Abnormal number call monitoring method and device, equipment and storage medium

Abstract

Embodiments of the present application disclose a kind of abnormal number call monitoring method, device, equipment and storage medium.The method includes according to call behavior characteristic set and card opening user information characteristic set from original number set screening out candidate number set;Further screening out abnormal number set;Through the full amount terminal database and normal terminal information library of pre-construction, the identity information of each abnormal terminal is acquired, and is added in abnormal terminal database;According to abnormal number set and abnormal terminal database, the identity information of new abnormal terminal matched with new abnormal number is detected in real time by new abnormal number configured to abnormal terminal;Limit the initiation call service of each new abnormal number, new abnormal number and the identity information of new abnormal terminal are added in abnormal number set and abnormal terminal database.The technical scheme of the embodiment of the present application provides a kind of abnormal number call monitoring mode, increases the new technology of criminal cost to reduce the incidence of telecommunication fraud.

Description

Technical Field

[0001] The embodiments of the present invention relate to computer technology, and in particular to a method, apparatus, device and storage medium for monitoring calls of abnormal numbers. Background Technology

[0002] Combating telecommunications and online fraud remains a major priority. Most telecommunications fraud is non-contact crime, with fraudsters primarily using call scams, SMS scams, and internet scams. New types of fraud techniques are constantly emerging, and prevention and control efforts often lag behind the evolving methods. In most cases, the analysis of call fraud cases employs a case-tracing approach, starting with the victim and seeking clues through reported phone numbers to uncover the entire criminal chain.

[0003] In the process of realizing this invention, the inventors discovered that the existing technology has the following main defects: the existing technology takes the victim as the breakthrough point, seeks clues and digs out the entire criminal chain through the reported phone number, which makes the evidence collection process difficult. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and storage medium for monitoring calls from abnormal numbers, thereby increasing the cost of crime and reducing the incidence of telecommunications fraud by monitoring calls from abnormal numbers.

[0005] In a first aspect, embodiments of the present invention provide a method for monitoring calls from abnormal numbers, the method comprising:

[0006] Obtain the original number set, and filter the original number set according to the call behavior feature set and the cardholder information feature set to obtain the candidate number set;

[0007] Filter out the abnormal number set controlled and used by the GOIP device from the candidate number set;

[0008] By using a pre-built full terminal database and a pre-built normal terminal information database, the identity information of each abnormal terminal that matches the abnormal number set is obtained, and the identity information of each abnormal terminal is added to the abnormal terminal database.

[0009] Based on the abnormal number set and the abnormal terminal database, new abnormal numbers configured in abnormal terminals are detected in real time, as well as the identity information of new abnormal terminals that match the new abnormal numbers;

[0010] Restrict the initiation of call services by each of the new abnormal numbers, and add the identity information of the new abnormal numbers and the new abnormal terminals to the abnormal number set and the abnormal terminal database.

[0011] Secondly, embodiments of the present invention also provide a call monitoring device for abnormal numbers, the device comprising:

[0012] The alternative number set acquisition module is used to acquire the original number set and filter the original number set according to the call behavior feature set and the cardholder information feature set to acquire the alternative number set;

[0013] The abnormal number set acquisition module is used to filter out the abnormal number set controlled and used by the GOIP device from the candidate number set;

[0014] The abnormal terminal identity information acquisition module is used to acquire the identity information of each abnormal terminal that matches the abnormal number set through a pre-built full terminal database and a pre-built normal terminal information database, and add the identity information of each abnormal terminal to the abnormal terminal database.

[0015] The real-time detection module is used to detect new abnormal numbers configured in abnormal terminals and the identity information of new abnormal terminals that match the new abnormal numbers in real time, based on the abnormal number set and the abnormal terminal database.

[0016] The module for adding abnormal new numbers and new terminal identity information is used to restrict the initiation of call services by each of the new abnormal numbers and to add the identity information of the new abnormal numbers and the new abnormal terminals to the abnormal number set and the abnormal terminal database.

[0017] Thirdly, embodiments of the present invention also provide a computer device, the computer device comprising:

[0018] One or more processors;

[0019] Storage device for storing one or more programs;

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the call monitoring method for abnormal numbers as described in any embodiment of the present invention.

[0021] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the call monitoring method for abnormal numbers as described in any embodiment of the present invention.

[0022] This invention, through its embodiments, obtains an original number set and filters it based on call behavior feature sets and SIM card user information feature sets to obtain a candidate number set. From this candidate number set, it filters out an abnormal number set controlled and used by GOIP devices. Using a pre-built full-scale terminal database and a pre-built normal terminal information database, it obtains the identity information of each abnormal terminal matching the abnormal number set and adds this information to the abnormal terminal database. Based on the abnormal number set and the abnormal terminal database, it detects new abnormal numbers configured in the abnormal terminals in real time, as well as the identity information of new abnormal terminals matching these new numbers. It restricts the initiation of call services by each new abnormal number and adds the identity information of the new abnormal number and the new abnormal terminal to the abnormal number set and the abnormal terminal database. This solves the problem in existing technologies that rely on victims as the starting point, seeking clues and uncovering the entire criminal chain through reported phone numbers, leading to high difficulty in evidence collection. It provides a new technology that increases the cost of crime and reduces the incidence of telecommunications fraud by monitoring calls from abnormal numbers. Attached Figure Description

[0023] Figure 1A A flowchart illustrating a method for monitoring abnormal numbers provided in Embodiment 1 of the present invention;

[0024] Figure 1B This is a specific application scenario for filtering abnormal number sets provided in Embodiment 1 of the present invention;

[0025] Figure 1C This is a specific application scenario of the call monitoring method for abnormal numbers provided in Embodiment 1 of the present invention;

[0026] Figure 2 This is a schematic diagram of the structure of a call monitoring device for abnormal numbers provided in Embodiment 2 of the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. Detailed Implementation

[0028] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0029] Example 1

[0030] Figure 1AThis is a flowchart of a call monitoring method for abnormal numbers provided in Embodiment 1 of the present invention. This embodiment is applicable to the monitoring of batch numbers. The method can be executed by a call monitoring device for abnormal numbers. This device can be implemented by software and / or hardware, and can generally be integrated into a server. Specifically, it includes the following steps:

[0031] S110. Obtain the original number set, and filter the original number set according to the call behavior feature set and the cardholder information feature set to obtain the candidate number set.

[0032] The original number set can refer to untested batches of numbers obtained from the back-end systems of major operators or other channels.

[0033] A call behavior feature set refers to a collection of specific patterns and characteristics derived from a comprehensive analysis of the call behavior characteristics of a large number of numbers making calls from GOIP devices. A call behavior feature set may include at least one of the following features: number of calls, caller ratio, geographical dispersion of called numbers, call duration, SIM card testing, base station continuity, and call location information. When the call behavior characteristics of numbers in the original number set satisfy the call behavior feature set, such numbers can be considered as potentially originating from GOIP devices.

[0034] Specifically, based on real-time signaling in the telecommunications O domain, a comprehensive analysis of the call behavior characteristics of a large number of numbers suspected of originating from GOIP devices revealed the following patterns:

[0035] 1. The peak hours for fraudulent calls are primarily between 9:00 AM and 8:00 PM daily, during which the vast majority of numbers in the SIM card pool receive ≥30 calls. Generally, GOIP devices are silent between 12:00 AM and 9:00 AM, and between 8:00 PM and midnight. While other situations may exist, the number of calls in these cases is extremely low, typically less than 3.

[0036] 2. When the outgoing caller rate exceeds 85%, most users will hang up or not answer, rarely calling back. Even if a call is made back, this fraudulent number will not appear as the called number more than three times. As the frequency of this number's use increases, it may be marked as a "suspected fraudulent call / suspected harassment call" by different platforms. The outgoing caller rate of such numbers can surge to over 95%, and complaints are very likely to arise.

[0037] 3. When a GOIP device makes a call, it dials randomly from the phone book. Initially, all calls were made automatically by the machine. As a result, the called numbers were geographically dispersed, with the dispersion of out-of-province called numbers exceeding 70%.

[0038] 4. Regarding the pattern of call duration, statistical analysis of a large number of call detail records (CDRs) revealed that 60% of calls were within 30 seconds, and a large proportion of the remaining 40% were disconnected directly. Less than 10% of calls lasted more than 1 minute.

[0039] 5. GOIP devices provide intelligent call charge statistics. However, during the process of inserting a number into the SIM card pool and using it, the machine cannot intelligently identify which operator the number belongs to, thus resulting in trial SIM card usage. For example, in the signaling, you will often see call records of "10086", "10010", and "10000" in the first few calls. The control system records the location of each number in the SIM card slot, as well as the operator type, balance, and other information.

[0040] 6. In user billing call details, the cell identity (CI) section has a high repetition rate, and even cross-regional CIs show continuity.

[0041] 7. By analyzing location registration event messages in historical signaling, it was found that most of these numbers exhibit a "drifting" phenomenon. For example, a user's location might be in Guangzhou at one moment, and suddenly appear in Inner Mongolia the next, without any actual crossing between the two locations within that time interval. This phenomenon is related to the networking of GOIP devices, which are deployed in two or more different cities, allowing the location of the numbers to change automatically, greatly increasing the deception involved in number location tracking.

[0042] The user information feature set refers to a collection of information characteristics such as the identity of the cardholder, the card application method, or the package for a large number of numbers calling from GOIP devices. The user information feature set may include at least one of the following characteristics: cardholder age, frequent card application and cancellation within a short period, number package value below a preset value threshold, number remaining silent and inactive before initiating a call, number having a single service type, and number being registered through express delivery or e-commerce.

[0043] Specifically, from the perspective of B-domain user information, the calling numbers of GOIP devices, through comprehensive analysis, exhibit the following key characteristics:

[0044] 1. The cardholders for this type of number are mainly teenagers and seniors aged 18-25 and 50-60. The card issuer has a history of frequent card issuance and cancellation within a short period of time.

[0045] 2. These number packages are mostly low-value packages, with most of them having a value of no more than 100 yuan.

[0046] 3. The number is mostly silent before making calls. After activation at a physical store, there are no call or data usage records for nearly 3 days. After online registration, there is no activation verification within a short period. It is suspected that the number was sent to fraudsters by mail or other means. This period is also the golden period for prevention. Pay close attention to newly registered numbers randomly roaming to other locations.

[0047] 4. Neither the primary nor secondary SIM card number under the user's name contains broadband bundled services, nor has the user subscribed to or signed up for any other value-added services such as television. The service type is singular, offering only voice calls and data traffic.

[0048] 5. Analysis of the channels through which cards are registered reveals that fraudsters often issue cards in bulk under the guise of courier services or e-commerce platforms. Occasionally, calls to certain numbers go through, and inquiries based on the information provided when the card was issued reveal that the user is not a courier. Therefore, these channels warrant close monitoring.

[0049] The alternative number set can be a collection of numbers selected from the original number set through a dual filtering method of call behavior feature set and cardholder information feature set.

[0050] In this embodiment, a list of numbers suspected to be made by GOIP devices can be filtered from the original number set based on the call behavior feature set and the cardholder information feature set, and used as a candidate number set.

[0051] S120. Filter out the abnormal number set controlled and used by the GOIP device from the candidate number set.

[0052] Among them, the abnormal number set can be a set of numbers controlled by GOIP devices and used for fraud, selected from the candidate number set.

[0053] Specifically, the candidate number set can be re-evaluated manually to filter out abnormal number sets that are controlled and used by GOIP devices.

[0054] For example, Figure 1B This is a specific application scenario for filtering abnormal number sets provided in Embodiment 1 of the present invention. For example... Figure 1B As shown, a pre-analysis is performed based on the call behavior characteristics of the user's real-time signaling to obtain numbers (i.e., the first set of numbers); further, suspected numbers are filtered out based on user information characteristics (i.e., the candidate set of numbers); the suspected numbers can be further manually judged to further lock down the list of numbers that are very likely to make calls from GOIP devices (i.e., the abnormal set of numbers), and the operator or regulatory department will handle them at different levels depending on the degree of harm of the numbers.

[0055] S130. Obtain the identity information of each abnormal terminal that matches the abnormal number set by using the pre-built full terminal database and the pre-built normal terminal information database, and add the identity information of each abnormal terminal to the abnormal terminal database.

[0056] The full terminal database can contain registration information data of various terminal devices when they join the network. It can include terminal registration information data collected by the operator's terminal self-registration system. The normal terminal information database refers to the registration information data of normal terminals when they join the network. Terminals included in the normal terminal information database are easily misidentified as abnormal terminals, such as single-function terminal devices like feature phones for the elderly and smartwatches for teenagers. Abnormal terminals can refer to terminal devices that control batch numbers to randomly make illegal calls, such as GOIP devices. Identity information can be the unique identification information of abnormal terminals, such as the International Mobile Equipment Identity (IMEI) or Mobile Equipment Identifier (MEID). The abnormal terminal database can be a database used to store the identity information of abnormal terminals, generally storing IMEI or MEID information. The abnormal terminal database can be pre-built and can be constructed based on at least one of the following sources: GOIP calling numbers confirmed as originating from GOIP devices and GOIP calling numbers obtained through analysis of police reports.

[0057] Optionally, after filtering out the abnormal number set controlled by GOIP devices, the terminal information controlling these abnormal numbers can be retrieved through the abnormal numbers in this set. Specifically, a series of operations, such as querying and comparing each abnormal number in the current abnormal number set, can be performed using a pre-built full terminal database and a pre-built normal terminal information database to obtain the identity information of each abnormal terminal matching the abnormal number set, and this identity information can be added to the abnormal terminal database to enrich the abnormal terminal database.

[0058] In an optional implementation of this embodiment, obtaining the identity information of each abnormal terminal matching the abnormal number set by using a pre-built full terminal database and a pre-built normal terminal information database may include:

[0059] Based on the terminal registration information corresponding to each abnormal number in the abnormal number set within a preset time period, the full terminal database is queried to obtain the identity information of candidate abnormal terminals that match the abnormal number set; based on the normal terminal information database, the identity information of normal terminals is filtered out from the identity information of each candidate abnormal terminal to obtain the identity information of each abnormal terminal.

[0060] The preset time period can refer to the time range for monitoring the registration information of each abnormal number, such as the last 30 days or a longer period. Terminal registration information can be the registration data of the terminal device when it joined the network, which includes the terminal device's identity information. The candidate abnormal terminals can refer to all abnormal terminals corresponding to the abnormal number set. Since the candidate abnormal terminals may include normal terminals that were mistakenly identified as abnormal terminals, further filtering of the candidate abnormal terminals is possible.

[0061] Optionally, based on a pre-built full-scale terminal database, the terminal registration information corresponding to each abnormal number in the abnormal number set within a preset time period can be analyzed and identified. Then, the identity information of each abnormal terminal matching the abnormal number set can be obtained, and the identity information of each abnormal terminal can be added to the abnormal terminal database, so that the abnormal terminals can continue to be monitored.

[0062] S140. Based on the abnormal number set and the abnormal terminal database, detect in real time new abnormal numbers configured in abnormal terminals, as well as the identity information of new abnormal terminals that match the new abnormal numbers.

[0063] Here, a new abnormal number can refer to a new number that is controlled for the first time by an abnormal terminal, and is different from any of the abnormal numbers in the abnormal number set (or has not been confirmed as an abnormal number). A new abnormal terminal can be a terminal that is monitored as an abnormal terminal for the first time, and this new abnormal terminal is different from any of the abnormal terminals matched in the abnormal terminal database.

[0064] Specifically, it can monitor each abnormal terminal in the abnormal terminal database in real time to detect whether there are new numbers that are different from the abnormal numbers in the abnormal number set and are configured on the currently detected abnormal terminal; furthermore, it can monitor the newly detected abnormal numbers in real time to detect whether the new abnormal numbers are configured on new terminals that are different from the abnormal terminals corresponding to the abnormal terminal database, and can query the identity information of the new terminal through the full terminal database.

[0065] S150. Restrict the initiation of call services by each of the new abnormal numbers, and add the identity information of the new abnormal numbers and the new abnormal terminals to the abnormal number set and the abnormal terminal database.

[0066] Optionally, calls initiated by new abnormal numbers can be restricted (e.g., number blocking or call interception), and the identity information of the new abnormal numbers and new abnormal terminals can be added to the abnormal number set and the abnormal terminal database, respectively.

[0067] The advantage of this setup is that by detecting new abnormal numbers and terminals in real time and adding them to the abnormal number set and new abnormal terminal database, the abnormal number set and abnormal terminal database can be enriched through repeated verification and multiple source tracing checks, increasing the amount of reference data and making the analysis results of abnormal numbers more accurate. It can also significantly increase the cost for criminals to commit crimes through GOIP devices, reduce the incidence of telecommunications fraud, protect people's property safety, and provide a basis for the governance of new types of fraud.

[0068] The technical solution of this embodiment obtains an original number set, filters it based on call behavior feature set and SIM card user information feature set to obtain a candidate number set; filters out abnormal number sets controlled and used by GOIP devices from the candidate number set; obtains the identity information of each abnormal terminal matching the abnormal number set through a pre-built full terminal database and a pre-built normal terminal information database, and adds the identity information of each abnormal terminal to the abnormal terminal database; based on the abnormal number set and the abnormal terminal database, detects new abnormal numbers configured on abnormal terminals in real time, and the identity information of new abnormal terminals matching the new abnormal numbers; restricts the initiation of call services by each new abnormal number, and adds the identity information of the new abnormal number and the new abnormal terminal to the abnormal number set and the abnormal terminal database. This solves the problem of existing technologies that rely on victims as the breakthrough point, seeking clues and uncovering the entire criminal chain through reported phone numbers, leading to high difficulty in the evidence collection stage. It provides a new technology that increases the cost of crime and reduces the incidence of telecommunications fraud by monitoring calls from abnormal numbers.

[0069] Based on the above technical solution, the original number set is filtered according to the call behavior feature set and the cardholder information feature set to obtain a candidate number set. Preferably, this can be done by: obtaining the original number set, filtering the original number set according to the call behavior feature set to obtain a first number set; and analyzing the first number set according to the cardholder information feature set to obtain the candidate number set.

[0070] The first number set can be a list of the first batch of numbers suspected to be controlled and used by GOIP devices, selected from the original number set based on the call behavior feature set.

[0071] Optionally, a first set of numbers can be selected from the original number set based on the call behavior feature set. To improve the accuracy of the analysis, the feature set of cardholder information can be further combined to assist in the analysis and select a candidate number set from the first set of numbers.

[0072] The advantage of this setup is that by combining the call behavior feature set of O-domain real-time signaling with the cardholder information feature set of user B-domain data, the accuracy of identifying the numbers used for GOIP device control can be improved.

[0073] For example, Figure 1C This is a specific application scenario of the call monitoring method for abnormal numbers provided in Embodiment 1 of the present invention. For example... Figure 1C As shown, numbers identified through analysis as highly likely to be calls originating from GOIP devices are imported into the full terminal database; the terminal registration information corresponding to these numbers within the past 30 days or a longer period is identified, and matching terminal IEMI or MEID information is obtained from the terminal registration information; the IEMI or MEID information of misjudged normal terminals is removed, and the IEMI or MEID information of abnormal terminals is added to the abnormal terminal database; then, online real-time monitoring is performed to obtain new abnormal numbers configured in the confirmed abnormal terminals; the new numbers are further scanned online to obtain new abnormal terminals matching the new abnormal numbers, thereby shutting down or blocking the calls of the new abnormal numbers, and adding the new abnormal terminals to the abnormal terminal database (i.e., adding them to the blacklist).

[0074] Example 2

[0075] Figure 2 This is a schematic diagram of a call monitoring device for abnormal numbers provided in Embodiment 2 of the present invention. The device may include: a candidate number set acquisition module 210, an abnormal number set acquisition module 220, an abnormal terminal identity information acquisition module 230, a real-time detection module 240, and an abnormal new number and new terminal identity information addition module 250. Wherein:

[0076] The alternative number set acquisition module 210 is used to acquire the original number set and filter the original number set according to the call behavior feature set and the cardholder information feature set to acquire the alternative number set;

[0077] The abnormal number set acquisition module 220 is used to filter out the abnormal number set controlled and used by the GOIP device from the candidate number set;

[0078] The abnormal terminal identity information acquisition module 230 is used to acquire the identity information of each abnormal terminal that matches the abnormal number set through a pre-built full terminal database and a pre-built normal terminal information database, and add the identity information of each abnormal terminal to the abnormal terminal database.

[0079] The real-time detection module 240 is used to detect new abnormal numbers configured in abnormal terminals and the identity information of new abnormal terminals that match the new abnormal numbers in real time, based on the abnormal number set and the abnormal terminal database.

[0080] The abnormal new number and new terminal identity information addition module 250 is used to restrict the initiation of call services by each of the new abnormal numbers and to add the identity information of the new abnormal numbers and the new abnormal terminals to the abnormal number set and the abnormal terminal database.

[0081] The technical solution of this embodiment obtains an original number set, filters it based on call behavior feature set and SIM card user information feature set to obtain a candidate number set; filters out abnormal number sets controlled and used by GOIP devices from the candidate number set; obtains the identity information of each abnormal terminal matching the abnormal number set through a pre-built full terminal database and a pre-built normal terminal information database, and adds the identity information of each abnormal terminal to the abnormal terminal database; based on the abnormal number set and the abnormal terminal database, detects new abnormal numbers configured on abnormal terminals in real time, and the identity information of new abnormal terminals matching the new abnormal numbers; restricts the initiation of call services by each new abnormal number, and adds the identity information of the new abnormal number and the new abnormal terminal to the abnormal number set and the abnormal terminal database. This solves the problem of existing technologies that rely on victims as the breakthrough point, seeking clues and uncovering the entire criminal chain through reported phone numbers, leading to high difficulty in the evidence collection stage. It provides a new technology that increases the cost of crime and reduces the incidence of telecommunications fraud by monitoring calls from abnormal numbers.

[0082] Optionally, in the above-mentioned device, the alternative number set acquisition module 210 can be specifically used for:

[0083] Obtain the original number set, and filter the original number set according to the call behavior feature set to obtain the first number set;

[0084] The candidate number set is obtained by analyzing the first number set based on the feature set of cardholder information.

[0085] Optionally, in the above-mentioned device, the abnormal terminal identity information acquisition module 230 can be specifically used for:

[0086] Based on the terminal registration information corresponding to each abnormal number in the abnormal number set within a preset time period, the full terminal database is queried to obtain the identity information of the candidate abnormal terminals that match the abnormal number set;

[0087] Based on the normal terminal information database, the identity information of normal terminals is filtered out from the identity information of each candidate abnormal terminal to obtain the identity information of each abnormal terminal.

[0088] Optionally, in the above-mentioned device, the full terminal database includes terminal registration information data collected by the operator's terminal self-registration system;

[0089] The abnormal terminal database is constructed based on at least one of the following sources: GOIP call numbers that have been confirmed as GOIP devices and GOIP call numbers obtained through analysis of public security reporting channels.

[0090] Optionally, in the above-described apparatus, the call behavior feature set includes at least one of the following features:

[0091] Number of calls, outgoing call percentage, geographical dispersion of called numbers, call duration, SIM card testing, base station continuity, and call location information.

[0092] Optionally, in the above-described device, the user information feature set includes at least one of the following features:

[0093] The following factors are considered as criteria for card issuance: age at which the card is issued, frequent card issuance and cancellation within a short period, number package value below the preset value threshold, number remaining silent and not activated before initiating a call, single type of number service, and number registration channel being express delivery or e-commerce.

[0094] The call monitoring device for abnormal numbers provided in the embodiments of the present invention can execute the call monitoring method for abnormal numbers provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0095] Example 3

[0096] Figure 3 This is a schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention, as shown below. Figure 3 As shown, the computer device includes a processor 310, a storage device 320, an input device 330, and an output device 340; the number of processors 310 in the computer device can be one or more. Figure 3 Taking a processor 310 as an example; the processor 310, storage device 320, input device 330, and output device 340 in a computer device can be connected via a bus or other means. Figure 3 Taking the example of a connection between China and Israel via a bus.

[0097] Storage device 320, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the abnormal number call monitoring method in this embodiment of the invention (e.g., the candidate number set acquisition module 210, the abnormal number set acquisition module 220, the abnormal terminal identity information acquisition module 230, the real-time detection module 240, and the abnormal new number and new terminal identity information addition module 250 in the abnormal number call monitoring device). Processor 310 executes various functional applications and data processing of the computer device by running the software programs, instructions, and modules stored in storage device 320, thereby implementing the above-mentioned abnormal number call monitoring method, which may include:

[0098] Obtain the original number set, and filter the original number set according to the call behavior feature set and the cardholder information feature set to obtain the candidate number set;

[0099] Filter out the abnormal number set controlled and used by the GOIP device from the candidate number set;

[0100] By using a pre-built full terminal database and a pre-built normal terminal information database, the identity information of each abnormal terminal that matches the abnormal number set is obtained, and the identity information of each abnormal terminal is added to the abnormal terminal database.

[0101] Based on the abnormal number set and the abnormal terminal database, new abnormal numbers configured in abnormal terminals are detected in real time, as well as the identity information of new abnormal terminals that match the new abnormal numbers;

[0102] Restrict the initiation of call services by each of the new abnormal numbers, and add the identity information of the new abnormal numbers and the new abnormal terminals to the abnormal number set and the abnormal terminal database.

[0103] Storage device 320 may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on terminal usage. Furthermore, storage device 320 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, storage device 320 may further include memory remotely located relative to processor 310, which can be connected to computer devices via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0104] Input device 330 can be used to receive input digital or character information, and to generate key signal inputs related to user settings and function control of the computer device. Output device 340 may include display devices such as a display screen.

[0105] Example 4

[0106] Embodiment 4 of the present invention also provides a computer-readable storage medium having a computer program stored thereon. When executed by a processor, the program is used to perform a call monitoring method for abnormal numbers. The method may include:

[0107] Obtain the original number set, and filter the original number set according to the call behavior feature set and the cardholder information feature set to obtain the candidate number set;

[0108] Filter out the abnormal number set controlled and used by the GOIP device from the candidate number set;

[0109] By using a pre-built full terminal database and a pre-built normal terminal information database, the identity information of each abnormal terminal that matches the abnormal number set is obtained, and the identity information of each abnormal terminal is added to the abnormal terminal database.

[0110] Based on the abnormal number set and the abnormal terminal database, new abnormal numbers configured in abnormal terminals are detected in real time, as well as the identity information of new abnormal terminals that match the new abnormal numbers;

[0111] Restrict the initiation of call services by each of the new abnormal numbers, and add the identity information of the new abnormal numbers and the new abnormal terminals to the abnormal number set and the abnormal terminal database.

[0112] Of course, the computer-executable instructions provided in the embodiments of the present invention are not limited to the method operations described above, but can also perform related operations in the call monitoring method for abnormal numbers provided in any embodiment of the present invention.

[0113] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0114] It is worth noting that in the embodiments of the call monitoring device for abnormal numbers described above, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0115] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method of call monitoring for anomalous numbers, characterized by, The method comprises the following steps: obtaining an original number set, and screening the original number set according to a call behavior feature set and an open card user information feature set to obtain a candidate number set; screening an abnormal number set controlled by a GOIP device from the candidate number set; obtaining identity information of each abnormal terminal matched with the abnormal number set through a pre-constructed full-amount terminal database and a pre-constructed normal terminal information library, and adding the identity information of each abnormal terminal into an abnormal terminal database; the full-amount terminal database comprises terminal registration information data of various terminal devices collected by an operator terminal self-registration system when the terminal devices are connected to a network; the abnormal terminal database is constructed according to at least one of the following sources: GOIP call numbers obtained through GOIP call number confirmation and public security reporting channel analysis; real-time detecting a new abnormal number configured in an abnormal terminal and identity information of a new abnormal terminal matched with the new abnormal number according to the abnormal number set and the abnormal terminal database; limiting the new abnormal number to initiate a call service, and adding the new abnormal number and the identity information of the new abnormal terminal into the abnormal number set and the abnormal terminal database.

2. The method of claim 1, wherein, The method comprises the following steps: obtaining an original number set, and screening the original number set according to a call behavior feature set to obtain a first number set; screening the first number set according to an open card user information feature set to obtain the candidate number set.

3. The method of claim 1, wherein, The method comprises the following steps: obtaining identity information of each abnormal terminal matched with the abnormal number set through a pre-constructed full-amount terminal database and a pre-constructed normal terminal information library, and adding the identity information of each abnormal terminal into an abnormal terminal database; the full-amount terminal database comprises terminal registration information data of various terminal devices collected by an operator terminal self-registration system when the terminal devices are connected to a network; the abnormal terminal database is constructed according to at least one of the following sources: GOIP call numbers obtained through GOIP call number confirmation and public security reporting channel analysis; querying the full-amount terminal database according to terminal registration information corresponding to each abnormal number in the abnormal number set within a preset time period to obtain identity information of a candidate abnormal terminal matched with the abnormal number set; 4. The method of claim 1, wherein, filtering out identity information of a normal terminal from the identity information of each candidate abnormal terminal according to the normal terminal information library to obtain the identity information of each abnormal terminal. The call behavior feature set comprises at least one of the following features:

5. The method of claim 1, wherein, call times, calling proportion, called number home location dispersion, call duration, card testing, base station continuity and call location information. The open card user information feature set comprises at least one of the following features:

6. An apparatus for monitoring calls from anomalous numbers, characterized by card opening age and frequent card opening and cancellation within a short time period, number package value lower than a preset value threshold, number call initiation silence before activation, single number service type, and number network access channel being express delivery or e-commerce. The method comprises the following steps: a candidate number set obtaining module is configured to obtain an original number set, and screen the original number set according to a call behavior feature set and an open card user information feature set to obtain a candidate number set; an abnormal number set obtaining module is configured to screen an abnormal number set controlled by a GOIP device from the candidate number set; An abnormal terminal identity information acquisition module is configured to acquire identity information of each abnormal terminal matched with the abnormal number set from a pre-constructed full-terminal database and a pre-constructed normal terminal information library, and add the identity information of each abnormal terminal to an abnormal terminal database; the full-terminal database includes terminal registration information data collected by an operator terminal self-registration system when various terminal devices access a network; the abnormal terminal database is constructed according to at least one of the following sources: GOIP device call-making numbers that have been confirmed and GOIP call-making numbers obtained through analysis of public security reporting channels; A real-time detection module is configured to detect, in real time, a new abnormal number configured in an abnormal terminal and identity information of a new abnormal terminal matched with the new abnormal number according to the abnormal number set and the abnormal terminal database; An abnormal new number and new terminal identity information addition module is configured to limit call service initiated by each new abnormal number, and add the new abnormal number and the identity information of the new abnormal terminal to the abnormal number set and the abnormal terminal database.

7. The apparatus of claim 6, wherein, The alternative number set acquisition module is configured to: acquire an original number set, and screen the original number set according to a call behavior feature set to obtain a first number set; judge the first number set according to a card opening user information feature set to obtain the alternative number set.

8. A computer device, comprising: The computer device includes: one or more processors; a storage device configured to store one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the call monitoring method of the abnormal number according to any one of claims 1-5.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the call monitoring method of the abnormal number according to any one of claims 1-5.

Images