.2, respectively, before training.

[0086] In one alternative implementation, the weights can be calculated using the Analytic Hierarchy Process (AHP).

[0087] Step S301: Set up a weighted scoring table.

[0088] In this step, the weights corresponding to the characteristic values ​​of illegal overseas employment are calculated using the Analytic Hierarchy Process (AHP). These characteristic values ​​are: AREA (residence in or near the workplace), COMM (high-frequency overseas communication), TEL (abnormal time communication), and CROSS (abnormal cross-border behavior). Specifically, a questionnaire was used to have 10 regulatory experts score the importance of these four indicators. The expert scores were then used to calculate the weights, resulting in a weighted scoring table for these four indicators, as shown in Table 1 below.

[0089] Table 1:

[0090] Step S302: Construct the judgment matrix.

[0091] As shown in Table 1, there are currently 10 experts who have scored the 4 indicators. The average score of the 10 experts is calculated to obtain the final judgment matrix table, as shown in Table 2 below: Table 2:

[0092] The table above shows that the CROSS indicator is generally more important than the AREA indicator, scoring 1.106 points; conversely, the COMM indicator scores 0.8 points compared to the AREA indicator. The interpretation of the relative importance of other indicators is similar.

[0093] After the judgment matrix is ​​constructed, the weights can be calculated.

[0094] Step S303: Calculate the weights and obtain the early warning score. Calculating the weights requires sequentially calculating the eigenvalues, the maximum eigenvalue, and finally obtaining the consistency index (CI) value, which is used for consistency testing. The calculation process of the AHP (Analytic Hierarchy Process) (using the sum-product method) is not detailed in this patent. In actual research, the calculation process is quite complex, and SPSSAU software can be used for calculation.

[0095] The results of the AHP hierarchical analysis, obtained through weight calculation, are shown in Table 3 below: Table 3:

[0096] From the table above, we can see that the weights of the four indicators AREA, COMM, TEL, and CROSS were calculated using the Analytic Hierarchy Process (AHP) (the calculation method is the sum-product method), and the resulting eigenvectors are (1.09, 0.872, 0.833, 1.205). The resulting weight values ​​are 27.244%, 21.795%, 20.833%, and 30.128%, respectively. The calculated weight values ​​are then rounded to two decimal places, resulting in weight values ​​of 0.27, 0.22, 0.21, and 0.3 for Q1, Q2, Q3, and Q4, respectively.

[0097] The resulting warning score is: S = AREA*0.27 + COMM*0.22 + TEL*0.21 + CROSS*0.3 Based on the obtained warning score, in step S104, a warning can be issued according to the warning score and the threshold set by the score.

[0098] Specifically, in the early warning and identification phase, for the person to be identified, a pre-set early warning threshold N can be obtained. Then, the early warning score S of the person to be identified is compared with the early warning threshold N to determine whether the person to be identified is an illegal worker abroad. If the early warning score is greater than the early warning threshold (S>N), then the person to be identified is identified as an illegal worker abroad. The early warning threshold can be set according to actual needs; this embodiment does not impose any limitations.

[0099] Figure 4 This is a flowchart illustrating the fourth method for early warning of illegal overseas workers provided in this application embodiment, as follows: Figure 4 As shown, the process may include the following steps: Step S401: Set the warning threshold in the warning scoring system; For example, thresholds for different risk levels can be set simultaneously in the early warning scoring system: A low-risk threshold typically refers to a threshold set that is relatively easy to trigger an alert (low-level alert). Based on such an alert threshold, even if a user exhibits only slightly abnormal behavior, it can be identified. For example, a low-risk threshold could be a numerical range [2, 3). In this case, users with an alert score below 2 would not trigger an alert, but if a user's alert score is greater than or equal to 2 but less than 3, a low-level alert would be triggered.

[0100] A medium-risk threshold typically refers to a warning threshold set within a moderate score range. Based on such a threshold, behaviors with potentially high risks can be identified. For example, a medium-risk threshold could be a numerical range [3, 6), in which case users with warning scores between 3 and 6 (excluding 6) would trigger a medium-level warning.

[0101] A high-risk threshold can be a set high score range to identify highly abnormal behavior. For example, a high-risk threshold of 6 would trigger a high-risk alert for users with a score exceeding 6.

[0102] Step S402: Threshold Comparison and Early Warning Trigger Real-time score calculation: After obtaining new signaling data for a user to be identified, the early warning score system can update the user's early warning score in real time.

[0103] Threshold comparison: The system compares the latest warning score with the set warning thresholds. If the warning score exceeds a certain threshold, the corresponding level of warning is triggered. Low-risk alert: Information is sent to the monitoring system for manual review. Low-risk alerts usually do not trigger immediate action, but they are recorded.

[0104] Medium-risk warning: The system generates an alert to notify relevant personnel for further analysis and assessment. For example, it may send a notification to the relevant risk control department.

[0105] High-risk warning: Triggering an emergency alert, the system will automatically take predetermined measures, such as restricting user access to certain services or initiating an emergency investigation procedure.

[0106] Early warning notifications: Depending on the warning level, the system will send different levels of notifications. For example, it may notify relevant personnel via SMS, email, or instant messaging tools.

[0107] Step S403: Early warning data recording, analysis, review, and optimization Warning Log Recording: Details of each warning are recorded in the warning scoring system's log, including the warning trigger time, user information, score, and a description of the specific abnormal behavior. These records are used for subsequent auditing and analysis.

[0108] Early warning data analysis: Regularly analyze early warning data to evaluate the effectiveness and accuracy of the early warning system. By analyzing historical early warning data, thresholds can be adjusted or scoring models optimized to reduce false alarms or missed alarms.

[0109] Manual review: Manually review medium- and high-risk warnings to confirm whether abnormal behavior actually exists, and take corresponding actions, such as investigation, warning, or restriction of user permissions.

[0110] System feedback and optimization: Feedback of manual review results to the early warning system, optimize scoring algorithms and threshold settings, and improve the accuracy of the early warning system.

[0111] Figure 5 This is a schematic diagram of an early warning device for illegal overseas workers provided in an embodiment of this application. Figure 5 As shown, the application includes a signaling data acquisition module 501, a feature value acquisition module 502, an early warning score acquisition module 503, and an early warning module 504. The functions of each module are detailed below: Signaling data acquisition module 501 is used to acquire user signaling data; The feature value acquisition module 502 is used to obtain feature values ​​of illegal overseas employment behavior based on the user signaling data; The early warning score acquisition module 503 is used to obtain an early warning score based on the characteristic values ​​of the illegal overseas employment behavior. The early warning module 504 is used to issue early warnings for illegal workers based on the early warning score.

[0112] In some implementations, the signaling data acquisition module 501 can be specifically used for: Acquire mobile signaling source data of users to be identified near the location of enterprises in border cities, and perform data filtering, classification, and storage; Data extraction is performed on the mobile phone signaling source data to obtain the user signaling data, which includes at least one of the following: Movement trajectory data is used to identify the user's activity area; Location information data, used to mark the user's geographical location; Roaming status data is used to record the user's roaming time period and location; Base station interaction record data is used to record the interaction records between the user and the base station, including but not limited to the connected base station ID, signal strength, and handover records; Communication record data is used to record the user's call records, SMS sending / receiving records, data connection records, and other communication behavior data.

[0113] In some implementation methods, the characteristic values ​​of illegal overseas employment include: The first characteristic value of illegal overseas employment represents the probability of residing in the place of work or its surrounding area; The second characteristic value of illegal overseas employment behavior represents the probability of engaging in high-frequency overseas communication activities; The third characteristic value of illegal overseas employment behavior represents the probability of engaging in abnormal time communication behavior; The fourth characteristic value for illegal overseas employment represents the probability of engaging in abnormal cross-border activities.

[0114] In some implementations: The first characteristic value of illegal overseas employment is obtained based on the actual distance between the user's workplace and residence, as well as a pre-set distance threshold; The second characteristic value of illegal overseas employment is obtained based on the user's total number of overseas calls and the user's total number of telephone communications within the corresponding period; The third characteristic value of illegal overseas employment is obtained based on the total number of calls made by the user during the abnormal time period and the total number of calls made by the user during the corresponding period; The fourth characteristic value for illegal overseas employment is obtained based on the number of times a user crosses borders and the number of times a user's location deviates from their company's work location.

[0115] In some implementations, the early warning score acquisition module 503 can be used to: calculate the weighted sum of the first overseas illegal employment behavior characteristic value, the second overseas illegal employment behavior characteristic value, the third overseas illegal employment behavior characteristic value, and the fourth overseas illegal employment behavior characteristic value, as the early warning score.

[0116] In some implementations, the warning module 504 can be specifically used for: When the warning score exceeds the preset score threshold, the corresponding level of warning is triggered, a notification of the corresponding level is sent according to the warning level, and the warning details are recorded in the log. Among them, the score thresholds are set as low-risk threshold, medium-risk threshold, and high-risk threshold; Low-risk thresholds are used to identify minor abnormal behaviors; The medium-risk threshold is used to identify behaviors with potentially high risks; High-risk thresholds are used to identify highly abnormal behavior.

[0117] In some implementations, the signaling data acquisition module 501 is also used to identify the signaling data of each user based on unique identifiers such as the user equipment ID and IMSI, and to classify the data of different users. Location filtering and time filtering further refine the data range and improve the accuracy of data collection. In some implementations, the feature value acquisition module 502 is also used to calculate feature values ​​for residing at or near the workplace, high-frequency overseas communication, communication during abnormal times, and abnormal cross-border behavior. Specifically, the feature value for residing at or near the workplace is calculated by comparing the distance between the user's nighttime residence and daytime workplace; the feature value for high-frequency overseas communication is calculated by statistically analyzing the ratio of the number of overseas calls made by the user to the total number of calls; the feature value for abnormal time-based communication is calculated by statistically analyzing the ratio of the number of calls made by the user during abnormal time periods to the total number of calls; and the feature value for abnormal cross-border behavior is calculated by statistically analyzing the distance between the user's activity location and the border line, as well as the number of times the user deviates from the company's workplace. In some implementations, the early warning score acquisition module 503 is also used to calculate the weight of each feature value using the AHP (Analytic Hierarchy Process) and determine the weight coefficients by combining expert scores, thereby improving the accuracy and reliability of the early warning score. In some implementations, the early warning module 504 is also used to set three levels of early warning thresholds: low risk, medium risk, and high risk, and to trigger the corresponding level of early warning response mechanism based on the early warning score, including pushing early warning information to the monitoring system, generating alarms to notify relevant personnel, and initiating emergency investigation procedures. In some implementations, such as Figure 5 In the device shown, the signaling data acquisition module 501 can connect with the external system to complete the data collection and preprocessing to obtain user signaling data. The feature value acquisition module 502 extracts user behavior features and calculates the feature value of illegal work behavior. The early warning score acquisition module 503 performs a comprehensive score and generates an early warning score. The early warning module 504 performs early warning identification and response based on the score results, thereby achieving the technical effect of accurate identification and efficient early warning of illegal workers abroad.

[0118] In some embodiments, this invention provides a method for early warning of illegal overseas workers based on mobile phone signaling data analysis and its application. The method includes the following steps: data interface with an external system is established through an internal system interface module to collect and transmit mobile phone signaling data; a data collection module cleans and standardizes the collected source data, and stores the data in corresponding database forms; a data analysis module analyzes and extracts the collected data to form a structured data table of key fields such as movement trajectory, location information, roaming status, base station interaction records, and communication records; a feature analysis module calculates four dimensions of illegal overseas worker behavior characteristics based on user signaling data: residing in or near the workplace, high-frequency overseas communication, abnormal time communication, and abnormal cross-border behavior; an early warning scoring module calculates an early warning score based on each behavioral feature value and its corresponding weight; and an early warning identification module compares the early warning score with a preset threshold. If the score exceeds the threshold, the individual is identified as an illegal worker and an early warning of the corresponding level is triggered.

[0119] Specifically, the process begins by acquiring mobile signaling data from telecom operators, including user location updates, call logs, SMS sending / receiving, and data connection information. This data is then combined with the geographical location of the employing company to determine its surrounding area, and signaling data from users within this area is filtered out. The data is then categorized and stored according to user behavior type (e.g., normal behavior, abnormal behavior) and frequency (e.g., high-frequency users, low-frequency users). During data storage, a relational or non-relational database is used for structured storage, and indexes are created for frequently used query fields to improve query efficiency. Simultaneously, encryption, access control, and privacy protection measures ensure data security. The collected raw data is cleaned and format-converted to remove noise and duplicate records, and the data format is standardized. Next, key information such as user movement trajectories, location information, roaming status, base station interaction records, and communication records are extracted from the data. Spatiotemporal clustering algorithms are used to analyze users' daily activity patterns, identify frequently occurring geographical areas, and determine whether abnormal cross-border or abnormal communication behaviors exist. The analysis results are structured and stored in corresponding database tables, and visualization charts are generated for subsequent analysis.

[0120] The calculation of characteristic values ​​for illegal overseas employment behavior begins with the following steps: First, by dividing the daytime and nighttime hours, the user's residence and workplace are identified, and the distance between them is calculated as the basis for the characteristic value representing "living in or near the workplace." Second, the number of overseas calls made by the user within a specific period is statistically analyzed to calculate the characteristic value representing "high-frequency overseas communication" for illegal overseas employment behavior. Third, the number of calls made by the user during late-night hours is analyzed to calculate the characteristic value representing "abnormal time communication" for illegal overseas employment behavior. Finally, by analyzing the distance between the user's activity location and the border, the frequency of their cross-border activities is statistically analyzed to calculate the characteristic value representing "abnormal cross-border behavior" for illegal overseas employment behavior. These characteristic values ​​are used to construct a risk assessment model for illegal workers.

[0121] In the early warning scoring stage, different weights are assigned to the four characteristic values ​​mentioned above, and the final weight coefficients are calculated using the Analytic Hierarchy Process (AHP). For example, the weights for residing at or near the workplace, high-frequency international communication, communication at unusual times, and unusual cross-border behavior are 0.27, 0.22, 0.21, and 0.3, respectively. The user's early warning score is obtained by weighted summation: S = AREA * 0.27 + COMM * 0.22 + TEL * 0.21 + CROSS * 0.3.

[0122] During the early warning identification phase, different risk levels, such as low, medium, and high risk, are set with warning thresholds. The system then determines whether to trigger an early warning based on a comparison of the warning score with these thresholds. If the score exceeds the set high-risk threshold, the system automatically triggers an emergency alarm and notifies relevant departments for further investigation. Simultaneously, the system records warning details, including user information, score, trigger time, and a description of the abnormal behavior, facilitating subsequent auditing and optimization. Furthermore, the early warning identification module supports the visualization of warning results, allowing regulatory personnel to intuitively grasp potential risks.

[0123] The sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0124] In the various embodiments of this application, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of different embodiments are consistent and can be referenced by each other. The technical features of different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0125] Those skilled in the art will recognize that, based on the units and algorithm steps described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is implemented in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0126] This application also provides a computer program product comprising instructions which, when executed by a computer, implement the methods described in the above method embodiments by the devices or apparatus described above.

[0127] This application also provides a computer-readable storage medium storing computer instructions for implementing the methods performed by the devices or apparatuses in the above method embodiments.

[0128] For example, when the computer program is executed by a computer, it enables the computer to implement the methods performed by the devices or apparatus in the various embodiments of the above methods.

[0129] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0130] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of apparatus or units may be electrical, mechanical, or other forms.

[0132] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0133] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0134] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0135] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An illegal foreign worker early warning method, characterized in that, The method comprises: obtaining user signaling data; obtaining an illegal foreign labor behavior characteristic value according to the user signaling data; obtaining a warning score according to the illegal foreign labor behavior characteristic value; warning illegal foreign labor personnel according to the warning score.

2. The method of claim 1, wherein, The method of obtaining user signaling data comprises: obtaining mobile phone signaling source data of a user to be identified near a location of an enterprise in a border city and performing data filtering, classification, and storage; performing data extraction on the mobile phone signaling source data to obtain the user signaling data, wherein the user signaling data comprises at least one of the following: mobile trajectory data, used for identifying an activity area of the user; location information data, used for marking a geographic location of the user; roaming state data, used for recording a roaming time period and a roaming location of the user; base station interaction record data, used for recording interaction records of the user with a base station, including but not limited to connected base station IDs, signal strengths, and handover records; communication record data, used for recording communication behavior data of the user, such as call records, short message sending / receiving records, and data connection records.

3. The method of claim 1, wherein, The illegal foreign labor behavior characteristic value comprises: a first illegal foreign labor behavior characteristic value, representing a probability of living in a work location or a surrounding area of the work location; a second illegal foreign labor behavior characteristic value, representing a probability of performing high-frequency foreign communication behavior; a third illegal foreign labor behavior characteristic value, representing a probability of performing abnormal time communication behavior; a fourth illegal foreign labor behavior characteristic value, representing a probability of performing abnormal cross-border behavior.

4. The method of claim 3, wherein: the first illegal foreign labor behavior characteristic value is obtained according to an actual distance between a work location and a residence location of the user and a pre-set distance threshold value; the second illegal foreign labor behavior characteristic value is obtained according to a total number of foreign calls of the user and a total number of all telephone communications of the user within a corresponding period; the third illegal foreign labor behavior characteristic value is obtained according to a total number of calls of the user within an abnormal time period and a total number of calls of the user within a corresponding period; the fourth illegal foreign labor behavior characteristic value is obtained according to a number of cross-border times of the user and a number of times that the user deviates from a work location of an enterprise.

5. The method of claim 3, wherein, The method of obtaining a warning score according to the illegal foreign labor behavior characteristic value comprises: calculating a weighted sum of the first illegal foreign labor behavior characteristic value, the second illegal foreign labor behavior characteristic value, the third illegal foreign labor behavior characteristic value, and the fourth illegal foreign labor behavior characteristic value as the warning score.

6. The method according to any one of claims 1 to 5, characterized in that, The method of warning illegal foreign labor personnel according to the warning score comprises: when the warning score exceeds a pre-set score threshold value, triggering a warning of a corresponding level, sending a notification of a corresponding level according to the warning level, and recording warning details in a log; wherein the score threshold value is set as a low-risk threshold value, a medium-risk threshold value, and a high-risk threshold value; the low-risk threshold value is used to identify a slightly abnormal behavior; the medium-risk threshold value is used to identify a behavior with a relatively high potential risk; the high-risk threshold value is used to identify a highly abnormal behavior.

7. An illegal foreign worker early warning application device, characterized in that, The device comprises: The signaling data acquisition module is configured to acquire user signaling data. The characteristic value obtaining module is configured to obtain an illegal overseas employment behavior characteristic value according to the user signaling data. The early warning score obtaining module is configured to obtain an early warning score according to the illegal overseas employment behavior characteristic value. The early warning module is configured to perform illegal employee early warning according to the early warning score.

8. An illegal foreign worker early warning device, characterized by, The processor and the memory are included. The computer program is stored in the memory and is configured to be executed by the processor to implement the method according to any one of claims 1 to 6.

9. A computer program product, characterised in that, The computer program is stored in the memory and is configured to be executed by the processor to implement the method according to any one of claims 1 to 6. The computer program is stored in the memory and is configured to be executed by the processor to implement the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, ​

Images