A detection method and detection system for GOIP fraud calls

Abstract

The present application discloses a method for detecting GOIP fraud calls based on the global mobile communication system of IP, the method comprising obtaining mobile communication network data and Internet data respectively, using one or any combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes to identify numbers on the mobile communication network data and Internet data respectively, obtain suspected GOIP fraud numbers, analyze the mobile communication network data and / or Internet data of the suspected GOIP fraud numbers, identify suspected GOIP fraud numbers with only mobile communication network data or only Internet data, and determine the remaining suspected GOIP fraud numbers other than the suspected GOIP fraud numbers with only mobile communication network data or only Internet data as GOIP fraud calls. The present application improves the accuracy of GOIP fraud call detection and reduces the misjudgment rate.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular, to a method for detecting GOIP fraudulent calls. Background Art

[0002] The IP-based global mobile communication system GSM (GOIP, GSM Over IP) equipment has been an important means of implementing telecommunications fraud in recent years. The suspects initiate calls to the GOIP equipment through the Internet, and then control the GOIP equipment to connect to the local communication base station to make calls. Although the calls received by the victims are from the local area, the fraudsters who actually talk to them are often hiding overseas.

[0003] A typical GOIP system network structure is as follows: Figure 1 As shown. The GOIP gateway is placed locally. The GOIP gateway provides multiple mobile phone radio frequency and baseband hardware. From the perspective of the mobile communication network, the GOIP gateway is like a number of mobile phone terminals. The GOIP gateway can be connected to the Internet using a common home broadband line or a mobile communication network card (for example, a 4G network card). The GOIP gateway is registered on an IP-based voice VOIP (VoiceOver IP) server on the Internet.

[0004] The suspect uses the dialing software on the phone or computer to dial the real called number. The dialing software uses the SIP protocol to initiate the call, which is routed to the VOIP server. The VOIP server routes the call to the GOIP gateway according to the configuration. The GOIP gateway completes the conversion between the SIP message on the Internet side and the air interface signaling of the mobile network and initiates the call to the mobile network. The call with the called user is realized through the GOIP gateway. From the called user's point of view, the calling number presented to the called user is the number of the SIM card inserted in the GOIP gateway, so that the caller can hide his identity.

[0005] At present, the GOIP gateway has evolved to the separation of machine and card, that is, the RF hardware part of the GOIP gateway (i.e., the cat pool) and the card pool are deployed in different places. As shown in the figure, the cat pool is located on the GOIP gateway body, and the card pool is located outside the GOIP gateway body. The cat pool and the card pool communicate in real time through the Internet. When establishing a call, the cat pool obtains a mobile phone number from the card pool in real time. In this way, even if the public security organs find the den and seize the cat pool, the card pool can escape the crackdown and escape being seized by the public security organs at the same time.

[0006] The existing fraud call detection methods based on GOIP basically use the call records of mobile communications and conduct modeling analysis based on call behavior characteristics. The call behavior characteristics used are mostly call frequency, called party dispersion, caller-called party balance ratio, and common trajectory of the same base station. This method has a certain effect, but because: on the one hand, the criminal suspects consciously resist investigation and will constantly try to change their call behavior, so it is possible to bypass the call feature monitoring model and cause missed detection; on the other hand, the call characteristics of a large number of non-fraud calls such as marketing calls and harassment calls are very similar to the call characteristics used by GOIP devices, and the model is difficult to distinguish, resulting in false detection, which brings a large amount of subsequent manual identification workload. Summary of the invention

[0007] The present invention provides a method for detecting GOIP fraudulent calls, so as to improve the accuracy of detecting GOIP fraudulent calls.

[0008] The detection method of GOIP fraud calls provided by the present invention is implemented as follows:

[0009] A method for detecting fraudulent calls of the Global System for Mobile Communications (GOIP) based on IP, the method comprising:

[0010] Get mobile communication network data and Internet data respectively.

[0011] Using one or any combination of GOIP device feature attributes, GOIP call behavior feature attributes, and call content semantic feature attributes, the mobile communication network data and the Internet data are respectively identified to obtain suspected GOIP fraud numbers.

[0012] Analyze the mobile communication network data and / or Internet data of suspected GOIP fraud numbers, identify suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data, and determine the remaining suspected GOIP fraud numbers except for the suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data as GOIP fraud calls.

[0013] Preferably, the method utilizes one or any combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes to identify numbers of mobile communication network data and Internet data, respectively, and obtain suspected GOIP fraud numbers, including:

[0014] The first model for telephone signaling classification is used to classify mobile communication network data, and the second model for Internet traffic classification is used to classify Internet data to obtain suspected GOIP fraud numbers.

[0015] in,

[0016] The first model and the second model are trained deep learning models.

[0017] Preferably, the classifying of the mobile communication network data using the first model for telephone signaling classification includes:

[0018] Extract at least one of the following features from the mobile communication network data:

[0019] The device fingerprint feature that characterizes the legitimacy of the GOIP device identification information, the signaling call feature that characterizes the attributes of the phone call, the base station location feature, the social feature that characterizes the degree of association between the calling and called numbers, the number feature of the GOIP device, the power on and off feature of the GOIP device, and the terminal matching feature that characterizes the correspondence between the card pool of the GOIP device and the GOIP device identification.

[0020] in,

[0021] The signaling call characteristics include one or any combination of call frequency, calling ratio, called out-of-province ratio, and called number dispersion.

[0022] Base station location features include high-risk base stations and / or base station trajectories,

[0023] Social features include historical communication relationships between calling and called numbers, and / or call balance ratios.

[0024] The number characteristics of GOIP devices include silent cards and / or new network cards,

[0025] The power on / off characteristics include power on / off time, power on / off location, active time, or any combination thereof;

[0026] Discretize the features of each number to form the feature vector of the number;

[0027] Multiple numbers form a feature vector matrix;

[0028] After the feature vector matrix is ​​processed by maximum pooling and flattening, it is input into the first model.

[0029] By processing the input eigenvector matrix through the first model, a first suspected GOIP fraud number is obtained.

[0030] Preferably, the method of using the second model for classifying Internet traffic to classify Internet traffic data includes:

[0031] Extracting at least one of the following features from the Internet traffic data: Internet traffic VoIP features, VoIP call features, and IP features;

[0032] The VoIP call features include one or any combination of the VoIP call source IP address, the VoIP call destination IP address, the number of sessions where the source IP is the called party, the number of sessions where the source IP is the calling party, the number of sessions where the destination IP is the called party, and the number of sessions where the destination IP is the calling party;

[0033] Discretize the features of each number to form the feature vector of the number;

[0034] Multiple numbers form a feature vector matrix;

[0035] After the feature vector matrix is ​​processed by maximum pooling and flattening, it is input into the second model.

[0036] The second suspected GOIP fraud number is obtained by processing the input eigenvector matrix through the second model.

[0037] Preferably, the mobile communication network data and / or Internet data of the suspected GOIP fraud number are analyzed to identify the suspected GOIP fraud number having only mobile communication network data or only Internet data, and the remaining suspected GOIP fraud numbers other than the suspected GOIP fraud numbers having only mobile communication network data or only Internet data are determined as GOIP fraud calls, including:

[0038] Match the call sessions of suspected fraudulent numbers in the mobile communication network data with the call sessions in the Internet data.

[0039] If the call session satisfies at least one of the following conditions, namely, the same time, the same gateway, the same access point location, and the same called number, or any combination thereof, it is determined to be a GOIP fraud number. Otherwise, it is determined to be one-way data, and the suspected GOIP fraud number corresponding to the call session is removed.

[0040] Preferably, the method further comprises,

[0041] Use standard communication protocols to connect to the mobile communication network for signaling and media, and take voice samples of calls initiated by suspected GOIP numbers.

[0042] Perform speech recognition and / or semantic understanding on the sampled speech,

[0043] Determine whether the GOIP fraud number is fraudulent based on the results of voice recognition and / or semantic understanding.

[0044] The method further includes, using the GOIP fraud number as a clue, tracing the data in the mobile communication network data and the Internet traffic data, and locking the target GOIP device.

[0045] The present invention also provides a GOIP fraud call detection system, the system comprising:

[0046] Data collection device, used to collect mobile communication network data and Internet data into the big data analysis platform,

[0047] The big data analysis platform is used to use one or any combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes to identify numbers on mobile communication network data and Internet data, respectively, to obtain suspected GOIP fraud numbers; analyze the mobile communication network data and / or Internet data of the suspected GOIP fraud numbers, identify the suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data, and determine the remaining suspected GOIP fraud numbers except for the suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data as GOIP fraud calls.

[0048] Preferably, the system further comprises:

[0049] The voice sampling device is used to connect the signaling and media with the mobile communication network using the standard communication protocol, and to sample the voice of the call initiated by the suspected GOIP number.

[0050] The recognition device performs speech recognition and / or semantic understanding on the sampled speech, and determines whether the GOIP fraud number is fraudulent based on the speech recognition and / or semantic understanding results;

[0051] and / or

[0052] The data tracing device is used to trace the data in the mobile communication network data and Internet traffic data based on the GOIP fraud number as a clue, and lock the target GOIP device.

[0053] The present invention further provides a big data analysis platform for detecting GOIP fraudulent calls, which is used to utilize one or any combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes to perform number identification on mobile communication network data and Internet data, respectively, to obtain suspected GOIP fraudulent numbers, analyze the mobile communication network data and / or Internet data of the suspected GOIP fraudulent numbers, identify suspected GOIP fraudulent numbers that only have mobile communication network data or only have Internet data, and determine the remaining suspected GOIP fraudulent numbers except for the suspected GOIP fraudulent numbers that only have mobile communication network data or only have Internet data as GOIP fraudulent calls.

[0054] The present application provides a method for detecting GOIP fraud calls, which covers the entire chain of GOIP fraud call management work with a full-process working mechanism of collection, analysis, sampling, content identification, research and judgment, tracing, and disposal, and provides one-stop product services; using one or any combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes, the mobile communication network data and the Internet data are respectively used to identify numbers to obtain suspected GOIP fraud numbers; by analyzing the mobile communication network data and / or Internet data of the suspected GOIP fraud numbers, unilateral data with only mobile communication network data or only Internet data is identified, thereby excluding non-fraud numbers, improving the accuracy of GOIP fraud call detection and reducing the misjudgment rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a schematic diagram of a typical GOIP system networking structure.

[0056] Figure 2 for Figure 2 A flow chart of a method for detecting GOIP fraudulent calls according to an embodiment of the present application.

[0057] Figure 3 A flow chart of the method for detecting GOIP fraud calls in this application.

[0058] Figure 4 A schematic diagram of a deep learning model.

[0059] Figure 5 A schematic diagram of the GOIP fraud call detection system according to an embodiment of the present application.

[0060] Figure 6 A schematic diagram of a big data analysis platform. DETAILED DESCRIPTION

[0061] In order to make the objectives, technical means and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings.

[0062] A GOIP fraud call detection method proposed in the present invention uses the feature latitude of one or any combination of GOIP device feature attributes, GOIP call behavior feature attributes, call content semantic feature attributes, and from three cognitive perspectives of device cognition, scene cognition, and content cognition, based on mobile communication network data and Internet data to extract features and build a multi-dimensional cognitive model. It combines behavioral cross-comparison, voice recognition, semantic classification and other technologies to analyze and detect GOIP fraud numbers and fraud devices, thereby improving the accuracy of identifying GOIP fraud calls and reducing the misjudgment rate.

[0063] See also Figure 2 As shown, Figure 2 This is a flow chart of a method for detecting GOIP fraudulent calls in an embodiment of the present application. The method includes:

[0064] Step 201, respectively obtain mobile communication network data and Internet data,

[0065] Step 202: using one or any combination of GOIP device feature attributes, GOIP call behavior feature attributes, and call content semantic feature attributes, respectively, perform number identification on mobile communication network data and Internet data to obtain suspected GOIP fraud numbers.

[0066] Step 203, analyze the mobile communication network data and / or Internet data of the suspected GOIP fraud numbers, identify the suspected GOIP fraud numbers with only mobile communication network data or only Internet data, and determine the remaining suspected GOIP fraud numbers except the suspected GOIP fraud numbers with only mobile communication network data or only Internet data as GOIP fraud calls.

[0067] This embodiment utilizes GOIP device characteristic attributes and GOIP call behavior characteristic attributes to improve the accuracy of identifying suspected GOIP fraud numbers, and further improves the detection of GOIP fraud numbers by filtering unilateral data.

[0068] To facilitate understanding of the present application, a specific embodiment is provided below for illustration.

[0069] See also Figure 3 As shown, Figure 3 This is a flow chart of the method for detecting GOIP fraudulent calls in this application. Based on mobile communication network data and Internet traffic data, the following processing is performed:

[0070] Step 301: Structural processing is performed on the mobile communication network data and the Internet traffic data, and the processed data is saved to the big data analysis platform.

[0071] The big data analysis platform is an application program that can be stored in the server as a client.

[0072] The mobile communication network data and Internet traffic data are aggregated to the big data analysis platform through the interface between the big data analysis platform and the mobile communication network.

[0073] In order to ensure the smoothness of the data aggregation process and solve the impact of data surges and delay jitter, distributed message middleware technology can be used to convert the data that needs to be stored in the big data analysis platform into a smooth data stream through a subscription-consumption mechanism.

[0074] Specifically, in order to achieve data regularization, a stream computing method is used to consume the original data stream from the distributed message middleware, normalize (structure) the original data stream, and then re-inject it into the distributed message middleware. When the big data analysis platform subscribes to the regularized data stream, the regularized and normalized data stream is consumed into the big data analysis platform.

[0075] Step 302: On the big data analysis platform side, the mobile communication network data is input into the first model for telephone signaling classification, and the Internet traffic data is input into the second model for Internet traffic classification, and they are classified separately to obtain the first GOIP suspected fraud number and the second GOIP suspected fraud number, and the union of the first GOIP suspected fraud number and the second GOIP suspected fraud number is taken as the suspected fraud number.

[0076] The first model and the second model are trained deep learning models, for example, a GoIP number classifier constructed using a neural network (ANN).

[0077] See also Figure 4 As shown, Figure 4 A schematic diagram of a deep learning model.

[0078] The input layer of the model is a matrix of feature vectors; where the feature vector is represented as [x 1 ,x 2 ,…x i ...x n 】 T , i = 1 ~ n, n is the number of features;

[0079] The hidden layer of the model is g(x j )=∑(w ij x i )+b j , where g(x j) represents the jth node in the hidden layer, w ij is the connection weight from the i-th input layer node to the j-th hidden layer node, b j is the bias of the jth hidden layer node, and the hidden layer node output uses the activation function, g'(x i ) = ReLU(g(x i ));

[0080] The output layer of the model is o i =∑(w' i g'(x i ))+b' i , i = 1 ~ k, k is the number of hidden layer nodes, w' i is the connection weight from the i-th hidden layer node to the output layer node, b' iis the bias of the i-th output layer node. The output layer output uses the sigmoid function, and the final output result is the probability value of the number belonging to a suspected fraudulent phone number, p = sigmoid (o i ).

[0081] Use the back propagation algorithm to train the training set data, and finally get w with an error function less than ε ij 、w' i 、b j , b' i , thus obtaining the trained deep learning model.

[0082] For the eigenvector matrix, this is determined as follows:

[0083] For the first model, when training the deep learning model or using the trained deep learning model for classification, at least one of the following features is extracted from the mobile communication network data:

[0084] The device fingerprint feature that characterizes the legitimacy of the GOIP device identification information, the signaling call feature that characterizes the attributes of the phone call, the base station location feature, the social feature that characterizes the degree of association between the calling and called numbers, the number feature of the GOIP device, the power on and off feature of the GOIP device, and the terminal matching feature that characterizes the correspondence between the card pool of the GOIP device and the GOIP device identification.

[0085] in,

[0086] The signaling call characteristics include one or any combination of call frequency, calling ratio, called out-of-province ratio, called number dispersion, etc.

[0087] Base station location features include high-risk base stations and / or base station trajectories, etc.

[0088] Social features include historical communication relationships between calling and called numbers, and / or call balance ratios, etc.

[0089] The number characteristics of GOIP devices include silent cards and / or new network cards, etc.

[0090] The power on / off features include power on / off time, power on / off location, active time, etc., or any combination thereof.

[0091] For the second model, when training the deep learning model or using the trained deep learning model for classification, extracting at least one of the following features from the Internet traffic data: Internet traffic VoIP features, VoIP call features, IP features;

[0092] The VoIP call features include: the source IP address of the VoIP call, the destination IP address of the VoIP call, the number of sessions in which the source IP is the called party within a set time period, the number of sessions in which the source IP is the calling party within a set time period, the number of sessions in which the destination IP is the called party within a set time period, the number of sessions in which the destination IP is the calling party within a set time period, or any combination thereof;

[0093] IP features include overseas IP, etc.

[0094] When extracting features, we combine the actual usage characteristics of the GoIP device and use the features of multiple cards in the same position as constraints for mining when counting call features, social features, number features, power on and off features, and terminal matching features. That is, we consider the common features of the group rather than the unique features of a single number.

[0095] After extracting the features, each number is discretized to form the feature vector of the number; multiple numbers form a feature vector matrix. After the feature vector matrix is ​​processed by maximum pooling and flattening, it is used as the input data of the model input layer.

[0096] Step 303, cross-check the suspected fraud numbers in the mobile communication network data and the Internet traffic data to find out the numbers that are connected to both the mobile communication network and the Internet, and have simultaneous call sessions, homogeneity, same location, and same called party communication behaviors, so as to filter out the suspected fraud numbers with only one-sided data, thereby eliminating interference factors such as marketing calls and harassment calls to the greatest extent.

[0097] In view of the fact that GOIP fraudulent calls occupy both mobile communication network resources and Internet traffic resources, in this step, the call session with the suspected fraudulent number in the mobile communication network data and the call session with the suspected fraudulent number in the Internet traffic data are matched. If the call session satisfies at least one of the following conditions or any combination thereof: the same time (simultaneous), the same gateway (homogeneous), the same access point location (same location), the same called number (same called), then it is determined to be a suspected fraudulent number. Otherwise, it is determined to be one-sided data, that is, the call session is either a call in the mobile communication network or a call in the Internet. For example, a call in the form of WeChat is a call in the Internet.

[0098] Step 304, voice sampling is performed on the calls of the filtered suspected fraudulent numbers, the call content is identified through voice recognition and / or semantic understanding, and the suspected fraudulent numbers are deeply analyzed to determine the fraudulent numbers.

[0099] For example, the sampled voice samples are converted into text, and natural language processing is used to perform content recognition on the text to identify fraud-related keywords, contextual semantics, etc., so as to determine whether the voice sample is fraudulent and further obtain the fraudulent number.

[0100] For another example, voice recognition is performed on the sampled voice sample, and the voice recognition result is compared with the pre-stored fraud-related voice recognition result. If it is consistent with the fraud-related voice recognition result, it is determined to be a fraud number.

[0101] Preferably, by using the calling party's subscription, a voice sample of the call can be obtained.

[0102] Step 305, tracing the source of the determined fraudulent number to lock the target GOIP device.

[0103] Using fraudulent numbers as clues, data tracing is performed in the original mobile communication network data and Internet traffic data to obtain target GOIP device information, including but not limited to device location, equipment installation time, broadband establishment location, broadband establishment person, phone card establishment person, etc., for use in handling and crackdowns.

[0104] See also Figure 5 As shown, Figure 5 This is a schematic diagram of the GOIP fraud call detection system of the present application embodiment. The system includes:

[0105] A data collection device is used to regularize the types, convert the formats, and normalize the values ​​of mobile communication network data and Internet traffic data, and then connect them to a big data analysis platform (such as HDFS). The mobile communication network data can be obtained through, for example, A interface call records and Gm interface call records, and the Internet traffic data can be obtained through, for example, S1-U interface records and fixed network traffic logs;

[0106] It should be understood that the structured processing of type regularization, format conversion, and value normalization can be handled by a big data analysis platform.

[0107] The big data analysis platform is used to model and analyze the mobile communication network data and Internet traffic data imported into the big data analysis platform using the trained deep learning model to obtain suspected GOIP numbers. The big data analysis platform includes functions such as data feature extraction, model construction, and behavioral cross-comparison.

[0108] The voice sampling device is used to connect the signaling and media with the mobile communication network through the standard communication protocol, and to perform voice sampling on the calls initiated by the suspected GOIP number. Preferably, the contract can be signed through the customer service system CRM, and the contract information is stored in the HLR / HSS. In this way, voice sampling can be performed on the calls involving the suspected GOIP number of the contracted user.

[0109] The voice sampling device is a communication call platform that is connected to the mobile communication network, supports 2G, 3G and 4G networks and various network standards such as GSM, CDMA, LTE, etc., and can support the establishment and release of calls.

[0110] The voice sampling device includes functional modules such as signaling access, media access, call recording, and call control.

[0111] in,

[0112] The signaling access module provides a standard control plane signaling interface to enable the voice sampling device to connect to the mobile communication network for establishing and processing control plane signaling;

[0113] The media access module provides a standard user plane interface to connect to the mobile communication network and is used for establishing and forwarding user plane signaling and data packets.

[0114] The call recording module is used to record the call after it is established;

[0115] The call control module is used to execute business logic.

[0116] The recognition device is used to perform content recognition on the voice samples of the suspected GOIP number collected by the voice sampling device to identify the fraudulent voices therein and then make a judgment on the GOIP number.

[0117] The recognition device includes two functional modules: speech recognition and semantic understanding. Speech recognition (ASR) uses deep learning convolutional neural network (CNN) to complete the continuous conversion function from speech to text; semantic understanding uses natural language processing (NLP) to process the converted text, deeply identify fraud-related keywords and contextual semantics, and determine whether the speech sample is fraudulent, so as to further determine the fraudulent GOIP number.

[0118] The data tracing device is used to trace the source of the data in the original mobile communication network data and Internet traffic data using the identified GOIP fraud number as a clue, and obtain the target GOIP equipment information, including the location, equipment identification, installation time, broadband establishment location, broadband establishment person, phone card establishment person and other information for disposal and crackdown.

[0119] See also Figure 6 As shown, Figure 6 A schematic diagram of a big data analysis platform (client). The big data analysis platform includes:

[0120] The data structured processing module is used to perform type regularization, format conversion, and value normalization on the mobile communication network data and the Internet traffic data to obtain structured mobile communication network data and the Internet traffic data.

[0121] A database module, used to store structured mobile communication network data and Internet traffic data;

[0122] The first classifier is used to identify the GOIP number of the mobile communication network data in the database through the telephone signaling classification model to obtain the first GOIP suspected fraud number.

[0123] The second classifier is used to identify the GOIP number of the Internet data through the Internet traffic classification model to obtain the second GOIP suspected fraud number.

[0124] Among them, the union of the first GOIP suspected fraud number and the second GOIP suspected fraud number is the GOIP suspected fraud number;

[0125] The cross-comparison module is used to cross-comparison the suspected GOIP fraud numbers in the mobile communication network data and the Internet traffic data, to find out the numbers that are connected to both the mobile communication network and the Internet, and have one or any combination of simultaneous call session, homogeneity, same location, and same called communication behavior as the unilateral data, and to take the remaining suspected GOIP fraud numbers as GOIP fraud numbers.

[0126] An embodiment of the present invention also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the GOIP fraud call detection method are implemented.

[0127] As for the apparatus / network-side device / storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0128] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0129] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting fraudulent calls based on the Global System for Mobile Communications (GOIP) over IP, characterized in that: The method includes, Get mobile communication network data and Internet data respectively. By using the combination of GOIP device feature attributes, GOIP call behavior feature attributes, and call content semantic feature attributes, we can identify the number of mobile communication network data and Internet data, and obtain suspected GOIP fraud numbers. Analyze the mobile communication network data and / or Internet data of suspected GOIP fraud numbers, identify suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data, and determine the remaining suspected GOIP fraud numbers other than the suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data as GOIP fraud calls; in, The method utilizes the combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes to identify the number of mobile communication network data and Internet data, respectively, and obtains suspected GOIP fraud numbers, including: The first model for telephone signaling classification is used to classify mobile communication network data, and the second model for Internet traffic classification is used to classify Internet data to obtain suspected GOIP fraud numbers. in, The first model and the second model are trained deep learning models; The method of classifying the mobile communication network data by using the first model for telephone signaling classification includes: Extract at least one of the following features from the mobile communication network data: The device fingerprint feature that characterizes the legitimacy of the GOIP device identification information, the signaling call feature that characterizes the attributes of the phone call, the base station location feature, the social feature that characterizes the degree of association between the calling and called numbers, the number feature of the GOIP device, the power on and off feature of the GOIP device, and the terminal matching feature that characterizes the correspondence between the card pool of the GOIP device and the GOIP device identification. in, Signaling call characteristics include call frequency, calling ratio, called out-of-province ratio, called number dispersion, or any combination thereof. Base station location features include high-risk base stations and / or base station trajectories, Social features include historical communication relationships between calling and called numbers, and / or call balance ratios. The number characteristics of GOIP devices include silent cards and / or new network cards, The power on / off characteristics include power on / off time, power on / off location, active time, or any combination thereof; Discretize the features of each number to form the feature vector of the number; Multiple numbers form a feature vector matrix; After the feature vector matrix is ​​processed by maximum pooling and flattening, it is input into the first model. The first model processes the input feature vector matrix to obtain a first suspected GOIP fraud number; The method of using the second model for Internet traffic classification to classify Internet traffic data includes: Extracting at least one of the following features from the Internet traffic data: Internet traffic VoIP features, VoIP call features, and IP features; The VoIP call features include one or any combination of the VoIP call source IP address, the VoIP call destination IP address, the number of sessions where the source IP is the called party, the number of sessions where the source IP is the calling party, the number of sessions where the destination IP is the called party, and the number of sessions where the destination IP is the calling party; Discretize the features of each number to form the feature vector of the number; Multiple numbers form a feature vector matrix; After the feature vector matrix is ​​processed by maximum pooling and flattening, it is input into the second model. The second suspected GOIP fraud number is obtained by processing the input eigenvector matrix through the second model.

2. The detection method according to claim 1, characterized in that The method comprises: analyzing the mobile communication network data and / or Internet data of the suspected GOIP fraud number, identifying the suspected GOIP fraud number having only mobile communication network data or only Internet data, and determining the remaining suspected GOIP fraud numbers other than the suspected GOIP fraud numbers having only mobile communication network data or only Internet data as GOIP fraud calls, including: Match the call sessions of suspected fraudulent numbers in the mobile communication network data with the call sessions in the Internet data. If the call session satisfies at least one of the following conditions, namely, the same time, the same gateway, the same access point location, and the same called number, or any combination thereof, it is determined to be a GOIP fraud number. Otherwise, it is determined to be one-way data, and the suspected GOIP fraud number corresponding to the call session is removed.

3. The detection method according to claim 1 or 2, characterized in that: The method further comprises, Use standard communication protocols to connect to the mobile communication network for signaling and media, and take voice samples of calls initiated by suspected GOIP numbers. Perform speech recognition and / or semantic understanding on the sampled speech, Determine whether the GOIP fraud number is fraudulent based on the results of voice recognition and / or semantic understanding.

4. The detection method according to claim 1 or 2, characterized in that: The method further includes, using the GOIP fraud number as a clue, tracing the data in the mobile communication network data and the Internet traffic data, and locking the target GOIP device.

5. A GOIP fraud call detection system, characterized in that: The system includes, Data collection device, used to collect mobile communication network data and Internet data into the big data analysis platform, A big data analysis platform is used to use a combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes to identify numbers on mobile communication network data and Internet data, respectively, to obtain suspected GOIP fraud numbers; analyze the mobile communication network data and / or Internet data of suspected GOIP fraud numbers, identify suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data, and determine the remaining suspected GOIP fraud numbers other than suspected GOIP fraud numbers that only have mobile communication network data or only have Internet data as GOIP fraud calls; in, The method utilizes the combination of GOIP device characteristic attributes, GOIP call behavior characteristic attributes, and call content semantic characteristic attributes to identify the number of mobile communication network data and Internet data, respectively, and obtains suspected GOIP fraud numbers, including: The first model for telephone signaling classification is used to classify mobile communication network data, and the second model for Internet traffic classification is used to classify Internet data to obtain suspected GOIP fraud numbers. in, The first model and the second model are trained deep learning models; The method of classifying the mobile communication network data by using the first model for telephone signaling classification includes: Extract at least one of the following features from the mobile communication network data: The device fingerprint feature that characterizes the legitimacy of the GOIP device identification information, the signaling call feature that characterizes the attributes of the phone call, the base station location feature, the social feature that characterizes the degree of association between the calling and called numbers, the number feature of the GOIP device, the power on and off feature of the GOIP device, and the terminal matching feature that characterizes the correspondence between the card pool of the GOIP device and the GOIP device identification. in, Signaling call characteristics include call frequency, calling ratio, called out-of-province ratio, called number dispersion, or any combination thereof. Base station location features include high-risk base stations and / or base station trajectories, Social features include historical communication relationships between calling and called numbers, and / or call balance ratios. The number characteristics of GOIP devices include silent cards and / or new network cards, The power on / off characteristics include power on / off time, power on / off location, active time, or any combination thereof; Discretize the features of each number to form the feature vector of the number; Multiple numbers form a feature vector matrix; After the feature vector matrix is ​​processed by maximum pooling and flattening, it is input into the first model. The first model processes the input feature vector matrix to obtain a first suspected GOIP fraud number; The method of using the second model for Internet traffic classification to classify Internet traffic data includes: Extracting at least one of the following features from the Internet traffic data: Internet traffic VoIP features, VoIP call features, and IP features; The VoIP call features include one or any combination of the VoIP call source IP address, the VoIP call destination IP address, the number of sessions where the source IP is the called party, the number of sessions where the source IP is the calling party, the number of sessions where the destination IP is the called party, and the number of sessions where the destination IP is the calling party; Discretize the features of each number to form the feature vector of the number; Multiple numbers form a feature vector matrix; After the feature vector matrix is ​​processed by maximum pooling and flattening, it is input into the second model. The second suspected GOIP fraud number is obtained by processing the input eigenvector matrix through the second model.

6. The detection system according to claim 5, characterized in that: The system also includes, The voice sampling device is used to connect the signaling and media with the mobile communication network using the standard communication protocol, and to sample the voice of the call initiated by the suspected GOIP number. The recognition device performs speech recognition and / or semantic understanding on the sampled speech, and determines whether the GOIP fraud number is fraudulent based on the speech recognition and / or semantic understanding results; and / or The data tracing device is used to trace the data in the mobile communication network data and Internet traffic data based on the GOIP fraud number as a clue, and lock the target GOIP device.

7. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the GOIP fraud call detection method as described in any one of claims 1 to 4.

Images