A method, system, storage medium and terminal device for detecting network fraud numbers

Abstract

The present application relates to a method for detecting network fraud numbers, the method comprising: firstly designing corresponding features for information fraud behavior and extracting features from user behavior logs to construct an original feature matrix and perform data preprocessing; then, according to the imbalance of the ratio of normal users to risky users in the original feature matrix after data preprocessing, a self-adjusting oversampling algorithm is used to oversample minority class samples and reconstruct a training set; then, pre-training and feature importance evaluation and feature screening are performed through an XGBoost model; then, the reconstructed feature matrix is ​​trained using XGBoost and LightGBM models; finally, the model performance is improved through the Stacking multi-model fusion method, a two-layer model Logistic is obtained, and a mobile network risk user identification model is completed. The present invention can improve the accuracy and robustness of fraud number identification in network communications, and meet the needs of practical applications.

Description

Technical Field

[0001] The present application relates to the fields of machine learning and network security, and in particular to a method, system, storage medium and terminal device for detecting network fraud numbers. Background Art

[0002] With the continuous development of information technology and communication technology, network risk behaviors such as information and communication fraud are becoming more and more frequent, and the technology is becoming more and more advanced and diverse, seriously affecting people's lives and work. Using big data and artificial intelligence to identify fraudulent numbers is an important direction for improving the technical capabilities of preventing and combating communication fraud.

[0003] At present, the detection of fraudulent numbers is usually based on specific constraints or the use of random forest algorithms. However, rule-based detection methods are not conducive to the ever-changing fraudulent behaviors, and are based on artificially designed specific rules, which are not flexible enough and have limited effects. The random forest algorithm has low prediction accuracy, so the detection rate of fraud risk users is also relatively low. Summary of the invention

[0004] Based on this, it is necessary to provide a network fraud number detection method, system, storage medium and terminal device that can improve the accuracy and robustness of fraud number identification in network communications in response to the above technical problems.

[0005] An embodiment of the present invention provides a method for detecting a network fraud number, the method comprising the following steps:

[0006] Oversampling of minority class samples is performed through a self-adjusting oversampling algorithm, and the oversampling matrix obtained by oversampling is fused with the feature engineering matrix to obtain a training feature matrix;

[0007] The XGBoost model and the LightGBM model are trained respectively by using the training feature matrix;

[0008] The prediction results of the XGBoost model and the LightGBM model are fused by stacking to obtain a Logistic model;

[0009] The network risk users in the communication process are identified through the Logistic model.

[0010] Furthermore, the method for obtaining the feature engineering matrix includes:

[0011] Extract features from the original data of communication network users in the actual data set, and construct an original feature matrix based on the extracted feature data;

[0012] Perform feature engineering processing on the original feature matrix to obtain a feature engineering matrix.

[0013] Furthermore, the method of extracting features from the original data of the communication network users in the actual data set and constructing an original feature matrix according to the extracted feature data includes:

[0014] Extract features from call logs, SMS logs and network raw logs of communication network users;

[0015] The extracted feature information of the call log, the SMS log and the original network log is combined with the basic user data to obtain an original feature matrix.

[0016] Furthermore, the method of performing feature engineering processing on the original feature matrix to obtain a feature engineering matrix includes:

[0017] Counting the feature dimension information of the normal user group and the fraud user group in the original feature matrix;

[0018] Use visualization tools to obtain multiple features where the differences between normal user groups and fraudulent user groups are greater than the target value;

[0019] Calculate the variance of each feature dimension in the original feature matrix, extract features with variance greater than the threshold according to the variance selection method, and delete features with differences between normal users and fraudulent user groups less than the target value, thus obtaining a feature engineering matrix.

[0020] Furthermore, the method of oversampling the minority class samples by using a self-adjusting oversampling algorithm and fusing the oversampling matrix obtained by oversampling with the feature engineering matrix to obtain a training feature matrix includes:

[0021] Calculate the K nearest neighbor samples of each minority class sample according to the distance metric; where K is the number of calculated nearest neighbor samples;

[0022] Calculate the similarity coefficient C of each minority class sample's K nearest neighbor samples according to the similarity coefficient model, and select minority class samples with C>C_method as sampling minority samples; where C_method is the similarity coefficient threshold;

[0023] The sampled minority samples and their corresponding neighboring minority class samples are used to generate an oversampled data set through a random sample generation model. The oversampled data set is combined with the classifier model using an "embedding method" to perform sample screening to obtain a matching minority class oversampling matrix, which is then fused with the feature engineering matrix to obtain a training feature matrix.

[0024] Furthermore, the method of training the XGBoost model and the LightGBM model respectively by using the training feature matrix includes:

[0025] Divide the data set corresponding to the training feature matrix into a training set and a test set; wherein the training set is training data for model training, and the test set is test data for model testing;

[0026] The training set and the test set are respectively input into the XGBoost model and the LightGBM model for 5-fold cross-validation training, so that the test set covers the entire training set.

[0027] Furthermore, during the cross-validation training process,

[0028] Set hyperparameters: loss function is AUC, evaluation function is fs_score, maximum depth parameter of model decision tree node splitting is 6, learning rate parameter is 0.08, regularization parameter is 2, maximum number of iterations is 10,000, and early stopping is 100;

[0029]

[0030]

[0031]

[0032] Among them, Precision is the precision rate, Recall is the recall rate, TP is the true positive example, FP is the false positive example, k is the threshold, and K is a constant.

[0033] Another embodiment of the present invention proposes a network fraud number detection system, which solves the existing detection of fraud numbers, which is usually based on specific constraints or using a random forest algorithm; however, the rule-based detection method is not conducive to the situation where fraudulent behaviors are varied, and is based on manually designed specific rules, which is not flexible enough and has limited effect; the random forest algorithm has low prediction accuracy, so the detection rate for users with fraud risks is also relatively low.

[0034] The network fraud number detection system according to an embodiment of the present invention includes:

[0035] The sampling module is used to oversample the minority class samples through a self-adjusting oversampling algorithm, and fuse the oversampling matrix obtained by oversampling with the feature engineering matrix to obtain a training feature matrix;

[0036] A training module, used to train the XGBoost model and the LightGBM model respectively through the training feature matrix;

[0037] A fusion module is used to fuse the prediction results of the XGBoost model and the LightGBM model by stacking to obtain a Logistic model;

[0038] The identification module is used to identify network risk users in the communication process through the Logistic model.

[0039] Another embodiment of the present invention further proposes a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the above-mentioned network fraud number detection method.

[0040] Another embodiment of the present invention further proposes a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the above-mentioned network fraud number detection method when executing the computer program.

[0041] The above-mentioned network fraud number detection method performs oversampling of minority class samples through a self-adjusting oversampling algorithm, and obtains a training feature matrix after fusing the oversampling matrix obtained by oversampling with the feature engineering matrix; the XGBoost model and the LightGBM model are trained respectively through the training feature matrix; the prediction results of the XGBoost model and the LightGBM model are fused by stacking to obtain a Logistic model; and the network risk users in the communication process are identified through the Logistic model. Compared with the prior art, the present invention can improve the accuracy and robustness of fraud number identification in network communication, and meet the actual application needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a flow chart of a method for detecting online fraud numbers provided by an embodiment of the present invention;

[0043] Figure 2 The data stream of the network fraud number detection method provided by the embodiment of the present invention;

[0044] Figure 3 for Figure 1 Specific flow diagram of step S11;

[0045] Figure 4 for Figure 1 Specific flow diagram of step S12;

[0046] Figure 5 for Figure 1 Schematic diagram of model fusion in step S13;

[0047] Figure 6 A structural block diagram of a network fraud number detection system provided by an embodiment of the present invention;

[0048] Figure 7 A structural diagram of a terminal device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this technical field without creative work are within the scope of protection of the present invention.

[0050] It should be noted that the step numbers in the text are only for the convenience of explaining the specific embodiment and do not limit the order of execution of the steps. The method provided in this embodiment can be executed by a related server, and the following description will be given by taking the server as the execution subject as an example.

[0051] like Figures 1 to 5 As shown, the network fraud number detection method provided by the embodiment of the present invention includes steps S11 to S14:

[0052] Step S11, oversampling the minority class samples by using a self-adjusting oversampling algorithm, and fusing the oversampling matrix obtained by oversampling with the feature engineering matrix to obtain a training feature matrix.

[0053] The method for obtaining the feature engineering matrix includes: extracting features from original data of communication network users in an actual data set, and constructing an original feature matrix based on the extracted feature data; and performing feature engineering processing on the original feature matrix to obtain a feature engineering matrix.

[0054] Specifically, before extracting the original features of the communication information of the communication network users in the actual data set, the basic attributes, calls, text messages and network behaviors of the communication network users are mainly considered. Among them, the call / text message features include: the number of calls per user per month, the average call duration, the call frequency, the ratio of outgoing and incoming calls, the distribution of communication time periods, the length of the opposite number, the prefix of the opposite number, the number of call objects, etc.; the network features include the user's upstream and downstream traffic, the number of visited websites, the frequency of visiting special websites, the upstream and downstream traffic and the type of visit, etc.

[0055] When extracting original features from the communication information of communication network users in the actual data set, code is written for the call logs, text messages, and network information original logs of communication network users to extract original features through statistical functions, aggregation functions, pivot tables, and other functions, and the feature information extracted from the three log tables is merged according to the user ID, thereby converting the log data into structured data, that is, the numerical feature matrix in the form of "sample-feature" required for model training. In addition, the numerical feature matrix is ​​cleaned by processing outliers (deleting) and filling missing values ​​(mean filling) to obtain the original feature matrix.

[0056] Furthermore, when acquiring the feature engineering matrix, the feature dimension information of the normal user group and the fraudulent user group in the original feature matrix is ​​counted; a plurality of features whose difference between the normal user group and the fraudulent user group is greater than the target value are acquired through visualization tools; the variance of each feature dimension in the original feature matrix is ​​calculated, and features whose variance is greater than a threshold are extracted according to the variance selection method, and features whose difference between the normal user group and the fraudulent user group is less than the target value are deleted, thereby obtaining the feature engineering matrix.

[0057] It is understandable that by statistically analyzing the data of each feature dimension of the normal user group and the fraud user group, and by using visualization tools such as kernel density maps and bar charts for comparative analysis, we can further obtain the features with large differences in the features of the two categories of user groups. On this basis: calculate the variance of each feature dimension in the sample set, extract features with variance greater than the threshold according to the variance selection method; delete features with small differences between normal users and fraud user groups, and obtain the feature engineering matrix after feature engineering processing. Since effective feature screening is performed based on feature variance thresholds, comparison of normal and fraud user features, etc., the feature dimension is reduced and the generalization ability of the model is improved.

[0058] See also Figure 3 , a method for oversampling minority class samples by a self-adjusting oversampling algorithm, and fusing the oversampling matrix obtained by oversampling with the feature engineering matrix to obtain a training feature matrix includes:

[0059] Step S111, calculating the K nearest neighbor samples of each minority class sample according to the distance metric; wherein K is the number of calculated nearest neighbor samples.

[0060] Step S112, calculate the similarity coefficient C of each minority class sample's K nearest neighbor samples according to the similarity coefficient model, and screen out minority class samples with C>C_method as sampling minority samples; wherein C_method is the similarity coefficient threshold, and the nearest neighbor minority class samples are the minority class samples among the K nearest neighbor samples.

[0061] Step S113, the sampled minority samples and their corresponding neighboring minority class samples are subjected to a random sample generation model to obtain an oversampled data set, and the oversampled data set is combined with the classifier model to use the "embedding method" to perform sample screening to obtain a matching minority class oversampled matrix, and then merged with the feature engineering matrix to obtain a training feature matrix.

[0062] Specifically, since the proportion of fraudulent user samples is much smaller than that of normal users in actual situations, sample imbalance will lead to deviations in the content of model training and learning, and the learned rules will focus more on majority class samples, resulting in poor model classification effect. Therefore, the self-adjusting oversampling algorithm (SA-SMOTE, Self Adjust-Synthetic Minority Oversampling Technique) is designed to balance the data, that is, to generate more minority class samples without changing the data distribution, so as to avoid a large difference in the proportion of samples of the two categories. The SA-SMOTE algorithm mainly obtains K neighboring samples of each minority class sample based on the existing minority class samples and the Euclidean distance metric. For all minority class samples, the minority class samples whose similarity coefficient with the target minority class samples is greater than the threshold C are screened out from the K nearest neighbor samples, and then new samples are randomly generated based on the feature distribution of the original minority samples and the similar samples in their K nearest neighbor samples.

[0063] Furthermore, the homogeneous coefficient model is:

[0064]

[0065] Among them, target_class is the minority sample category, class(i) represents the category of sample i, and K is the number of neighboring samples.

[0066] Furthermore, the random sample generation model is:

[0067] x new =x+rand(0,1)*(x n -x)

[0068] x is the original minority class sample feature vector, x n is the feature vector of the nth nearest neighbor sample among the K nearest neighbor samples of the sample, and rand(0,1) is a randomly generated decimal between 0 and 1.

[0069] Furthermore, the sample screening is generated by the "embedding method": the classification algorithm is trained to obtain the prediction evaluation index score before adding the oversampled sample and the algorithm prediction evaluation index score after adding the current oversampled sample. If the addition of the oversampled sample improves the score of the prediction result evaluation index on the validation set, the currently generated oversampled minority class sample is retained, otherwise it is discarded until the ratio of positive and negative samples meets the preset ratio. Among them, in the process of randomly generating minority class samples by the SA-SMOTE algorithm, the number of neighbor samples K and the threshold C_method of the same coefficient of the minority class K neighbor samples are used as hyperparameters, which can be tuned according to the experiment. Since the oversampled data set after oversampling has added minority class samples under the original data distribution, the impact of data imbalance on the accuracy of the training model is alleviated to a certain extent.

[0070] It is understandable that the fraudulent user sample data is enhanced through the self-adjusting oversampling balance algorithm, thereby avoiding a large gap between the proportion of fraudulent users and normal users without changing the data distribution, and improving the learning ability of the model. This algorithm can improve the detection performance of the model in the case of limited training data.

[0071] Step S12, training the XGBoost model and the LightGBM model respectively through the training feature matrix.

[0072] Specifically, the oversampled dataset adds minority class samples to the original data distribution. The added samples and the original samples together constitute a new training dataset, which can alleviate the impact of data imbalance on the accuracy of the training model to a certain extent. Feature screening is performed on the full dataset. Feature screening uses the embedding method, that is, the training feature matrix formed by the full training dataset is put into the XGBoost model and LightGBM model for training.

[0073] See also Figure 4 , the method of training the XGBoost model and the LightGBM model respectively by using the training feature matrix includes:

[0074] Step S121, dividing the data set corresponding to the training feature matrix into a training set and a test set; wherein the training set is training data for model training, and the test set is test data for model testing.

[0075] Step S122, input the training set and the test set into the XGBoost model and the LightGBM model respectively for 5-fold cross-validation training, so that the validation set covers the entire training set.

[0076] Among them, when performing 5-fold cross-validation training for classification tasks, 4 / 5 of the training data is used as the training set and 1 / 5 as the test set. The test set is switched and repeated 5 times so that the test set covers the entire training set.

[0077] Different from the evaluation method in traditional machine learning, in the task of information fraud identification, in addition to the accuracy, we often pay more attention to identifying more fraudulent users with high precision. Precision is the proportion of samples correctly predicted as positive (fraudulent users) by the classifier in a given test data set to all samples predicted as positive. The calculation formula is:

[0078]

[0079] Among them, TP is a true positive (the actual label is positive, and the predicted result is positive), and FP is a false positive (the actual label is negative, and the predicted result is positive). Precision is used to intuitively represent the ability of the classifier to mark positive examples.

[0080] Recall is the ratio of samples with positive labels in a given test data set that are predicted to be positive. The calculation formula is:

[0081]

[0082] Among them, FN is the false negative class (the actual label is the positive class, and the predicted result is the negative class).

[0083] Therefore, the XGBoost model is improved accordingly, and the training logic is modified. Its evaluation function fs_score is the recall score of the model when the precision exceeds the threshold. Its calculation formula is:

[0084]

[0085] Among them, Precision is the precision rate, Recall is the recall rate, k is the threshold, and K is a constant.

[0086] Furthermore, during the cross-validation training process, the hyperparameters were set: the loss function was AUC, the evaluation function was fs_score, the maximum depth parameter max_depth of the decision tree node splitting in XGBoost was 6, the learning rate parameter eta was 0.08, and the L2 regularization parameter was set to 2.

[0087] Furthermore, during the training process, the maximum number of iterations is set to 10,000 rounds, and the early stopping is set to 100 rounds, that is, if the new training effect in the validation set fs_score score cannot exceed the current optimal score every 100 rounds, the training is stopped to prevent overfitting.

[0088] Furthermore, XGBoost is a tree-like ensemble model. After training, the feature importance is ranked according to the number of times each feature is split at the tree node. Feature selection is performed based on the ranking, thereby reducing the feature dimension and improving the generalization ability of the model.

[0089] It should also be noted that in order to improve the generalization ability and stability of the detection model, the XGBoost model can be pre-trained and feature importance evaluation and feature screening can be performed before collective training of the XGBoost model and the LightGBM model. That is, based on the new training feature matrix obtained by XGBoost model pre-training, feature importance evaluation and feature screening, the XGBoost and LightGBM models are trained again.

[0090] Step S13, the prediction results of the XGBoost model and the LightGBM model are fused by stacking to obtain a Logistic model.

[0091] It can be understood that the model training is based on XGBoost and LightGBM models, and the Stacking method is used for fusion, thereby improving the accuracy and generalization ability of the mobile network fraud user identification method.

[0092] Step S14: identifying network risk users in the communication process through the Logistic model.

[0093] See also Figure 5 The prediction results of the two models are fused through the Stacking method to obtain the final mobile network fraud user prediction model. Stacking is a two-layer model structure, with XGBoost and LightGBM as the first layer and the Logistic model as the second layer. The fusion method is to train the XGBoost and LightGBM models respectively using the 5-fold cross-validation method, and use the prediction values ​​of the two models for the training set and test set samples as the features of the Logistic model for training. Logistic makes the final category prediction based on this.

[0094] It is understandable that the XGBoost algorithm and LightGBM algorithm in machine learning are used to build and train models for telecommunication network user behavior data. Both XGBoost and LightGBM models are forward step-by-step addition integration algorithms based on decision trees, which are composed of multiple decision trees. The subsequent sub-models will be adjusted according to the prediction performance of the previous sub-models, which is often easier to improve the overall performance of the model. In XGBoost, the second-order Taylor expansion is used to describe the target loss function, which is conducive to the approximation of the optimal point of the model and makes the prediction of the model more accurate. In addition, in XGBoost, the leaf node prediction value of the base model is not a simple average of the target value of the samples assigned to the leaf nodes, but is obtained by optimizing the target loss function theoretically. The weight change in the target loss function is actually a negative gradient factor multiplied by a coefficient consisting of the inverse of the second-order gradient plus a constant. That is, the weight change will be optimized along the negative gradient direction, and the optimization amplitude will be dynamically adjusted according to the gradient change amplitude (the second-order gradient describes the gradient change). Therefore, the tree model in XGBoost is easier to obtain the optimal solution, and to a certain extent avoids the "oscillation" phenomenon near the optimal point. Make model predictions more accurate.

[0095] The present invention combines the characteristics of improving the recall rate of fraudulent user identification with high precision in the task of telecommunications fraud identification, optimizes XGBoost and LightGBM, and customizes the evaluation function fs_score to ensure that the ability to identify fraudulent users is improved with high precision.

[0096] The present invention adopts the Stacking model fusion algorithm to fuse the above XGBoost and LightGBM models to obtain a fraud number prediction model with high accuracy and good robustness. Different models will learn different rules and information during data training. Through appropriate model fusion, the final model can integrate the advantages of internal models, thereby improving the accuracy of prediction and robustness, making its performance on new data more stable.

[0097] In classification tasks, sample imbalance can lead to deviations in the content of model training and learning, and the learned rules focus more on majority class samples, resulting in poor model classification results. In the case of limited data, this paper proposes a self-adjusting oversampling balance algorithm to generate appropriate minority class samples without changing the distribution of the original data, thereby improving the model training effect.

[0098] The above-mentioned network fraud number detection method performs oversampling of minority class samples through a self-adjusting oversampling algorithm, and obtains a training feature matrix after fusing the oversampling matrix obtained by oversampling with the feature engineering matrix; the XGBoost model and the LightGBM model are trained respectively through the training feature matrix; the prediction results of the XGBoost model and the LightGBM model are fused by stacking to obtain a Logistic model; and the network risk users in the communication process are identified through the Logistic model. Compared with the prior art, the present invention can improve the accuracy and robustness of fraud number identification in network communication, and meet the actual application needs.

[0099] It should be understood that, although the various steps in the above-mentioned flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flow chart may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0100] like Figure 6 FIG. 1 is a block diagram of a network fraud number detection system provided by the present invention, wherein the system comprises:

[0101] The sampling module 21 is used to oversample the minority class samples by using a self-adjusting oversampling algorithm, and to fuse the oversampling matrix obtained by oversampling with the feature engineering matrix to obtain a training feature matrix.

[0102] The method for obtaining the feature engineering matrix includes:

[0103] Extract features from the original data of communication network users in the actual data set, and construct an original feature matrix based on the extracted feature data;

[0104] Perform feature engineering processing on the original feature matrix to obtain a feature engineering matrix.

[0105] Specifically, feature extraction is performed on the original data of the communication network users in the actual data set, and an original feature matrix is ​​constructed based on the extracted feature data, specifically,

[0106] Extract features from call logs, SMS logs and network raw logs of communication network users;

[0107] The extracted feature information of the call log, the SMS log and the original network log is combined with the basic user data to obtain an original feature matrix.

[0108] Furthermore, the original feature matrix is ​​subjected to feature engineering processing to obtain a feature engineering matrix, specifically,

[0109] Counting the feature dimension information of the normal user group and the fraud user group in the original feature matrix;

[0110] Use visualization tools to obtain multiple features where the differences between normal user groups and fraudulent user groups are greater than the target value;

[0111] Calculate the variance of each feature dimension in the original feature matrix, extract features with variance greater than the threshold according to the variance selection method, and delete features with differences between normal users and fraudulent user groups less than the target value, thus obtaining a feature engineering matrix.

[0112] Furthermore, the sampling module 21 is specifically used to calculate K nearest neighbor samples of each minority class sample according to the distance metric; wherein K is the number of calculated nearest neighbor samples;

[0113] Calculate the similarity coefficient C of each minority class sample's K nearest neighbor samples according to the similarity coefficient model, and select minority class samples with C>C_method as sampling minority samples; where C_method is the similarity coefficient threshold;

[0114] The sampled minority samples and their corresponding neighboring minority class samples, as well as the random samples generated by the random sample generation model, form a sampling matrix, and are fused with the feature engineering matrix to obtain a training feature matrix.

[0115] The training module 22 is used to train the XGBoost model and the LightGBM model respectively through the training feature matrix.

[0116] Specifically, the data set corresponding to the training feature matrix is ​​divided into a training set and a test set; wherein the training set is training data for model training, and the test set is test data for model testing;

[0117] The training set and the test set are respectively input into the XGBoost model and the LightGBM model for 5-fold cross-validation training, so that the test set covers the entire training set.

[0118] Furthermore, during the cross-validation training process,

[0119] Set hyperparameters: loss function is AUC, evaluation function is fs_score, maximum depth parameter of model decision tree node splitting is 6, learning rate parameter is 0.08, regularization parameter is 2, maximum number of iterations is 10,000, and early stopping is 100;

[0120]

[0121]

[0122]

[0123] Among them, Precision is the precision rate, Recall is the recall rate, TP is the true positive example, FP is the false positive example, k is the threshold, and K is a constant.

[0124] The fusion module 23 is used to perform model fusion on the prediction results of the XGBoost model and the LightGBM model by stacking to obtain a Logistic model.

[0125] The identification module 24 is used to identify network risk users in the communication process through the Logistic model.

[0126] The network fraud number detection system provided by the embodiment of the present invention performs oversampling of minority class samples through a self-adjusting oversampling algorithm, and obtains a training feature matrix after fusing the oversampling matrix obtained by oversampling with the feature engineering matrix; the XGBoost model and the LightGBM model are trained respectively through the training feature matrix; the prediction results of the XGBoost model and the LightGBM model are fused through the stacking method to obtain a Logistic model; and the network risk users in the communication process are identified through the Logistic model. Compared with the prior art, the present invention can improve the accuracy and robustness of fraud number identification in network communication, and meet the actual application needs.

[0127] An embodiment of the present invention also provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the above-mentioned network fraud number detection method.

[0128] The embodiment of the present invention also provides a terminal device, see Figure 7As shown, it is a structural block diagram of a preferred embodiment of a terminal device provided by the present invention, wherein the terminal device includes a processor 10, a memory 20, and a computer program stored in the memory 20 and configured to be executed by the processor 10, and the processor 10 implements the above-mentioned network fraud number detection method when executing the computer program.

[0129] Preferably, the computer program can be divided into one or more modules / units (such as computer program 1, computer program 2, ...), and the one or more modules / units are stored in the memory 20 and executed by the processor 10 to complete the present invention. The one or more modules / units can be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

[0130] The processor 10 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor 10 may be any conventional processor. The processor 10 is the control center of the terminal device, and various parts of the terminal device are connected using various interfaces and lines.

[0131] The memory 20 mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc., and the data storage area can store related data, etc. In addition, the memory 20 can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, and a flash card (Flash Card), etc., or the memory 20 can also be other volatile solid-state storage devices.

[0132] It should be noted that the above terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art will understand that Figure 7The structural block diagram is merely an example of a terminal device and does not constitute a limitation on the terminal device. The terminal device may include more or fewer components than shown in the figure, or a combination of certain components, or different components.

[0133] In summary, the network fraud number detection method, system, storage medium and terminal device provided in the embodiments of the present invention perform oversampling of minority class samples through a self-adjusting oversampling algorithm, and fuse the oversampling matrix obtained by oversampling with the feature engineering matrix to obtain a training feature matrix; the XGBoost model and the LightGBM model are trained respectively through the training feature matrix; the prediction results of the XGBoost model and the LightGBM model are fused by stacking to obtain a Logistic model; and the network risk users in the communication process are identified through the Logistic model. Compared with the prior art, the present invention can improve the accuracy and robustness of fraud number identification in network communication, and meet the actual application needs.

[0134] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting online fraud numbers, characterized in that: The method comprises the following steps: The self-adjusting oversampling algorithm is used to oversample the minority class samples, and the oversampling matrix obtained by oversampling is fused with the feature engineering matrix to obtain the training feature matrix; specifically, it includes: Calculate the K nearest neighbor samples of each minority class sample according to the distance metric; where K is the number of calculated nearest neighbor samples; Calculate the similarity coefficient C of each minority class sample's K nearest neighbor samples according to the similarity coefficient model, and select minority class samples with C>C_method as sampling minority samples; where C_method is the similarity coefficient threshold; The sampled minority samples and their corresponding neighboring minority class samples are used to generate an oversampled data set through a random sample generation model. The oversampled data set is combined with the classifier model to use the "embedding method" to screen samples to obtain a matching minority class oversampled matrix, which is then fused with the feature engineering matrix to obtain a training feature matrix. The XGBoost model and the LightGBM model are trained respectively by using the training feature matrix; The prediction results of the XGBoost model and the LightGBM model are fused by stacking to obtain a Logistic model; The network risk users in the communication process are identified through the Logistic model.

2. The method for detecting network fraud numbers according to claim 1, characterized in that: The method for obtaining the feature engineering matrix includes: Extract features from the original data of communication network users in the actual data set, and construct an original feature matrix based on the extracted feature data; Perform feature engineering processing on the original feature matrix to obtain a feature engineering matrix.

3. The method for detecting network fraud numbers according to claim 2, characterized in that: The method of extracting features from the original data of the communication network users in the actual data set and constructing the original feature matrix according to the extracted feature data includes: Extract features from call logs, SMS logs and network raw logs of communication network users; The extracted feature information of the call log, the SMS log and the original network log is combined with the basic user data to obtain an original feature matrix.

4. The method for detecting network fraud numbers according to claim 2, characterized in that: The method of performing feature engineering processing on the original feature matrix to obtain a feature engineering matrix includes: Counting the feature dimension information of the normal user group and the fraud user group in the original feature matrix; Use visualization tools to obtain multiple features where the differences between normal user groups and fraudulent user groups are greater than the target value; Calculate the variance of each feature dimension in the original feature matrix, extract features with variance greater than the threshold according to the variance selection method, and delete features with differences between normal users and fraudulent user groups less than the target value, thus obtaining a feature engineering matrix.

5. The method for detecting network fraud numbers according to claim 1, characterized in that: The method of training the XGBoost model and the LightGBM model respectively by using the training feature matrix includes: Divide the data set corresponding to the training feature matrix into a training set and a test set; wherein the training set is training data for model training, and the test set is test data for model testing; The training set and the test set are respectively input into the XGBoost model and the LightGBM model for 5-fold cross-validation training, so that the test set covers the entire training set.

6. The method for detecting network fraud numbers according to claim 5, characterized in that: During the cross-validation training process, Set hyperparameters: loss function is AUC, evaluation function is fs_score, maximum depth parameter of model decision tree node splitting is 6, learning rate parameter is 0.08, regularization parameter is 2, maximum number of iterations is 10,000, and early stopping is 100; Among them, Precision is the precision rate, Recall is the recall rate, TP is the true positive example, FP is the false positive example, k is the threshold, and K is a constant.

7. A network fraud number detection system, characterized in that: The system comprises: The sampling module is used to oversample the minority class samples through a self-adjusting oversampling algorithm, and fuse the oversampling matrix obtained by oversampling with the feature engineering matrix to obtain a training feature matrix; specifically, it includes: Calculate the K nearest neighbor samples of each minority class sample according to the distance metric; where K is the number of calculated nearest neighbor samples; Calculate the similarity coefficient C of each minority class sample's K nearest neighbor samples according to the similarity coefficient model, and select minority class samples with C>C_method as sampling minority samples; where C_method is the similarity coefficient threshold; The sampled minority samples and their corresponding neighboring minority class samples are used to generate an oversampled data set through a random sample generation model. The oversampled data set is combined with the classifier model to use the "embedding method" to screen samples to obtain a matching minority class oversampled matrix, which is then fused with the feature engineering matrix to obtain a training feature matrix. A training module, used to train the XGBoost model and the LightGBM model respectively through the training feature matrix; A fusion module is used to fuse the prediction results of the XGBoost model and the LightGBM model by stacking to obtain a Logistic model; The identification module is used to identify network risk users in the communication process through the Logistic model.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the network fraud number detection method as described in any one of claims 1 to 6.

9. A terminal device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the network fraud number detection method as described in any one of claims 1 to 6 when executing the computer program.

Images