Telecommunications data processing method, device, electronic device and storage medium

Abstract

The present invention discloses a method, device, electronic device and storage medium for processing telecommunication data, and relates to the field of big data technology, wherein the method comprises: obtaining telecommunication data, wherein the telecommunication data comprises: equipment information and call information; preprocessing the telecommunication data, and generating multidimensional feature data comprising equipment information and call information according to the preprocessed telecommunication data; inputting the multidimensional feature data into a trained evaluation model, and performing risk evaluation on the multidimensional feature data, wherein the evaluation model is trained based on a gradient enhancement algorithm and historical multidimensional feature data; performing a comprehensive evaluation on the telecommunication data according to the risk evaluation result and post-processing rules, so as to confirm whether the telecommunication data has a fraud risk, wherein the post-processing rules are to evaluate the risk based on keywords. Through the present invention, the accuracy and recognition efficiency of telecommunication fraud detection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a method, device, electronic device and storage medium for processing telecommunication data. Background Art

[0002] With the rapid development of the Internet in my country, mobile phones and other communication tools are becoming more and more popular. Almost everyone has a mobile phone, which brings people convenient shopping, social networking, communication, games and other new functions, but also brings frequent fraud incidents. There are many kinds of fraud, the number of victims is increasing, and prevention is difficult. It has become a major problem that endangers customer safety. Customers have suffered personal financial information leakage, and criminal suspects have induced customers to operate transfer transactions and induce customers to transfer their own funds in the end, thus defrauding funds.

[0003] The current fraud detection solutions have the following main difficulties:

[0004] First, the fraudulent methods have evolved from simple text, voice, and links to today's complex voice, text, and other mixed methods. Due to the huge volume of calls, it is difficult for regulatory authorities to monitor and intercept all calls in real time.

[0005] Second, the data categories are unbalanced. There is a large gap between the positive and negative samples obtained. In massive data, the proportion of positive samples often far exceeds that of negative samples.

[0006] Third, telecommunications fraud has fewer behavioral characteristics and little difference in differentiation, which cannot improve the accuracy of the classifier used in detection. In addition, it is also necessary to rely on manual analysis, which further reduces the efficiency of telecommunications fraud identification. Summary of the invention

[0007] In view of this, the present invention provides a telecommunication data processing method, an electronic device and a storage medium to solve at least one of the above-mentioned problems.

[0008] According to a first aspect of the present invention, a method for processing telecommunication data is provided, the method comprising:

[0009] Acquiring telecommunication data, the telecommunication data including: device information and call information;

[0010] Preprocessing the telecommunication data, and generating multi-dimensional feature data including device information and call information according to the preprocessed telecommunication data;

[0011] Inputting the multidimensional feature data into a trained assessment model to perform risk assessment on the multidimensional feature data, wherein the assessment model is trained based on a gradient boosting algorithm and historical multidimensional feature data;

[0012] The telecommunications data is comprehensively evaluated according to the risk assessment results and post-processing rules to confirm whether the telecommunications data has fraud risks, and the post-processing rules are to evaluate risks based on keywords.

[0013] According to a second aspect of the present invention, a telecommunication data processing device is provided, the device comprising:

[0014] A data acquisition unit, used to acquire telecommunication data, wherein the telecommunication data includes: device information and call information;

[0015] A preprocessing unit, used for preprocessing the telecommunication data;

[0016] A multi-dimensional feature data generating unit, used to generate multi-dimensional feature data including device information and call information according to the pre-processed telecommunication data;

[0017] An evaluation unit, configured to input the multidimensional feature data into a trained evaluation model to perform risk evaluation on the multidimensional feature data, wherein the evaluation model is trained based on a gradient boosting algorithm and historical multidimensional feature data;

[0018] The comprehensive evaluation unit is used to perform a comprehensive evaluation on the telecommunication data according to the risk evaluation result and the post-processing rule to confirm whether the telecommunication data has a fraud risk, and the post-processing rule is to evaluate the risk based on keywords.

[0019] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the program.

[0020] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0021] It can be seen from the above technical scheme that multidimensional feature data is generated by preprocessing the acquired telecommunications data, and then the multidimensional feature data is input into the trained evaluation model, and risk assessment is performed on the multidimensional feature data. In combination with the risk assessment results and post-processing rules, a comprehensive assessment is performed on the telecommunications data to confirm whether there is a risk of fraud in the telecommunications data. This technical scheme can accurately reflect the actual situation of telecommunications fraud characteristics based on the multidimensional feature data, and at the same time, a comprehensive assessment is performed on the telecommunications data in combination with the risk assessment results and post-processing rules of the evaluation model, which can improve the accuracy and recognition efficiency of telecommunications fraud detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 is a flowchart of a method for processing telecommunication data according to an embodiment of the present invention;

[0024] Figure 2 is a detailed flow chart of a method for processing telecommunication data according to an embodiment of the present invention;

[0025] Figure 3 is a structural block diagram of a telecommunication data processing device according to an embodiment of the present invention;

[0026] Figure 4 is a structural block diagram of a model training unit according to an embodiment of the present invention;

[0027] Figure 5 It is a schematic block diagram of the system structure of the electronic device 600 according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] In view of the fact that the current telecommunications fraud detection scheme has low accuracy and recognition efficiency, an embodiment of the present invention provides a telecommunications data processing scheme, which can accurately reflect the real situation of telecommunications fraud characteristics from a multi-dimensional perspective, thereby improving the accuracy and recognition efficiency of telecommunications fraud detection. The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0030] Figure 1 is a flowchart of a method for processing telecommunication data according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0031] Step 101, obtaining telecommunication data, the telecommunication data including: device information and call information;

[0032] Step 102, preprocessing the telecommunication data, and generating multi-dimensional feature data including device information and call information according to the preprocessed telecommunication data;

[0033] Step 103, inputting the multidimensional feature data into a trained evaluation model to perform risk evaluation on the multidimensional feature data, wherein the evaluation model is trained based on a gradient enhancement algorithm and historical multidimensional feature data;

[0034] Step 104, comprehensively evaluate the telecommunication data according to the risk assessment results and post-processing rules to confirm whether the telecommunication data has fraud risks. The post-processing rules are to evaluate risks based on keywords (eg, keywords that may have risks in the call content).

[0035] Multidimensional feature data is generated by preprocessing the acquired telecommunications data, and then the multidimensional feature data is input into a trained evaluation model to perform risk assessment on the multidimensional feature data. In combination with the risk assessment results and post-processing rules, a comprehensive assessment is performed on the telecommunications data to confirm whether there is a risk of fraud in the telecommunications data. The embodiment of the present invention can accurately reflect the actual situation of telecommunications fraud characteristics based on the multidimensional feature data, and at the same time, a comprehensive assessment is performed on the telecommunications data in combination with the risk assessment results and post-processing rules of the evaluation model, thereby improving the accuracy and recognition efficiency of telecommunications fraud detection.

[0036] In actual operation, the evaluation model may be an extreme gradient boosting (XGBoost, eXtreme GradientBoosting) model. Specifically, the extreme gradient boosting model may be trained in the following manner: (1) acquiring historical telecommunication data, the historical telecommunication data including historical device information and historical call information; (2) preprocessing the historical telecommunication data to generate historical multidimensional feature data; (3) dividing the historical multidimensional feature data into training data and test data according to a predetermined rule; (4) training the extreme gradient boosting model according to the training data, and performing a model evaluation operation on the trained extreme gradient boosting model according to the test data; (5) determining that the training of the extreme gradient boosting model is completed when the accuracy of the model evaluation operation result reaches a predetermined value.

[0037] In one embodiment, the call information may include: call content. Accordingly, step 102 preprocesses the telecommunication data including: performing speech recognition on the call content, and performing word segmentation on the recognized text based on natural language technology; performing keyword recognition on the word segmented text based on pre-set keywords (i.e., risk-sensitive words, such as subpoena, account abnormality, loan, etc.), and performing sentiment recognition on the word segmented text based on a trained sentiment analysis model.

[0038] The sentiment analysis model here can be trained based on historical telecommunications data, analyzed based on call content, and perform sentiment recognition on call content.

[0039] In a specific implementation, the above call information may include: call attributes, for example, the number of calls within a predetermined time, the called party, the calling party, the call duration, etc.

[0040] The generation of multidimensional feature data in the above step 102 specifically includes: setting multidimensional features and their labels according to device information, call attributes, keyword recognition operation results, and emotion recognition operation results; and then generating multidimensional feature data according to the set multidimensional features and their labels.

[0041] For step 104, a post-processing rule evaluation may be performed on the telecommunication data according to the above keyword recognition operation result; and then a comprehensive evaluation may be performed on the telecommunication data according to the risk evaluation result and the post-processing rule evaluation result.

[0042] In order to better understand the present invention, the following Figure 2 The telecommunication data processing flow shown in FIG. Figure 2 As shown in the figure, the process includes: data collection, data cleaning, building multi-dimensional features, model training, model evaluation, and post-processing rules. The following describes each part separately.

[0043] 1. Data collection.

[0044] The collected data includes: device information, call information, call information including: call time, call type, call content, as well as sensitive dictionaries and disabled dictionaries, etc. These data can come from banks, operators, etc.

[0045] The device information specifically includes: device model, device MAC (local area network address), device number, network type, router MAC, login location, login time, etc.

[0046] Call duration refers to the time between the start and end of the conversation between the suspect and the victim.

[0047] The call type refers to whether the victim is the caller or the called party.

[0048] The content of the call includes: the conversation between the suspect and the victim. The recording file can be converted into a text file through ASR (Automatic Speech Recognition) technology.

[0049] 2. Data cleaning processing (corresponding to the above-mentioned preprocessing).

[0050] The collected data comes from different places and the data quality is uneven. Therefore, it is necessary to process the data. The specific processing process includes the following situations.

[0051] 2.1 Data Transformation or Deletion

[0052] Generally, the obtained information data cannot be directly used and it is necessary to judge whether to transform or eliminate it.

[0053] For example, the device information cannot be directly used and needs to be transformed. Through the device information, characteristic information can be obtained, such as whether the device number is a normal number or an abnormal number; information such as device model, device MAC, network type, and routing MAC can be used to judge whether the calling device is a simulator, malicious IP (address), spam IP (spam address), etc.; the login location and login time can locate the number of regions where the same device appears within the same time period and how many regions have appeared. The call content also cannot be directly used. It is necessary to use natural language processing methods. First, use a word segmentation tool to segment the content, then eliminate the stop words, and finally use the TextRank algorithm to extract keywords.

[0054] The call content needs to be eliminated. Usually, not all call information will be used. After word segmentation, it is necessary to further eliminate the stop words, such as punctuation marks, numbers, letters, "de", "您好" (hello in Chinese) and other information that is useless for analysis.

[0055] 2.2 Data Loss

[0056] For the situation where data may be missing during the acquisition process, special processing is required. For integer types, the average value, median, etc. need to be taken for filling.

[0057] 2.3 Redundant Data

[0058] During the process of training the model, it is necessary to ensure the uniqueness of the data. The method for redundant data is to remove duplicates.

[0059] 3. Construct Multidimensional Features.

[0060] In the embodiments of the present invention, a feature engineering can be constructed based on three major categories of data. The specific feature mapping is shown in Table 1 below:

[0061]

[0062] Table 1

[0063] The construction of the first category of data: Construct features based on device information. The specific features are shown in items 1 - 5 in Table 1:

[0064] label: The label indicates whether it is a telecommunications fraud, with values {0, 1}, where 0 indicates normal and 1 indicates abnormal.

[0065] is_evil_number: whether the call device is abnormal, the value is {0, 1}, 0 means normal, 1 means abnormal.

[0066] is_simulator: Whether the call device is a simulator, the value is {0, 1}, 0 means normal, 1 means abnormal.

[0067] is_evil_ip: malicious IP address of the calling device, with a value of {0, 1}, where 0 indicates normal and 1 indicates abnormal.

[0068] is_spam_ip: Whether the calling device is a spamIP, the value is {0, 1}, 0 means normal, 1 means abnormal.

[0069] number_info: call device number information, such as China Mobile, China Unicom, China Telecom, and Internet number. The value is {China Mobile: 1, China Unicom: 2, China Telecom: 3, Internet number: 4}, which converts the string type into an integer type.

[0070] The second type of data construction is feature construction based on statistical information, see the features of numbers 6 to 14 in Table 1:

[0071] region_count: counts the total number of times the device appears in a region during a call, and takes an integer value.

[0072] region_diff: counts the number of regions the device appears in during a call, and takes an integer value.

[0073] number_count: counts the number of times the call device number appears, and the value is an integer.

[0074] call_count: counts the number of calls within a given time period, and takes an integer value.

[0075] is_called: counts the number of times the user is called, and the value is an integer.

[0076] duration_call_time: counts the total duration of calls within a given time period, in seconds (s).

[0077] duration_call_time_mean: Calculates the mean call duration within a given period of time, in seconds.

[0078] duration_call_time_std: Calculates the standard deviation of call duration within a given period of time, in seconds.

[0079] duration_time: the time period for statistical calls, in seconds.

[0080] The third type of data construction is feature construction based on the call content. After the call content is converted into a text file using ASR technology, the text is processed using natural language technology. The specific steps are as follows:

[0081] Step 1: Assume that x1, x2, x3, …, xn are text sequences converted by ASR technology.

[0082] Step 2: Use the word segmentation tool to obtain the words {x1x2, x3x4, x5, x6x7, …, xn-1xn}.

[0083] Step 3: Use the sorted stop dictionary to filter the word segmentation results and retain the remaining words.

[0084] Step 4: Use the sensitive dictionary to determine whether the text contains sensitive words and keywords, such as subpoena, loan, account anomaly, etc.

[0085] Step 5: After step 4 is completed, use the TextRank algorithm to extract keywords and sensitive values ​​for the remaining words, such as ID card, information, bank, etc.

[0086] Step 6: Determine whether all the acquired conversation data is telecommunications fraud conversation content. Specifically: use the deep learning model BERT to calculate the Embedding (vector) and save the Embedding in the Faiss (a computing library) library. Then, after calculating the conversations in the training set into Embeddings, calculate the similarity through Faiss, and then set a threshold to obtain the number of conversations in each group that are closest to telecommunications fraud, thereby obtaining the value of similarity_sentence_count (number of similar conversations).

[0087] Step 7: Calculate the sentiment polarity of the conversation, use the sentiment analysis model to analyze the content of the fraudulent conversation, and determine whether it is positive or negative. The value of sentiment (sensitive words in the call) is {negative: 0, positive: 1}, and finally accumulate and sum the sentiment polarity.

[0088] Step 8: The keywords obtained in steps 4 and 5 can be encoded using one-hot encoding to obtain relevant word-level features.

[0089] Based on the above description, Table 2 is an example of feature mapping:

[0090]

[0091] Table 2

[0092] 4. Model training.

[0093] XGBoost is a distributed gradient boosting algorithm model. The input data includes multi-dimensional features x i and label y i .

[0094] The objective function obj(θ) is used to measure the effect of parameter θ. The objective function consists of two parts: the training loss function L(θ) and the regularization term Ω(θ), as shown in formulas (1) and (2):

[0095] obj(θ)=L(θ)+Ω(θ) (1)

[0096]

[0097] Where L(θ) represents the training loss function, as shown in formula (2), which measures the prediction ability of the model on the training data, and Ω(θ) represents the regularization term, which controls the complexity of the model and prevents overfitting.

[0098] The mathematical expression of the loss function selected in the embodiment of the present invention is shown in formula (3):

[0099]

[0100] The XGBoost model has a multi-decision tree ensemble. The trees in the XGBoost model are composed of a set of Classification and Regression Trees (CART). The prediction results of multiple trees need to be combined, and the scores on each tree are added together to get the final score. The mathematical expression is shown in the following formula (4):

[0101]

[0102] K represents the number of trees, where F is the set of all CART probabilities, and the optimization objective function is shown in formula (5):

[0103]

[0104] The numerical expression of f is shown in formula (6), ω is the vector of leaf scores, q is the function that assigns each data point to the corresponding leaf, T is the number of leaves, and d represents the feature dimension.

[0105] f t (x) = ω q(x) ,ω∈R T ,q:R d →{1,2,...,T} (6)

[0106] Among them, the regularization function is shown in formula (7), γ is the penalty intensity coefficient, and λ is the weight coefficient of ω. These two parameters can be given according to actual conditions:

[0107]

[0108] Install XGBoost in advance, the training process is as follows:

[0109] Step 1: Import training features and corresponding labels. Generate the dataset format using the DMatrix method provided by XGBoost. There are three main advantages of using DMatrix: 1. Loading data into DMatrix format can be directly received by the model; 2. Thresholds can be set for missing parameters and missing values ​​can be processed; 3. Weights can be set for sample features, and high weights can be set for the three features of device information, sensitive words, and sentiment polarity.

[0110] Step 2: Use XGBoost's train method to train the model, and divide the data samples into training and test sets in an 8:2 ratio. During the training process, you need to enter the set algorithm parameters, such as which booster (model) to use, the maximum number of available threads, the learning rate, the maximum depth of a tree, the maximum incremental step size of each leaf output, the sampling method, the sub-sample ratio of the training instance, and a series of adjustable parameters.

[0111] 5. Model evaluation.

[0112] After training the model, select accuracy as the evaluation index of the model. Specifically, use the XGBoost model predict method to predict the test set, and calculate the accuracy of the obtained results and the annotated labels. Through cross-validation, record the accuracy and corresponding model parameters each time, and constantly adjust the training samples and model parameters to make the accuracy reach the expected value. When the accuracy reaches the expected value, the model at this time is the final model required, and the model result is expressed as P i Indicates that P i ∈{0,1}.

[0113] 6. Post-processing rules.

[0114] The post-processing rules are mainly used in combination with the model to make up for the inaccurate judgment of the model and make judgments in a comprehensive way. Specifically, the post-processing rules use sensitive words (or keywords) to judge the content of the phone call to see if the number of sensitive words in the identified phone call content exceeds 10. If it exceeds 10, then R i =1, otherwise R i = 0. The final post-processing rule is shown in formula (8), where α∈[0,1],

[0115] y i =α*R i +(1-α)*P i (8)

[0116] As can be seen from the above description, the embodiment of the present invention discloses a telecommunications fraud detection solution based on multi-dimensional features. Under the premise of complying with national financial institutions and national telecommunications laws and regulations, protecting personal data privacy from being leaked, and ensuring data information security, relevant features are obtained to establish a multi-dimensional feature telecommunications fraud detection model. The embodiment of the present invention has the following advantages:

[0117] 1. The features cover a wide range. The multi-dimensional features include not only call information, but also device information and call information. Feature extraction is performed from hardware to software, and audio and video recognition technology and natural language processing technology (NLP) are used at the same time.

[0118] 2. Strong computing power, XGBoost training can support parallelism. Before model training, the features are sorted in advance and saved as a block structure. This structure is reused in model iterations, which can greatly reduce the amount of calculation.

[0119] 3. Data security: By training the model based on features, there is no need to save relevant data, so there is no need to worry about customer data leakage, which complies with the requirements of laws and regulations.

[0120] 4. It improves the early warning capability of telecommunications fraud in the financial system, which can effectively prevent customers from being induced to conduct transfer transactions against their true intentions, and can better protect the safety of customers' funds.

[0121] Based on similar inventive concepts, an embodiment of the present invention further provides a telecommunication data processing device, which can preferably be used to implement the process in the above method embodiment.

[0122] Figure 3 is the resulting block diagram of the telecommunications data processing device, such as Figure 3 As shown, the device includes: a data acquisition unit 31, a preprocessing unit 32, a multi-dimensional feature data generation unit 33, an evaluation unit 34 and a comprehensive evaluation unit 35, wherein:

[0123] The data acquisition unit 31 is used to acquire telecommunication data, wherein the telecommunication data includes: device information and call information;

[0124] A preprocessing unit 32, configured to preprocess the telecommunication data;

[0125] A multi-dimensional feature data generating unit 33, configured to generate multi-dimensional feature data including device information and call information according to the pre-processed telecommunication data;

[0126] An evaluation unit 34, configured to input the multidimensional feature data into a trained evaluation model to perform risk evaluation on the multidimensional feature data, wherein the evaluation model is trained based on a gradient enhancement algorithm and historical multidimensional feature data;

[0127] The comprehensive evaluation unit 35 is used to perform a comprehensive evaluation on the telecommunication data according to the risk evaluation result and the post-processing rule to confirm whether the telecommunication data has a fraud risk, and the post-processing rule is to evaluate the risk based on keywords.

[0128] The telecommunication data acquired by the data acquisition unit 31 is pre-processed by the multi-dimensional feature data generation unit 33 to generate multi-dimensional feature data. Subsequently, the evaluation unit 34 inputs the multi-dimensional feature data into the trained evaluation model to perform risk evaluation on the multi-dimensional feature data. The comprehensive evaluation unit 35 performs a comprehensive evaluation on the telecommunication data in combination with the risk assessment results and post-processing rules to confirm whether the telecommunication data has a fraud risk. The embodiment of the present invention can accurately reflect the actual situation of telecommunication fraud characteristics based on the multi-dimensional feature data, and at the same time, comprehensively evaluate the telecommunication data in combination with the risk assessment results and post-processing rules of the evaluation model, thereby improving the accuracy and recognition efficiency of telecommunication fraud detection.

[0129] Preferably, the above evaluation model is an extreme gradient boosting model.

[0130] Specifically, the above device also includes: a model training unit. Figure 4 4 is a structural block diagram of the model training unit, which specifically includes: a historical data acquisition module 41, a historical multi-dimensional feature data generation module 42, a data division module 43 and a training module 44, wherein:

[0131] A historical data acquisition module 41 is used to acquire historical telecommunication data, wherein the historical telecommunication data includes: historical device information and historical call information;

[0132] A historical multi-dimensional feature data generating module 42, configured to generate historical multi-dimensional feature data after pre-processing the historical telecommunication data;

[0133] A data partitioning module 43, used to partition the historical multi-dimensional feature data into training data and test data according to a predetermined rule;

[0134] The training module 44 is used to train the extreme gradient boosting model according to the training data, and perform a model evaluation operation on the trained extreme gradient boosting model according to the test data; in response to the model evaluation operation result that the accuracy reaches a predetermined value, it is determined that the extreme gradient boosting model training is completed.

[0135] In one embodiment, the call information includes: call content. The corresponding pre-processing unit specifically includes: a word segmentation processing module, a keyword recognition module and a sentiment recognition module, wherein:

[0136] A word segmentation processing module, used to perform speech recognition operation on the call content and perform word segmentation processing on the recognized text based on natural language technology;

[0137] A keyword recognition module is used to perform keyword recognition operations on the text after word segmentation processing according to pre-set keywords;

[0138] The emotion recognition module is used to perform emotion recognition operations on the text after the word segmentation processing based on the trained emotion analysis model.

[0139] In actual operation, the above call information also includes: call attributes.

[0140] The multi-dimensional feature data generating unit specifically includes: a feature setting module and a multi-dimensional feature data generating module, wherein:

[0141] A feature setting module is used to set multi-dimensional features and their labels according to device information, call attributes, keyword recognition operation results, and emotion recognition operation results;

[0142] The multidimensional feature data generation module is used to generate multidimensional feature data according to the set multidimensional features and their labels.

[0143] Specifically, the above-mentioned comprehensive evaluation unit specifically includes: a post-processing rule evaluation module and a comprehensive evaluation module, wherein:

[0144] A post-processing rule evaluation module, used for performing post-processing rule evaluation on the telecommunication data according to the keyword recognition operation result;

[0145] The comprehensive evaluation module is used to perform a comprehensive evaluation on the telecommunication data according to the risk evaluation result and the post-processing rule evaluation result.

[0146] The specific execution process of the above-mentioned units and modules can be found in the description of the above-mentioned method embodiment, which will not be repeated here.

[0147] In actual operation, the above-mentioned units and modules may be provided in combination or individually, and the present invention is not limited thereto.

[0148] This embodiment also provides an electronic device, which may be a desktop computer, a tablet computer, a mobile terminal, etc., but this embodiment is not limited thereto. In this embodiment, the electronic device may be implemented with reference to the above method embodiment and the telecommunications data processing device embodiment, the contents of which are incorporated herein, and the repeated parts are not repeated.

[0149] Figure 5 FIG. 6 is a schematic block diagram of a system structure of an electronic device 600 according to an embodiment of the present invention. Figure 5 As shown, the electronic device 600 may include a central processor 100 and a memory 140; the memory 140 is coupled to the central processor 100. It should be noted that this figure is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0150] In one embodiment, the telecommunication data processing function may be integrated into the central processor 100. The central processor 100 may be configured to perform the following control:

[0151] Acquiring telecommunication data, the telecommunication data including: device information and call information;

[0152] Preprocessing the telecommunication data, and generating multi-dimensional feature data including device information and call information according to the preprocessed telecommunication data;

[0153] Inputting the multidimensional feature data into a trained assessment model to perform risk assessment on the multidimensional feature data, wherein the assessment model is trained based on a gradient boosting algorithm and historical multidimensional feature data;

[0154] The telecommunications data is comprehensively evaluated according to the risk assessment results and post-processing rules to confirm whether the telecommunications data has fraud risks, and the post-processing rules are to evaluate risks based on keywords.

[0155] From the above description, it can be seen that the electronic device provided in the embodiment of the present application generates multidimensional feature data by pre-processing the acquired telecommunications data, and then inputs the multidimensional feature data into a trained evaluation model, performs risk assessment on the multidimensional feature data, and comprehensively evaluates the telecommunications data in combination with the risk assessment results and post-processing rules to confirm whether the telecommunications data has a fraud risk. The embodiment of the present invention can accurately reflect the actual situation of the telecommunications fraud characteristics based on the multidimensional feature data, and at the same time comprehensively evaluates the telecommunications data in combination with the risk assessment results and post-processing rules of the evaluation model, which can improve the accuracy and recognition efficiency of telecommunications fraud detection.

[0156] In another embodiment, the telecommunication data processing device may be configured separately from the central processor 100. For example, the telecommunication data processing device may be configured as a chip connected to the central processor 100, and the telecommunication data processing function is implemented under the control of the central processor.

[0157] like Figure 5As shown, the electronic device 600 may further include: a communication module 110, an input unit 120, an audio processing unit 130, a display 160, and a power supply 170. It is worth noting that the electronic device 600 does not necessarily have to include Figure 5 In addition, the electronic device 600 may also include Figure 5 For components not shown, reference may be made to the prior art.

[0158] like Figure 5 As shown, the central processor 100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor devices and / or logic devices. The central processor 100 receives inputs and controls the operations of various components of the electronic device 600.

[0159] The memory 140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 100 may execute the program stored in the memory 140 to implement information storage or processing.

[0160] The input unit 120 provides input to the CPU 100. The input unit 120 is, for example, a key or a touch input device. The power supply 170 is used to provide power to the electronic device 600. The display 160 is used to display display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0161] The memory 140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 140 may also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application / function storage unit 142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 600 through the central processor 100.

[0162] The memory 140 may also include a data storage unit 143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 144 of the memory 140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0163] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via an antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processor 100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0164] Based on different communication technologies, multiple communication modules 110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module (transmitter / receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide an audio output via the speaker 131 and receive an audio input from the microphone 132, thereby realizing a common telecommunication function. The audio processor 130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 130 is also coupled to the central processor 100, so that the sound can be recorded on the local machine through the microphone 132, and the sound stored on the local machine can be played through the speaker 131.

[0165] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above telecommunication data processing method are implemented.

[0166] To sum up, the embodiment of the present invention adopts a multi-dimensional feature training model, which, in addition to the features such as the number of calls, duration, and geographical distribution, also adds features such as device information and call content for expansion. Starting from a multi-dimensional perspective, it can more accurately reflect the actual situation of telecommunications fraud characteristics, and has stronger generalization ability, thereby improving the accuracy and recognition efficiency of telecommunications fraud detection.

[0167] The preferred embodiments of the present invention are described above with reference to the accompanying drawings. Many features and advantages of these embodiments are clear from this detailed description, and therefore the claims are intended to cover all such features and advantages of these embodiments that fall within their true spirit and scope. In addition, since many modifications and changes are easily conceivable to those skilled in the art, it is not intended to limit the embodiments of the present invention to the precise structure and operation illustrated and described, but all suitable modifications and equivalents falling within its scope may be covered.

[0168] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0172] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for processing telecommunication data, characterized in that: The method comprises: Acquiring telecommunication data, the telecommunication data including: device information and call information; Preprocessing the telecommunication data, and generating multi-dimensional feature data including device information and call information according to the preprocessed telecommunication data; Inputting the multidimensional feature data into a trained assessment model to perform risk assessment on the multidimensional feature data, wherein the assessment model is trained based on a gradient boosting algorithm and historical multidimensional feature data; Comprehensively evaluating the telecommunications data according to the risk assessment results and post-processing rules to confirm whether the telecommunications data has fraud risks, wherein the post-processing rules are to evaluate risks based on keywords; The call information includes call content, and preprocessing the telecommunication data includes: Performing voice recognition on the call content and performing word segmentation on the recognized text based on natural language technology; Performing a keyword recognition operation on the text after word segmentation processing according to preset keywords, and performing a sentiment recognition operation on the text after word segmentation processing based on a trained sentiment analysis model; The call information includes call attributes, and the multi-dimensional feature data including device information and call information generated according to the pre-processed telecommunication data includes: Setting multi-dimensional features and labels thereof according to device information, call attributes, keyword recognition operation results, and emotion recognition operation results, wherein the call attributes include at least one of the following: number of calls within a predetermined time, called party, calling party, and call duration; Generate multidimensional feature data based on the set multidimensional features and their labels.

2. The method according to claim 1, characterized in that The evaluation model is an extreme gradient boosting model, which is trained in the following way: Acquiring historical telecommunication data, the historical telecommunication data including: historical device information and historical call information; Preprocessing the historical telecommunication data to generate historical multi-dimensional feature data; Dividing the historical multidimensional feature data into training data and test data according to a predetermined rule; Training the extreme gradient boosting model according to the training data, and performing a model evaluation operation on the trained extreme gradient boosting model according to the test data; In response to the model evaluation operation result that the accuracy reaches a predetermined value, it is determined that the extreme gradient boosting model training is completed.

3. The method according to claim 1, characterized in that: Comprehensively evaluating the telecommunications data based on the risk assessment results and post-processing rules includes: performing post-processing rule evaluation on the telecommunications data according to the keyword recognition operation result; A comprehensive assessment is performed on the telecommunications data based on the risk assessment results and the post-processing rule assessment results.

4. A telecommunication data processing device, characterized in that: The device comprises: A data acquisition unit, used to acquire telecommunication data, wherein the telecommunication data includes: device information and call information; A preprocessing unit, used for preprocessing the telecommunication data; A multi-dimensional feature data generating unit, used to generate multi-dimensional feature data including device information and call information according to the pre-processed telecommunication data; An evaluation unit, configured to input the multidimensional feature data into a trained evaluation model to perform risk evaluation on the multidimensional feature data, wherein the evaluation model is trained based on a gradient boosting algorithm and historical multidimensional feature data; A comprehensive evaluation unit, configured to comprehensively evaluate the telecommunication data according to a risk evaluation result and a post-processing rule to confirm whether the telecommunication data has a fraud risk, wherein the post-processing rule is to evaluate the risk based on keywords; The call information includes: call content, and the pre-processing unit includes: A word segmentation processing module, used to perform speech recognition operation on the call content and perform word segmentation processing on the recognized text based on natural language technology; A keyword recognition module is used to perform keyword recognition operations on the text after word segmentation processing according to pre-set keywords; An emotion recognition module, used for performing emotion recognition operation on the text after the word segmentation processing based on the trained emotion analysis model; The call information also includes: call attributes, and the multi-dimensional feature data generating unit includes: A feature setting module is used to set multi-dimensional features and their labels according to device information, call attributes, keyword recognition operation results, and emotion recognition operation results; The multidimensional feature data generation module is used to generate multidimensional feature data according to the set multidimensional features and their labels, and the call attributes include at least one of the following: the number of calls within a predetermined time, the called party, the calling party, and the call duration.

5. The device according to claim 4, characterized in that The evaluation model is an extreme gradient boosting model, and the device comprises: a model training unit, The model training unit comprises: A historical data acquisition module, used to acquire historical telecommunication data, the historical telecommunication data including: historical device information and historical call information; A historical multi-dimensional feature data generation module, used to generate historical multi-dimensional feature data after pre-processing the historical telecommunication data; A data partitioning module, used for partitioning the historical multi-dimensional feature data into training data and test data according to a predetermined rule; A training module is used to train the extreme gradient boosting model according to the training data, and perform a model evaluation operation on the trained extreme gradient boosting model according to the test data; in response to the model evaluation operation result that the accuracy reaches a predetermined value, determine that the extreme gradient boosting model training is completed.

6. The device according to claim 4, characterized in that The comprehensive assessment unit includes: A post-processing rule evaluation module, used for performing post-processing rule evaluation on the telecommunication data according to the keyword recognition operation result; The comprehensive evaluation module is used to perform a comprehensive evaluation on the telecommunication data according to the risk evaluation result and the post-processing rule evaluation result.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 3 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images