Abnormal communication number identification method and device, electronic equipment and readable medium

Abstract

The present disclosure provides an abnormal communication number identification method, device, electronic equipment and readable medium, wherein the abnormal communication number identification method comprises: performing clustering processing on feature index data of any suspected abnormal number output by a trained deep learning model through an improved clustering algorithm; determining the weight of each item index in the feature index data after clustering processing; determining the standard score of each item index in the feature index data; calculating the abnormality score of each item index according to the weight and the standard score; and determining that the suspected abnormal number is an abnormal number according to the abnormality score. Through the embodiments of the present disclosure, the accuracy and reliability of abnormal number identification are improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and in particular, to an abnormal communication number identification method and device, an electronic device and a readable medium. BACKGROUND

[0002] At present, with the popularization of mobile phones and the development of high-tech, many illegal personnel use communication tools such as mobile phones and network phones and modern technology to implement remote and non-contact fraud on victims by fabricating false information and setting up scams, and induce victims to make payments or transfer money, which has caused great economic losses to the people.

[0003] In related technologies, there are mainly two methods for identifying fraudulent calls:

[0004] 1) Threshold identification through business rules: According to the historical call, roaming, traffic and other data of the calling number, the user's usage behavior is analyzed, and the threshold of the business rules is set according to the characteristics of the historical fraudulent numbers, such as the number of calls exceeding a certain value, whether to go to a high-risk roaming area, and the traffic exceeding a certain value, etc., to identify fraudulent numbers.

[0005] 2) Identification through machine learning method: Machine learning method has been widely promoted and applied in anti-fraud scenarios due to its automation and intelligence. This method uses the call record, roaming, traffic and other data of the calling number, applies supervised learning classification technology, and uses decision tree, neural network, etc. to establish a fraudulent number identification model. This method extracts the characteristics of fraudulent numbers through machine learning, which can accurately identify abnormal numbers.

[0006] However, the existing abnormal number identification method also has the following shortcomings:

[0007] (1) Abnormal number identification through business rules: If the abnormal number feature extraction is incorrect, or the threshold setting is unreasonable, or the sample size is small, the error is relatively large.

[0008] (2) Abnormal number identification through machine learning algorithm: Due to the serious imbalance between positive and negative samples, the model training is prone to local optimal solution, and overfitting phenomenon occurs, resulting in invalid learning and unable to accurately classify the numbers.

[0009] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0010] The purpose of the present disclosure is to provide an abnormal communication number identification method and device, electronic equipment and readable medium, which at least partially overcomes the problem of poor accuracy of abnormal number identification due to limitations and defects of related technologies.

[0011] According to a first aspect of an embodiment of the present disclosure, an abnormal communication number identification method is provided, comprising: performing clustering processing on feature indicator data of any suspected abnormal number output by a trained deep learning model through an improved clustering algorithm; determining the weight of each item indicator in the feature indicator data after clustering processing; determining the standard score of each item indicator in the feature indicator data; calculating the abnormality score of each item indicator according to the weight and the standard score; and determining that the suspected abnormal number is an abnormal number according to the abnormality score.

[0012] In an exemplary embodiment of the present disclosure, before performing clustering processing on feature indicator data of suspected abnormal numbers output by a trained deep learning model through an improved clustering algorithm, it further comprises: collecting a sample set of feature indicator data of communication numbers; constructing a loss function of the deep learning model according to a cross-entropy function and a focal loss function; and training the deep learning model through the sample set of feature indicator data and the loss function.

[0013] In an exemplary embodiment of the present disclosure, it further comprises: determining the mean and standard deviation of the feature indicator data; determining the influence factor of the feature indicator data according to the mean and the standard deviation; determining the sum value of the influence factors of the feature indicator data in the feature indicator data; and determining the weight of any feature indicator data according to the ratio between the influence factor and the sum value of the influence factors.

[0014] In an exemplary embodiment of the present disclosure, it further comprises: determining the current center point of the feature indicator data; cyclically determining the point with the maximum distance from the current center point as a new center point, and removing the current center point, until the number of determined clustering center points in the feature indicator data reaches a preset number; and determining the clustering algorithm with the preset number of clustering center points as the improved clustering algorithm.

[0015] In an exemplary embodiment of the present disclosure, determining the weight of each item indicator in the feature indicator data after clustering processing comprises: determining the number of each item indicator in the feature indicator data; and determining the weight of the item indicator according to the number and the weight of the feature indicator data.

[0016] In an example embodiment of the present disclosure, the determining the standard score of each sub-item indicator in the feature indicator data comprises: calculating the standard score of the feature indicator data by a kernel density function, the kernel density function being subject to a normal distribution.

[0017] In an example embodiment of the present disclosure, the calculating the standard score of the feature indicator data by a kernel density function comprises: assuming that the coordinate of the highest point position of the normal distribution is a specified coordinate; and calculating the standard value of the feature indicator data according to the size relationship between the coordinate value of the feature indicator data and the specified coordinate.

[0018] According to a second aspect of the embodiments of the present disclosure, an identification device of an abnormal communication number is provided, comprising: a clustering module configured to perform clustering processing on feature indicator data of any suspected abnormal number output by a trained deep learning model by using an improved clustering algorithm; a determining module configured to determine the weight of each sub-item indicator in the feature indicator data after the clustering processing; the determining module is configured to determine the standard score of each sub-item indicator in the feature indicator data; and a calculating module configured to calculate the abnormality degree score of each sub-item indicator according to the weight and the standard score; and the determining module is configured to determine that the suspected abnormal number is an abnormal number according to the abnormality degree score.

[0019] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the method according to any one of the preceding aspects based on instructions stored in the memory.

[0020] According to a fourth aspect of the present disclosure, a computer readable storage medium is provided, the computer readable storage medium storing a program, the program being executed by a processor to implement the identification method of an abnormal communication number according to any one of the preceding aspects.

[0021] According to the embodiments of the present disclosure, the feature indicator data of any suspected abnormal number output by a trained deep learning model is clustered by using an improved clustering algorithm, thereby solving the problem of overfitting of an unbalanced sample set. In addition, the weight of each sub-item indicator in the feature indicator data after the clustering processing is determined, and then the standard score of each sub-item indicator in the feature indicator data is determined, and the abnormality degree score of each sub-item indicator is calculated according to the weight and the standard score, and it is determined that the suspected abnormal number is an abnormal number according to the abnormality degree score, thereby improving the accuracy and reliability of the identification of the abnormal number.

[0022] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles of the present disclosure. It is to be understood that the drawings are designed solely for purposes of illustration to be used in conjunction with the description in specifying the present embodiments. As such, other drawings, having different numbers and labels from those of the drawing figures being discussed, can represent other embodiments consistent with the present disclosure, which can be understood clearly and entirely by those skilled in the art from a study of the drawings, specifications, and patent laws.

[0024] Figure 1 is a flowchart of a method for identifying an abnormal communication number in an exemplary embodiment of the present disclosure;

[0025] Figure 2 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0026] Figure 3 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0027] Figure 4 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0028] Figure 5 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0029] Figure 6 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0030] Figure 7 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0031] Figure 8 is a block diagram of an apparatus for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0032] Figure 9 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0033] Figure 10 is a flowchart of a method for identifying an abnormal communication number in another exemplary embodiment of the present disclosure;

[0034] Figure 11 is a block diagram of an apparatus for identifying an abnormal communication number in an exemplary embodiment of the present disclosure;

[0035] Figure 12 is a block diagram of an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0036] Example implementations will now be described more fully with reference to the accompanying drawings. Example implementations can be implemented in any number of manners, and are not limited to the examples described herein; rather, examples are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example implementations to those skilled in the art. Described features, structures, or characteristics can be combined in any suitable manner in one or more implementations. In the following description, numerous specific details are provided to give a thorough understanding of implementations of the disclosure. One skilled in the relevant art will recognize, however, that the aspects of the disclosure can be practiced without one or more of the specific details, or with other methods, components, materials, and so forth. In other instances, well-known structures have not been described in detail so as not to obscure aspects of the disclosure.

[0037] Furthermore, the accompanying drawings are only schematic and are non-limiting detailed descriptions of implementations, wherein same reference numerals can be used to denote same or similar parts throughout the several views, and thus repeated description is omitted. Some of the blocks in the diagrams can be functional blocks that can employ software, hardware, firmware, or any combination thereof. These functional blocks can be implemented in software or hardware or a combination thereof.

[0038] Example implementations of the disclosure will now be described in detail with reference to the accompanying drawings.

[0039] Figure 1 is a flowchart of an abnormal communication number identification method in an example embodiment of the disclosure.

[0040] Referring to Figure 1 The abnormal communication number identification method can include:

[0041] In step S102, the feature indicator data of any suspected abnormal number output by the trained deep learning model is clustered by an improved clustering algorithm.

[0042] In step S104, the weight of each item indicator in the clustered feature indicator data is determined.

[0043] In step S106, the standard score of each item indicator in the feature indicator data is determined.

[0044] In step S108, the abnormality score of each item indicator is calculated according to the weight and the standard score.

[0045] In step S110, the suspected abnormal number is determined to be an abnormal number according to the abnormality score.

[0046] The embodiment of the present disclosure solves the problem of overfitting of unbalanced sample sets by improved clustering algorithm for clustering the feature indicator data of any suspected abnormal number output by the trained deep learning model. In addition, by determining the weight of each item indicator in the feature indicator data after clustering processing, the standard score of each item indicator in the feature indicator data is determined, and the abnormality score of each item indicator is calculated according to the weight and the standard score, and the suspected abnormal number is determined as an abnormal number according to the abnormality score, which improves the accuracy and reliability of the abnormal number identification.

[0047] In an exemplary embodiment of the present disclosure, a training sample set is first adopted, and then the establishment of a deep learning model is completed according to the following three steps, and then a test sample set is used to verify the model.

[0048] Step 1, constructing a deep learning model based on a convolutional neural network:

[0049] The convolutional neural network includes a feature extractor composed of a convolutional layer and a pooling layer, and a classifier composed of a fully connected layer. The number of classifiers is determined by the number classification label, and in the embodiment of the present disclosure, the number of classifiers is 2, that is, two classifiers corresponding to abnormal numbers and non-abnormal numbers.

[0050] Step 2, training the feature extractor and the classifier:

[0051] The feature map corresponding to the training sample set after data preprocessing and the number classification label are input into the model to train the feature extractor and the number classifier. After training, the loss function value and the accuracy are calculated, and if the accuracy is not ideal, the learning rate and other parameters are adjusted, and the first step and the second step are repeated. If the training result is ideal, the model weight is saved for subsequent model deployment.

[0052] Step 3, model deployment implementation:

[0053] The parameters of the embodiment of the present disclosure are adjusted several times, and the final parameter settings are as follows: learning rate p = 0.001, loss function adjustment factor a = 0.25, and g = 0.15, which can minimize the model loss function and achieve the optimal solution.

[0054] Then, the test sample set is used to verify the model, and the accuracy of the model is calculated. The accuracy of the test sample set in the embodiment of the present disclosure can reach 95%.

[0055] After the above three steps, the model parameters can be saved, the model can be deployed and implemented, and finally the model outputs the number category and the probability value of the corresponding category.

[0056] In an exemplary embodiment of the present disclosure, a feature map of a to-be-confirmed identification number in any 30-day window period is calculated and input into a convolutional neural network model of solidified deployment, and a corresponding number category and probability value are output. Meanwhile, a probability threshold is set to 0.6, and a number corresponding to a number category probability value greater than the threshold is identified as a suspected abnormal number.

[0057] Next, each step of the abnormal communication number identification method will be described in detail.

[0058] In an exemplary embodiment of the present disclosure, as shown in Figure 2 Before the feature indicator data of the suspected abnormal number output by the trained deep learning model is clustered by the improved clustering algorithm, it further includes:

[0059] Step S202, a sample set of feature indicator data of a communication number is collected.

[0060] Step S204, a loss function of the deep learning model is constructed according to a cross-entropy function and a focal loss function.

[0061] Step S206, the deep learning model is trained through the sample set of the feature indicator data and the loss function.

[0062] In an exemplary embodiment of the present disclosure, the cross-entropy loss function is expressed as shown in the following formula (1):

[0063] CE(x) = -log(x), (Formula 1)

[0064] Wherein, x is the probability of being classified as 1.

[0065] For the samples to be studied by the embodiments of the present disclosure, the sample proportions of abnormal numbers and non-abnormal numbers are seriously unbalanced, and directly applying the cross-entropy loss function will cause a local optimal solution, resulting in invalid learning and unable to perform accurate classification.

[0066] Compared with the cross-entropy loss function, the focal loss function introduces adjustment factors a and y, changes the proportions of positive and negative samples in the training set, and can effectively solve the problem of unbalanced classification of positive and negative samples. The calculation process of the focal loss function is shown in the following formula (2):

[0067] FL(x) = -a(1-x) γ log(x)(y> 0), (Formula 2)

[0068] Wherein, p is the prediction value of the model for the abnormal number, p e [0, 1].

[0069] Specifically, when α = 1 and γ = 0, the focus loss function and the cross-entropy loss function have the same expression.

[0070] While the focus loss function can address the imbalance between positive and negative samples, it overemphasizes difficult-to-classify samples and neglects easily-classified samples, making it prone to overfitting to outliers and anomalies. The technical solution of this invention, by constructing a new loss function, not only solves the problem of severe imbalance between positive and negative samples but also considers the losses caused by outliers and anomalies in the samples.

[0071] The embodiments of this disclosure improve the focus loss function, thereby enhancing the classification performance for imbalanced data, as shown in the following expression (Equation 3):

[0072]

[0073] Preferably, when α = 1 and γ = 0, the improved focus loss function and cross-entropy loss function have the same expression form.

[0074] To address the overfitting problem caused by outliers and achieve the global optimum, this embodiment of the disclosure fuses the cross-entropy loss function and the improved focus loss function to construct a new loss function, as shown in Equation 4 below:

[0075] G(x)=θ×FL′(x)+(1-θ)×CE(x), (Formula 4)

[0076] Where θ is an adjustment parameter, θ∈[0,1], γ≥0.

[0077] After rearranging (Formula 4), the final loss function constructed in this embodiment is as follows (Formula 4).

[0078] As shown in Equation 5):

[0079]

[0080] Through the embodiments of this disclosure, the constructed loss function not only solves the problem of severe imbalance in the classification of positive and negative samples, but also takes into account the loss caused by some outliers and anomalies in the samples, thereby improving the classification accuracy of abnormal numbers.

[0081] In one exemplary embodiment of this disclosure, such as Figure 3 As shown, methods for identifying abnormal communication numbers also include:

[0082] Step S302: Determine the mean and standard deviation of the characteristic index data.

[0083] Step S304: Determine the influence factor of the characteristic index data based on the mean and the standard deviation.

[0084] Step S306, determine the sum value of the influence factor of the feature index data in the feature index data.

[0085] Step S308, determine the weight of any feature index data according to the ratio between the influence factor and the sum value of the influence factor.

[0086] In an exemplary embodiment of the present disclosure, it is assumed that there is a data matrix shown in the following (formula 6):

[0087]

[0088] Wherein, X is the data set with n samples in the above deep learning module, wherein x i ={x i1 , x i2 , …, x im} represents a data sample with m classification attributes, x ik represents the value of the kth attribute in the sample x i .

[0089] In an embodiment of the present disclosure, n is the number of training samples, attribute is the feature index of the deep learning module, and m is the number of feature indexes 17.

[0090] First, the influence factor calculation method of each attribute of the sample is proposed, and then the influence factor is normalized to obtain the weight ω j of each attribute. The standard deviation of each attribute of the sample is calculated as shown in (formula 7) and (8):

[0091]

[0092]

[0093] Wherein, is the average value of the jth attribute of the sample, S j is the standard deviation of the jth attribute of the sample. The standard deviation reflects the dispersion degree of each attribute of the sample.

[0094] The influence factor of each attribute of the sample is calculated as shown in (formula 9):

[0095]

[0096] Wherein, δ j is defined as the influence factor of the jth attribute, which reflects the relative dispersion degree of each attribute. The greater the attribute influence factor, the greater the change of the attribute in the sample.

[0097] The weight ω jNormalization is performed on (formula 9), and the weight of each attribute is as shown in (formula 10):

[0098]

[0099] The size of the attribute weight ω j reflects the different degrees of the role of each attribute in the clustering process.

[0100] Then, the embodiment of the disclosure constructs the influence factor matrix ω as shown in (formula 11):

[0101]

[0102] The sample X is weighted to obtain X' = X·ω, that is, x i ' = x i ·ω, i = 1, 2, …, n.

[0103] In the above embodiment, by improving the clustering algorithm of the embodiment of the disclosure, different influence factors are given to different attribute values of the sample, and the influence degree of each attribute on the clustering result is comprehensively reflected. In addition, the improved clustering algorithm also considers the proportion of unbalanced samples, and avoids falling into a local optimal solution.

[0104] In an exemplary embodiment of the disclosure, as shown in Figure 4 , the abnormal communication number identification method further includes:

[0105] Step S402, determining the current center point of the feature index data.

[0106] Step S404, cyclically determining the point with the maximum distance from the current center point as a new center point, and removing the current center point, until the number of the determined clustering center points in the feature index data reaches a preset number.

[0107] Step S406, determining the clustering algorithm with the preset number of clustering center points as the improved clustering algorithm.

[0108] In an exemplary embodiment of the disclosure, the improved method of the clustering algorithm includes the following specific steps:

[0109] Step one, setting the data set X' of the feature index data of the last step, the number K of clustering centers, and the initial clustering center point set U.

[0110] Step two, recording the set X1' = {x1, x2, x3, …, x p} corresponding to p points of positive samples, and the set X2' = {x p+1 , x p+2 , xp+3 ,..., x p+q}, then X' = X1' U X2', p + q = n.

[0111] Step three, the initial center point set U is initialized as an empty set, i.e. U = {}.

[0112] Step four, the selected initial center point m j is calculated as follows (formula 12) to all samples j :

[0113]

[0114] wherein, j = {1, 2, 3,..., K}, j is the number of clusters, i.e. corresponding to the jth cluster center point. Each time an initial point is selected, the sample set will be removed from a point, and the weighted distance is recalculated.

[0115] Step five, the selected initial center point m j is taken as the center, and the farthest sample point in the spherical surface with a radius of d j is selected as the next initial center point m j+1 .

[0116] In an exemplary embodiment of the present disclosure, if the farthest point is a selected center point sample, it is removed, and the next farthest sample point is selected as the initialization center point.

[0117] In an exemplary embodiment of the present disclosure, if there are 2 or more sample points in the spherical surface with the same distance, the average of the multiple points is taken as the initialization center point.

[0118] In an exemplary embodiment of the present disclosure, if there is no sample point in the spherical surface, the radius d j is expanded by a times (a = 1, 2, 3,..., 10), and the search is continued until an initialization center point is found, as shown below (formula 13) :

[0119] U = U U {m j+1}, (formula 13)

[0120] Steps four and five are repeated until K center points are found.

[0121] Step six, the initialization center point set U is output, and the initial center point algorithm ends.

[0122] In the above embodiment, since the first point of the initial center point set is determined, the farthest point within the radius of the weighted distance is searched with the point as the center, and the obtained center point is also basically determined, eliminating the randomness of the initial center point selection and ensuring that a higher quality clustering initial center point is obtained.

[0123] In an exemplary embodiment of the present disclosure, as shown in Figure 10 The improved K-means algorithm first assigns a corresponding weight to each attribute according to the influence factor of each attribute in the clustering process, and then selects the initial clustering center by the improved fast initial clustering center selection method, which changes from random to determined. Then the improved clustering algorithm can be used to cluster the training sample set. The specific steps of the improved K-means algorithm include:

[0124] Step S1002, input the initial sample set and the number of clusters K.

[0125] Step S1004, weighting processing is performed on the sample attributes.

[0126] Step S1006, output the new sample set.

[0127] Step S1008, execute the clustering center initialization determination rule.

[0128] Step S1010, determine K initial clustering centers.

[0129] Step S1012, perform clustering processing.

[0130] Step S1014, output the clustering result.

[0131] In an exemplary embodiment of the present disclosure, as shown in Figure 5 Determining the weight of each item indicator in the feature indicator data after clustering processing includes:

[0132] Step S502, determine the number of each item indicator in the feature indicator data.

[0133] Step S504, determine the weight of the item indicator according to the number and the weight of the feature indicator data.

[0134] In an exemplary embodiment of the present disclosure, first, the behavior characteristics of each type of user are analyzed according to the clustering result, then the key indicators are classified according to the characteristics, the overall weight of each classification indicator is confirmed according to business experience, and the weight of each item indicator in each classification is confirmed.

[0135] Table 1

[0136]

[0137] As shown in Table 1, one of the high voice category users, the key indicators are divided into 4 categories: in-network, voice, traffic and income. First, the weights of the 4 categories of indicators are confirmed, that is, the values of w 01 , w 02 , w 03 and w 04 , and then the weight of each indicator is confirmed according to the confirmed large category indicators. The weight of the 4 categories of indicators has a large difference in the proportion of different user behavior characteristics. The weight of each sub-item is the average value of the weight of the large category, that is, w i = w 0j / k, w 0j is the weight of the jth large category indicator, and k is the number of sub-item indicators under the category.

[0138] In an exemplary embodiment of the present disclosure, as shown in Figure 6 , determining the standard score of each sub-item indicator in the feature indicator data comprises:

[0139] Step S602, calculating the standard score of the feature indicator data by a kernel density function, the kernel density function being subject to a normal distribution.

[0140] In an exemplary embodiment of the present disclosure, as shown in Figure 7 , calculating the standard score of the feature indicator data by a kernel density function comprises:

[0141] Step S702, assuming that the coordinate of the highest point position of the normal distribution is a specified coordinate.

[0142] Step S704, calculating the standard value of the feature indicator data according to the size relationship between the coordinate value of the feature indicator data and the specified coordinate.

[0143] In an exemplary embodiment of the present disclosure, the kernel density function is used to calculate the standard score of the indicator for distinguishing the positive and negative of the indicator, the kernel density function being subject to a normal distribution, assuming that the coordinate corresponding to the highest point position is t0, then the positive and negative of the indicator can be confirmed according to the actual value x of the indicator and the position of t0, and the standard score b i of each indicator is calculated, w being a preset parameter, and the calculation process being shown as follows (formula 14):

[0144]

[0145] Further, the health degree score ∑w i .b i of each category of indicators can be obtained by weighted sum of each indicator weight and standard score calculated above. Then the health degree h of each sub-divided user is obtained by summing the health degree of each category of indicators, and the calculation process is shown as follows (formula 15):

[0146] h =∑∑w i .b i , (Formula 15)

[0147] Corresponding to the above method embodiments, the present disclosure also provides an abnormal communication number identification device which can be used to execute the above method embodiments.

[0148] Figure 11 is a block diagram of an abnormal communication number identification device in an exemplary embodiment of the present disclosure.

[0149] Reference Figure 11 The abnormal communication number identification device 1100 can include:

[0150] The clustering module 1102 is configured to perform clustering processing on the feature indicator data of any suspected abnormal number output by the trained deep learning model through an improved clustering algorithm.

[0151] The determination module 1104 is configured to determine the weight of each item indicator in the feature indicator data after clustering processing.

[0152] The determination module 1104 is configured to determine the standard score of each item indicator in the feature indicator data.

[0153] The calculation module 1106 is configured to calculate the abnormality score of each item indicator according to the weight and the standard score.

[0154] The determination module 1106 is configured to determine the suspected abnormal number as an abnormal number according to the abnormality score.

[0155] In an exemplary embodiment of the present disclosure, the abnormal communication number identification device 1100 is also used to: collect a sample set of feature indicator data of communication numbers; construct a loss function of the deep learning model according to a cross-entropy function and a focal loss function; and train the deep learning model through the sample set of feature indicator data and the loss function.

[0156] In an exemplary embodiment of the present disclosure, as shown in Figure 8 and Figure 9 The abnormal communication number identification device 1100 can also be divided into three modules including a deep learning module 802, a health degree calculation module 804 and an abnormal number determination module 806.

[0157] The steps performed by the deep learning module 802 include determining samples, constructing a loss function, establishing a model and determining suspected abnormal numbers.

[0158] The deep learning module 802 constructs a new loss function by fusing the cross-entropy loss function and the improved focus loss function, as described above. This not only solves the classification accuracy problem caused by severe imbalance between positive and negative samples but also considers the losses caused by outliers and anomalies. Next, a deep learning convolutional neural network is used to build an abnormal number identification model, and the parameters of the learner are trained using the improved loss function. Finally, the classification category and probability of the numbers to be identified are calculated based on the deep learning model, and a set of suspected abnormal numbers is determined according to the set threshold.

[0159] The steps performed by the health calculation module 804 include improving K-means clustering, determining the weights of feature indicators, calculating the standard score, and calculating the user's health score.

[0160] The health score calculation module 804 first uses an improved K-means algorithm to cluster the samples. The improved K-means algorithm has two main features: 1) Based on the different degrees of influence each attribute plays in the clustering process, an influence factor calculation method is proposed to calculate the weights of the attribute values, comprehensively reflecting the influence of each attribute on the clustering results; 2) The initial cluster center selection method is improved, changing from random to determined selection of initial cluster centers. Next, the weight of each indicator is determined, and then a kernel density function is proposed to calculate the standard score of the indicator to address the issue of indicator positivity or negativity. Finally, the indicator weights and standard scores are weighted and summed to obtain the user's health score.

[0161] The steps performed by the abnormal number determination module 806 include determining the abnormal number.

[0162] The abnormal number identification module 806 sets a health score threshold. When the health score of a suspected abnormal number exceeds a certain threshold, it is added to the fraud number whitelist for management and labeled as pending classification. If not shut down immediately, the platform will shut it down, and the communication behavior of the number will continue to be tracked for another month. Finally, the suspected abnormal number is removed from the set of suspected abnormal numbers obtained in the first step, resulting in the final set of abnormal numbers.

[0163] like Figure 9 As shown, the sample processing steps in the embodiments of this disclosure include:

[0164] Step S902, statistical characteristic indicators.

[0165] We statistically analyzed 17 behavioral characteristics of all online users during the 30-day window period, including voice calls, data usage, income, online activity, activity level, and number of payments. The specific meanings of these characteristics are shown in Table 2 below.

[0166] Table 2

[0167]

[0168] Step S904, constructing a feature map.

[0169] The above 17 feature indicators are preprocessed, including normalization, missing value filling, and outlier processing, etc. Then, an N*M feature matrix is constructed for each number, where N is the number of days in the window period, and M is the number of behavioral feature indicators. In an embodiment of the present disclosure, each number is a 30*17 feature matrix. Further, the feature matrix is converted into a feature map.

[0170] Step S906, label division of target variable.

[0171] The fraud numbers reported by the public security bureau during “20210306-20210406” are searched in the sample user numbers. If the number exists, the number label is defined as an abnormal number, otherwise as a normal number. According to this method, each sample number is labeled with a classification label.

[0172] Step S908, determining a training sample set and a test sample set.

[0173] The feature map and number classification label of each number constitute a sample, and the embodiment of the present disclosure totals 871889 samples. Then, all samples are randomly sampled according to 7:3, 70% of the data is used as a training sample set, and 30% is used as a test sample set.

[0174] In an exemplary embodiment of the present disclosure, the abnormal communication number recognition device 1100 is further configured to: determine the average value and the standard deviation of the feature indicator data; determine the influence factor of the feature indicator data according to the average value and the standard deviation; determine the sum value of the influence factors of the feature indicator data in the feature indicator data; and determine the weight of any feature indicator data according to the ratio between the influence factor and the sum value of the influence factors.

[0175] In an exemplary embodiment of the present disclosure, the abnormal communication number recognition device 1100 is further configured to: determine the current center point of the feature indicator data; cyclically determine the point with the maximum distance from the current center point as a new center point, and remove the current center point, until the number of determined clustering center points in the feature indicator data reaches a preset number; and determine the clustering algorithm with the preset number of clustering center points as the improved clustering algorithm.

[0176] In an exemplary embodiment of the present disclosure, the determination module 1104 is further configured to: determine the number of each sub-item indicator in the feature indicator data; and determine the weight of the sub-item indicator according to the number and the weight of the feature indicator data.

[0177] In an example embodiment of the present disclosure, the determining module 1104 is further configured to calculate a standard score of the feature index data by a kernel density function, the kernel density function being subject to a normal distribution.

[0178] In an example embodiment of the present disclosure, the determining module 1104 is further configured to assume that a coordinate of a highest point of the normal distribution is a specified coordinate; and calculate a standard value of the feature index data according to a size relationship between a coordinate value of the feature index data and the specified coordinate.

[0179] Since the functions of the apparatus 1100 have been described in detail in the corresponding method embodiments, the present disclosure will not be described here again.

[0180] It should be noted that although several modules or units of the device for action execution are mentioned in the foregoing detailed description, such division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into embodied by multiple modules or units.

[0181] In an example embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0182] Those skilled in the art can understand that various aspects of the present disclosure can be implemented as a system, a method or a program product. Therefore, various aspects of the present disclosure can be embodied as a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0183] The electronic device 1200 according to this embodiment of the present disclosure will be described below with reference to Figure 12 Figure 12 The displayed electronic device 1200 is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0184] As Figure 12 shown, the electronic device 1200 is in the form of a general computing device. The components of the electronic device 1200 can include, but are not limited to, the at least one processing unit 1210 described above, the at least one storage unit 1220 described above, and a bus 1230 connecting different system components, including the storage unit 1220 and the processing unit 1210.

[0185] ​The storage unit stores program codes which can be executed by the processing unit 1210, so that the processing unit 1210 performs the steps described in the above “Exemplary Method” section according to various exemplary embodiments of the present application. For example, the processing unit 1210 can perform the method as shown in the embodiments of the present disclosure.

[0186] The storage unit 1220 can include a readable medium in the form of volatile storage unit, such as a random access memory (RAM) 12201 and / or a cache memory 12202, and further include a read-only memory (ROM) 12203.

[0187] The storage unit 1220 can further include program / utility 12204 having a set of programs / modules 12205, including an operating system, one or more application programs, other programs, and programmatic data, each or any combination thereof, which can include implementation of a network environment.

[0188] The bus 1230 can represent one or more of several types of bus structures, including a storage unit bus or bus controller, a peripheral bus, a graphics acceleration port, a processing unit bus, or a local bus using any of a variety of bus architectures.

[0189] The electronic device 1200 can also communicate with one or more external devices 1240 such as a keyboard or pointing device, a Bluetooth device, etc.; other devices such as a storage device or an external effects device; and / or one or more devices that enable a user to interact with the electronic device 1200; and / or one or more devices that enable the electronic device 1200 to communicate with one or more other computing devices. Such communication can be via the input / output (I / O) interface 1250. The electronic device 1200 can also communicate with one or more networks such as a local area network (LAN), a wide area network (WAN), and / or the Internet through a network adapter 1260. The network adapter 1260 can be any of a variety of modems, including cable modem, digital subscriber line (DSL), and / or the like. As shown, the network adapter 1260 communicates with the other components of the electronic device 1200 through the bus 1230. It should be understood that various other hardware and / or software elements can be used in conjunction with the electronic device 1200. These include but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0190] Those skilled in the art can easily understand from the above description of the embodiments that the example embodiments described herein can be implemented by software or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or on a network, and includes a number of instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the methods according to the embodiments of the present disclosure.

[0191] In the example embodiments of the present disclosure, a computer readable storage medium is also provided, on which a program product capable of implementing the above-mentioned method of the present disclosure is stored. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes program codes for causing a terminal device to perform the steps according to various example embodiments of the present disclosure described in the above-mentioned “example method” section of the present disclosure when the program product is run on the terminal device.

[0192] The program product for implementing the above-mentioned method according to the embodiments of the present disclosure can adopt a portable compact disc read-only memory (CD-ROM) and include program codes, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited to this, and in the present document, the readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, device, or apparatus.

[0193] The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium may, for example, be but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0194] A computer readable signal medium can include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that can be

[0195] Program code embodied on a computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0196] Computer program code for carrying out operations for aspects of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider. The application is not limited to a specific programming language or computer system.

[0197] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. One skilled in the relevant art will recognize that the embodiments described herein can be practiced with embodiments that are not exactly as described above, without parting from the spirit and scope of the present application. In addition, it should be appreciated that structural features or aspects of the application can be used separately, combined in any combination, or sub-combined in any manner.

[0198] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the present application cover any and all variations of the application that come within the scope of the claims and their equivalents. It is intended that the specification and examples be considered exemplary only, with the true scope and spirit of the application being indicated by the following claims.

Claims

1. A method of identifying an abnormal communication number, characterized by, The method comprises the following steps: performing clustering processing on feature indicator data of any suspected abnormal number output by a trained deep learning model through an improved clustering algorithm; determining the weight of each item indicator in the feature indicator data after clustering processing; determining the standard score of each item indicator in the feature indicator data, comprising: calculating the standard score of the feature indicator data through a kernel density function, wherein the kernel density function is subject to a normal distribution, comprising: assuming that the coordinates of the highest point position of the normal distribution are specified coordinates; calculating the standard value of the feature indicator data according to the size relationship between the coordinate value of the feature indicator data and the specified coordinates; calculating the abnormality score of each item indicator according to the weight and the standard score; determining that the suspected abnormal number is an abnormal number according to the abnormality score; determining the current center point of a non-equilibrium data set of the feature indicator data; determining the point with the maximum distance from the current center point as a new center point in a loop, and removing the current center point until the number of determined clustering center points in the feature indicator data reaches a preset number; determining the clustering algorithm with the preset number of clustering center points as the improved clustering algorithm.

2. The method of claim 1, wherein the step of identifying the abnormal communication number is performed by the processor of the mobile terminal. Before performing clustering processing on feature indicator data of suspected abnormal numbers output by a trained deep learning model through an improved clustering algorithm, the method further comprises the following steps: collecting a sample set of feature indicator data of communication numbers; constructing a loss function of the deep learning model according to a cross-entropy function and a focal loss function; training the deep learning model through the sample set of feature indicator data and the loss function.

3. The method of claim 1, wherein the step of identifying the abnormal communication number is performed by the steps of: The method further comprises the following steps: ​ determining the mean value and the standard deviation of the feature indicator data; determining the influence factor of the feature indicator data according to the mean value and the standard deviation; determining the sum value of the influence factors of the feature indicator data in the feature indicator data; determining the weight of any feature indicator data according to the ratio between the influence factor and the sum value of the influence factors.

4. The method of claim 1, wherein the step of identifying the abnormal communication number is performed by the steps of: The method of determining the weight of each item indicator in the feature indicator data after clustering processing comprises the following steps: ​ determining the number of each item indicator in the feature indicator data; determining the weight of the item indicator according to the number and the weight of the feature indicator data.

5. An apparatus for identifying an abnormal communication number, characterized by comprising: The method comprises the following steps: a clustering module is configured to perform clustering processing on feature indicator data of any suspected abnormal number output by a trained deep learning model through an improved clustering algorithm; a determination module is configured to determine the weight of each item indicator in the feature indicator data after clustering processing; the determination module is configured to determine the standard score of each item indicator in the feature indicator data, comprising: calculating the standard score of the feature indicator data through a kernel density function, wherein the kernel density function is subject to a normal distribution, comprising: assuming that the coordinates of the highest point position of the normal distribution are specified coordinates; calculating the standard value of the feature indicator data according to the size relationship between the coordinate value of the feature indicator data and the specified coordinates; a calculation module is configured to calculate the abnormality score of each item indicator according to the weight and the standard score. The determining module is configured to determine the suspected abnormal number as an abnormal number according to the abnormality score; determine a current center point of a non-equilibrium data set of the feature index data; determine a point with a maximum distance from the current center point as a new center point, and remove the current center point until a number of determined cluster center points in the feature index data reaches a preset number; determine a clustering algorithm with the preset number of cluster center points as the improved clustering algorithm.

6. An electronic device, comprising: comprise: a memory; and a processor coupled to the memory, the processor being configured to execute a method for identifying an abnormal communication number based on instructions stored in the memory, as claimed in any one of claims 1-4.

7. A computer readable storage medium having stored thereon a program which, when executed by a processor, implements a method for identifying an abnormal communication number, as claimed in any one of claims 1-4.

Images