A network fraud explainable detection and digital forensic shunting method based on community-speech-platform feature fusion

Abstract

The application relates to the technical field of network security, and discloses a network fraud explainable detection and digital evidence diversion method based on community-speech-platform feature fusion. The application obtains a network interaction observation object to be detected and performs de-identification processing; generates community relationship evidence data, speech promotion evidence data and platform behavior evidence data from the observation object; encodes and maps the three types of evidence data to a shared representation space respectively, generates fusion weights corresponding to the observation object, and fuses the fusion weights to obtain evidence chain fusion representation; generates a risk identification result containing a risk category and a risk value according to the evidence chain fusion representation; generates an evidence object index according to the risk identification result and a contribution parameter; and stores the risk identification result and the evidence object index in association to generate digital evidence diversion data. The application can protect user privacy and data security while providing traceable data organization support for subsequent review, audit and source hierarchical evaluation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for interpretable detection and digital forensics triage of network fraud based on the fusion of community, dialogue and platform features. Background Technology

[0002] Online fraud detection and digital forensics triage are crucial components of cybersecurity governance, platform risk control, and anti-fraud early warning systems. With the intertwined use of social media platforms, instant messaging platforms, online transaction platforms, and external redirection platforms, online fraud is increasingly exhibiting a chain-like process involving cross-community recruitment, private chat persuasion, cross-platform migration, external link redirection, and payment prompts. In this process, individual community invitations, ordinary conversations, or external link redirects may not present obvious risk characteristics in isolation. Only by placing community relationships, persuasive tactics, and platform behavior within the same network interaction observation object and processing them in a correlated manner can a more complete characterization of online fraud risks be achieved.

[0003] Existing technologies for detecting online fraud often identify and analyze fraudulent calls from the perspectives of call texts, fraudulent scripts, number relationships, case patterns, platform behavior, or evidence-gathering electronic data.

[0004] There are already publicly available technologies for identifying fraudulent scripts. For example: Patent CN115098621B discloses a method and system for discovering fraudulent script samples. This solution performs similarity matching and aggregation on call text, matching representative text against a known database of fraudulent scripts. If a match fails, the corresponding call text is identified as a suspected new fraudulent script and submitted for review. This solution can discover call script samples that are similar to or different from the known script database, belonging to a fraudulent script discovery logic based on matching call text and script database. Regarding the chain detection of online fraud, this solution mainly focuses on identifying call text and script databases. It does not disclose the unified encoding and fusion processing of the script progression process, community relationship evidence, and platform behavior evidence as three types of evidence data within the same online interaction observation object, nor does it disclose mapping the risk identification results into a structured evidence object index.

[0005] Patent CN109451182B discloses a method and apparatus for detecting fraudulent phone calls. This method converts voice calls into text, extracts keyword weight vectors, identifies fraudulent clusters through text clustering, and constructs a text social network using call data and keywords. Fraudulent calls are then identified through tag propagation. This method combines text clustering and a text social network for fraudulent call detection, enabling risk identification in telephone fraud scenarios using keywords and number relationships. Regarding cross-platform detection of online fraud, this method's text social network is primarily constructed around call text and number relationships. It does not disclose the generation of community relationship evidence data, conversation progression evidence data, and platform behavior evidence data from network interaction observation objects, nor does it disclose the mapping of these three types of evidence representations to a shared representation space to generate corresponding fusion weights for the observation objects.

[0006] In the areas of graph concatenation and relational network analysis, relevant technologies have been disclosed. For example, patent CN121256116A discloses a method for multi-dimensional graph concatenation and visualization of telecommunications network fraud cases based on graph databases. This solution constructs a knowledge graph containing multiple entities such as cases, personnel, accounts, and devices, integrating hard association matching, soft similarity graph algorithms, temporal behavior analysis, and natural language processing information extraction to achieve cross-temporal and spatial case concatenation analysis, and visualizes it through force-directed graphs, timelines, Sankey diagrams, etc. This solution is mainly aimed at concatenation analysis and visualization judgment after case data has been formed, focusing on the correlation mining between entities such as cases, personnel, accounts, and devices. Regarding the online detection stage, this solution does not disclose the generation of community relationship evidence, dialogue progression evidence, and platform behavior evidence for undetermined network interaction observation objects, and the formation of evidence chain fusion representation based on the shared representation and fusion weight of the three types of evidence.

[0007] Patent CN112445870A discloses a method for analyzing cases using a knowledge graph based on mobile phone evidence data. This method acquires valid electronic data from multiple mobile phones, extracts feature information, and performs collision detection and matching between the features of the case to be analyzed and a historical case database, generating a code word list, a visual structure diagram, and a case-merging knowledge graph. This method can assist in case analysis and judgment from the perspectives of mobile phone evidence data, code word matching, and relationship graphs. Regarding the combination of online fraud detection and evidence triage, the input to this method is mainly the acquired mobile phone evidence data and a historical case database. The technical focus is on case collision, code word recognition, relationship graph generation, and case-merging analysis. It does not disclose the simultaneous generation of an evidence object index containing evidence source identifiers, time bucket identifiers, hashed evidence object identifiers, feature category identifiers, and interpretation scores during the risk identification result generation stage.

[0008] In the field of graph neural networks and fraud detection, there are already solutions that use graph structures for transaction fraud, abnormal transactions, or node risk identification. For example, patent CN112396160A discloses a transaction fraud detection method and system based on graph neural networks. This solution acquires transaction data and preprocesses it, extracts historical features and aggregated features of transaction behavior, and then uses graph convolutional networks and fully connected layers to predict fraud at transaction nodes. This solution can identify transaction fraud by utilizing the connections between transaction data and historical behavioral features. Regarding the modeling of the evidence chain of online fraud community-script-platform, this solution mainly focuses on transaction data and transaction node risks. The graph structure is used for extracting aggregated features of transaction behavior. However, it does not disclose the joint modeling of community relationship graphs, script progression sequences, and platform behavior vectors as three types of heterogeneous evidence data, nor does it disclose the mapping processing from risk identification results to evidence object indexes.

[0009] In the area of ​​multimodal anti-fraud or multi-source data fusion, relevant technologies have been disclosed. For example, patent CN113918949A discloses a method for identifying fraudulent apps based on multimodal fusion. This solution obtains the app installation file, extracts features from the installation file to obtain installation file features, and performs multimodal fusion on the installation file features. Based on the fused features and a fraud-related feature database, it identifies fraudulent apps. This solution focuses on fraudulent app identification, and the fusion object is the relevant features of the app's program file. Regarding online interaction fraud detection, this solution does not disclose using the online interaction observation object as the processing unit, nor does it disclose the shared space mapping and observation object-level fusion weight generation between the three types of evidence data: community relationships, dialogue progression, and platform behavior.

[0010] Patent publication number CN119476950A discloses a method and system for joint prevention and early warning against fraud. This solution targets specific anti-fraud areas, collects and integrates target user behavior data from multiple channels in real time, preprocesses it, extracts features related to fraudulent behavior, constructs a risk model, generates a risk score, triggers an early warning mechanism based on the risk score, and dynamically optimizes the risk model based on feedback. This solution can conduct risk assessment and early warning through multi-channel behavioral data. Regarding digital evidence triage, this solution mainly outputs risk scores and early warning results, but does not disclose the association and storage of risk categories, risk values, and evidence object indexes, nor does it disclose the formation of digital evidence triage data for review, auditing, and source-based hierarchical assessment.

[0011] In the areas of digital and multimodal forensics, technologies already exist for analyzing multimedia samples, electronic data, or case materials. For example, existing digital multimedia forensics methods construct multimodal knowledge graphs based on image frames, audio signals, and text subtitles for multimedia content analysis. The objects of this type of approach are primarily multimedia samples or existing electronic evidence, with a focus on evidence content analysis, knowledge graph construction, and consistency assessment. However, in the context of online fraud detection, these solutions do not publicly disclose the unified representation and fusion of community relationship evidence, dialogue progression evidence, and platform behavior evidence during the risk identification phase, nor do they publicly disclose the association and storage of online fraud risk identification results with evidence object indexes as digital forensics distribution data.

[0012] In summary, the existing technology has at least the following shortcomings: First, existing fraud script identification, call fraud detection, or keyword clustering solutions mainly focus on identifying call text, fraud keywords, or known script databases. They can discover suspicious text content or suspected script samples, but they have not publicly disclosed the unified encoding and fusion processing of the script progression process, community relationship evidence, and platform behavior evidence as three types of evidence data in the same network interaction observation object.

[0013] Second, existing graph concatenation, knowledge graph analysis, or graph neural network fraud detection solutions mainly focus on the relationship between case entities, transaction nodes, or call relationships. They can discover gang relationships, abnormal nodes, or case connections, but they usually do not publicly encode and map community relationship evidence data, dialogue progression evidence data, and platform behavior evidence data separately to a shared representation space, and generate fusion weights based on the observed objects to form a fusion representation of the evidence chain.

[0014] Third, while existing multimodal anti-fraud, fraud APP identification, or multi-channel early warning solutions involve multi-source data fusion and risk scoring, most of them only output risk scores, identification results, or early warning results, without disclosing that the online fraud risk identification results are further mapped into a structured evidence object index that includes evidence source identifiers, time bucket identifiers, hashed evidence object identifiers, feature category identifiers, and interpretation scores.

[0015] Fourth, existing digital evidence collection or case analysis solutions are mostly geared towards existing electronic evidence, mobile phone evidence data, or case materials that have already been classified. They focus on collision matching, code word recognition, relationship graph generation, or visualization analysis. They do not disclose how to associate and store risk categories, risk values, and evidence object indexes during the online fraud risk identification stage to generate digital evidence diversion data suitable for subsequent review, auditing, and source stratification assessment. Summary of the Invention

[0016] Given the problems of existing technologies, such as the often fragmented processing of textual rhetoric, community relationships, and platform behavior, and the lack of structured correlation between risk identification results and specific evidence objects, a method for interpretable detection and digital forensics triage of network fraud based on the fusion of community-rhetoric-platform features is proposed.

[0017] Its purpose is to generate three types of evidence data—community relationships, rhetoric progression, and platform behavior—from the same observed object under de-identification conditions, to perform shared space fusion and risk identification, and to store the risk identification results in association with the evidence object index as digital evidence diversion data, thereby forming traceable and verifiable structured diversion data while identifying the risk of online fraud.

[0018] The technical solution of this invention is a method for interpretable detection and digital forensics triage of online fraud based on the fusion of community, dialogue, and platform features, including: S1: Obtain the network interaction observation object to be detected and perform de-identification processing on the observation object.

[0019] S2 generates evidence data on community relationships, rhetoric progression, and platform behavior from the observed objects.

[0020] S3 encodes the community relationship evidence data, the speech promotion evidence data, and the platform behavior evidence data respectively to obtain the community evidence representation, the speech evidence representation, and the platform evidence representation.

[0021] S4 maps the community evidence representation, the rhetoric evidence representation, and the platform evidence representation to the shared representation space, and generates fusion weights corresponding to the observed objects based on the three types of evidence representations. The three types of evidence representations are then fused according to the fusion weights to form an evidence chain fusion representation.

[0022] S5 generates a network fraud risk identification result containing risk category and risk value based on the evidence chain fusion representation.

[0023] S6 generates an evidence object index based on the results of online fraud risk identification and the contribution parameters corresponding to the three types of evidence.

[0024] S7 associates and stores the results of online fraud risk identification with the evidence object index, generating digital evidence collection and diversion data.

[0025] Furthermore, in S1, the network interaction to be detected is the observation record from the network interaction process. After the observation record is de-identified, it retains the feature-level data used for evidence construction and does not use the original username, original URL or original platform token as risk identification input.

[0026] Furthermore, in S2, the community relationship evidence data includes a de-identified community interaction graph. The node attributes of the interaction graph are generated based on message volume, contact diversity, number of invitations, URL sharing rate, and account age bucket. The edge attributes are generated based on reply relationship, invitation relationship, forwarding relationship, time interval, and repeated contact. The graph statistical parameters of the interaction graph are generated based on graph density, degree centrality, betweenness centrality, clustering coefficient, invitation burstiness, and broker node ratio.

[0027] Furthermore, in S2, the evidence data for advancing the conversation includes de-identified dialogue text sequences and stage indicators generated without using final category labels. These stage indicators are generated based on trust building escalation, emotional dependence, commitment to benefits, urgency, confidentiality requirements, platform switching instructions, risk neutralization statements, and transfer guidance.

[0028] Furthermore, in S2, platform behavior evidence data is generated based on posting frequency, response interval, number of platform switches, number of account migrations, number of redirects, number of channel migrations, abnormal account age, payment prompt frequency, and sudden increases in posting.

[0029] Furthermore, in S3, when encoding community relationship evidence data, graph sampling aggregation encoding and graph attention encoding are used to process community relationship evidence data; when encoding dialogue advancement evidence data, Transformer-based semantic encoding is used to process dialogue advancement evidence data; and when encoding platform behavior evidence data, numerical embedding and category embedding are used to process platform behavior evidence data.

[0030] Furthermore, in S4, attention scores are calculated for the community evidence representation, the rhetoric evidence representation, and the platform evidence representation after being mapped to the shared representation space. The attention scores are then normalized to obtain the fusion weights. The three types of evidence representations after mapping are then fused according to the fusion weights to obtain the evidence chain fusion representation.

[0031] Furthermore, in S6, the contribution parameters include one or more of the following: fusion weight, explanation score, and feature contribution value; the fusion weight comes from the attention normalization result of the three types of evidence representations, the explanation score corresponds to the explanation score field in the evidence object index, and the feature contribution value represents the degree of contribution of community, rhetoric, or platform evidence items to the risk category and risk value.

[0032] Furthermore, in S6, the evidence object index is represented as a set of tuples: in, For the identification of the source of evidence, For time bucket identification, For hashing evidence object identifiers, For feature category identification, To explain the score, For the first The number of evidence items corresponding to each observed object.

[0033] Furthermore, when generating a model for performing online fraud risk identification, record identifiers, scenario identifiers, template family identifiers, source narrative identifiers, CSP grouping identifiers, source type identifiers, and evidence hash keys are excluded from the training input, and the excluded fields are retained as fields for segmentation, auditing, source stratification assessment, or review.

[0034] Furthermore, the digital forensics triage data includes online fraud risk identification results and evidence object indexes. The online fraud risk identification results include risk categories and risk values, while the evidence object indexes include evidence source identifiers, time bucket identifiers, hashed evidence object identifiers, feature category identifiers, and interpretation scores.

[0035] This invention also provides a system for interpretable detection and digital forensics triage of online fraud based on the fusion of community, script, and platform features, characterized by comprising: The data acquisition and de-identification module acquires the network interaction observation objects to be detected and performs de-identification processing on the observation objects.

[0036] The three-element evidence construction module generates community relationship evidence data, conversational progression evidence data, and platform behavior evidence data from the observed objects.

[0037] The multimodal coding module encodes community relationship evidence data, speech progression evidence data, and platform behavior evidence data respectively, resulting in community evidence representation, speech evidence representation, and platform evidence representation; The shared space projection and fusion module maps the three types of evidence representations to the shared representation space, generates fusion weights corresponding to the observed objects based on the three types of evidence representations, and fuses the mapped three types of evidence representations according to the fusion weights to obtain the evidence chain fusion representation.

[0038] The risk identification module generates network fraud risk identification results containing risk categories and risk values ​​based on the evidence chain fusion representation.

[0039] The evidence index generation module generates an evidence object index based on the results of online fraud risk identification and the contribution parameters corresponding to the three types of evidence.

[0040] The diversion data generation module generates a diversion status identifier based on the risk value, evidence object index, and threshold configuration parameters. It then associates and stores the diversion status identifier, the network fraud risk identification result, the evidence object index, the model version identifier, the threshold configuration parameters, and the interpretation snapshot timestamp to generate digital evidence diversion data.

[0041] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for interpretable detection and digital forensics triage of network fraud based on the fusion of community, rhetoric, and platform features.

[0042] Compared with the prior art, the present invention has the following beneficial effects: 1. By generating evidence data on community relationships, persuasive tactics, and platform behavior from the same network interaction observation object, community relationships, persuasive tactics, and platform behavior are unified into three types of heterogeneous evidence data. This can characterize the correlation between community recruitment, phased persuasion, and cross-platform operation behaviors in online fraud, which is helpful in addressing the problem that single-dimensional or partial-dimensional detection in existing technologies cannot fully characterize the chain fraud process.

[0043] 2. By mapping the three types of evidence representations to a shared representation space, and generating fusion weights corresponding to the current observation object based on the three types of evidence representations, and fusing the mapped three types of evidence representations according to the fusion weights, an evidence chain fusion representation is obtained. This enables community relationship evidence, rhetoric advancement evidence, and platform behavior evidence to participate in fusion processing in the same representation space, which is beneficial to addressing the problem in existing technologies where the scattered processing of the three types of evidence makes it difficult for weak signals to participate in risk identification in a coordinated manner.

[0044] 3. An evidence object index is generated by using the network fraud risk identification results and the contribution parameters corresponding to the three types of evidence. The network fraud risk identification results and the evidence object index are associated and stored as digital evidence diversion data. While outputting the risk category and risk value, a structured index data containing evidence source identifier, time bucket identifier, hashed evidence object identifier, feature category identifier and interpretation score is formed. This establishes a traceable correspondence between the risk identification results and specific evidence objects, which helps to address the problem of the lack of structured association between risk identification results and evidence objects in existing technologies.

[0045] 4. By excluding record identifiers, scene identifiers, template family identifiers, source narrative identifiers, CSP grouping identifiers, source type identifiers, and evidence hash keys from the training input, and retaining the excluded fields as fields for classification, auditing, source hierarchical evaluation, or review, the reliance on non-risk evidence fields such as source identifiers, template families, or evidence hash keys during model training can be reduced. This allows the risk identification process to be mainly based on community relationship evidence, conversational advancement evidence, and platform behavior evidence, which helps reduce the risk of leakage caused by similar templates, repetitive narratives, or source fields.

[0046] 5. By constructing, encoding, fusing, identifying risks, generating evidence indexes, and generating diverted data for observed objects under de-identification conditions, the system completes the identification of network fraud risks and the generation of digital evidence diverted data without using the original username, real identity, original account, original URL, or original platform token as input for risk identification. This provides a traceable data organization foundation for subsequent review, auditing, and source stratification assessment while protecting user privacy and data security. Attached Figure Description

[0047] Figure 1 This is a system flow and module architecture diagram of the present invention; Figure 2 This is a flowchart illustrating the dataset construction, source composition, and governance process of this invention; Figure 3 This is a flowchart of the network fraud interpretable detection and digital forensics triage method of the present invention; Figure 4 This is a diagram of the evidence object index and digital forensics diversion data structure of the present invention. Detailed Implementation

[0048] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0049] Example 1, referring to Figure 1 - Figure 3 This is the first embodiment of the present invention, which provides a method for interpretable detection and digital forensics triage of network fraud based on the fusion of community, rhetoric and platform features.

[0050] In this embodiment, the method is applied to a network platform anti-fraud risk analysis system, a platform review and verification system, a financial institution fraud risk analysis system, or a digital evidence collection and triage system.

[0051] The system receives de-identified network interactive observation objects formed from publicly available sources, open reports, simulated dialogues, benign records of difficult-to-bear samples, or legally authorized sources.

[0052] The objects to be observed in online interactions can include community recruitment records, private chat snippets, platform switching events, external link redirection events, and payment notification events.

[0053] The system does not use original usernames, real identities, original accounts, original URLs, original platform tokens, or unauthorized private platform logs as inputs for identifying online fraud risks. For original identifier fields that are legally obtained or contained in public sources, the system performs normalization, hashing, bucketing, or field replacement processing during the de-identification stage. The processed feature-level data is then used for the construction, encoding, fusion, risk identification, evidence index generation, and digital evidence diversion data generation of community relationship evidence, dialogue advancement evidence, and platform behavior evidence.

[0054] The method in this embodiment includes the following steps: S1: Obtain the network interaction observation object to be detected and perform de-identification processing on the observation object.

[0055] Specifically, the network interaction observation objects to be detected are derived from publicly available anti-fraud warnings, open report summaries, simulated fraud dialogues, benign records of difficult-to-handle samples, or de-identified feature-level interaction records formed with legal authorization.

[0056] The network interaction observation objects to be detected do not include unauthorized private platform logs, original personally identifiable information, or confidential case materials.

[0057] Specifically, de-identification processing includes normalizing, hashing, bucketing, or replacing fields of the original username, original account identifier, original URL, platform token, and original identifier of the evidence object.

[0058] After de-identification, the system retains feature-level data such as message volume, relationship type, time sequence, number of resource jumps, number of platform switches, number of account migrations, and payment prompt frequency.

[0059] The aforementioned feature-level data is used for subsequent evidence construction; the original identity field and the original resource field are not used as inputs for identifying online fraud risks.

[0060] S2 generates evidence data on community relationships, rhetoric progression, and platform behavior from the observed objects.

[0061] Specifically, each network interaction observation object to be detected is represented as a ternary evidence record: in, Indicates the first One network interaction observation object to be detected. Data representing evidence of community relationships This indicates that the rhetoric is being used to advance evidence and data. This represents evidence data regarding platform behavior.

[0062] Triadic evidence records are used to represent community relationships, rhetoric, and platform behavior within the same observed object.

[0063] S21, Generate community relationship evidence data: The system extracts interaction subjects, groups, channels, de-identified link resource identifiers and contact events from the de-identified observation objects to generate a de-identified community interaction graph.

[0064] De-identified link resource identifiers include de-identified URL identifiers, shared link identifiers, or shared resource identifiers, used to represent link-type resources that are shared, forwarded, or redirected within the observed object, and do not contain the original URL content.

[0065] The nodes in the community interaction graph include interaction subject nodes, group nodes, channel nodes, and de-identified link resource identifier nodes.

[0066] Node attributes are generated based on data in the message volume, contact diversity, number of invitations, URL sharing rate, and account age bucket.

[0067] The account age bucket is used as an account node attribute to represent the category field after bucketing the account creation time or account activity time.

[0068] Edge attributes are generated based on data from reply relationships, invitation relationships, forwarding relationships, time intervals, and repeated contacts. Graph statistics parameters of the interaction graph are generated based on graph density, degree centrality, betweenness centrality, clustering coefficient, invitation burstiness, and broker node ratio.

[0069] The broker node ratio is generated based on the number of cross-group connections, cross-channel connections, the number of times a node appears as an invitation or forwarding intermediary node, the number of times it connects to different de-identified link resource identifiers, and the bridging position in repeated contact paths.

[0070] The brokerage node ratio is used to characterize the proportion of nodes with cross-group, cross-channel, or cross-path bridging relationships in the community interaction graph.

[0071] S22, Generate evidence data for advancing the dialogue: The system arranges the de-identified dialogue text in chronological order to form a sequence of de-identified dialogue text.

[0072] The system generates stage indicators without reading the final risk category label. Stage indicators are generated based on semantic fragments, keyword phrases, contextual location, temporal order, and turn-taking relationships within the dialogue text.

[0073] The phase indicators are generated based on data from trust building and upgrading, emotional dependence, commitment to benefits, urgency, confidentiality requirements, platform switching instructions, risk neutralization statements, and transfer guidance.

[0074] The stage indicators are not output as the final risk category on their own, but together with the de-identified dialogue text sequence, they constitute the evidence data for the advancement of the rhetoric.

[0075] S23, Generate platform behavior evidence data: The system extracts data from the observed objects, including posting frequency, response interval, number of platform switches, number of account migrations, number of redirects, number of channel migrations, abnormal account age, payment prompt frequency, and sudden increases in posting.

[0076] Platform switching frequency is generated based on migration events between different channels or services within the observed object; account migration frequency is generated based on switching events between different accounts, account entry points, or contact entry points of the interacting entity; redirection frequency is generated based on link jumps or resource jumps; channel migration frequency is generated based on events where the interaction process migrates from one communication channel to another; payment prompt frequency is generated based on the number of payment prompts or transfer prompts. The system performs numerical, binning, standardization, or categorization processing on the above data to generate platform behavior evidence data.

[0077] In this embodiment, the correspondence between the three types of evidence data, evidence collection and review metadata, and explicit exclusion metadata is shown in Table 1: Table 1. Exclusion of Feature Groups and Explicit Metadata in CSP-FDF The source channel, timestamp, hash identifier, and interpretation category in Table 1 correspond to the evidence source identifier, time bucket identifier, hashed evidence object identifier, and feature category identifier in this embodiment, respectively.

[0078] S3 encodes the community relationship evidence data, the speech promotion evidence data, and the platform behavior evidence data respectively to obtain the community evidence representation, the speech evidence representation, and the platform evidence representation.

[0079] S31, Encoding Community Relationship Evidence Data: The system uses graph sampling aggregation coding and graph attention coding to process community relationship evidence data.

[0080] The community encoder takes as input a de-identified community interaction graph, node attributes, edge attributes, and graph statistical parameters, and outputs a fixed-dimensional representation of community evidence.

[0081] Graph sampling aggregation coding aggregates information about the neighborhood of nodes, while graph attention coding assigns different weights to different neighboring nodes, edge relationships, or graph structure features.

[0082] S32, Encoding the evidence data for the advancement of the speech: The system uses semantic encoding based on Transformer to process the evidence data for the advancement of the speech.

[0083] The speech encoder takes as input a de-identified dialogue text sequence and stage indicators, and outputs a fixed-dimensional speech evidence representation.

[0084] De-identified dialogue text sequences provide contextual semantic information, while stage indicators provide information on the progression of the dialogue.

[0085] S33, Encoding Platform Behavior Evidence Data: The system uses numerical embedding and categorical embedding to process platform behavior evidence data.

[0086] The platform encoder takes as input the platform behavior vector and the category field embedding results, and outputs a fixed-dimensional platform evidence representation.

[0087] For numerical fields such as posting frequency, response interval, number of platform switches, number of account migrations, number of redirects, number of channel migrations, and payment prompt frequency, the system performs standardization or normalization processing; for fields such as abnormal account age, channel type, or behavior category, the system performs embedded encoding.

[0088] In one implementation of this embodiment, the encoding process for the three types of evidence is represented as follows: in, Indicate the type of evidence. Represents a set of modes. This represents evidence of community relationships. This indicates evidence supporting the use of persuasive language. This represents evidence of the platform's behavior; Indicates the first The first of the observed objects Class of evidence data; The encoder represents the corresponding evidence type; Indicates encoder parameters; Indicates the first The encoding results of evidence data.

[0089] S4 maps the community evidence representation, the rhetoric evidence representation, and the platform evidence representation to the shared representation space, and generates fusion weights corresponding to the observed objects based on the three types of evidence representations. The three types of evidence representations are then fused according to the fusion weights to form an evidence chain fusion representation.

[0090] S41, Mapping the three types of evidence representations to a shared representation space: The system maps community evidence representation, verbal evidence representation, and platform evidence representation to a shared representation space. The shared representation space is a vector space of the same dimension after mapping the community evidence representation, verbal evidence representation, and platform evidence representation. The three types of evidence representations have the same vector dimension within the shared representation space.

[0091] In one implementation of this embodiment, the shared space mapping process is represented as follows: in, Indicates the first The representation of class evidence mapped to the shared representation space; and Indicates the relationship with the first Mapping parameters corresponding to the class of evidence; This represents a nonlinear mapping function.

[0092] S42, Calculate the attention score: The system calculates the attention score based on the three types of evidence representations in the shared representation space. In one implementation of this embodiment, the attention score is represented as: in, Indicates the first The type of evidence represents the corresponding attention score; , and Indicates the attention parameter. The superscript indicates the transpose operation.

[0093] S43, Normalize the attention score to obtain the fusion weight: The system normalizes the attention score to obtain the fusion weight corresponding to the current observation object: in, Indicates the first The class of evidence represents the corresponding fusion weight, and the fusion weight is for the first class of evidence. Each observation object is calculated separately and is not used as a fixed weight shared by all observation objects; Indicates the first The type of evidence represents the corresponding attention score; For modal set The summation index in the middle is used to traverse the three modalities of community relationship evidence, speech advancement evidence, and platform behavior evidence; This represents evidence of community relationships. This indicates evidence supporting the use of persuasive language. This represents evidence of the platform's behavior.

[0094] In one implementation of this embodiment, when any type of evidence data—community relationship evidence data, conversational progression evidence data, or platform behavior evidence data—is unavailable in the current observation object, the system masks the attention score corresponding to the unavailable evidence data and resets the fusion weight corresponding to the unavailable evidence data to zero. The system then normalizes the attention scores corresponding to the remaining available evidence data to obtain the fusion weight corresponding to the current observation object. Evidence chain fusion is generated based on the actually available evidence data in the current observation object.

[0095] S44, Generate a fused representation of the evidence chain based on the fusion weights: The system fuses the three types of evidence representations after mapping according to the fusion weights to obtain a fused representation of the evidence chain. in, Indicates the first Evidence chain fusion representation corresponding to each observed object.

[0096] S5 generates a network fraud risk identification result containing risk category and risk value based on the evidence chain fusion representation.

[0097] The system inputs the evidence chain fusion representation into the classification network to obtain the risk category distribution.

[0098] In one implementation of this embodiment, the risk category distribution is represented as follows: in, Indicates the first Risk category distribution corresponding to each observed object and This represents the parameters of the classification network.

[0099] The system generates risk categories and risk values ​​based on the risk category distribution.

[0100] The risk category is determined by the category with the largest value in the risk category distribution, and the risk value is determined by the probability value of the corresponding category.

[0101] Risk categories can be configured based on the online fraud detection task, such as investment, romantic investment, fake e-commerce, impersonating customer service, loan refund, part-time job, or benign category. They can also be configured based on the risk type in the application scenario.

[0102] S6, see reference Figure 4 Based on the results of online fraud risk identification and the contribution parameters corresponding to the three types of evidence, an evidence object index is generated.

[0103] S61, Generate contribution parameters: Contribution parameters are data parameters used to generate the evidence object index.

[0104] Contribution parameters include modal-level contribution parameters and evidence item-level contribution parameters.

[0105] The modal-level contribution parameter is the fusion weight corresponding to the community evidence representation, the rhetorical evidence representation, and the platform evidence representation. The fusion weight is used to characterize the fusion ratio of the three types of evidence representation in the current observation object.

[0106] The evidence item-level contribution parameter is the interpretation score corresponding to the evidence item, and the interpretation score is written into the evidence object index. Field.

[0107] In one implementation of this embodiment, the system first determines the modal-level contribution of community relationship evidence data, speech promotion evidence data, and platform behavior evidence data in the current observation object based on the fusion weight, and then determines the evidence item-level contribution parameter based on the feature contribution value in the corresponding evidence data.

[0108] The feature contribution value is used to characterize the degree of contribution of an evidence item to the risk category and risk value. The system generates the interpretation score corresponding to the evidence item based on the feature contribution value of the evidence item.

[0109] Therefore, the fusion weight is used to determine the modal-level correspondence between the three types of evidence data and the risk identification results, and the interpretation score is used to determine the degree of contribution of the evidence item after it enters the evidence object index.

[0110] S62, Determine the evidence items to be included in the evidence object index: When generating the evidence object index, the system maps the network fraud risk identification results to the community evidence representation, script evidence representation and platform evidence representation that participated in the risk identification, and determines the evidence items that correspond to the risk identification results based on the modality-level contribution parameters and the evidence item-level contribution parameters.

[0111] Evidence items are derived from feature fields, time segments, or graph structure node / edge records in community relationship evidence data, conversation progression evidence data, or platform behavior evidence data.

[0112] S63, Generate Evidence Object Index: The evidence object index is represented as a set of tuples: in, For the identification of the source of evidence, For time bucket identification, For hashing evidence object identifiers, For feature category identification, To explain the score, For the first The number of evidence items corresponding to each observed object.

[0113] Evidence source identifier is used to indicate the source channel corresponding to the evidence item; time bucket identifier is used to indicate the time position of the evidence item in the observed object; hashed evidence object identifier is used to establish index relationship without exposing the original evidence object identifier; feature category identifier is used to indicate which type of feature the evidence item belongs to in community relationship, rhetoric advancement or platform behavior; interpretation score is used to indicate the degree of contribution between the evidence item and the risk identification result.

[0114] The evidence object index is used to establish the correspondence between risk identification results and review metadata, and is not used alone to prove behavioral intent, damage results, or attribution.

[0115] In this embodiment, the forensic interpretation template for high-risk alerts is shown in Table 2: Table 2. Evidence Explanation Template for High-Risk Alerts S7 associates and stores the results of online fraud risk identification with the evidence object index, generating digital evidence collection and diversion data.

[0116] S71, Associated Storage of Risk Identification Results and Evidence Object Index: The system associates and stores risk category, risk value, evidence object index, model version identifier, threshold configuration parameters and interpretation snapshot timestamp to generate digital evidence triage data.

[0117] The snapshot timestamp is the system time when the system generates the evidence object index and stores it in association with the network fraud risk identification result; the snapshot timestamp is used to mark the generation time of the interpretation result and the diversion data record, but is not used to indicate the time of occurrence of the original evidence event. The time position of the original evidence event in the observed object is indicated by the time bucket identifier.

[0118] Digital forensics triage data consists of data records corresponding to the observed objects, including the observed object identifier, risk category, risk value, evidence object index set, model version identifier, threshold configuration parameters, interpretation snapshot timestamp, and triage status identifier.

[0119] The observed object is identified by the de-identified index field.

[0120] S72, Generate Triage Status Identifier: The triage status identifier is generated based on the risk value, review threshold, and audit retention threshold.

[0121] When the risk value is greater than or equal to the review threshold, the diversion status is generated as "entering review"; when the risk value is less than the review threshold but greater than or equal to the audit retention threshold, the diversion status is generated as "audit retention"; when the risk value is less than the audit retention threshold, the diversion status is generated as "diversion not triggered".

[0122] The review threshold and audit retention threshold are stored as threshold configuration parameters associated with the digital forensics diversion data.

[0123] S73, Generate Review Queue Items and Audit Logs: The system reads the network fraud risk identification results, evidence object index, model version identifier, threshold configuration parameters, interpretation snapshot timestamp, and diversion status identifier to generate review queue items corresponding to the observed objects.

[0124] The review queue item includes the observation object identifier, risk category, risk value, evidence object index set, and diversion status identifier.

[0125] The system sorts the review queue items based on risk value, diversion status identifier, and interpretation score in the evidence object index, and writes the sorting results into the review queue.

[0126] The system generates audit logs simultaneously when generating review queue items. The audit logs include observation object identifiers, model version identifiers, threshold configuration parameters, explanation snapshot timestamps, evidence object index sets, diversion status identifiers, and queue sorting results.

[0127] Audit logs are stored in association with review queue items to record the data processing relationships between network fraud risk identification results, evidence object indexes, and digital forensics diversion data.

[0128] In this embodiment, the audit content for quality control of evidence collection and triage is shown in Table 3: Table 3. Quality Control Audit of Evidence Collection and Triage The network fraud risk identification results, evidence object index, and digital forensics diversion data generated by this invention are used for data organization in review, auditing, and source stratification assessment. The method steps of this invention do not include automatic penalties, automatic account blocking, conviction determination, or identity attribution determination.

[0129] Example 2, refer to Figure 1 - Figure 2 This is the second embodiment of the present invention, which differs from the first embodiment in that it further defines the model training input processing, grouping, and experimental verification methods.

[0130] Reference Figure 2 , Figure 2 A flowchart outlining the dataset construction, source composition, and governance process. When generating a model for performing online fraud risk identification, the system performs the following steps: S201, exclude record identifiers, scene identifiers, template family identifiers, source narrative identifiers, CSP grouping identifiers, source type identifiers, and evidence hash keys from the training input. Excluded fields will not be used as training input for community relationship evidence data, rhetoric progression evidence data, or platform behavior evidence data.

[0131] S202 specifies that excluded fields will be retained for segmentation, auditing, source stratification assessment, or review. Record identifiers are used to locate training records, scenario identifiers are used to distinguish scenario sources, template family identifiers are used to distinguish speech or behavior template sources, source narrative identifiers are used to distinguish source narratives, CSP grouping identifiers are used for grouping, source type identifiers are used for source stratification assessment, and evidence hash keys are used for de-identification indexing or auditing location.

[0132] Evidence hash keys are not used as input to the risk identification model; when review or audit is required, evidence hash keys are used as de-identified index fields to locate records.

[0133] S203 divides data into groups based on scene identifiers, template family identifiers, source narrative identifiers, and CSP grouping identifiers, so that records in the same group do not enter the training set, validation set, and test set at the same time.

[0134] During the training process, the system uses de-identified community relationship evidence data, conversation progression evidence data, and platform behavior evidence data, but does not use the aforementioned excluded fields to train the risk identification model.

[0135] In this embodiment, the dataset composition and leak detection partitioning are shown in Table 4: Table 4. Composition and Leak Lockout Division of CSP-FraudBench In this embodiment, the data governance, leakage control, and validity protocols are shown in Table 5: Table 5. Data Governance, Leakage Control, and Effectiveness Protocols In one implementation of this embodiment, the model implementation and evaluation settings are shown in Table 6: Table 6. Implementation and Evaluation Settings In other implementations, encoder parameters, projection dimensions, and training parameters can be adaptively adjusted based on data size, number of risk categories, and deployment environment.

[0136] In one implementation of this embodiment, the model training uses a class-weighted cross-entropy loss function: in, This represents the loss function value during model training. This represents the total number of training samples in a single training batch. Indicates the total number of risk categories; Indicates the first Category weight coefficients corresponding to risk categories; Indicates the first The true class labels of each training sample; Indicates the indicator function, when the first... The true class label of the training sample is equal to the first training sample. The value is 1 if it falls under the risk category, and 0 otherwise. The model will represent the first The predicted value of the training sample is the _th ... The probability value of a risk category.

[0137] In the verification process of this embodiment, the performance was strictly grouped and reserved as shown in Table 7: Table 7. Comparative performance in rigorous grouping tests The values ​​are the mean ± standard deviation over five random seeds; PR-AUC is the macro-mean of the pair of the remainder.

[0138] In the verification process of this embodiment, the source drift and leakage checks are shown in Table 8: Table 8. Source Stratification Validation and Simulation Validity Check During the verification process of this embodiment, the ablation and regular feature sensitivity results are shown in Table 9: Table 9. Sensitivity results of ablation and regularity features During the verification process in this embodiment, the category-level performance is shown in Table 10: Table 10. Category-level performance of CSP-FDF In the verification process of this embodiment, after temperature scaling, the expected calibration error is 0.027 and the Brier score is 0.056.

[0139] The calibration data described above is used to illustrate the risk value calibration in this embodiment. The remaining processing procedures are the same as in Embodiment 1.

[0140] Example 3, referring to Figure 1This is the third embodiment of the present invention, which differs from the second embodiment in that it provides a network fraud interpretable detection and digital forensics triage system based on the fusion of community, rhetoric, and platform features.

[0141] The system includes a data acquisition and de-identification module, a ternary evidence construction module, a multimodal coding module, a shared space projection and fusion module, a risk identification module, an evidence index generation module, and a diversion data generation module.

[0142] The data acquisition and de-identification module acquires the network interaction observation objects to be detected, performs de-identification processing on the observation objects, and outputs the de-identified observation objects.

[0143] The three-element evidence construction module receives the de-identified observation objects and generates community relationship evidence data, dialogue advancement evidence data, and platform behavior evidence data.

[0144] The multimodal coding module receives community relationship evidence data, speech promotion evidence data, and platform behavior evidence data, and outputs community evidence representation, speech evidence representation, and platform evidence representation, respectively.

[0145] The shared space projection and fusion module receives community evidence representation, verbal evidence representation, and platform evidence representation, and generates a fused evidence chain representation.

[0146] The risk identification module receives the evidence chain fusion representation and generates a network fraud risk identification result that includes risk category and risk value.

[0147] The evidence index generation module receives the results of network fraud risk identification and the contribution parameters corresponding to the three types of evidence, and generates an evidence object index.

[0148] The data generation module receives the results of network fraud risk identification and the index of evidence objects, and stores the network fraud risk identification results and the index of evidence objects together to generate digital evidence diversion data.

[0149] The remaining processing steps are the same as in Example 1 or Example 2.

[0150] Example 4, refer to Figure 1 This is the fourth embodiment of the present invention, which differs from the third embodiment in that it provides a computer-readable storage medium.

[0151] The computer-readable storage medium stores a computer program that, when executed by a processor, implements the network fraud interpretable detection and digital forensics triage method based on the fusion of community-script-platform features in Embodiment 1 or Embodiment 2.

[0152] Computer-readable storage media include read-only memory, random access memory, flash memory, hard disk, solid-state drive, optical disk, magnetic disk, or other storage media capable of storing computer programs.

[0153] When the processor executes the computer program, it completes the acquisition and de-identification processing of the network interaction observation objects to be detected, the generation of three types of evidence data, the encoding of three types of evidence, the mapping of shared space, the generation of fusion weights, the generation of evidence chain fusion representation, the generation of network fraud risk identification results, the generation of evidence object indexes, and the generation of digital evidence diversion data.

[0154] The remaining processing steps are the same as in Example 1 or Example 2.

[0155] Based on embodiments 1-4, the working principle of this invention is as follows: The system first acquires the network interaction observation object to be detected and performs de-identification processing on the observation object; then, it generates community relationship evidence data, dialogue progression evidence data, and platform behavior evidence data from the same observation object; next, it encodes the three types of evidence data respectively and maps the community evidence representation, dialogue evidence representation, and platform evidence representation to a shared representation space; then, it calculates the fusion weight for the current observation object and generates an evidence chain fusion representation based on the fusion weight; then, it generates a network fraud risk identification result containing risk categories and risk values ​​based on the evidence chain fusion representation; then, it generates an evidence object index based on the risk identification result and the contribution parameters corresponding to the three types of evidence representations; finally, it associates and stores the risk identification result with the evidence object index to generate digital evidence diversion data. Through the above data processing process, community relationship evidence, dialogue progression evidence, and platform behavior evidence form an evidence chain fusion representation in the same observation object, and a traceable data association relationship is formed between the risk identification result and the evidence object index.

[0156] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for interpretable detection and digital forensics triage of online fraud based on the fusion of community, script, and platform features, characterized in that, include: Obtain the network interaction observation objects to be detected, and perform de-identification processing on the observation objects; Generate evidence data on community relationships, rhetoric progression, and platform behavior from the observed subjects; The evidence data of community relationships, the evidence data of communication techniques, and the evidence data of platform behavior are encoded to obtain the community evidence representation, the communication technique evidence representation, and the platform evidence representation. The community evidence representation, the rhetoric evidence representation, and the platform evidence representation are mapped to a shared representation space. Based on the three types of evidence representation, a fusion weight corresponding to the observed object is generated. The three types of evidence representation are fused according to the fusion weight to form an evidence chain fusion representation. Based on the evidence chain fusion representation, a network fraud risk identification result containing risk category and risk value is generated; Based on the results of online fraud risk identification and the contribution parameters corresponding to the three types of evidence, an evidence object index is generated; The results of online fraud risk identification are linked and stored with the evidence object index to generate digital evidence collection and distribution data.

2. The method for interpretable detection and digital forensics triage of online fraud based on the fusion of community-script-platform features as described in claim 1, characterized in that: Community relationship evidence data includes de-identified community interaction graphs. The node attributes of the interaction graphs are generated based on message volume, contact diversity, number of invitations, URL sharing rate, and account age buckets. The edge attributes are generated based on reply relationships, invitation relationships, forwarding relationships, time intervals, and repeated contacts. The graph statistical parameters of the interaction graphs are generated based on graph density, degree centrality, betweenness centrality, clustering coefficient, invitation burstiness, and broker node ratio.

3. The method for interpretable detection and digital forensics triage of online fraud based on the fusion of community-script-platform features as described in claim 1, characterized in that: The evidence data for advancing the conversation includes de-identified dialogue text sequences and stage indicators generated without using final category labels. The stage indicators are generated based on trust building and escalation, emotional dependence, commitment to benefits, urgency, confidentiality requirements, platform switching instructions, risk neutralization statements, and transfer guidance.

4. The method for interpretable detection and digital forensics triage of online fraud based on the fusion of community-script-platform features as described in claim 1, characterized in that: Platform behavior evidence data is generated based on posting frequency, response interval, number of platform switches, number of account migrations, number of redirects, number of channel migrations, abnormal account age, payment prompt frequency, and sudden increases in posting.

5. The method for interpretable detection and digital forensics triage of online fraud based on the fusion of community-script-platform features as described in claim 1, characterized in that: Evidence data on community relationships, communication techniques, and platform behavior is coded separately, including: Graph sampling aggregation coding and graph attention coding are used to process community relationship evidence data; Semantic encoding based on Transformer is used to process phrasing to advance evidence data; Numerical embedding and categorical embedding are used to process platform behavioral evidence data.

6. The method for interpretable detection and digital forensics triage of online fraud based on the fusion of community-script-platform features as described in claim 5, characterized in that: Based on three types of evidence, fusion weights corresponding to the observed objects are generated, including: Calculate attention scores for the three types of evidence representations mapped to the shared representation space; The attention scores are normalized to obtain the fusion weights.

7. The method for interpretable detection and digital forensics triage of online fraud based on the fusion of community-script-platform features as described in claim 1, characterized in that: Evidence object indices are represented as a set of tuples: in, For the identification of the source of evidence, For time bucket identification, For hashing evidence object identifiers, For feature category identification, To explain the score, For the first The number of evidence items corresponding to each observed object.

8. The method for interpretable detection and digital forensics triage of online fraud based on the fusion of community-script-platform features as described in claim 1, characterized in that: When generating a model for performing online fraud risk identification, record identifiers, scenario identifiers, template family identifiers, source narrative identifiers, CSP grouping identifiers, source type identifiers, and evidence hash keys are excluded from the training input. The excluded fields are retained as fields for segmentation, auditing, source stratification assessment, or review.

9. A system for interpretable detection and digital forensics triage of online fraud based on the fusion of community, script, and platform features, characterized in that: include: The data acquisition and de-identification module acquires the network interaction observation objects to be detected and performs de-identification processing on the observation objects; The three-element evidence construction module generates community relationship evidence data, dialogue progression evidence data, and platform behavior evidence data from the observed objects; The multimodal coding module encodes community relationship evidence data, speech progression evidence data, and platform behavior evidence data respectively, resulting in community evidence representation, speech evidence representation, and platform evidence representation; The shared space projection and fusion module maps the three types of evidence representations to the shared representation space, generates fusion weights corresponding to the observed objects based on the three types of evidence representations, and fuses the mapped three types of evidence representations according to the fusion weights to obtain the evidence chain fusion representation; The risk identification module generates network fraud risk identification results containing risk categories and risk values ​​based on the evidence chain fusion representation; The evidence index generation module generates an evidence object index based on the results of online fraud risk identification and the contribution parameters corresponding to the three types of evidence. The diversion data generation module generates a diversion status identifier based on the risk value, evidence object index, and threshold configuration parameters. It then associates and stores the diversion status identifier, the network fraud risk identification result, the evidence object index, the model version identifier, the threshold configuration parameters, and the interpretation snapshot timestamp to generate digital evidence diversion data.

10. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images