Method, system and electronic device for identifying victims of telecom fraud

Abstract

The application discloses a kind of telecom fraud victim identification method, system and electronic equipment, wherein method includes: sample data is collected and preprocessed, and the characteristics of sample data are obtained;According to the first rule, the sample data is screened, and the sample data set is obtained by marking the screened sample data;According to sample data set, data training is carried out on the logistic regression model;According to the second rule, the sample data set is screened, and the to-be-identified sample is obtained;The weight of the trained logistic regression model is exported, and the weight is configured to online rule engine, and the telecom fraud victim in the to-be-identified sample is identified by online rule engine.The application embodiment uses real-time sample data in the first rule and the logistic regression model, uses offline population data in the second rule, mixes offline data and real-time data, solves the problem that single data type cannot be used to warn telecom fraud victims.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of victim identification, in particular to a telecom fraud victim identification method and system and electronic equipment. BACKGROUND

[0002] At the current stage, most frauds involve borrowing funds, that is, after the victim's own money is fraudulently taken by the fraudster, the victim is induced to borrow money on various lending platforms through various rhetoric, and then the money is fraudulently transferred to a designated account. In order to identify telecom fraud victims, early warning of the victim group can be performed, and for most lending platforms, certain characteristics and commonalities can be found from the victim's lending records, so that high-risk victims can be pushed in time during lending to provide early warning for police officers to further prevent fraud.

[0003] In the process of identifying telecom fraud victims, the collected sample data often needs to be labeled, the corresponding black and white sample data sets are labeled by collecting offline samples and data characteristic indicators, and then a data set is modeled through a machine learning algorithm to obtain a risk control judgment model based on offline data. The discovery of telecom fraud victims often has a high timeliness requirement. A large number of data records and characteristics will be generated in a short time on the same day, and very frequent lending records will often be shown in a short period of time. If only offline data is collected when collecting sample data without using real-time data, high-risk victims may have already been deceived.

[0004] And because the active fraud group (that is, the group of people who use various technical means to borrow and fraudulently borrow related credit products) behaves similarly to the group of people who are deceived in the lending data dimension, it is difficult to distinguish between the group of people who are deceived and the active fraud group by simply comparing real-time credit records.

[0005] Therefore, if only offline data is used, the telecom fraud victims may have already been deceived and the money transferred, and the model warning is meaningless; if only real-time data is used, the group of people who are deceived and the active fraud group may be confused, which will increase the difficulty of early warning and investigation. SUMMARY

[0006] The main purpose of the present application is to provide a telecom fraud victim identification method and system to solve the problem that only offline data or online data is used in the prior art, which cannot realize early warning of telecom fraud victims.

[0007] In order to achieve the above purpose, the first aspect of the present application provides a telecom fraud victim identification method, comprising:

[0008] Collecting sample data and preprocessing to obtain characteristics of the sample data.

[0009] determining a first rule according to the characteristics of the sample data, screening the sample data according to the first rule, and labeling the screened sample data to obtain a sample data set;

[0010] training a logistic regression model according to the sample data set;

[0011] determining a second rule based on offline population data indicating a credit risk level or a fraud level, screening the sample data set according to the second rule to obtain a sample to be identified;

[0012] deriving the weight of the trained logistic regression model and configuring the weight to an online rule engine to identify a telecom fraud victim in the sample to be identified through the online rule engine.

[0013] Optionally, the sample data includes black samples and white samples, the black samples use a telecom fraud victim population data in a day, and the white samples use all population data in the corresponding same day.

[0014] The sample data is collected and preprocessed to obtain the characteristics of the sample data, including:

[0015] The sample data is cleaned.

[0016] The sample data after data cleaning is subjected to feature engineering, and the user RFM model is used to construct features according to time slices, and the corresponding features are subjected to one-hot encoding expansion and merging to obtain the characteristics of the sample data.

[0017] Optionally, the first rule is determined according to the characteristics of the sample data, the sample data is screened according to the first rule, and the screened sample data is labeled to obtain a sample data set, including:

[0018] The first rule is determined according to the distribution of the sample data.

[0019] According to the first rule, the black samples and white samples in the sample data that are irrelevant to the relevant characteristics are filtered out.

[0020] The screened sample data is re-labeled for black and white samples to obtain a sample data set.

[0021] The first threshold range of the sample data set is determined.

[0022] Optionally, the logistic regression model is trained according to the sample data set, including:

[0023] The logistic regression model is configured with real-time multi-head data, and the logistic regression model is trained.

[0024] After the training is completed, a second threshold range of the logistic regression model is demarcated.

[0025] Optionally, the second rule is determined based on the offline population data indicating the credit risk level or the fraud level, and the sample data set is filtered according to the second rule to obtain the to-be-identified sample, including:

[0026] The second rule is determined based on the offline population data indicating the credit risk level or the fraud level;

[0027] According to the second rule, the sample with high credit risk or high fraud risk in the sample data set is filtered out to obtain the to-be-identified sample;

[0028] A third threshold range of the to-be-identified sample is demarcated.

[0029] Further, the method further includes:

[0030] After the logistic regression model is constructed offline, the online mode is put into operation, and the threshold value is demarcated after the model is output to increase the form of rule matching to complete the filtering.

[0031] Optionally, the weight of the logistic regression model after the training is completed is derived, and the weight is configured to the online rule engine to identify the telecom fraud victim in the to-be-identified sample, including:

[0032] The weight includes the demarcated first threshold range, the second threshold range and the third threshold range;

[0033] According to the intersection of the first threshold range, the second threshold range and the third threshold range, a fourth threshold range of a sigmoid function value S(x) is obtained;

[0034] According to the fourth threshold range of the sigmoid function value S(x), the fifth threshold range of the input x is inversely deduced according to the following sigmoid function expression:

[0035]

[0036] After the weight of the logistic regression model is configured to the online rule engine, real-time data is obtained;

[0037] According to the real-time data, a residual w0, an i-th feature x i , a feature x i and a corresponding weight w i are determined, where 1≤i≤n, and n is the total number of features;

[0038] The polynomial X is determined according to the following formula:

[0039] X = w0+ w1x1+... + w i x i +... + w n x n

[0040] If the value of X is within the fifth threshold range of x, the sample corresponding to the real-time data is identified as a victim of telecom fraud.

[0041] The second aspect of the application provides a system for identifying victims of telecom fraud, comprising:

[0042] A collection unit is configured to collect sample data and perform preprocessing to obtain features of the sample data.

[0043] A first rule screening unit is configured to determine a first rule based on the features of the sample data, screen the sample data according to the first rule, and label the screened sample data to obtain a sample data set.

[0044] A model training unit is configured to train a logistic regression model based on the sample data set.

[0045] A second rule screening unit is configured to determine a second rule based on offline population data indicating credit risk levels or fraud levels, screen the sample data set according to the second rule, and obtain a sample to be identified.

[0046] An identification unit is configured to export the weight of the trained logistic regression model and configure the weight to an online rule engine, and identify victims of telecom fraud in the sample to be identified through the online rule engine.

[0047] The third aspect of the application provides a computer readable storage medium storing computer instructions for causing a computer to execute the method for identifying victims of telecom fraud according to any one of the first aspect.

[0048] The fourth aspect of the application provides an electronic device comprising at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores computer programs executable by the at least one processor, and the computer programs are executed by the at least one processor to cause the at least one processor to execute the method for identifying victims of telecom fraud according to any one of the first aspect.

[0049] The embodiment of the present application combines the first rule, the logistic regression model and the second rule, and uses real-time sample data in the first rule and the logistic regression model, and uses offline crowd data in the second rule, mixes offline data and real-time data, combines the advantages of two different formats of data together, can distinguish the telecom fraud victim group and the active fraud group, discovers the telecom fraud victim in time and gives an early warning, and solves the problem that the prior art cannot realize early warning of the telecom fraud victim by only using single offline data or single online data. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed in the specific embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0051] Figure 1 The flowchart of the telecom fraud victim identification method provided by the embodiment of the present application is shown in the figure.

[0052] Figure 2 The block diagram of the telecom fraud victim identification system provided by the embodiment of the present application is shown in the figure.

[0053] Figure 3 The block diagram of the electronic device provided by the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0054] In order to make the person skilled in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0055] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and in the above description of the drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0056] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0057] In the process of identifying victims of telecom fraud, it is often necessary to label the collected sample data, collect offline samples and data feature indicators, label the corresponding black and white sample data sets, and then model the data set through a machine learning algorithm to obtain a risk control judgment model based on offline data. If only offline data is used, it is likely that the victim of telecom fraud has been deceived and the money has been transferred, so the model warning is meaningless; if only real-time data is used, it is easy to mix the victim group of telecom fraud with the active fraud group, which will also increase the difficulty of warning and investigation.

[0058] To solve the above problems, the present application provides a method for identifying victims of telecom fraud, as shown in Figure 1 The method comprises the following steps S101 to S105:

[0059] Step S101: collecting sample data and pre-processing to obtain the features of the sample data;

[0060] The sample data in the embodiment of the application is credit index data, which is basically derived from data recorded when a user generates a relevant behavior, including operations such as applying for a loan, installment, checking a credit limit, and the like. The sample data mainly collects three types of relevant field data: the first type is a user behavior record table, which mainly records the time of user behavior, a partner, an operation event (such as borrowing), corresponding device record information, pass or fail judgment information, and the like; the second type is relevant specific information about a product to be evaluated, including a matching id, a time, specific classification information of a product involved, such as a product belonging to a large category, whether it is a consumer loan, whether it is a cash loan, an amount involved, and the like; and the third type is model data that has been generated and used, which is offline population data indicating a credit risk level or a fraud level. The offline population data is based on user multi-dimensional data to select black and white samples, and is obtained by using a traditional machine learning training method to train a machine learning model.

[0061] The sample data in the step S101 includes black samples and white samples, the black samples use telecom fraud victim population data in a day, and the white samples use all population data in the corresponding same day;

[0062] Since the black samples use the collected fraud population in a whole day, all traffic data in the same day is used as the white samples, so that the overall sample distribution is consistent with the real situation, and the later screening rules can be consistent with offline data and online data.

[0063] Specifically, the step S101 includes:

[0064] The sample data is subjected to data cleaning, which includes screening the black samples, and removing samples with incomplete information and a small amount of money involved, so that the black samples used are more accurate;

[0065] The sample data after data cleaning is subjected to feature engineering, a user RFM model is used to construct features according to a time slice, corresponding features are expanded and merged by one-hot encoding, and features of the sample data are obtained;

[0066] The sample data corresponds to users without de-duplication, that is, personnel without de-duplication, and samples generated by each person at each time are regarded as independent samples for identification, so that the online identification can be consistent.

[0067] The feature engineering is a series of engineering processing of the sample data after data cleaning, which removes impurities and redundancies in the data, refines the data into features, and inputs the features into subsequent screening rules or models;

[0068] The RFM model is an important tool and means for measuring customer value and customer profit ability, and describes the value status of a customer through three indexes of consumption time interval (Recency), consumption frequency (Frequency) and consumption amount (Monetary) of the customer. Detailed feature engineering is performed on log data corresponding to a sample, user FRM features are constructed according to time slices, corresponding features are expanded and merged by one-hot (one-hot encoding), etc.

[0069] Step S102: determining a first rule according to the features of the sample data, screening the sample data according to the first rule, marking the screened sample data, and obtaining a sample data set; the sample data used in the first rule screening is real-time multi-head data, for example, real-time multi-head data of consumption loans or cash loans;

[0070] Since the fraud occurrence rate under the full amount of users is extremely low, the correlation of the related features under the full amount of users is low, and is not more than 0.03; in order to make the model have stronger pertinence and reduce the pressure of online operation, the first rule is drawn according to the distribution of the sample, the correlation of the related features under these users is improved to 0.1-0.3 after the preliminary screening, which can be reflected on the model, after screening, the record samples that do not meet the conditions are removed, and the sample data after removal is marked again as black and white samples.

[0071] Specifically, the step S102 includes:

[0072] The first rule is drawn according to the distribution of the sample data; the setting of the first rule depends on the distribution of the sample data, and the first rule is drawn as much as possible to the line that makes the feature correlation higher, the absolute number controllable, and the loss as small as possible, for example, the features of the sample data can include real-time multi-head and short-time threshold, and the first rule can be drawn according to the real-time multi-head data of consumption loans or cash loans within 6 hours;

[0073] According to the first rule, the black samples and white samples irrelevant to the related features in the sample data are filtered out; the record samples irrelevant to the related features are removed;

[0074] The screened sample data is marked again as black and white samples, and a sample data set is obtained.

[0075] The first threshold range of the sample data set is drawn.

[0076] After screening using the first rule, the correlation degree of the relevant features to the black and white samples is increased, the absolute number of the screened samples is controllable, most of the filtered samples are white samples, and the filtered black samples are irrelevant to the relevant features. In the embodiment of the application, the screening advantage of the first rule is used to directly remove part of the noise data samples, and then the samples are labeled to better enable the model to learn the important data performance of real-time multi-head, while ensuring the consistency of the offline and online models.

[0077] In the process of identifying victims of telecom fraud, since the sample data is similar to flow data, the same person can generate multiple records, and the data features are not the same. Therefore, in the offline training of the model, the labeling mode of person-label cannot be used mechanically. If the labeling mode of person-label is performed roughly, for a user who generates more data records, the data performance features from not obvious to obvious are all labeled as the same label, and records of different data indicators are all labeled as the same label. Therefore, it is difficult for the model to distinguish such samples during training, resulting in poor model effect. This problem exists in both offline modeling labeling and online learning real-time feedback labeling. In the embodiment of the application, the screening advantage of the first rule is used to directly remove part of the noise data samples, and then the samples are labeled to better enable the model to learn the important data performance of real-time multi-head, while ensuring the consistency of the offline and online models.

[0078] The relatively standard modeling sample data set is obtained through the above steps S101 and S102. Since the online rule engine is used, the model selection cannot be too complex but also cannot be too linear. Therefore, logistic regression is selected as the model for data training.

[0079] Step S103: data training is performed on the logistic regression model according to the sample data set. In the training of the logistic regression model, real-time multi-head data is used.

[0080] The logistic regression model in the embodiment of the application is more stable than other powerful models. In the case of a small amount of samples, the overall model is more stable whether offline or online, and is not prone to overfitting. The logistic regression model has good interpretability, and the key features have a strong guiding effect on business personnel handling cases. When adjusting, the weight can be adjusted through the online rule system to achieve the purpose of adjusting the model.

[0081] Specifically, the step S103 includes:

[0082] The logistic regression model is configured using real-time multi-head data, and data training is performed on the logistic regression model.

[0083] After training, a second threshold range of the logistic regression model is determined.

[0084] Step S104: determining a second rule based on the offline population data indicating the credit risk level or the fraud level, screening the sample data set according to the second rule to obtain the to-be-identified sample; and referencing the offline population data in the second rule screening;

[0085] Since the performance data of the fraud victims and the fraud black and gray production molecules are relatively similar in this scenario, a single data type model is difficult to distinguish these non-target populations, therefore, the embodiment of the present application references the existing corresponding offline human data as a basis for judgment, uses the offline population data indicating the credit risk level or the fraud level to truly distinguish the fraud victims from other populations, so as to improve the accuracy of identifying the fraud victims.

[0086] Among them, the offline population data indicating the credit risk level or the fraud level are obtained by selecting appropriate black and white samples, selecting fraud sample data as black samples and selecting credit sample data as white samples for machine learning model training, and the training method is consistent with the traditional machine learning training method. The offline population data indicating the credit risk level can be obtained by using the modeling method of the credit score widely used in the industry, which comprehensively describes the credit level of the user by using the user's cross-platform credit record, static appearance, performance ability, consumption preference, Internet footprint and other data; the offline population data indicating the fraud level can be a fraud scoring prediction product developed for banks, insurance companies, consumer finance, Internet finance and other financial institutions, which is used for fraud risk assessment in pre-loan audit.

[0087] For example, the existing offline population data indicating the credit risk level and the existing offline population data indicating the fraud level can be combined to filter out possible non-target populations, including filtering out high credit risk populations and high fraud risk populations.

[0088] Specifically, the step S104 includes:

[0089] The second rule is determined based on the offline population data indicating the credit risk level or the fraud level; the difference between the fraud victim population data and the active fraud population data in the offline population data is judged by using the existing offline population data indicating the credit risk level or the fraud level, and the second rule is determined to divide the fraud victim population and the active fraud population;

[0090] According to the second rule, the samples with high credit risk or high fraud risk in the sample data set are filtered out to obtain the to-be-identified sample; and the non-target population with high credit risk or high fraud risk in the sample data set is filtered out, so as to improve the accuracy of identifying the fraud victims;

[0091] A third threshold range of the to-be-identified sample is determined.

[0092] After the third threshold range of the sample to be identified is determined, the method further comprises:

[0093] After the logistic regression model is built offline, the online mode is put online, and the threshold is determined after the output model is divided to increase the form of rule matching to complete the screening. After the model is built offline, there is also a corresponding online part. When the online mode is put online, the threshold can also be determined after the output model is divided to increase the form of rule matching to complete the screening.

[0094] The present application combines the first rule, the logistic regression model and the second rule, and uses real-time sample data in the first rule and the logistic regression model, and uses offline population data in the second rule, mixes offline data and real-time data, and combines the advantages of two different formats of data together, so that the telecom fraud victim group and the active fraud group can be distinguished, the telecom fraud victims can be discovered in time and warned, and the problem that the existing technology cannot realize the warning of the telecom fraud victims by only using single offline data or single online data is solved.

[0095] Step S105: Deriving the weight of the logistic regression model after training is completed, and configuring the weight to the online rule engine, and identifying the telecom fraud victim in the sample to be identified through the online rule engine.

[0096] Specifically, the step S105 comprises:

[0097] The weight comprises the determined first threshold range, the second threshold range and the third threshold range;

[0098] According to the intersection of the first threshold range, the second threshold range and the third threshold range, a fourth threshold range of a sigmoid function value S(x) is obtained;

[0099] According to the fourth threshold range of the sigmoid function value S(x), the fifth threshold range of the input x is inversely deduced according to the following sigmoid function expression:

[0100]

[0101] For example, assuming that the fourth threshold range of S(x) is 0.65-1, when S(x) takes 0.65 and 1 respectively, the corresponding value of the input x can be inversely deduced according to the above sigmoid function expression, and then the fifth threshold range of x is obtained.

[0102] After the weight of the logistic regression model is configured to the online rule engine, real-time data is obtained;

[0103] According to the real-time data, the residual error w0, the i-th feature x i , the feature xi corresponding weight w i wherein, 1≤i≤n, n is the total number of characteristics;

[0104] The polynomial X is determined according to the following formula:

[0105] X = w0+w1x1+…+wnxn i x i +…+w n x n

[0106] If the value of X is in the fifth threshold range of x, the sample corresponding to the real-time data is identified as a telecom fraud victim, judged as a high-risk person, and output.

[0107] From the above description, it can be seen that the present application achieves the following technical effects:

[0108] The present application combines the first rule, the logistic regression model and the second rule, and uses real-time sample data in the first rule and the logistic regression model, and uses offline crowd data in the second rule, mixes offline data and real-time data, and combines the advantages of two different formats of data together, so that the telecom fraud victim group and the active fraud group can be distinguished, the telecom fraud victims can be discovered in time and warned, and the problem that the existing technology cannot realize the warning of the telecom fraud victims by using only single offline data or single online data is solved.

[0109] The present application combines the actual anti-telecom fraud business, and develops a complete funnel judgment model of the first rule, the logistic regression model and the second rule, reasonably uses the advantages of rules and models, and avoids the obvious defects in the business.

[0110] The present application mixes offline data and real-time data, uses real-time multi-head sample data in the first rule and the logistic regression model, and uses offline crowd data in the second rule, and combines the advantages of different data types together.

[0111] In the present application, the screening advantage of the first rule is used to directly remove part of the noise data samples, and then the samples are labeled to better enable the model to learn important data such as real-time multi-head, while ensuring the consistency of the model offline and online.

[0112] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0113] The embodiment of the present application also provides a telecom fraud victim identification system for implementing the telecom fraud victim identification method, as shown in the accompanying drawings, which comprises: Figure 2

[0114] a collecting unit 21 configured to collect sample data and perform preprocessing to obtain features of the sample data;

[0115] a first rule screening unit 22 configured to determine a first rule according to the features of the sample data, screen the sample data according to the first rule, and label the screened sample data to obtain a sample data set;

[0116] a model training unit 23 configured to perform data training on a logistic regression model according to the sample data set;

[0117] a second rule screening unit 24 configured to determine a second rule based on offline people data indicating credit risk levels or fraud levels, screen the sample data set according to the second rule, and obtain a sample to be identified;

[0118] an identification unit 25 configured to export weights of the trained logistic regression model, configure the weights to an online rule engine, and identify telecom fraud victims in the sample to be identified through the online rule engine.

[0119] The embodiment of the present application also provides an electronic device, as shown in the accompanying drawings, which comprises one or more processors 31 and a memory 32, Figure 3 Figure 3 The processor 31 is taken as an example in the description.

[0120] The controller can also comprise an input device 33 and an output device 34.

[0121] The processor 31, the memory 32, the input device 33 and the output device 34 can be connected through a bus or other means, Figure 3 The connection through the bus is taken as an example in the description.

[0122] ​​The processor 31 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, or a combination thereof, or any other chip that performs different functions or a combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0123] The memory 32 is a non-transitory computer-readable storage medium, and can be used to store non-transitory software programs, non-transitory computer-executable programs and modules, such as program instructions / modules corresponding to the control method in the embodiments of the present application. The processor 31 executes various functions and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 32, that is, implements the telecommunications fraud victim identification method of the above method embodiments.

[0124] The memory 32 can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function. The data storage area can store data created by the use of the processing device of the server, etc. In addition, the memory 32 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 32 can optionally include a memory remotely arranged with respect to the processor 31, and these remote memories can be connected to the network connection device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0125] The input device 33 can receive input digital or character information, and generate key signal inputs related to user settings and function controls of the processing device of the server. The output device 34 can include a display device such as a display screen.

[0126] One or more modules are stored in the memory 32, and when executed by the one or more processors 31, perform the method as shown in Figure 1 .

[0127] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The program can be stored in a computer readable storage medium, and when the program is executed, the program can include the processes of the above-mentioned embodiment of each motor control method. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FM), a hard disk drive (HDD), a solid-state drive (SSD), or the like. The storage medium can also include a combination of the above-mentioned types of memories.

[0128] Although the embodiments of the present application have been described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method of identifying victims of telecommunications fraud, characterized in that, The method comprises the following steps: Collecting sample data and pre-processing to obtain the characteristics of the sample data; Determine the first rule according to the characteristics of the sample data, filter the sample data according to the first rule, and label the filtered sample data to obtain a sample data set; Data training of the logistic regression model according to the sample data set; Determine the second rule based on the offline population data indicating the credit risk level or fraud level, filter the sample data set according to the second rule, and obtain the to-be-identified sample, which includes offline data and real-time data; Export the weight of the trained logistic regression model and configure it to the online rule engine to identify the telecom fraud victims in the to-be-identified sample, comprising: The weight includes the first threshold range, the second threshold range and the third threshold range; According to the intersection of the first threshold range, the second threshold range and the third threshold range, the fourth threshold range of the sigmoid function value S(x) is obtained; According to the fourth threshold range of the sigmoid function value S(x), the fifth threshold range of the input x is inversely deduced according to the following sigmoid function expression: After configuring the weight of the logistic regression model to the online rule engine, the real-time data is obtained; determining a residual error w0, an i-th feature x i , a feature x i , a corresponding weight w i , where 1≤i≤n, n is the total number of features; Determine the polynomial X according to the following formula: X = w0+ w1x1+... + w i x i +... + w n x n If the value of X is within the fifth threshold range of x, the sample corresponding to the real-time data is identified as a telecom fraud victim.

2. The method of claim 1, wherein, The sample data includes black samples and white samples, the black samples use the telecom fraud victim population data in a day, and the white samples use the population data of the corresponding same day; The collection of sample data and pre-processing to obtain the characteristics of the sample data comprises: Data cleaning of the sample data; Feature engineering of the data cleaned sample data, constructing features according to time slice using user RFM model, expanding and merging corresponding features by one-hot encoding to obtain the characteristics of the sample data.

3. The method of claim 1, wherein, The first rule is determined according to the characteristics of the sample data, the sample data is filtered according to the first rule, and the filtered sample data is labeled to obtain a sample data set, comprising: The first rule is determined according to the distribution of the sample data; According to the first rule, the black samples and white samples in the sample data that are irrelevant to the relevant features are filtered out; The black and white samples of the filtered sample data are labeled again to obtain a sample data set; The first threshold range of the sample data set is determined.

4. The method of claim 1, wherein, The data training of the logistic regression model according to the sample data set comprises: Configure the logistic regression model with real-time multi-head data and train the logistic regression model; After training, the second threshold range of the logistic regression model is determined.

5. The method of claim 1, wherein, The second rule is determined based on the offline population data indicating the credit risk level or fraud level, and the sample data set is filtered according to the second rule to obtain the to-be-identified sample, comprising: Determine the second rule based on the offline population data indicating the credit risk level or fraud level; According to the second rule, samples with high credit risk or high fraud risk in the sample data set are filtered out to obtain to-be-identified samples; A third threshold range of the to-be-identified samples is determined.

6. The method of claim 5, wherein, The method further comprises: After the offline construction of the logistic regression model is completed, the online mode is put into operation, and the threshold is determined in the form of increasing rule matching through the output model to complete the screening.

7. A telecom fraud victim identification system characterized in that, Comprise: A collection unit configured to collect sample data and perform preprocessing to obtain features of the sample data; A first rule screening unit configured to determine a first rule according to the features of the sample data, screen the sample data according to the first rule, and label the screened sample data to obtain a sample data set; A model training unit configured to train a logistic regression model according to the sample data set; A second rule screening unit configured to determine a second rule based on offline population data indicating credit risk level or fraud level, screen the sample data set according to the second rule, and obtain to-be-identified samples, wherein the to-be-identified samples comprise offline data and real-time data; An identification unit configured to export weights of the trained logistic regression model, configure the weights to an online rule engine, and identify telecom fraud victims in the to-be-identified samples through the online rule engine; The weights comprise a first threshold range, a second threshold range, and a third threshold range; According to the intersection of the first threshold range, the second threshold range, and the third threshold range, a fourth threshold range of a sigmoid function value S(x) is obtained; According to the fourth threshold range of the sigmoid function value S(x), the fifth threshold range of the input x is inversely deduced according to the following sigmoid function expression: After the weights of the logistic regression model are configured to the online rule engine, real-time data are obtained; determining a residual error w0, an i-th feature x i , a feature x i a corresponding weight w i , where 1≤i≤n, n is the total number of features; A polynomial X is determined according to the following formula: X = w0+ w1x1+... + w i x i +... + w n x n If the value of X is within the fifth threshold range of x, the sample corresponding to the real-time data is identified as a telecom fraud victim.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to execute the telecom fraud victim identification method of any one of claims 1-6.

9. An electronic device, comprising: The electronic device comprises at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to cause the at least one processor to execute the telecom fraud victim identification method of any one of claims 1-6.

Images