Information identification method, device and storage medium

Abstract

Embodiments of the present application disclose an information identification method and device and a storage medium. The method comprises: obtaining operator-side related data corresponding to a to-be-detected number, wherein the operator-side related data comprises charging information, user information and signaling data; inputting the operator-side related data into a classifier model to obtain feature data, comparing the feature data with standard feature data, and outputting a candidate number based on a comparison result; determining a suspected GOIP device based on the candidate number and the operator-side related data; verifying the candidate number to obtain an abnormal number; and performing positioning analysis on the suspected GOIP device to obtain location information of the GOIP device. Through the technical scheme of the embodiments of the present application, abnormal information can be quickly and accurately identified, and the security of a communication network is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of mobile communication security technology, and in particular to an information identification method, device, and storage medium. Background Art

[0002] In recent years, with the rapid development of the internet, finance, and communications industries, negative telecommunications incidents, carried out using various modern, high-tech means, have rapidly spread. Due to the diverse methods employed by perpetrators and the difficulty in identifying and preventing them, these incidents have severely harmed the public. In particular, perpetrators often use virtual dialing devices based on technologies such as the Global System for Mobile Over Internet Protocol (GOIP) to conduct calls. By exploiting the flexibility, concealment, and transparency of GOIP technology, they purchase key GOIP equipment and set up illegal gateways, impersonating calls from public security, judicial organs, banks, or friends and relatives, defrauding the public of substantial sums of money. They also employ techniques such as separating the person from the device, using modem pools for bulk dialing, modifying caller ID, and performing multiple redirection links to evade enforcement action by relevant authorities, severely harming the interests of the public.

[0003] Due to the limitations of some existing GOIP device identification and location methods, they cannot accurately identify abnormal numbers of different GOIP devices, nor can they quickly and accurately locate GOIP devices. Therefore, in order to effectively monitor and precisely combat negative behaviors on communication networks and effectively manage new types of negative network activities, it is imperative to strengthen the management of abnormal numbers and abnormal devices and improve the ability to identify abnormal information. Summary of the Invention

[0004] The embodiments of the present invention provide an information identification method, device, and storage medium, which can realize rapid and accurate identification of abnormal information and improve the security of network communications.

[0005] In a first aspect, an embodiment of the present invention provides an information identification method, which is applied to an operator side and includes:

[0006] Obtain operator-side related data corresponding to the number to be detected, wherein the operator-side related data includes billing information, user information, and signaling data;

[0007] Inputting the operator-side related data into a classifier model to obtain feature data, comparing the feature data with standard feature data, and outputting an alternative number based on the comparison result;

[0008] Determine a suspected GOIP device based on the candidate number and the operator-side related data;

[0009] Verifying the candidate numbers to obtain abnormal numbers;

[0010] Perform positioning analysis on the suspected GOIP device to obtain location information of the GOIP device.

[0011] In a second aspect, an embodiment of the present invention further provides an electronic device, including:

[0012] one or more processors;

[0013] a storage device for storing one or more programs,

[0014] When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any embodiment of the present invention.

[0015] In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any embodiment of the present invention.

[0016] The technical solution of the embodiment of the present invention obtains an alternative number by inputting the operator-side relevant data corresponding to the number to be detected into the classifier model, and determines the suspected GOIP device based on the alternative number and the operator-side relevant data. Finally, the alternative number is verified to obtain the abnormal number, and the suspected GOIP device is located and analyzed to obtain the location information of the GOIP device. This solves the problem in the prior art that the abnormal numbers of different GOIP devices cannot be accurately identified, and the GOIP device cannot be quickly and accurately located. It can realize the rapid and accurate identification of abnormal information and improve the security of network communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flow chart of an information identification method provided by an embodiment of the present invention;

[0018] Figure 2 is a flow chart of an information identification method provided by an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of a preferred information identification method process provided by an embodiment of the present invention;

[0020] Figure 4 This is a schematic structural diagram of an information identification device provided by an embodiment of the present invention;

[0021] Figure 5 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In the technical solutions of the embodiments of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of user personal information (such as facial information, voice information, etc.) are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0023] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It will be understood that the specific embodiments described herein are intended only to illustrate the present invention and are not intended to limit the present invention. It should also be noted that, for ease of description, the accompanying drawings only illustrate portions relevant to the present invention, not all structures.

[0024] Figure 1 A flowchart of an information identification method provided in an embodiment of the present invention is applicable to situations where abnormal information of a GOIP device is identified. The method can be performed by an information identification device, which can be implemented in hardware and / or software and can generally be integrated into an electronic device.

[0025] like Figure 1 As shown, an information identification method provided by an embodiment of the present invention includes the following specific steps:

[0026] S110: Acquire operator-side related data corresponding to the number to be detected, wherein the operator-side related data includes billing information, user information, and signaling data.

[0027] Among them, the number to be detected may refer to a number that needs to be detected for abnormality, that is, it is necessary to detect whether the number to be detected is an abnormal number, and the abnormality may refer to a situation that will cause a negative telecommunications event. Billing information may refer to the call record information generated during the use of the number to be detected, such as the charges generated by calls, text messages, or traffic, etc. User information may refer to the user profile information and account opening information of the user corresponding to the number to be detected, and the number of numbers under the same identity information can be confirmed by obtaining user information. Signaling data may refer to the data captured and recorded by the operator's communication base station when the mobile phone user corresponding to the number to be detected makes a call, sends text messages, or moves a location. The signaling data field usually contains time and spatial location attributes. Therefore, the user's Internet access, text messages, terminal, and location dimensional data can also be obtained from the signaling data.

[0028] In an optional embodiment, the operator-side data may also include payment information, where payment information may refer to recharge information for communication charges paid by the number to be tested. Typically, users recharge numbers infrequently and for large amounts, but abnormal numbers typically recharge small amounts more frequently. Therefore, payment information can also be used as a basis for determining whether the number to be tested is a candidate number.

[0029] S120: Inputting the operator-side related data into a classifier model to obtain feature data, comparing the feature data with standard feature data, and outputting an alternative number based on the comparison result.

[0030] Among them, the alternative number may refer to a number that may be an abnormal number. The classifier model may refer to a model that classifies the number to be detected as an alternative number or a normal number based on the operator-side relevant data corresponding to the number to be detected. In an embodiment of the present invention, the extreme gradient boosting (eXtreme Gradient Boosting, XGBOOST) classifier model can be used to classify the number to be detected. Optionally, the feature data includes: the number of calls to the number to be detected, the call frequency of the number to be detected, the discreteness of the called number, the silence duration of the number to be detected, the power on and off pattern of the device to which the number to be detected belongs, the location information of the number to be detected, the location of the number to be detected, the first call location of the number to be detected, the active time period of the number to be detected, and the replacement frequency of the device to which the number to be detected belongs. Standard feature data may refer to data obtained through training using operator data from various abnormal event work orders known to relevant departments. Optionally, standard feature data may refer to feature data in a classifier model used to evaluate whether the number to be detected is an alternative number. That is, the standard feature data may be used as a basis for evaluating whether the number to be detected is an alternative number. If the feature data of the number to be detected is highly similar to the standard feature data, the number to be detected is determined to be an alternative number. Otherwise, the number to be detected is determined not to be an alternative number.

[0031] S130: Determine a suspected GOIP device based on the candidate number and the operator-side related data.

[0032] A suspected GOIP device refers to a device that may be a GOIP device. Typically, a GOIP device can support hundreds of mobile subscriber identity modules (SIM) cards operating simultaneously. Therefore, multiple candidate numbers and carrier-side data can be used to determine whether the device to which the candidate number belongs is a suspected GOIP device.

[0033] Specifically, the operator-side data corresponding to the number to be tested is input into a classifier model to obtain feature data corresponding to the number to be tested. The standard feature data in the classifier model is then compared with the obtained feature data to output an alternative number based on the comparison result. Subsequently, the suspected GOIP device to which the alternative number belongs is determined based on the alternative number and the operator-side data. Thus, by using artificial intelligence algorithms to automatically learn and analyze the various data of the number to be tested, the candidate number and the suspected GOIP device can be obtained, facilitating subsequent work.

[0034] In an optional embodiment, the determination of suspected GOIP devices based on the alternative numbers and the operator-side related data includes: if it is determined based on the operator-side related data that multiple alternative numbers are turned on and off at the same time, or the base station locations to which multiple alternative numbers belong are updated at the same time, then the devices to which the multiple alternative numbers belong are suspected GOIP devices. Specifically, since a GOIP device can usually support hundreds of mobile phone SIM cards operating at the same time, and most GOIP devices are in a powered-off state during non-working periods, when multiple alternative numbers are turned on and off at the same time from the operator-side signaling data, the devices to which the multiple alternative numbers belong can be listed as suspected GOIP devices, waiting for verification work to be carried out; in addition, since GOIP devices have a large mobility, when the base station locations to which multiple alternative numbers belong are updated at the same time, the devices to which the multiple alternative numbers belong can also be listed as suspected GOIP devices, waiting for verification work to be carried out.

[0035] S140: Verify the candidate number to obtain an abnormal number.

[0036] Wherein, verifying the alternative number may refer to re-verifying the obtained alternative number to determine whether the alternative number is a truly abnormal number. For example, the alternative number's call duration may be verified. For example, if most of the alternative number's calls are short, such as two to three minutes, the alternative number may be determined to be an abnormal number. The alternative number's call frequency may also be verified. For example, if the alternative number frequently makes multiple outgoing calls within a short period of time, such as if the alternative number makes nearly 20 outgoing calls within ten minutes, the alternative number may be determined to be an abnormal number. The alternative number's communication relationship with the outgoing call may also be verified. The communication relationship may refer to the communication and contact relationship between the alternative number and the outgoing call. For example, a normal number usually has a fixed communication relationship, such as a relative, colleague, classmate, or friend. If there is no communication relationship between the alternative number and the outgoing call, that is, it proves that the alternative number has no fixed contact person, the alternative number may be determined to be an abnormal number.

[0037] In an optional embodiment, verifying the alternative number to obtain an abnormal number includes: shutting down the alternative number and directing the alternative number to be restored; and verifying whether the alternative number is an abnormal number based on the restoration result. Shutting down the alternative number can mean shutting down different services of the alternative number while the alternative number is in a call. For example, only the outgoing call service of the alternative number can be shut down, preventing the alternative number from making outgoing calls; or all services of the alternative number can be shut down, preventing the alternative number from performing any services. Specifically, an intelligent outbound calling system can be used to first verify whether the alternative number is in a call or in a shutdown state. If the alternative number is in a call, the alternative number is shut down. The intelligent outbound calling system can be a system that automatically dials the alternative number at a scheduled time. By calling the alternative number at a scheduled time, it can be verified whether the alternative number is in a call or in a shutdown state. Typically, abnormal numbers are powered on between 8 and 9 a.m. and powered off between 6 and 7 p.m., making calls continuously during the day. Guiding the alternative number to reactivate service may involve guiding the alternative number to reactivate the suspended service by sending a text message or a link to obtain the alternative number's internet access information. Specifically, during the reactivation process, the operator can use the alternative number's internet access information to complete a five-in-one self-service verification of the user, ID, card, terminal, and location to verify whether the alternative number is an abnormal number.

[0038] Optionally, the verification of whether the alternative number is an abnormal number based on the re-use result includes: if the same device is used to re-use multiple alternative numbers, then the multiple alternative numbers are abnormal numbers; or, if the number of re-uses of the target alternative number within a preset time period is greater than a set number, then the target alternative number is an abnormal number. The target alternative number may refer to the alternative number selected for verification; the preset time period may refer to a pre-set value for limiting the re-use time period of the alternative number, which may be 5 minutes, half an hour, or may be set according to actual needs; the set number of times may refer to a pre-set value for evaluating the number of re-uses of the alternative number, which may be 10 times, 20 times, or may be set according to actual needs. Specifically, if the same device is used to reactivate multiple alternative numbers, it proves that the device can simultaneously operate multiple alternative numbers, meaning that these multiple alternative numbers can be verified as abnormal numbers. Furthermore, because abnormal numbers typically conduct multiple services in a short period of time, if an alternative number is reactivated more than a set number of times within a preset time period, such as 10 times within 5 minutes, the alternative number can be verified as abnormal. This allows for further verification of the alternative numbers and ensures the accuracy of the abnormal information identification results.

[0039] S150: Performing positioning analysis on the suspected GOIP device to obtain location information of the GOIP device.

[0040] The performing of location analysis on the suspected GOIP device may refer to refining the location of the suspected GOIP device according to the acquired location of the base station corresponding to the suspected GOIP device, so as to obtain the location information of the GOIP device.

[0041] Specifically, after obtaining the candidate number and the suspected GOIP device, the candidate number can be verified to obtain the abnormal number, and the suspected GOIP device can be located and analyzed to obtain the location information of the GOIP device, thereby obtaining complete and accurate abnormal information.

[0042] In an optional embodiment, the location analysis of the suspected GOIP device to obtain the location information of the GOIP device includes: determining the location information of the base station to which the suspected GOIP device belongs through the classifier model; determining the second location area where the suspected GOIP device is located based on the measurement report MR information in the first location area covered by the base station; and determining the location information of the GOIP device in the second location area based on Internet traffic information, broadband subscription information, and water and electricity information. The first location area may refer to the coverage area of ​​the base station to which the suspected GOIP device belongs. The second location area may refer to the area where the suspected GOIP device is located. For example, if the first location area is the coverage area of ​​the base station to which the suspected GOIP device belongs, the second location area may be the location area of ​​a cell where the suspected GOIP device is located. The measurement report MR information may refer to information obtained based on the Internet access information when the alternative number is restored, including the International Mobile Equipment Identity (IMEI). High-precision GPS positioning can be performed using the IMEI information in the measurement report MR information to accurately locate the area where the suspected GOIP device is located to the meter level. Internet traffic information can refer to the amount of data consumed when accessing the Internet; broadband subscription information can refer to the location information recorded when registering for broadband, such as the specific address of a particular broadband line; and water and electricity information can refer to the amount of water and electricity used. Specifically, after determining the second location area where the suspected GOIP device is located, the Internet traffic information, broadband subscription information, and water and electricity information for each specific location within the second location area can be collected and analyzed to determine the location of the GOIP device.

[0043] Wherein, optionally, the determination of the location of the GOIP device based on Internet traffic information, broadband subscription information, and water and electricity information includes: determining a target location where the uplink information and downlink information in the Internet traffic information are symmetrical, and determining the location identifier of the target location based on the broadband subscription information; if the water and electricity values ​​of the target location with the location identifier are less than the set value, then the location information of the target location is the location information of the GOIP device. Wherein, uplink information can refer to traffic information consumed by input operations, such as traffic information consumed by sending requests; downlink information can refer to traffic information consumed by output operations, such as traffic information consumed by browsing videos; usually, if the uplink information is traffic information consumed by sending requests and the downlink information is traffic information consumed by browsing videos, then the uplink information and the downlink information are asymmetric; if both the uplink information and the downlink information are traffic information consumed by making calls, then the uplink information and the downlink information are symmetrical. The target location can refer to the location where the GOIP device is located. The broadband subscription information can include a location identifier when the broadband is subscribed. The set value may refer to a pre-set value for evaluating water and electricity values. Since household water consumption is usually higher in summer and household electricity consumption is higher in summer or winter, and the location where the GOIP device is located is usually uninhabited, water consumption is very low and monthly electricity consumption does not fluctuate much, therefore, if the water and electricity value is less than the set value, it proves that the specific location to which the water and electricity value belongs is not a normal place of residence.

[0044] Specifically, taking the second location area as a certain community as an example, first screen the houses whose uplink information and downlink information in the Internet traffic information in the community are symmetrical, and use the qualified houses as the target locations. For example, since only GOIP devices use port 5060, if the traffic on port 5060 is large, it may be a GOIP device. Therefore, the Internet Protocol (IP) on port 5060 can be detected by analyzing the traffic information, matching the broadband address using port 5060, and then evaluating the water and electricity values ​​of the house. If the water and electricity values ​​of the house are less than the set values, the location information of the house, such as the house number, can be used as the location information of the GOIP device. Therefore, the location information of the GOIP device can be determined through Internet traffic information, broadband registration information, and water and electricity information to achieve accurate positioning of the GOIP device.

[0045] The technical solution of the embodiment of the present invention obtains an alternative number by inputting the operator-side relevant data corresponding to the number to be detected into the classifier model, and determines the suspected GOIP device based on the alternative number and the operator-side relevant data. Finally, the alternative number is verified to obtain the abnormal number, and the suspected GOIP device is located and analyzed to obtain the location information of the GOIP device. This solves the problem in the prior art that the abnormal numbers of different GOIP devices cannot be accurately identified, and the GOIP device cannot be quickly and accurately located. It can realize the rapid and accurate identification of abnormal information and improve the security of network communication.

[0046] Figure 2 Flowchart of an information identification method provided by an embodiment of the present invention. Figure 2 As shown, an information identification method provided by an embodiment of the present invention includes the following specific steps:

[0047] S210: Using operator-side related data corresponding to the abnormal number as training set data, and inputting the training set data into the original classifier model, training the original classifier model to obtain a trained classifier model.

[0048] The carrier-side data corresponding to the abnormal numbers can be used as positive sample data to form the training set data for training the original classifier model. Optionally, the training set data can also include negative sample data, which can refer to carrier-side data corresponding to non-abnormal numbers. The training set data, including negative and positive sample data, can be input into the original classifier model to complete the training of the original classifier model and obtain a trained classifier model.

[0049] Specifically, since the trained classifier model contains standard feature data corresponding to the alternative numbers, by inputting the operator-side relevant data corresponding to the number to be detected into the trained classifier model for analysis, the alternative numbers and the base station locations corresponding to the alternative numbers can be output.

[0050] Therefore, by training the classifier model, a trained classifier model can be provided for subsequent work, thereby improving the working efficiency of the abnormal information identification method.

[0051] S220: Obtain operator-side related data corresponding to the number to be detected.

[0052] S230: Inputting the operator-side related data into a classifier model to obtain feature data, comparing the feature data with standard feature data, and outputting an alternative number based on the comparison result.

[0053] S240: Determine a suspected GOIP device based on the candidate number and the operator-side related data.

[0054] S250: Verify the candidate number to obtain an abnormal number.

[0055] S260: Perform positioning analysis on the suspected GOIP device to obtain location information of the GOIP device.

[0056] On the basis of the above embodiment, it also includes: by performing correlation analysis on the confirmed abnormal numbers, the victim number, the abnormal type, the severity of the harm and the correlation relationship between the abnormal numbers are obtained, and all numbers under the ID card registered with the abnormal number are analyzed and warned, so as to assist relevant departments to carry out a strong crackdown on the negative event, effectively reduce the possibility of the general public being harmed, and effectively safeguard the property safety and legal rights and interests of the masses.

[0057] The technical solution of the embodiment of the present invention is as follows: first, the operator-side related data corresponding to the abnormal number is used as training set data, and the training set data is input into the original classifier model, the original classifier model is trained to obtain a trained classifier model, and then the operator-side related data corresponding to the number to be detected is input into the classifier model to obtain an alternative number, and the suspected GOIP device is determined based on the alternative number and the operator-side related data. Finally, the alternative number is verified to obtain the abnormal number, and the suspected GOIP device is located and analyzed to obtain the location information of the GOIP device. This solves the problem in the prior art that the abnormal numbers of different GOIP devices cannot be accurately identified, and the GOIP device cannot be quickly and accurately located. It can achieve rapid and accurate identification of abnormal information, thereby improving the security of network communication.

[0058] like Figure 3 As shown in FIG, a schematic diagram of a preferred information identification method process provided by an embodiment of the present invention. Figure 3In the process, first, the operator-side relevant data corresponding to the number to be detected, such as billing information, user information and signaling data, are input into the classifier model to detect the number to be detected, and the detected number (i.e., the alternative number) and the detected GOIP device location (i.e., the location information of the base station to which the suspected GOIP device belongs) are output. The detected numbers are further screened using the user's account opening information, package information, payment information and the number of numbers under the same certificate to screen out numbers with a higher degree of suspicion. Afterwards, the intelligent outbound call verification system (i.e., the intelligent outbound call system) is used to verify the numbers with a higher degree of suspicion. If the number with a higher degree of suspicion is in a call, the number with a higher degree of suspicion will be shut down and notified by SMS to guide online verification. Based on the verification results, it is verified whether the number with a higher degree of suspicion is an abnormal number. In addition, high-precision GPS is performed through the IMEI information collected from the Internet information during the verification process. Coordinate positioning (i.e., determining the second location area where the suspected GOIP device is located); detecting the 5060 port IP by analyzing traffic data (i.e., Internet traffic information) and matching the home address using the 5060 port through home broadband packaging information (i.e., broadband registration information), and filtering out the upstream and downstream traffic balanced broadband information (i.e., the upstream information and the downstream information in the Internet traffic information are symmetrical), and then making an intersection based on the detailed address information, focusing on the suspicion of the GOIP device, and determining the detailed address of the GOIP location (i.e., the location information of the GOIP device) through other auxiliary data such as water and electricity data (i.e., water and electricity information).

[0059] Figure 4 This is a schematic diagram of the structure of an information identification device provided by an embodiment of the present invention. The device can execute the information identification method involved in the above embodiments. The device can be implemented in software and / or hardware. Figure 4 As shown, the information identification device specifically includes: a data acquisition module 410, a data detection module 420, a device determination module 430, a data verification module 440, and a device positioning module 450.

[0060] The data acquisition module 410 is used to obtain operator-side related data corresponding to the number to be detected, wherein the operator-side related data includes billing information, user information and signaling data;

[0061] a data detection module 420 for inputting the operator-side relevant data into a classifier model to obtain feature data, comparing the feature data with standard feature data, and outputting an alternative number based on the comparison result;

[0062] A device determination module 430 is configured to determine a suspected GOIP device based on the candidate number and the operator-side related data;

[0063] A data verification module 440 is used to verify the candidate numbers and obtain abnormal numbers;

[0064] The device positioning module 450 is used to perform positioning analysis on the suspected GOIP device to obtain the location information of the GOIP device.

[0065] The technical solution of the embodiment of the present invention obtains an alternative number by inputting the operator-side relevant data corresponding to the number to be detected into the classifier model, and determines the suspected GOIP device based on the alternative number and the operator-side relevant data. Finally, the alternative number is verified to obtain the abnormal number, and the suspected GOIP device is located and analyzed to obtain the location information of the GOIP device. This solves the problem in the prior art that the abnormal numbers of different GOIP devices cannot be accurately identified, and the GOIP device cannot be quickly and accurately located. It can realize the rapid and accurate identification of abnormal information and improve the security of network communication.

[0066] Optionally, the data verification module 440 may include: a recovery boot unit and a data verification unit;

[0067] The resuming guidance unit is used to shut down the alternative number and guide the alternative number to resume service;

[0068] The data verification unit is used to verify whether the candidate number is an abnormal number based on the re-call result.

[0069] Optionally, the data verification unit can be specifically used to: if the same device is used to re-activate multiple alternative numbers, then the multiple alternative numbers are abnormal numbers; or, if the number of times the target alternative number is re-activated within a preset time period is greater than the set number, then the target alternative number is an abnormal number.

[0070] Optionally, the device positioning module 450 may include: a base station location determination unit, a second location area determination unit, and a device positioning unit;

[0071] The base station location determination unit is configured to determine the location information of the base station to which the suspected GOIP device belongs by using the classifier model;

[0072] A second location area determining unit is configured to determine, in the first location area covered by the base station, a second location area where the suspected GOIP device is located based on the measurement report MR information;

[0073] The device positioning unit is used to determine the location information of the GOIP device in the second location area based on Internet traffic information, broadband subscription information, and water and electricity information.

[0074] Optionally, the device positioning unit can be specifically used to determine the target location where the uplink information and the downlink information in the Internet traffic information are symmetrical, and determine the location identifier of the target location based on the broadband registration information; if the water and electricity values ​​of the target location with the location identifier are less than the set value, then the location information of the target location is the location information of the GOIP device.

[0075] Optionally, the device determination module 430 can be specifically used to, if it is determined based on the operator-side relevant data that multiple alternative numbers are turned on and off at the same time, or the base station locations to which multiple alternative numbers belong are updated at the same time, then the devices to which the multiple alternative numbers belong are suspected GOIP devices.

[0076] Optionally, the characteristic data includes: the number of calls of the number to be detected, the call frequency of the number to be detected, the discreteness of the called number, the silence duration of the number to be detected, the power on and off pattern of the device to which the number to be detected belongs, the location information of the number to be detected, the location of the number to be detected, the first call location of the number to be detected, the active time period of the number to be detected, and the replacement frequency of the device to which the number to be detected belongs.

[0077] Optionally, the information identification device may further include a model training module for using the operator-side relevant data corresponding to the abnormal number as training set data, and inputting the training set data into the original classifier model to train the original classifier model to obtain a trained classifier model.

[0078] The information identification device provided in the embodiment of the present invention can execute the information identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0079] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the electronic device includes a processor 510, a memory 520, an input device 530, and an output device 540; the number of processors 510 in the electronic device can be one or more. Figure 5 In the figure, a processor 510 is used as an example; the processor 510, memory 520, input device 530 and output device 540 in the electronic device can be connected via a bus or other means. Figure 5 The bus connection is taken as an example.

[0080] Memory 520, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the information identification method in the embodiments of the present invention (for example, the data acquisition module 410, data detection module 420, device determination module 430, data verification module 440, and device positioning module 450 in the information identification device). The processor 510 executes the software programs, instructions, and modules stored in memory 520 to execute various functional applications and data processing of the electronic device, thereby implementing the above-mentioned information identification method.

[0081] The memory 520 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function; the data storage area may store data generated based on the use of the terminal. Furthermore, the memory 520 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state memory device. In some instances, the memory 520 may further include memory remotely located relative to the processor 510, and such remote memory may be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0082] The input device 530 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. The output device 540 may include a display device such as a display screen.

[0083] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, is used to perform an information identification method, the method comprising:

[0084] Obtain operator-side related data corresponding to the number to be detected, wherein the operator-side related data includes billing information, user information, and signaling data;

[0085] Inputting the operator-side related data into a classifier model to obtain feature data, comparing the feature data with standard feature data, and outputting an alternative number based on the comparison result;

[0086] Determine a suspected GOIP device based on the candidate number and the operator-side related data;

[0087] Verifying the candidate numbers to obtain abnormal numbers;

[0088] Perform positioning analysis on the suspected GOIP device to obtain location information of the GOIP device.

[0089] Of course, the storage medium containing computer-executable instructions provided in an embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in the information identification method provided in any embodiment of the present invention.

[0090] Through the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented with the help of software and necessary general-purpose hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0091] It is worth noting that in the embodiment of the above-mentioned information identification device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0092] Note that the above are only preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments and may include many other equivalent embodiments without departing from the concept of the present invention. The scope of the present invention is determined by the scope of the appended claims.

Claims

1. An information identification method, characterized in that: The method is applied to an operator side, and the method includes: Obtain operator-side related data corresponding to the number to be detected, wherein the operator-side related data includes billing information, user information, and signaling data; Inputting the operator-side related data into a classifier model to obtain feature data, comparing the feature data with standard feature data, and outputting an alternative number based on the comparison result; Determine a suspected GOIP device based on the candidate number and the operator-side related data; Verifying the candidate numbers to obtain abnormal numbers; Performing positioning analysis on the suspected GOIP device to obtain location information of the GOIP device; The method of performing positioning analysis on a suspected GOIP device to obtain the location information of the GOIP device includes: Determine the location information of the base station to which the suspected GOIP device belongs by using the classifier model; In the first location area covered by the base station, determining the second location area where the suspected GOIP device is located based on the measurement report MR information; In the second location area, determining the location information of the GOIP device based on the Internet traffic information, broadband subscription information, and water and electricity information; The hydropower information includes seasonal variation information and fluctuation information of hydropower.

2. The method according to claim 1, characterized in that The verifying the candidate number to obtain an abnormal number includes: Shutting down the alternative number and guiding the alternative number to resume service; Verify whether the candidate number is an abnormal number based on the re-start result.

3. The method according to claim 2, characterized in that The verifying whether the candidate number is an abnormal number based on the resuming result includes: If the same device is used to re-enable multiple candidate numbers, then the multiple candidate numbers are abnormal numbers; or If the target alternative number is called more times than the set number in the preset time period, the target alternative number is considered an abnormal number.

4. The method according to claim 1, wherein The determining of the location of the GOIP device based on the Internet traffic information, the broadband subscription information, and the water and electricity information includes: determining a target location where the uplink information and the downlink information in the Internet traffic information are symmetrical, and determining a location identifier of the target location based on the broadband subscription information; If the water and electricity values ​​of the target location with the location identifier are less than the set value, the location information of the target location is the location information of the GOIP device.

5. The method according to claim 1, wherein The determining of a suspected GOIP device based on the candidate number and the operator-side related data includes: If it is determined based on the operator-side related data that multiple alternative numbers are turned on and off at the same time, or the base station locations to which multiple alternative numbers belong are updated at the same time, then the devices to which the multiple alternative numbers belong are suspected GOIP devices.

6. The method according to claim 1, characterized in that The characteristic data includes: the number of calls to the number to be detected, the calling frequency of the number to be detected, the discreteness of the called number, the silence duration of the number to be detected, the power on and off pattern of the device to which the number to be detected belongs, the location information of the number to be detected, the location of the number to be detected, the first call location of the number to be detected, the active time period of the number to be detected, and the replacement frequency of the device to which the number to be detected belongs.

7. The method according to claim 1, characterized in that Also includes: The operator-side related data corresponding to the abnormal number is used as training set data, and the training set data is input into the original classifier model, and the original classifier model is trained to obtain a trained classifier model.

8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images