A method and device for constructing an analysis model based on communication data

Abstract

The present invention provides a method and device for constructing an analysis model based on communication data, including collecting communication data related to clues of an event to be analyzed, extracting core attribute data from the communication data and classifying them into multiple types, and using each type as a calculation factor; presetting corresponding model conditions and proportional operation rules for each calculation factor according to event clues, and then converting the data that meets the model conditions in each calculation factor into corresponding scores through corresponding proportional operation rules; weightedly adding and calculating the scores corresponding to each calculation factor to obtain the total score of this analysis; constructing an analysis model based on communication data according to the above steps to analyze the organization and members of the organization related to the event. The present invention can be applied to the analysis of clues of abnormal entry and exit of items carried in and out of the country based on communication and other event research, which greatly improves the analysis ability and work efficiency of the staff and has broad application prospects.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic forensics, and in particular to a method and device for constructing an analysis model based on communication data. Background Art

[0002] The main technical means for handling irregular items entering and leaving the country are currently to analyze the contact objects based on call log data, but the patterns and characteristics of organizations carrying irregular items entering and leaving the country have not been discovered, and no data processing model has been established. The data quality is low, and a large number of staff are required to conduct manual analysis and judgment, which greatly reduces work efficiency.

[0003] The prior art has the following deficiencies:

[0004] 1. Insufficient technical means, mainly relying on experience. Existing technical means are based on analysis tools for research and analysis, such as using call record analysis software to analyze the communication relationship between numbers, or using bill analysis software to analyze the transfer relationship between bank cards. They mainly rely on the experience of intelligence researchers to make manual judgments. There is no research based on the rules of call records of abnormal entry and exit of items, extracting key core data, establishing data analysis models, and improving the analysis quality and efficiency of intelligence researchers.

[0005] 2. Although there are rules to follow, the data value is not mined and the research and judgment model is not solidified. The original research and judgment analysis mainly focuses on the analysis of the call object entity, without effectively mining the value of the data, abstracting the core attributes of the data, and forming an analysis and judgment model.

[0006] Based on the data research of call records of abnormally carried items entering and leaving the country, this paper proposes a model construction method and device based on communication data. Summary of the invention

[0007] The present invention proposes a method and device for constructing an analysis model based on communication data to solve the defects of the prior art mentioned above.

[0008] In one aspect, the present invention proposes a method for constructing an analysis model based on communication data, the method comprising the following steps:

[0009] S1: collecting communication data related to clues of the event to be analyzed for analysis, and extracting core attribute data from the communication data, classifying the core attribute data into multiple types, and taking each type as a calculation factor;

[0010] S2: Pre-setting corresponding model conditions and proportional operation rules for each calculation factor according to event clues, and then converting the data that meets the model conditions in each calculation factor into corresponding scores according to the corresponding proportional operation rules;

[0011] S3: Perform weighted accumulation calculation on the scores corresponding to the calculation factors to obtain the total score of this analysis;

[0012] S4: constructing an analysis model based on communication data according to S1 to S3, performing multiple analyses based on the analysis model, and thereby analyzing the organization and members of the organization related to the event based on the scores of the calculation factors and the total score obtained from the multiple analyses.

[0013] The above method analyzes the communication record data and extracts the core attribute data, including time data, location data, main number data, object number data, communication type data, and time continuity and location relationship. Combined with the rules of abnormal entry and exit activities, an automated analysis model based on abnormal entry and exit is established. This model mainly relies on the elements of the above communication record data as calculation factors. By performing independent model calculations on each calculation factor and setting the model condition percentage, the calculation results of each model condition are weighted and matched one by one with the organizational role conditions set by the system, and the clue numbers connected to the system are automatically labeled with role labels according to the model conditions. The analysis model constructed by this method has greatly improved the analysis ability and work efficiency of intelligence analysts.

[0014] In a specific embodiment, the core attribute data is classified into multiple types, and the multiple types include:

[0015] Communication time data: data representing the communication time range of the event to be analyzed that is of key concern;

[0016] Communication location data: data representing the concentrated location of the area of ​​focus of the event to be analyzed;

[0017] Main contact number data: relevant characteristic data of the main contact number of the event to be analyzed;

[0018] Contact object number data: relevant characteristic data representing the number of the contact object of the event to be analyzed;

[0019] Communication type data: relevant characteristic data characterizing the communication type of focus of the event to be analyzed;

[0020] Communication time continuation data: characterizes the continuation and disconnection of the key time nodes of the event to be analyzed;

[0021] Relationship data of communication locations: data representing the relationship between the regional cluster locations where the various members of the organization that is the focus of the event to be analyzed appear.

[0022] In a specific embodiment, when the communication time data is used as a calculation factor, the specific steps of S2 include:

[0023] According to the communication time range that is focused on in the analysis process of the event to be analyzed, the time range interval that the data in the operation rule needs to meet is set, and the time range interval is set as the model condition corresponding to the communication time data;

[0024] Counting the number of the communication time data that meets the time range interval to obtain the number of times that meet the condition;

[0025] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication time data to obtain a corresponding score.

[0026] In a specific embodiment, when the communication location data is used as a calculation factor, the specific steps of S2 include:

[0027] According to the data of the regional aggregation position that is focused on during the analysis of the event to be analyzed, a visual map is used to circle the position range of the regional aggregation position that is focused on on the visual map, and the position range is set as a model condition corresponding to the communication position data;

[0028] The number of the communication location data that meets the location range is counted to obtain the number of times that the condition is met:

[0029] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional operation rule corresponding to the communication location data to obtain a corresponding score.

[0030] In a specific embodiment, when the communication main number data is used as a calculation factor, the specific steps of S2 include:

[0031] According to the relevant characteristic data of the communication main number focused on in the analysis process of the event to be analyzed, a main number format range that meets the relevant characteristics is set, and the main number format range is set as a model condition corresponding to the communication main number data;

[0032] Counting the number of the communication main number data that meets the main number format range to obtain the number of times that the condition is met;

[0033] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication main number data to obtain a corresponding score.

[0034] In a specific embodiment, when the communication object number data is used as a calculation factor, the specific steps of S2 include:

[0035] According to the relevant characteristic data of the communication object number that is focused on in the analysis process of the event to be analyzed, an object number format range that meets the relevant characteristics is set, and the object number format range is set as a model condition corresponding to the communication object number data;

[0036] Counting the number of the communication object number data that meets the object number format range to obtain the number of times that the condition is met;

[0037] Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional calculation rule corresponding to the communication object number data to obtain a corresponding score.

[0038] In a specific embodiment, when the communication type data is used as a calculation factor, the specific steps of S2 include:

[0039] According to the relevant characteristic data of the communication type focused on in the analysis process of the event to be analyzed, a range of communication types that meet the relevant characteristics is set, and the range of the communication types is set as a model condition corresponding to the communication type data;

[0040] Counting the number of the communication type data that meets the range of the communication type to obtain the number of times the condition is met;

[0041] Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional operation rule corresponding to the communication type data to obtain a corresponding score.

[0042] In a specific embodiment, when the communication time duration data is used as a calculation factor, the specific steps of S2 include:

[0043] According to the continuation and disconnection of the time nodes focused on in the analysis process of the event to be analyzed, determine whether the time nodes of the communication record are continuous, so as to set the disconnected state as the disconnected state when the connected time exceeds a certain time, and set the disconnected state as the model condition corresponding to the connection time continuation data;

[0044] Counting the number of the communication time duration data that meets the non-communication state to obtain the number of times that meet the condition;

[0045] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication time duration data to obtain a corresponding score.

[0046] In a specific embodiment, when the relationship data of the communication location is used as a calculation factor, the specific steps of S2 include:

[0047] An effective area range is set according to the regional cluster position that is focused on during the analysis of the event to be analyzed. When two members of the organization appear at the same time in the effective area range, it means that the same-frequency location condition is met, and the same-frequency location condition is set as the model condition corresponding to the communication time duration data;

[0048] Counting the number of the communication time duration data that meets the same-frequency location condition to obtain the number of times the condition is met;

[0049] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication time duration data to obtain a corresponding score.

[0050] According to a second aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a computer processor, the above method is implemented.

[0051] According to a third aspect of the present invention, a device for constructing an analysis model based on communication data is provided, the device comprising:

[0052] Communication data extraction and classification module: configured to collect communication data related to clues of the event to be analyzed for analysis, and extract core attribute data from the communication data, classify the core attribute data into multiple types, and use each type as a calculation factor;

[0053] The score calculation model building module is configured to pre-set corresponding model conditions and proportional operation rules for each calculation factor according to event clues, and then convert the data that meets the model conditions in each calculation factor into corresponding scores through the corresponding proportional operation rules;

[0054] Score accumulation module: configured to perform weighted accumulation calculation on the scores corresponding to the calculation factors to obtain the total score of this analysis;

[0055] Automated analysis module: configured to construct an analysis model based on the communication data according to the communication data extraction and classification module to the score accumulation module, and perform multiple analyses based on the analysis model, so as to analyze the organization related to the event and the members of the organization based on the scores of the calculation factors and the total score obtained from the multiple analyses.

[0056] The present invention analyzes the communication record data, extracts the core attribute data, including time data, location data, main number data, object number data, communication type data, and time continuity, location relationship, etc., and extracts elements, and combines the rules of abnormal entry and exit activities to establish a set of automated analysis models based on abnormal entry and exit of items. The model mainly relies on the elements of the above communication record data as calculation factors, and performs independent model calculations on each calculation factor and sets the model condition percentage, and performs weighted calculations on the calculation results of each model condition, and matches them one by one with the organizational role conditions set by the system, and automatically tags the clue numbers connected to the system according to the model conditions. The analysis model constructed by the present invention greatly improves the analysis ability and work efficiency of intelligence researchers. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and together with the description are used to explain the principles of the present invention. Other embodiments and many expected advantages of the embodiments will be readily appreciated as they become better understood by reference to the following detailed description. Other features, objects and advantages of the present application will become more apparent by reading the detailed description of the non-limiting embodiments made with reference to the following drawings:

[0058] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0059] Figure 2 is a flow chart of a method for constructing an analysis model based on communication data according to an embodiment of the present invention;

[0060] Figure 3 It is a diagram of the overall data model and calculation factor structure of a specific embodiment of the present invention;

[0061] Figure 4 It is a framework diagram of a device for constructing an analysis model based on communication data according to an embodiment of the present invention;

[0062] Figure 5 It is a structural diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0063] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0064] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0065] Figure 1 An exemplary system architecture 100 is shown to which an analysis model building method based on communication data according to an embodiment of the present application can be applied.

[0066] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0067] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various applications can be installed on terminal devices 101, 102, 103, such as data processing applications, data visualization applications, web browser applications, etc.

[0068] Terminal devices 101, 102, 103 can be hardware or software. When terminal devices 101, 102, 103 are hardware, they can be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc. When terminal devices 101, 102, 103 are software, they can be installed in the electronic devices listed above. They can be implemented as multiple software or software modules (for example, software or software modules used to provide distributed services), or they can be implemented as a single software or software module. No specific limitation is made here.

[0069] The server 105 may be a server that provides various services, such as a background information processing server that provides support for the communication data displayed on the terminal devices 101, 102, and 103. The background information processing server may process the obtained scores and generate processing results (such as a total score).

[0070] It should be noted that the method provided in the embodiment of the present application can be executed by the server 105, and can also be executed by the terminal devices 101, 102, 103. The corresponding device is generally set in the server 105, and can also be set in the terminal devices 101, 102, 103.

[0071] It should be noted that the server can be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or it can be implemented as a single server. When the server is software, it can be implemented as multiple software or software modules (for example, software or software modules used to provide distributed services), or it can be implemented as a single software or software module. No specific limitation is made here.

[0072] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0073] According to an embodiment of the present invention, a method for constructing an analysis model based on communication data is provided. Figure 2 FIG. 2 is a flow chart showing a method for constructing an analysis model based on communication data according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0074] S1: collecting communication data related to clues of the event to be analyzed for analysis, and extracting core attribute data from the communication data, classifying the core attribute data into multiple types, and taking each type as a calculation factor;

[0075] S2: Pre-setting corresponding model conditions and proportional operation rules for each calculation factor according to event clues, and then converting the data that meets the model conditions in each calculation factor into corresponding scores according to the corresponding proportional operation rules;

[0076] S3: Perform weighted accumulation calculation on the scores corresponding to the calculation factors to obtain the total score of this analysis;

[0077] S4: constructing an analysis model based on communication data according to S1 to S3, performing multiple analyses based on the analysis model, and thereby analyzing the organization and members of the organization related to the event based on the scores of the calculation factors and the total score obtained from the multiple analyses.

[0078] In a specific embodiment, the core attribute data is classified into multiple types, and the multiple types include:

[0079] Contact time data: data representing the contact time range of the event to be analyzed that is of key concern:

[0080] Communication location data: data representing the focus area of ​​the event to be analyzed:

[0081] Main contact number data: Characteristic data related to the main contact number of the event to be analyzed:

[0082] Contact object number data: Characteristic data related to the number of the contact object that is the focus of the event to be analyzed:

[0083] Communication type data: relevant characteristic data characterizing the communication type of the event to be analyzed that is of key concern:

[0084] Communication time continuation data: characterizes the continuation and disconnection of the key time nodes of the event to be analyzed:

[0085] Relationship data of communication locations: data representing the relationship between the regional cluster locations where the various members of the organization that is the focus of the event to be analyzed appear.

[0086] In a specific embodiment, when the communication time data is used as a calculation factor, the specific steps of S2 include:

[0087] According to the communication time range that is focused on in the analysis process of the event to be analyzed, the time range interval that the data in the operation rule needs to meet is set, and the time range interval is set as the model condition corresponding to the communication time data;

[0088] Counting the number of the communication time data that meets the time range interval to obtain the number of times that meet the condition;

[0089] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication time data to obtain a corresponding score.

[0090] In a specific embodiment, when the communication location data is used as a calculation factor, the specific steps of S2 include:

[0091] According to the data of the regional aggregation position focused on during the analysis of the event to be analyzed, the position range of the regional aggregation position focused on on the visual map is determined using a visual map, and the position range is set as a model condition corresponding to the communication position data;

[0092] The number of the communication location data that meets the location range is counted to obtain the number of times that the condition is met:

[0093] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional operation rule corresponding to the communication location data to obtain a corresponding score.

[0094] In a specific embodiment, when the communication main number data is used as a calculation factor, the specific steps of S2 include:

[0095] According to the relevant characteristic data of the communication main number focused on in the analysis process of the event to be analyzed, a main number format range that meets the relevant characteristics is set, and the main number format range is set as the model condition corresponding to the communication main number data:

[0096] The number of the communication main number data that meets the main number format range is counted to obtain the number of times that the condition is met:

[0097] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication main number data to obtain a corresponding score.

[0098] In a specific embodiment, when the communication object number data is used as a calculation factor, the specific steps of S2 include:

[0099] According to the relevant characteristic data of the communication object number that is focused on in the analysis process of the event to be analyzed, an object number format range that meets the relevant characteristics is set, and the object number format range is set as a model condition corresponding to the communication object number data;

[0100] Counting the number of the communication object number data that meets the object number format range to obtain the number of times that the condition is met;

[0101] Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional calculation rule corresponding to the communication object number data to obtain a corresponding score.

[0102] In a specific embodiment, when the communication type data is used as a calculation factor, the specific steps of S2 include:

[0103] According to the relevant characteristic data of the communication type focused on in the analysis process of the event to be analyzed, a range of communication types that meet the relevant characteristics is set, and the range of the communication types is set as a model condition corresponding to the communication type data;

[0104] Counting the number of the communication type data that meets the range of the communication type to obtain the number of times the condition is met;

[0105] Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional operation rule corresponding to the communication type data to obtain a corresponding score.

[0106] In a specific embodiment, when the communication time duration data is used as a calculation factor, the specific steps of S2 include:

[0107] According to the continuation and disconnection of the time nodes focused on in the analysis process of the event to be analyzed, determine whether the time nodes of the communication record are continuous, so as to set the disconnected state as the disconnected state when the connected time exceeds a certain time, and set the disconnected state as the model condition corresponding to the connection time continuation data;

[0108] Counting the number of the communication time duration data that meets the non-communication state to obtain the number of times that meet the condition;

[0109] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication time duration data to obtain a corresponding score.

[0110] In a specific embodiment, when the relationship data of the communication location is used as a calculation factor, the specific steps of S2 include:

[0111] An effective area range is set according to the regional cluster position that is focused on during the analysis of the event to be analyzed. When two members of the organization appear at the same time in the effective area range, it means that the same-frequency location condition is met, and the same-frequency location condition is set as the model condition corresponding to the communication time duration data;

[0112] Counting the number of the communication time duration data that meets the same-frequency location condition to obtain the number of times the condition is met;

[0113] Then, according to the number of times the condition is met, proportional conversion is performed based on the proportional calculation rule corresponding to the communication time duration data to obtain a corresponding score.

[0114] The construction of the analysis model of the present invention is described below using a specific embodiment. Figure 3 It is an overall data model and calculation factor structure diagram of a specific embodiment of the present invention.

[0115] Figure 3 The calculation factors and their corresponding score calculation methods shown in are described as follows:

[0116] 1. Contact time

[0117] Take the time point of the communication record as the calculation factor. For example, set the model condition to 0:00 to 5:00 in the morning. Use the following formula to calculate the data. First, determine whether the model condition is met. On this basis, calculate the interval range data. Refer to the following formula to obtain the proportional score of the model condition. The formula is as follows:

[0118] (1) R = Time (D) ∈

[05] . D is the communication time.

[0119] Line judgment, R is the result of conditional judgment:

[0120] (2) C = Count(R). C is the number of times the condition is met;

[0121] (3)S=(C>=10):15? (C>=5):10: (C>=1):5:0.

[0122] S is the calculation result. The score S calculated according to the model condition formula is added to the score of each organizational role label and converted into the proportion of the organizational role according to the proportion of the full score.

[0123] 2. Communication location

[0124] Using the location data of the communication record as the calculation factor, the location range of the gathering places in the key areas is determined through the visual map, and the effective range is controlled within 500 meters to determine whether the longitude and latitude data meet the model conditions. On this basis, the number of times the model conditions are met is accumulated for score calculation. Refer to the following formula to obtain the proportional score of the model conditions. The formula is as follows:

[0125] (1)d=R*arcos[cos(y1)*cos(y2)*cos(x1-x2)+s in(y1)*s in(y2)]:

[0126] d is the distance between the two locations, R is the radius of the earth 6371km, x1, y1 are the longitude and latitude of the communication location, x2, y2 are the longitude and latitude of the key area gathering place set by the model conditions;

[0127] (2) C = Count (d <= 500). C is the number of times the condition is met;

[0128] (3)S=(C>=10):5? (C>=1):3:0.

[0129] S is the calculation result. The score S calculated according to the model condition formula is added to the score of each organizational role label and converted into the proportion of the organizational role according to the proportion of the full score.

[0130] 3. Same frequency position (i.e. relationship data of communication position)

[0131] The communication location data of the organization members is used as a calculation factor to determine whether the communication locations of the organization members are in the same area. The communication latitude and longitude data of each team member are compared. Those within the effective range of 500 meters are considered to be in the same frequency position. First, determine whether the model conditions are met. On this basis, the interval range data is calculated. Refer to the following formula to obtain the proportional score of the model conditions. The formula is as follows:

[0132] (1)d=R*arcos[cos(y1)*cos(y2)*cos(x1-x2)+s in(y1)*s in(y2)]:

[0133] Where d is the distance between the communication locations of the two organization members, R is the radius of the earth 6371km, x1, y1 are the longitude and latitude of the communication location of organization member 1, x2, y2 are the longitude and latitude of the communication location of organization member 2, and so on, to obtain the data of the communication locations of the organization members at the same frequency;

[0134] (2) C = Count (d <= 500). C is the number of times the condition is met;

[0135] (3)S=(C>=10):5? (C>=1):3:0.

[0136] S is the calculation result. The score S calculated according to the model condition formula is added to the score of each organizational role label and converted into the proportion of the organizational role according to the proportion of the full score.

[0137] 4. Main number (work phone)

[0138] Take the main number of the communication record as the calculation factor. For example, set the model condition as the main number type to start with an overseas number (00852, 00853, 00886, etc.) or a virtual number segment number (165.167, 170, 171, 184, etc.). Use the following formula to calculate the data. First, determine whether the model condition is met. If the condition is met, the main number can be set as a working phone. At the same time, the interval range data is calculated on this basis to obtain the proportional score of the model condition. The formula is as follows:

[0139] S=R1:10?R2:5:0.

[0140] S is the calculation result, R1 satisfies the overseas number condition, and R2 satisfies the virtual number segment condition. The score S calculated according to the model condition formula is added to the score of each organizational role label and converted into the proportion of the organizational role based on the full score ratio.

[0141] 5. Communication time continuation (taking the time gap state as an example)

[0142] The communication time of the communication record is used as the calculation factor to determine whether the time node of the communication record is continuous. The model condition is set as whether there is no communication for more than 24 hours (fault). The data is calculated using the following formula. On this basis, the interval range data is calculated. Referring to the following formula, the proportional score of the model condition is obtained. The formula is as follows:

[0143] (1) h = d1 - d2;

[0144] Where h is the time difference in hours, d1 is the contact time of contact record 1, and d2 is the contact time of contact record 2. The calculation is done in order of time.

[0145] (2) C = Count (h> = 24). C is the number of times the condition is met;

[0146] (3)S=(C>=3):10? (C>=1):5:0.

[0147] S is the calculation result. The score S calculated according to the model condition formula is added to the score of each organizational role label and converted into the proportion of organizational roles based on the proportion of full marks.

[0148] 6. Contact object (taking satellite number as an example)

[0149] The other party's number in the communication record is used as the calculation factor. For example, the model condition is set to the other party's number type starting with a satellite number (134925, 134930, 0087, 0580, 1749, etc.). The data is calculated using the following formula, and the interval range data is calculated on this basis to obtain the proportional score of the model condition. The formula is as follows:

[0150] (1) C = Count (R). C is the number of times the condition is met, and R is the number of the contact object.

[0151] (2)S=(C>=5):10? (C>=1):5:0.

[0152] S is the calculation result. The score S calculated according to the model condition formula is added to the score of each organizational role label and converted into the proportion of organizational roles based on the proportion of full marks.

[0153] 7. Communication type (taking SMS transfer as an example)

[0154] The communication type of the communication record is used as the calculation factor. By determining that the communication type is SMS and bank SMS (for example, the number is 95533, etc.), and that there is a communication record within 30 minutes before and after, this is used as the model condition for judgment. The interval range data is calculated based on the satisfaction of the model condition. Referring to the following formula, the proportion score of the model condition is obtained. The formula is as follows:

[0155] (1) C = Count(R). C is the number of times the condition is met, and R is the set model condition, which satisfies the SMS transfer and the communication record.

[0156] (2)S=(C>=3):10? (C>=1):5:0.

[0157] S is the calculation result. The score S calculated according to the model condition formula is added to the score of each organizational role label and converted into the proportion of organizational roles based on the full score ratio.

[0158] Through the above-mentioned conditional settings of the analysis model for the entry and exit of abnormal items, the communication record data is automatically analyzed for analysis and early warning, and potential organization members are automatically discovered, providing effective data support for the intelligent judgment and analysis of combating the entry and exit of abnormal items.

[0159] At present, the analysis of the entry and exit of abnormal items in the market is mainly based on analysis tools. The information and relationships of the objects of concern are found through analysis tools. This solution studies the data of the model of the entry and exit of abnormal items, and proposes a data research and processing method based on the model of the entry and exit of abnormal items. By building an automated analysis model to automatically analyze the data, combined with the laws and characteristics of the organization of the entry and exit of abnormal items, it has achieved good results in the intelligent judgment and analysis of combating the entry and exit of abnormal items.

[0160] This method and device can not only be used in the analysis of clues of abnormal entry and exit of articles based on communication, but can also be used as a basis for the study of other events, such as economic events based on capital transactions. It is only necessary to adjust the relevant data parameters of the model, and the application prospect is broad.

[0161] Figure 4 The framework diagram of a communication data-based analysis model construction device according to an embodiment of the present invention is shown. The device comprises a communication data extraction and classification module 401, a score calculation model construction module 402, a score accumulation module 403 and an automatic analysis module 404.

[0162] In a specific embodiment, the communication data extraction and classification module 401 is configured to collect communication data related to clues of the event to be analyzed for analysis, and extract core attribute data from the communication data, classify the core attribute data into multiple types, and use each type as a calculation factor;

[0163] The score calculation model building module 402 is configured to pre-set corresponding model conditions and proportional operation rules for each calculation factor according to event clues, and then convert the data that meets the model conditions in each calculation factor into corresponding scores according to the corresponding proportional operation rules;

[0164] The score accumulation module 403 is configured to perform weighted accumulation calculation on the scores corresponding to the calculation factors to obtain the total score of this analysis;

[0165] The automated analysis module 404 is configured to construct an analysis model based on the communication data according to the communication data extraction and classification module to the score accumulation module, and perform multiple analyses based on the analysis model, thereby analyzing the organization related to the event and the members of the organization based on the scores of the calculation factors and the total score obtained from the multiple analyses.

[0166] This device analyzes the communication record data and extracts core attribute data, including time data, location data, main number data, object number data, communication type data, and time continuity, location relationship, etc., and combines the rules of abnormal entry and exit activities to establish an automated analysis model based on abnormal entry and exit of items. This model mainly relies on the elements of the above communication record data as calculation factors. By performing independent model calculations on each calculation factor and setting the model condition percentage, the calculation results of each model condition are weighted and matched one by one with the organizational role conditions set by the device, and the clue numbers connected to the system are automatically labeled with role labels according to the model conditions. The analysis model constructed by this device has greatly improved the analysis ability and work efficiency of intelligence analysts.

[0167] Reference below Figure 5 , which shows a schematic diagram of the structure of a computer system 500 suitable for implementing an electronic device of an embodiment of the present application. Figure 5 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0168] like Figure 5 As shown, computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. Various programs and data required for the operation of system 500 are also stored in RAM 503. CPU 501, ROM 502 and RAM 503 are connected to each other via a bus 505. An input / output (I / O) interface 505 is also connected to bus 504.

[0169] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.: an output section 507 including a liquid crystal display (LCD), etc. and a speaker, etc.: a storage section 508 including a hard disk, etc.: and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed so that a computer program read therefrom is installed into the storage section 508 as needed.

[0170] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above functions defined in the method of the present application are executed. It should be noted that the computer-readable storage medium described in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.

[0171] Computer program code for carrying out operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as C++.

[0172] The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0173] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0174] The modules involved in the embodiments described in the present application may be implemented by software or hardware. The units described may also be arranged in a processor, and the names of these units do not constitute limitations on the units themselves in certain circumstances.

[0175] An embodiment of the present invention further relates to a computer-readable storage medium having a computer program stored thereon, which implements the method described above when the computer program is executed by a computer processor. The computer program includes program code for executing the method shown in the flowchart. It should be noted that the computer-readable medium of the present application may be a computer-readable signal medium or a computer-readable medium or any combination of the above two.

[0176] The present invention analyzes the communication record data, extracts the core attribute data, including time data, location data, main number data, object number data, communication type data, and time continuity, location relationship, etc., and extracts elements, and combines the rules of abnormal entry and exit activities to establish a set of automated analysis models based on abnormal entry and exit of items. The model mainly relies on the elements of the above communication record data as calculation factors, and performs independent model calculations on each calculation factor and sets the model condition percentage, and performs weighted calculations on the calculation results of each model condition, and matches them one by one with the organizational role conditions set by the system, and automatically tags the clue numbers accessed by the system with role labels according to the model conditions. The analysis model constructed by this method greatly improves the analysis ability and work efficiency of intelligence researchers.

[0177] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A method for constructing an analysis model based on communication data, characterized in that: The following steps are involved: S1: Collect and analyze communication data related to clues of abnormal entry and exit of articles, extract core attribute data from the communication data, classify the core attribute data into multiple types, and use each type as a calculation factor; The core attribute data is classified into multiple types, including: Contact time data: data representing the contact time range of the incident of carrying items in and out of the country that is of particular concern: Communication location data: data representing the concentrated locations of key areas of concern for the incidents of carrying items in and out of the country in a normal manner; Main contact number data: Feature data related to the main contact number of the incident of carrying items in and out of the country that is of particular concern: Contact person number data: Characteristic data related to the number of the contact person of key concern in the event of abnormal entry and exit of items: Communication type data: characteristic data related to the communication type of focus of the incident of carrying items in and out of the country; Contact time continuity data: Indicates the continuity and disconnection of the key time nodes of the incident of carrying abnormal items in and out of the country: Relationship data of communication locations: data representing the relationship between the regional cluster locations where the members of the organization of focus of attention for the incident of carrying items in and out of the country abnormally appear; S2: Preset corresponding model conditions and proportional operation rules for each calculation factor according to event clues, and then convert the data that meets the model conditions in each calculation factor into corresponding scores through the corresponding proportional operation rules: When the communication time data is used as a calculation factor, the specific steps include: According to the communication time range that is focused on in the analysis of the abnormal entry and exit events, the time range interval that the data in the operation rule needs to meet is set, and the time range interval is set as the model condition corresponding to the communication time data: Counting the number of the communication time data that meets the time range interval to obtain the number of times that meet the condition; Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional calculation rule corresponding to the contact time data to obtain a corresponding score; When the communication location data is used as a calculation factor, the specific steps include: According to the data of the concentrated area locations of key concern in the analysis of the abnormal entry and exit events of the items carried in and out of the country, a visual map is used to circle the location range of the concentrated area locations of key concern on the visual map, and the location range is set as a model condition corresponding to the communication location data; The number of the communication location data that meets the location range is counted to obtain the number of times that the condition is met: Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional operation rule corresponding to the communication location data to obtain a corresponding score; When the communication object number data is used as a calculation factor, the specific steps include: According to the relevant characteristic data of the communication object number that is focused on in the analysis process of the abnormal carrying of articles in and out of the country, the object number format range that meets the relevant characteristics is set, and the object number format range is set as the model condition corresponding to the communication object number data: The number of the communication object number data that meets the object number format range is counted to obtain the number of times the condition is met: Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional operation rule corresponding to the contact object number data to obtain a corresponding score; When the communication type data is used as a calculation factor, the specific steps include: According to the relevant characteristic data of the communication type focused on in the analysis of the abnormal entry and exit event, a range of communication types that meet the relevant characteristics is set, and the range of the communication type is set as the model condition corresponding to the communication type data: The number of the communication type data that meets the range of the communication type is counted to obtain the number of times the condition is met: Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional operation rule corresponding to the communication type data to obtain a corresponding score; When the communication time duration data is used as a calculation factor, the specific steps include: According to the continuity and disconnection of the time nodes that are focused on in the analysis process of the abnormal entry and exit events, it is determined whether the time nodes of the communication record are continuous, so that if the connection time exceeds a certain time, it is set as a disconnected state, and the disconnected state is set as the model condition corresponding to the connection time continuity data: The number of the communication time duration data satisfying the non-communication state is counted to obtain the number of times that meet the condition: Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional calculation rule corresponding to the contact time duration data to obtain a corresponding score; When the relationship data of the communication location is used as a calculation factor, the specific steps include: The effective area range is set according to the regional cluster positions that are focused on during the analysis of the abnormal entry and exit events. When two members of the organization appear at the same time in the effective area range, it means that the same-frequency location condition is met. The same-frequency location condition is set as the model condition corresponding to the communication time duration data: The number of the communication time duration data satisfying the co-frequency location condition is counted to obtain the number of times the condition is satisfied: Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional calculation rule corresponding to the contact time duration data to obtain a corresponding score; S3: Perform weighted accumulation calculation on the scores corresponding to the calculation factors to obtain the total score of this analysis; S4: constructing an analysis model based on communication data according to S1 to S3, performing multiple analyses based on the analysis model, and thereby analyzing the organization and members of the organization related to the event based on the scores of the calculation factors and the total score obtained from the multiple analyses.

2. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program implements the method of claim 1 when executed by a computer processor.

3. A device for constructing an analysis model based on communication data, characterized in that: include: Communication data extraction and classification module: configured to collect communication data related to clues of abnormal entry and exit of items for analysis, and extract core attribute data from the communication data, classify the core attribute data into multiple types, and use each type as a calculation factor: The core attribute data is classified into multiple types, including: Contact time data: data representing the contact time range of the incident of carrying items in and out of the country that is of particular concern: Communication location data: data representing the concentrated locations of key areas of concern for the incidents of carrying items in and out of the country in a normal manner; Main contact number data: Feature data related to the main contact number of the incident of carrying items in and out of the country that is of particular concern: Contact person number data: Characteristic data related to the number of the contact person of key concern in the event of abnormal entry and exit of items: Communication type data: characteristic data related to the communication type of focus of the incident of carrying items in and out of the country; Contact time continuity data: Indicates the continuity and disconnection of the key time nodes of the incident of carrying abnormal items in and out of the country: Relationship data of communication locations: data representing the relationship between the regional cluster locations where the members of the organization of focus of attention for the incident of carrying items in and out of the country abnormally appear; The score calculation model building module is configured to pre-set corresponding model conditions and proportional operation rules for each calculation factor according to event clues, and then convert the data that meets the model conditions in each calculation factor into corresponding scores through the corresponding proportional operation rules; When the communication time data is used as a calculation factor, the specific steps include: According to the communication time range that is focused on in the analysis of the abnormal entry and exit events, the time range interval that the data in the operation rule needs to meet is set, and the time range interval is set as the model condition corresponding to the communication time data: Counting the number of the communication time data that meets the time range interval to obtain the number of times that meet the condition; Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional calculation rule corresponding to the contact time data to obtain a corresponding score; When the communication location data is used as a calculation factor, the specific steps include: According to the data of the concentrated area locations of key concern in the analysis of the abnormal entry and exit events of the items carried in and out of the country, a visual map is used to circle the location range of the concentrated area locations of key concern on the visual map, and the location range is set as a model condition corresponding to the communication location data; The number of the communication location data that meets the location range is counted to obtain the number of times that the condition is met: Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional operation rule corresponding to the communication location data to obtain a corresponding score; When the communication object number data is used as a calculation factor, the specific steps include: According to the relevant characteristic data of the communication object number that is focused on in the analysis process of the abnormal carrying of articles in and out of the country, the object number format range that meets the relevant characteristics is set, and the object number format range is set as the model condition corresponding to the communication object number data: The number of the communication object number data that meets the object number format range is counted to obtain the number of times the condition is met: Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional operation rule corresponding to the contact object number data to obtain a corresponding score; When the communication type data is used as a calculation factor, the specific steps include: According to the relevant characteristic data of the communication type focused on in the analysis of the abnormal entry and exit event, a range of communication types that meet the relevant characteristics is set, and the range of the communication type is set as the model condition corresponding to the communication type data: The number of the communication type data that meets the range of the communication type is counted to obtain the number of times the condition is met: Then, according to the number of times the condition is met, a proportional conversion is performed based on the proportional operation rule corresponding to the communication type data to obtain a corresponding score; When the communication time duration data is used as a calculation factor, the specific steps include: According to the continuity and disconnection of the time nodes that are focused on in the analysis process of the abnormal entry and exit events, it is determined whether the time nodes of the communication record are continuous, so that if the connection time exceeds a certain time, it is set as a disconnected state, and the disconnected state is set as the model condition corresponding to the connection time continuity data: The number of the communication time duration data satisfying the non-communication state is counted to obtain the number of times that meet the condition: Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional calculation rule corresponding to the contact time duration data to obtain a corresponding score; When the relationship data of the communication location is used as a calculation factor, the specific steps include: The effective area range is set according to the regional cluster positions that are focused on during the analysis of the abnormal entry and exit events. When two members of the organization appear at the same time in the effective area range, it means that the same-frequency location condition is met. The same-frequency location condition is set as the model condition corresponding to the communication time duration data: The number of the communication time duration data satisfying the co-frequency location condition is counted to obtain the number of times the condition is satisfied: Then, according to the number of times the condition is satisfied, a proportional conversion is performed based on the proportional calculation rule corresponding to the contact time duration data to obtain a corresponding score; Score accumulation module: configured to perform weighted accumulation calculation on the scores corresponding to each calculation factor to obtain the total score of this analysis: Automated analysis module: configured to construct an analysis model based on the communication data according to the communication data extraction and classification module to the score accumulation module, and perform multiple analyses based on the analysis model, so as to analyze the organization related to the event and the members of the organization based on the scores of the calculation factors and the total score obtained from the multiple analyses.

Images