Fraudulent call identification method and system

Abstract

The application provides a fraud phone identification method and system, to solve the problem of data isolation and low accuracy in the prior art, the method comprises the following steps: each participant node periodically sends the user ID data and label data in the blacklist maintained by itself to the management node; the management node finds out the label data with the same ID, and judges whether there is a label marked as a fraud phone in the label data with the same ID, if there is, it notifies the relevant participant node to update the label corresponding to the ID in the local blacklist to a fraud phone; when each participant node finds a suspected fraud number, it first acquires the ID corresponding to the number, and then uses the acquired ID to query the corresponding label data in the local blacklist to identify whether the number is a fraud phone. The technical scheme provided by the application accurately and efficiently identifies fraud phones, and at the same time realizes data privacy protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, in particular to a fraud call identification method and a fraud call identification system. BACKGROUND

[0002] Telecommunication fraud has attracted more and more attention due to its diversified criminal means, low criminal cost, large number of victims and difficulty in tracking, and has become a serious social problem. This also brings great public opinion pressure to operators. In recent years, operators have been exploring anti-fraud technologies.

[0003] Currently, the fraud call identification method is generally to analyze the behaviors of the number to perform machine learning and modeling analysis, such as modeling and prediction based on the behaviors of the number such as call duration, online duration, number of hang-ups, subscription of package services, and call frequency, and then generating a black and gray list to be submitted to the communication management bureau for record keeping. In the traditional scenario, due to the need for data privacy protection, operators cannot share data with each other, and can only build and predict models by themselves, resulting in high false positive and false negative rates of fraud calls. SUMMARY

[0004] The present application is completed in order to at least partially solve the technical problem that the fraud call identification in the prior art is data isolated and cannot be linked, thereby affecting the identification accuracy.

[0005] According to an aspect of the present application, a fraud call identification method is provided, the method comprising:

[0006] Each participant node periodically sends user identity identifier ID data and label data in the blacklist maintained by itself to the management node, each blacklist includes multiple data, and each data includes ID, phone number, a plurality of attribute information and a label indicating whether it is a fraud call;

[0007] The management node receives the ID data and label data sent by each participant node, finds out the label data with the same ID, and judges whether there is a label indicating a fraud call in the label data with the same ID. If there is, the relevant participant node is notified to update the label corresponding to the ID in the local blacklist to a fraud call;

[0008] When each participant node finds a suspected fraud number, it first acquires the ID corresponding to the number, and then queries the corresponding label data in the local blacklist using the acquired ID to identify whether the number is a fraud call.

[0009] Optionally, before each participant node sends the ID data and label data in the blacklist maintained by itself to the management node, it further comprises:

[0010] The participating nodes periodically aggregate the multiple pieces of data corresponding to the same ID in the blacklists maintained by the participating nodes to obtain local blacklists aggregated in the ID dimension.

[0011] Optionally, the multiple pieces of data corresponding to the same ID are aggregated, and the aggregation specifically includes:

[0012] The attribute information in the multiple pieces of data corresponding to the ID is summed up respectively, and the label values in the multiple pieces of data corresponding to the ID are subjected to an OR operation.

[0013] Optionally, the method further includes:

[0014] The participating nodes respectively calculate hash values h1 of the ID data in the blacklists maintained by the participating nodes, and then send the respective hash values h1 to the management node.

[0015] The management node receives the hash values h1 sent by the participating nodes, and finds the label data with the same ID.

[0016] Optionally, the method further includes:

[0017] The participating nodes jointly negotiate a random number r, and then respectively calculate hash values h2 of the ID data in the blacklists maintained by the participating nodes concatenated with the random number r, and then send the respective hash values h2 to the management node.

[0018] The management node receives the hash values h2 sent by the participating nodes, and finds the label data with the same ID.

[0019] Optionally, the method further includes:

[0020] The participating nodes perform multi-party horizontal federated learning model training using the data in the local blacklists of the participating nodes to obtain an anti-fraud model.

[0021] When the participating nodes discover a suspected fraudulent number, if the number is identified as a non-fraudulent call according to the local blacklist of the participating nodes, the participating nodes input the attribute information corresponding to the number into the anti-fraud model, and determine whether the output result of the model is a fraudulent call, and if so, update the label in the local blacklist corresponding to the number to a fraudulent call.

[0022] Optionally, before the participating nodes obtain the anti-fraud model, the method further includes:

[0023] If the management node determines that there is no label indicating a fraudulent call in the label data with the same ID, the participating nodes negotiate public and private keys of a homomorphic encryption algorithm, encrypt the attribute information corresponding to the ID in the blacklists maintained by the participating nodes using the public key, and send the attribute information to the management node.

[0024] The management node receives the encrypted attribute information corresponding to the ID sent by the related participant nodes, and calculates the sum of each item of the encrypted attribute information corresponding to the ID, and then sends the sum to the related participant nodes respectively.

[0025] The related participant nodes receive the sum of each item of the encrypted attribute information corresponding to the ID, decrypt the sum using the private key, divide the sum by the number of the related participant nodes, and obtain the average of each item of the attribute information corresponding to the ID, and update the original attribute information in the local blacklist of each participant node using the average of each item of the attribute information corresponding to the ID.

[0026] Optionally, the method further comprises:

[0027] The participant nodes periodically synchronize the label data of the telephone numbers marked as fraudulent telephone numbers in the local blacklist maintained by each participant node to the management node.

[0028] Optionally, the participant nodes include operators, and the management node includes a communication management bureau.

[0029] According to another aspect of the present application, a fraudulent telephone number identification system is provided, and the system comprises:

[0030] The management node and a plurality of participant nodes;

[0031] Each participant node is configured to periodically send the user identity identification ID data and label data in the local blacklist maintained by each participant node to the management node, each blacklist includes a plurality of data, and each piece of data includes an ID, a telephone number, a plurality of attribute information, and a label indicating whether the telephone number is a fraudulent telephone number;

[0032] The management node is configured to receive the ID data and label data sent by the participant nodes, find the label data with the same ID, and determine whether the label data with the same ID includes a label indicating a fraudulent telephone number, and if so, notify the related participant nodes to update the label corresponding to the ID in the local blacklist of the participant nodes to indicate a fraudulent telephone number;

[0033] Each participant node is further configured to, when a suspected fraudulent telephone number is found, first obtain the ID corresponding to the telephone number, and then query the label data corresponding to the ID in the local blacklist using the obtained ID, to identify whether the telephone number is a fraudulent telephone number.

[0034] The technical solution provided by the present application can include the following beneficial effects:

[0035] The fraud phone identification method and system provided by the application, each participant node sends ID data in the blacklist maintained by each participant node and label data indicating whether the phone is a fraud phone to the management node, the management node performs data fusion and then informs the relevant participant nodes to update the label data in the local blacklist, then each participant node can accurately and efficiently identify the fraud phone according to the recently updated blacklist, the interference caused by multiple numbers for one certificate is eliminated through the foregoing data fusion method, and the management node does not need to obtain the user behavior data of each participant, thereby realizing the data privacy protection between the participants and between the participants and the management node.

[0036] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art upon examination of the following or can be learned by practice of the present application. The objects and other advantages of the present application can be realized and attained by the structure particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0037] The accompanying drawings are included to provide a further understanding of the technical scheme of the present application, and constitute a part of the specification, and are used together with the embodiments of the present application to explain the technical scheme of the present application, and do not constitute a limitation on the technical scheme of the present application.

[0038] Figure 1 A flowchart of a fraud phone identification method provided by an embodiment of the present application;

[0039] Figure 2 A flowchart of another fraud phone identification method provided by an embodiment of the present application;

[0040] Figure 3 A structural diagram of a fraud phone identification system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical scheme and advantages of the embodiments of the present application more clear, the specific embodiments of the present application are described in detail below with reference to the drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0042] Currently, the anti-fraud means of telecom is mainly by each operator or Internet company to analyze the user data of itself to mark the fraud phone. Since each company can only master the user data of its own side, the data volume is insufficient when analyzing, and the false negative and false positive rates of fraud phone identification are high. In view of the technical problems that the current telecom anti-fraud technology is data isolated and cannot be data linked, thereby affecting the identification accuracy, the embodiment of the present application proposes a scheme capable of fusing multi-party data for fraud phone identification, which can also meet the requirements of the state regulatory department on data privacy protection. The following will be described in detail through specific embodiments.

[0043] Figure 1 A flowchart of a fraud phone identification method provided by the embodiment of the present application is shown in FIG. 1. Figure 1 As shown in the figure, the method comprises the following steps S101 to S103.

[0044] S101. Each participant node periodically sends the ID (identity, user identity) data and label data in the blacklist maintained by itself to the management node, each blacklist comprises a plurality of data, and each data comprises ID, phone number, a plurality of attribute information and a label indicating whether it is a fraud phone. The specific value of the sending period can be set and adjusted by the person skilled in the art according to the actual demand.

[0045] In the embodiment, each blacklist data comprises ID (user identity), NUM (phone number), IA, IB, …, IH (a plurality of attribute information related to user behavior, such as call duration, online duration, number of hang-ups, subscription information of package service, frequency of making calls, etc.), and DF (label, used to mark whether it is a fraud phone). Among them, the ID can be an ID card number, or a passport number or other number capable of identifying the user identity, which will be described below by taking the ID card number as an example, but the present application is not limited thereto.

[0046] The format of the blacklist is shown in Table 1 as follows:

[0047] Table 1

[0048]

[0049] For convenience of description, the embodiment takes three participants a, b and c as an example, each participant node maintains a blacklist containing the label data of the fraud phone marked, wherein DF = 1 indicates that the corresponding phone number is a fraud phone, and DF = 0 indicates that the corresponding phone number is not a fraud phone. It can be seen that the blacklist contains not only fraud phones but also non-fraud phones.

[0050] The format of the blacklist maintained by the participant node a is shown in Table 2 as follows:

[0051] Table 2

[0052] ID NUM IA IB … IH DF ID a1 ]]> NUM a1 ]] IA a1 ]] IB a1 ]] … IH a1 ]] 0 ID a2 ]]> NUM a2 ]]> IA a2 ]] IB a2 ]] … IH a2 ]] 1 … ID al ]]> NUM al ]]> IA al ]] IB al ]]> … IH al ]]> 1

[0053] The blacklist format maintained by the participant node b is shown in Table 3 as follows:

[0054] Table 3

[0055]

[0056]

[0057] The blacklist format maintained by the participant node c is shown in Table 4 as follows:

[0058] Table 4

[0059] ID NUM IA IB … IH DF ID c1 ]]> NUM c1 ]]> IA c1 ]]> IB c1 ]]> … IH c1 ]]> 0 ID c2 ]]> NUM c2 ]]> IA c2 ]] IB c2 ]] … IH c2 ]]> 0 … ID cn ]]> NUM cn ]] IA cn ]] IB cn ]]> … IH cn ]] 1

[0060] In addition to the three participants a, b and c providing blacklist data, the present scheme also involves a management party g responsible for coordinating the parties to execute the protocol and aggregate the result data.

[0061] S102. The management party node receives the ID data and label data sent by each participant node, finds out the label data with the same ID, and judges whether there is a label marked as a fraud phone in the label data with the same ID. If there is, the relevant participant node is notified to update the label corresponding to the ID in its local blacklist to a fraud phone.

[0062] Among them, the relevant participant node refers to: for each participant node that sends the same ID data (may be more than one) to the management party node, if there is a label marked as a fraud phone in the label data corresponding to a certain same ID data, then those participant nodes that send the same ID data are the relevant participant nodes.

[0063] S103. When each participant node discovers a suspected fraud number, it first obtains the ID corresponding to the number, and then uses the obtained ID to query the corresponding label data in its local blacklist to identify whether the number is a fraud phone.

[0064] Among them, the participant can be an operator, and the management party can be a communication management bureau.

[0065] Since one ID can register multiple numbers in one or multiple operators, a telecom fraudster can only use one number to make a fraudulent call in the same time period, while other numbers can not have typical telecom fraud characteristics and can be across operators, which can interfere with fraud number identification. Based on this, in the present embodiment, each participant node sends the ID data in the blacklist maintained by itself and the label data indicating whether it is a fraudulent call to the management node, and the management node notifies the relevant participant nodes to update the label data in the local blacklist after data fusion. Then, each participant node can accurately and efficiently identify fraudulent calls according to the recently updated blacklist, and the interference caused by one ID with multiple numbers is eliminated through the foregoing data fusion method, and the management node does not need to obtain the user behavior data of each participant, thereby realizing data privacy protection between each participant and between the participants and the management node.

[0066] In a specific embodiment, before step S101, the following step S104 is further included.

[0067] S104. Each participant node periodically aggregates multiple pieces of data corresponding to the same ID in the blacklist maintained by itself to obtain a local blacklist aggregated in the ID dimension. The specific value of the period can be set and adjusted by a person skilled in the art according to actual needs.

[0068] In the present embodiment, one ID in each blacklist can correspond to multiple NUMs, i.e., multiple pieces of data, so that data preprocessing is required in each participant node to obtain a blacklist aggregated in the ID dimension, which is convenient for subsequent judgment and processing of the management node.

[0069] In a specific embodiment, step S104 aggregates multiple pieces of data corresponding to the same ID, specifically as follows.

[0070] The attribute information in each piece of data corresponding to the ID is summed up respectively, and the label values in the multiple pieces of data corresponding to the ID are operated by OR.

[0071] In the present embodiment, the three participant nodes a, b and c respectively aggregate the blacklist data in the ID dimension. Specifically, if one ID in a certain blacklist corresponds to s pieces of data, the attribute IA, IB, …, IH in the s pieces of data is summed up respectively, and the label values in the s pieces of data are operated by OR to obtain the new attribute value and the label value corresponding to the ID.

[0072] For the ID data sent by each participant node to the management node, in order to prevent the leakage of user ID in the transmission process, the present application adopts a Hash algorithm to ensure the secure transmission of ID data, and one of the following two schemes can be used.

[0073] In an alternative embodiment, before step S101, the method further comprises step S105.

[0074] S105. Each participant node calculates the hash value h1 of each ID data in the blacklist maintained by the participant node.

[0075] Correspondingly, step S101 specifically comprises: each participant node sends the corresponding hash value h1 to the management node; and step S102 specifically comprises: the management node receives the hash values h1 sent by the participant nodes and finds the tag data with the same ID (hash value).

[0076] In this embodiment, the three participant nodes a, b and c calculate the hash value h1 = Hash(ID) of each ID, and then send the hash value to the management node g. After the management node g collects the h1 sent by the three parties, the management node finds the tag data with the same ID, for example, the ID ax of the participant node a, the ID by of the participant node b and the ID cz of the participant node c are the same.

[0077] Since the hash values generated according to different plaintexts can be the same (i.e. hash collision), in order to solve this problem, the present application introduces a random factor to be mixed into the plaintext for hash calculation. Correspondingly, in another alternative embodiment, before step S101, the method further comprises step S106.

[0078] S106. The participant nodes jointly negotiate a random number r, and then calculate the hash value h2 of each ID data in the blacklist maintained by the participant node in cascade with the random number r.

[0079] Correspondingly, step S101 specifically comprises: each participant node sends the corresponding hash value h2 to the management node; and step S102 specifically comprises: the management node receives the hash values h2 sent by the participant nodes and finds the tag data with the same ID (hash value).

[0080] In this embodiment, the three participant nodes a, b and c jointly negotiate a random number r, and then calculate the hash value h2 = Hash(ID | r) of each ID in cascade with the random number r, and then send the hash value to the management node g. After the management node g collects the h2 sent by the three parties, the management node finds the tag data with the same ID. For example, the ID ax of the participant node a, the ID by of the participant node b and the ID cz of the participant node c are the same, and it is necessary to judge DF ax || DF by || DF czwhether is 1, if yes, indicating that DF ax , DF by , and DF cz at least one of is not 0, informs the participant node a to set DF in the xth data in its local blacklist to 1, informs the participant node b to set DF in the yth data in its local blacklist to 1, and informs the participant node c to set DF in the zth data in its local blacklist to 1, so that the participant nodes a, b and c update the local blacklist respectively.

[0081] After each participant node completes the local blacklist update according to the foregoing scheme, in order to further improve the accuracy of the fraud phone identification, the application utilizes the multi-party updated blacklist data to perform the anti-fraud model training based on the federated learning, and after the training is completed, each participant node will obtain a telecom anti-fraud model, and then the anti-fraud model is further utilized to identify whether the suspected fraud number is a fraud phone, and the specific scheme is as follows.

[0082] In a specific embodiment, before step S103, the following step S107 is further included.

[0083] S107. Each participant node uses the data in the respective local blacklist to perform multi-party horizontal federated learning model training to obtain an anti-fraud model.

[0084] Wherein, the horizontal federated learning (Horizontal Federated Learning) is also called homogenous federated learning (Homogenous Federated Learning), which refers to the federated learning in which each participant has the same feature space but different sample spaces. Since the horizontal federated learning algorithm itself is prior art, the specific algorithm of the application will not be described here.

[0085] Correspondingly, in step S103, when each participant node discovers a suspected fraud number, if it is identified as a non-fraud phone according to its local blacklist, then each item of attribute information corresponding to the number is input into the anti-fraud model, and it is judged whether the model output result is a fraud phone, if yes, then the corresponding label in its local blacklist is updated to a fraud phone.

[0086] In this embodiment, when a participant node discovers a suspected fraud number, it first queries the user identity ID w corresponding to the number, and then queries the label data DF corresponding to the ID w in the local blacklist. If DF = 1, it is determined that the number is a fraud phone, and the local blacklist is updated. If DF = 0, each item of attribute information corresponding to the number is input into the anti-fraud model, and it is judged whether the output result is a fraud phone, if yes, the local blacklist is updated.

[0087] In order to improve the accuracy of the output result of the anti-fraud model, the blacklist data maintained by each participant node can be pre-generalized, and then the multi-party horizontal federated learning model training is performed by using the generalized blacklist data of each participant node, so as to obtain a more accurate anti-fraud model.

[0088] After the management node finds the label data with the same ID based on the ID data and label data sent by each participant node, if there is no label marked as a fraudulent call in the label data with the same ID, such as DF ax ||DF by ||DF cz , it is equal to 0, which means that DF ax , DF by and DF cz are all 0, at this time, the relevant participant node does not need to update the local blacklist, but directly executes the following multi-party data generalization scheme.

[0089] In one specific embodiment, before step S107, the following steps S108 to S110 are further included.

[0090] S108. If the management node determines that there is no label marked as a fraudulent call in the label data with the same ID, the relevant participant nodes negotiate the public and private keys of the homomorphic encryption algorithm, respectively encrypt the attribute information corresponding to the ID in the blacklist maintained by each participant node using the public key, and send it to the management node;

[0091] S109. The management node receives the encrypted attribute information corresponding to the ID sent by the relevant participant nodes, and respectively calculates the sum of the encrypted attribute information corresponding to the same ID, and then sends it to the relevant participant nodes;

[0092] S110. The relevant participant nodes receive the sum of the encrypted attribute information corresponding to the same ID, respectively decrypt it using the private key, and then divide it by the number of relevant participant nodes to obtain the average of the attribute information corresponding to the ID, and respectively update the corresponding original attribute information in the local blacklist of each participant node using the average of the attribute information corresponding to the ID.

[0093] Specifically, the participant nodes a, b and c negotiate the public and private keys of the homomorphic encryption algorithm E, and then the participant node a encrypts the attribute information IA ax , IB ax ,..., IH ax in its blacklist using the public key of algorithm E to obtain E(IA ax ), E(IB ax ),..., E(IH ax) and sends to the management node g, the participant node b encrypts the attribute information IA by , IB by ,..., IH by in its blacklist using the public key of algorithm E to obtain E(IA by ), E(IB by ),..., E(IH by ) and sends to the management node g, the participant node c encrypts the attribute information IA cz , IB cz ,..., IH cz in its blacklist using the public key of algorithm E to obtain E(IA cz ), E(IB cz ),..., E(IH cz ) and sends to the management node g. The management node calculates E(IA ax )+E(IA by )+E(IA cz ), E(IB ax )+E(IB by )+E(IB cz ),..., E(IH ax )+E(IH by )+E(IH cz ) and sends to the participant nodes a, b and c respectively. Since algorithm E is an additive homomorphic encryption algorithm, the participant nodes a, b and c can all calculate the average of each attribute information: and update the original attribute information in the local blacklist respectively with the average of each attribute information.

[0094] In the embodiment, to realize data linkage, the problem of data privacy protection must be considered. First, the data privacy protection between the participant nodes which master user data is realized, and the plaintext data cannot be out of network in the process of collaborative analysis. Then, the data privacy protection between the participant nodes and the management node is realized, and the business data of normal users cannot be known by the management department. Therefore, in the present application, each participant node encrypts each attribute information related to user behavior based on the homomorphic encryption algorithm and sends to the management node, and the management node does not need to decrypt the data, but directly sums the data and returns to each participant node, thereby realizing the data privacy protection between each participant node and between the participant node and the management node, and ensuring that the normal business data of users cannot be known by the management department.

[0095] In a specific embodiment, the method further comprises the following step S111.

[0096] S111. Each participant node synchronizes the label data marked as fraudulent phone in the local blacklist maintained by each participant node to the management node periodically.

[0097] In this embodiment, the telecom fraud blacklist data (i.e., the label data corresponding to the ID) analyzed by each participant node should also be submitted to the management department, so as to facilitate the data integration and subsequent application of the management department.

[0098] It should be noted that the order of the above steps is only a specific example proposed for the purpose of describing the embodiments of the present application, and the present application does not limit the order of the above steps. Those skilled in the art can adjust them as needed in actual application; moreover, the sequence number of the above steps does not limit the execution order.

[0099] Figure 2 Another flowchart of the fraud phone identification method provided by the embodiments of the present application is shown in FIG. 2. Figure 2 As shown in FIG. 2, the method comprises the following steps S201 to S213.

[0100] S201. Each operator node periodically aggregates the multiple data corresponding to the same ID in the blacklist maintained by each operator node, to generate the local blacklist aggregated in the ID dimension by each operator node;

[0101] S202. Each operator node negotiates a random number r, and then calculates the hash value h = Hash (ID | r) of each item of ID data concatenated with the random number r in the blacklist maintained by each operator node, and then sends the corresponding hash value h to the management department node periodically;

[0102] S203. The management department node collects the hash values h transmitted by each operator node, and finds out the label data with the same ID;

[0103] S204. The management department node determines whether there is a label marked as fraudulent phone in the label data with the same ID, if there is, step S205 is executed; if not, step S206 is executed;

[0104] S205. The management department node notifies the relevant operator node to update the label corresponding to the ID in the local blacklist to fraudulent phone, and then the relevant operator node updates the local blacklist data after receiving the notification of the management department node;

[0105] S206. The relevant operator node negotiates the public and private keys of the homomorphic encryption algorithm, respectively encrypts each item of attribute information corresponding to the ID in the blacklist maintained by each operator node using the public key, and sends it to the management department node;

[0106] S207. The management department node receives each item of encrypted attribute information corresponding to the ID sent by the relevant operator node, and calculates the sum of each item of encrypted attribute information corresponding to the ID, and then sends the sum to the relevant operator node respectively;

[0107] S208. The relevant operator node receives the sum of each item of encrypted attribute information corresponding to the ID, decrypts the sum using the private key, and then divides the sum by the number of the relevant operator nodes to obtain the average of each item of attribute information corresponding to the ID, and updates the corresponding original attribute information in the local blacklist using the average of each item of attribute information corresponding to the ID respectively;

[0108] S209. Each operator node uses the local blacklist data after data generalization in step S208 and the local blacklist data after updating in step S205 to perform multi-party horizontal federated learning model training to obtain an anti-fraud model;

[0109] S210. When the operator node discovers a suspected fraudulent number, the operator node first obtains the ID corresponding to the number, and then queries the corresponding label data in the local blacklist using the obtained ID to identify whether the number is a fraudulent call. If it is identified that the number is not a fraudulent call, each item of attribute information corresponding to the number is input into the anti-fraud model obtained in step S209;

[0110] S211. The operator node determines whether the output result of the anti-fraud model is a fraudulent call. If yes, step S212 is performed. If no, step S210 is returned;

[0111] S212. The corresponding label in the local blacklist is updated to a fraudulent call;

[0112] S213. Each operator node synchronizes the label data marked as a fraudulent call in the local blacklist maintained by the operator node to the management department node periodically, and the management department node updates the management department blacklist data after receiving the synchronization data from the operator nodes.

[0113] The fraud call identification method provided by the embodiments of the present disclosure converges multi-party data for anti-fraud analysis under the premise of ensuring user behavior data privacy protection, eliminates the interference caused by one certificate and multiple numbers, realizes multi-party identity information-based telecom fraud identification, and has higher accuracy.

[0114] Figure 3 A structure diagram of a fraud call identification system provided by the embodiments of the present disclosure is shown in FIG. 1. Figure 3 As shown in FIG. 1, the system includes a management node 31 and a plurality of participant nodes 32.

[0115] Wherein, each participant node 32 is configured to periodically send the ID (user identity) data and label data in the blacklist maintained by each participant node 32 to the management node 31, each blacklist includes multiple data, and each data includes ID, phone number, attribute information, and label indicating whether it is a fraudulent call;

[0116] The management node 31 is configured to receive the ID data and label data sent by each participant node 32, find out the label data with the same ID, and determine whether there is a label indicating a fraudulent call in the label data with the same ID. If there is, the related participant node 32 is notified to update the label corresponding to the ID in the local blacklist to a fraudulent call.

[0117] Each participant node 32 is also configured to, when a suspected fraudulent number is found, first obtain the ID corresponding to the number, and then use the obtained ID to query the corresponding label data in the local blacklist to identify whether the number is a fraudulent call.

[0118] In a specific embodiment, each participant node 32 is further configured to, before sending the ID data and label data in the blacklist maintained by each participant node 32 to the management node 31, periodically aggregate the multiple data corresponding to the same ID in the local blacklist to obtain the local blacklist after aggregation in the ID dimension.

[0119] In an optional embodiment, each participant node 32 aggregates the multiple data corresponding to the same ID, specifically:

[0120] Each participant node 32 respectively sums each item of attribute information in the multiple data corresponding to the ID, and performs an OR operation on the label values in the multiple data corresponding to the ID.

[0121] In a specific embodiment, each participant node 32 is further configured to calculate the hash value h1 of each ID data in the blacklist maintained by each participant node 32, and then send the corresponding hash value h1 to the management node 31. The management node 31 is specifically configured to receive the hash value h1 sent by each participant node 32, and find out the label data with the same ID.

[0122] In another optional embodiment, each participant node 32 is further configured to jointly negotiate a random number r, and then calculate the hash value h2 of each ID data in the blacklist maintained by each participant node 32 concatenated with the random number r, and then send the corresponding hash value h2 to the management node 31. The management node 31 is specifically configured to receive the hash value h2 sent by each participant node 32, and find out the label data with the same ID.

[0123] In a specific implementation, each participant node 32 is further configured to use the data in the respective local blacklist to perform multi-party horizontal federated learning model training to obtain an anti-fraud model, and when a suspected fraudulent number is found, if the number is identified as a non-fraudulent call according to the local blacklist, input each attribute information corresponding to the number into the anti-fraud model, and determine whether the model output is a fraudulent call, if so, update the corresponding label in the local blacklist to a fraudulent call.

[0124] In a specific implementation, if the management node 31 determines that there is no label indicating a fraudulent call in the label data with the same ID, the relevant participant node 32 is configured to, before obtaining the anti-fraud model, negotiate the public and private keys of the homomorphic encryption algorithm, encrypt each attribute information corresponding to the ID in the respective maintained blacklist using the public key and send it to the management node 31; the management node 31 is further configured to receive each encrypted attribute information corresponding to the ID sent by the relevant participant node 32, and calculate the sum of each same encrypted attribute information corresponding to the ID, and send it to the relevant participant node 32; the relevant participant node 32 is further configured to receive the sum of each same encrypted attribute information corresponding to the ID, decrypt it using the private key and divide it by the number of relevant participant nodes to obtain the average of each attribute information corresponding to the ID, and update each original attribute information in the respective local blacklist using the average of each attribute information corresponding to the ID.

[0125] In a specific implementation, each participant node 32 is further configured to periodically synchronize the label data indicating a fraudulent call in the respective maintained local blacklist to the management node 31.

[0126] In a specific implementation, the participants include operators, and the management includes a communication management bureau.

[0127] The fraud call identification system provided by the embodiments of the present disclosure can converge multi-party data for anti-fraud analysis while ensuring the privacy protection of user behavior data, eliminate the interference caused by one certificate with multiple numbers, and realize multi-participant identity information-based telecom fraud identification with higher accuracy.

[0128] In summary, the fraud call identification method and system provided by the present disclosure proposes a scheme capable of fusing multi-party data for fraud call identification. First, the self-designed data reduction protocol is used to integrate multi-party data while ensuring the privacy protection of user behavior data, so as to eliminate the influence of one certificate with multiple numbers on the analysis results. Then, the federated learning technology is used for telecom anti-fraud model construction and prediction, which can effectively improve the fraud call identification efficiency and accuracy, and also meet the requirements of data privacy protection of the national regulatory authorities.

[0129] Those skilled in the art can understand that all or some of the steps in the method disclosed above, the functions of the modules / units in the system and the device can be implemented as software, firmware, hardware and appropriate combinations thereof. In the hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer readable medium, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is known to those skilled in the art that communication media typically includes computer readable instructions, data structures, program modules or other data in modulated data signals such as carrier waves or other transport mechanisms, and can include any information delivery medium.

[0130] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A fraud call identification method, characterized by, The application comprises the following steps: Each participant node periodically sends user identity ID data and label data in the blacklist maintained by each participant node to the management node, each blacklist comprises multiple data, each data comprises ID, phone number, attribute information and label indicating whether it is a fraudulent call, the ID is an ID number or a passport number, and the attribute information comprises call duration, number of hang-ups, subscription information of package services and call frequency; The management node receives the ID data and label data sent by each participant node, finds out the label data with the same ID, and determines whether there is a label indicating a fraudulent call in the label data with the same ID, if there is, the relevant participant node is informed to update the label corresponding to the ID in the local blacklist to a fraudulent call; Each participant node first acquires the ID corresponding to the suspected fraudulent number when the suspected fraudulent number is found, and then queries the corresponding label data in the local blacklist by using the acquired ID to identify whether the number is a fraudulent call; The participant is an operator, and the management is a communication management bureau; After the local blacklist of each participant node is updated, the data of the blacklist maintained by each participant node is generalized, and then the horizontal federated learning model training of multiple parties is performed by using the generalized blacklist data of each participant node to obtain an anti-fraud model; in the process of data generalization, each participant node encrypts each item of attribute information related to user behavior based on a homomorphic encryption algorithm and sends the encrypted attribute information to the management node, and the management node does not need to decrypt the data, but directly sums the data and returns the summed data to each participant node; When each participant node finds a suspected fraudulent number, if it is identified as a non-fraudulent call according to the local blacklist, the attribute information corresponding to the number is input into the anti-fraud model, and it is determined whether the output result of the model is a fraudulent call, if it is, the label corresponding to the number in the local blacklist is updated to a fraudulent call.

2. The method of claim 1, wherein, Before each participant node sends the ID data and label data in the blacklist maintained by each participant node to the management node, the following steps are further included: Each participant node periodically aggregates multiple data corresponding to the same ID in the local blacklist maintained by each participant node to obtain the local blacklist aggregated in the ID dimension.

3. The method of claim 2, wherein, The multiple data corresponding to the same ID are aggregated in the following manner: The attribute information in the multiple data corresponding to the ID is summed respectively, and the label values in the multiple data corresponding to the ID are operated by OR.

4. The method according to any one of claims 1 to 3, characterized in that, Further included are the following steps: Each participant node calculates the hash value h1 of each ID data in the blacklist maintained by each participant node, and then sends the corresponding hash value h1 to the management node; The management node receives the hash value h1 sent by each participant node, and finds out the label data with the same ID.

5. The method according to any one of claims 1-3, characterized in that, Further included are the following steps: Each participant node jointly negotiates a random number r, and then calculates the hash value h2 of each ID data concatenated with the random number r in the blacklist maintained by each participant node, and then sends the corresponding hash value h2 to the management node; The management node receives the hash values h2 sent by the participant nodes, and finds the label data with the same ID.

6. The method of claim 1, wherein, Before obtaining the anti-fraud model, the following steps are further included: If the management node determines that there is no label indicating a fraudulent call in the label data with the same ID, the relevant participant nodes negotiate the public and private keys of the homomorphic encryption algorithm, encrypt the attribute information corresponding to the ID in the blacklist maintained by each participant node using the public key, and send the encrypted attribute information to the management node; The management node receives the attribute information corresponding to the ID sent by the relevant participant nodes, calculates the sum of the same attribute information corresponding to the ID, and sends the sum to the relevant participant nodes; The relevant participant nodes receive the sum of the same attribute information corresponding to the ID, decrypt the sum using the private key, divide the decrypted sum by the number of the relevant participant nodes, obtain the average attribute information corresponding to the ID, and update the original attribute information in the local blacklist using the average attribute information.

7. The method of claim 1, wherein, Further included are: The participant nodes periodically synchronize the label data indicating a fraudulent call in the local blacklist maintained by each participant node to the management node.

8. A scam call identification system, characterized by, Included are: The management node and a plurality of participant nodes, the participant nodes being operators, and the management node being a communication management bureau; Each participant node is configured to periodically send the user identity identifier ID data and label data in the blacklist maintained by each participant node to the management node, each blacklist including a plurality of data, each piece of data including an ID, a phone number, a plurality of attribute information, and a label indicating whether it is a fraudulent call, the ID being an ID number or a passport number, and the attribute information including call duration, number of hang-ups, subscription information of package services, and call frequency; The management node is configured to receive the ID data and label data sent by the participant nodes, find the label data with the same ID, determine whether there is a label indicating a fraudulent call in the label data with the same ID, and if there is, notify the relevant participant nodes to update the label corresponding to the ID in the local blacklist to indicate a fraudulent call; Each participant node is further configured to, when a suspected fraudulent number is found, first obtain the ID corresponding to the number, and then query the corresponding label data in the local blacklist using the obtained ID to identify whether the number is a fraudulent call; After the local blacklist is updated by each participant node, each participant node is further configured to perform data generalization on the blacklist data maintained by each participant node, and then perform multi-party horizontal federated learning model training using the data generalized blacklist data of each participant node to obtain an anti-fraud model; wherein, in the process of data generalization, each participant node encrypts the attribute information related to user behavior based on the homomorphic encryption algorithm and sends the encrypted attribute information to the management node, and the management node does not need to decrypt the data, but directly sums the data and returns the summed data to each participant node. The participant nodes are further configured to, when a suspected fraud number is discovered, if the number is identified as a non-fraud call according to the local blacklist of each participant node, input each item of attribute information corresponding to the number into the anti-fraud model, and determine whether the output result of the model is a fraud call, if yes, update the corresponding label in the local blacklist to a fraud call.

Images