Telephone fraud warning method, device, equipment and medium

Abstract

The present application discloses a telephone fraud early warning method, device, equipment and medium, which relates to the field of communication technology. The method includes: obtaining intelligence data of real-time calls, and determining the intelligence data of real-time fraud calls based on the intelligence data of the real-time calls and the historical fraud-related terminal IP information; storing the intelligence data of the real-time fraud calls in a preset database; determining the first early warning information corresponding to the real-time fraud calls based on the intelligence data of the real-time fraud calls and the portrait of the fraud victims, and using the intelligence data stored in the preset database in the previous time period to determine the second early warning information corresponding to the called user, so as to provide telephone fraud early warning based on the first early warning information and the second early warning information. Through the above technical solution, real-time fraud calls are identified in a timely manner, and the early warning information of fraud calls is corrected through batch processing. The present application can quickly identify telephone fraud and provide telephone fraud early warnings in a timely manner.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a telephone fraud early warning method, device, equipment and medium. Background Art

[0002] my country's telecommunications industry is currently developing rapidly. With over 950 million mobile phone users, China has become the world's largest telecommunications nation. However, alongside this rapid growth, various criminal activities exploiting the convenience of modern communication technologies and settlement methods have also become increasingly rampant. Currently, most methods for identifying phone fraud rely on fraudulent number recognition, voice content, or voiceprint annotation to identify the outgoing number. These drawbacks include a complex identification process, excessive reliance on historical fraud case information, and slow real-time warnings. Therefore, the challenge of rapidly identifying phone fraud and providing timely warnings remains to be solved. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a telephone fraud early warning method, device, equipment and medium that can quickly identify telephone fraud and issue a timely telephone fraud early warning. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a telephone fraud early warning method, comprising:

[0005] Acquire real-time phone intelligence data, and determine real-time fraudulent phone intelligence data based on the real-time phone intelligence data and historical fraud-related terminal IP information;

[0006] Storing the real-time fraud call intelligence data in a preset database;

[0007] The first warning information corresponding to the real-time fraud call is determined based on the intelligence data of the real-time fraud call and the portrait of the fraud victim, and the second warning information corresponding to the called user is determined using the intelligence data stored in the preset database in the previous time period, so as to facilitate telephone fraud warning based on the first warning information and the second warning information.

[0008] Optionally, before determining the real-time fraud call intelligence data based on the real-time call intelligence data and historical fraud-related terminal IP information, the method further includes:

[0009] Filter out the first suspicious calling number whose time interval between two consecutive fraudulent calls is within a preset time period from the historical call data;

[0010] Screening out a second suspicious calling number from a historical fraud victim database, the second suspicious calling number corresponding to which the number of victims is greater than a preset threshold;

[0011] The historical fraud-related terminal IP information is determined based on the first suspicious calling number and the second suspicious calling number.

[0012] Optionally, also include:

[0013] A fraud victim portrait is drawn based on the historical victims in the historical fraud victim database, and a fraud victim classification label in the fraud victim portrait is determined.

[0014] Optionally, the step of creating a fraud victim portrait based on historical victims in the historical fraud victim database and determining a fraud victim classification label in the fraud victim portrait includes:

[0015] A fraud victim portrait is portrayed based on the behavioral labels of the online fraud victims, telephone fraud victims, and application fraud victims in the historical fraud victim database, and an urgency level label of the fraud victim in the fraud victim portrait is constructed.

[0016] Optionally, determining the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the fraud victim portrait includes:

[0017] Determine the urgency level label of the fraud victim corresponding to the called user corresponding to the real-time fraud call;

[0018] The first warning information corresponding to the real-time fraud call is determined based on the behavior information of the called user and the urgency level label of the fraud victim.

[0019] Optionally, the determining the second warning information corresponding to the called user using the intelligence data stored in the preset database in the previous time period includes:

[0020] Determine the total duration of fraudulent calls to the called user during the preset time period using the real-time fraudulent call intelligence data set during the preset time period;

[0021] The second warning information corresponding to the called user is determined based on the total duration of fraudulent phone calls within a preset time period.

[0022] Optionally, determining the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the fraud victim portrait, and determining the second warning information corresponding to the called user using the intelligence data stored in the preset database in the previous time period, includes:

[0023] A telephone fraud early warning model built with the Lambda architecture is adopted. Flink is used to process the first early warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the portrait of the fraud victim. Hive is used to determine the second early warning information corresponding to the called user based on the intelligence data stored in the preset database in the previous time period.

[0024] In a second aspect, the present application discloses a telephone fraud early warning device, comprising:

[0025] An intelligence data acquisition module is used to acquire intelligence data of real-time calls and determine intelligence data of real-time fraudulent calls based on the intelligence data of real-time calls and historical fraud-related terminal IP information;

[0026] An intelligence data storage module, used to store the intelligence data of the real-time fraud calls into a preset database;

[0027] The telephone fraud warning module is used to determine the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the portrait of the fraud victim, and to use the intelligence data stored in the preset database in the previous time period to determine the second warning information corresponding to the called user, so as to facilitate telephone fraud warning based on the first warning information and the second warning information.

[0028] In a third aspect, the present application discloses an electronic device, comprising:

[0029] Memory, used to store computer programs;

[0030] A processor is used to execute the computer program to implement the steps of the telephone fraud early warning method disclosed above.

[0031] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the telephone fraud warning method disclosed above are implemented.

[0032] When the present application is making a telephone fraud warning, it first obtains the intelligence data of the real-time phone call, and determines the intelligence data of the real-time fraud phone call based on the intelligence data of the real-time phone call and the historical fraud-related terminal IP information, and stores the intelligence data of the real-time fraud phone call in a preset database. Then, based on the intelligence data of the real-time fraud phone call and the portrait of the fraud victim, it determines the first warning information corresponding to the real-time fraud phone call, and uses the intelligence data stored in the preset database in the previous time period to determine the second warning information corresponding to the called user, so as to make a telephone fraud warning based on the first warning information and the second warning information. It can be seen that when the present application is making a telephone fraud warning, when the intelligence data of the real-time phone call is obtained, the intelligence data of the real-time fraud phone call is determined by the historical fraud-related terminal IP, and the warning information corresponding to the real-time fraud phone call is determined by the portrait of the fraud victim to make a telephone fraud warning. Therefore, in the process of identifying fraudulent calls, the early warning information corresponding to the real-time telephone fraud is determined by the portrait of the fraud victim, avoiding the problem of slow early warning speed through voice content recognition or voiceprint annotation and the problem of early warning limitations caused by excessive reliance on historical fraud case information for telephone fraud early warning, so that the victim information corresponding to the real-time telephone fraud can be quickly grasped; on the other hand, through the collaboration of stream processing and batch processing, the real-time fraud calls are timely identified and the early warning information of the fraud calls is corrected through batch processing, thereby ensuring the timeliness of the telephone fraud early warning. In summary, this application can quickly identify telephone fraud and issue telephone fraud early warnings in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0034] Figure 1 A flowchart of a telephone fraud early warning method provided for this application;

[0035] Figure 2 A flowchart of a specific telephone fraud early warning method provided for this application;

[0036] Figure 3 A diagram of the behavioral characteristics of fraud victims provided for this application;

[0037] Figure 4 Schematic diagram of the telephone fraud warning model provided for this application;

[0038] Figure 5 Diagram of the corresponding conditions of the telephone fraud warning level provided for this application;

[0039] Figure 6 Diagram of telephone fraud warning levels provided for this application;

[0040] Figure 7 A schematic diagram of the structure of a telephone fraud warning device provided in this application;

[0041] Figure 8 This is a structural diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0043] Currently, most methods for identifying phone fraud rely on fraudulent number recognition, voice content, or voiceprint annotation to identify the outgoing number. However, the disadvantages of this method are that the recognition process is complex and overly dependent on historical fraud case information, resulting in slow real-time warning speed. Therefore, this application provides a phone fraud warning method that can quickly identify phone fraud and provide timely phone fraud warnings.

[0044] The embodiment of the present invention discloses a telephone fraud early warning method, see Figure 1 As shown, the method includes:

[0045] Step S11: Acquire intelligence data of real-time calls, and determine intelligence data of real-time fraudulent calls based on the intelligence data of real-time calls and historical fraud-related terminal IP information.

[0046] In this embodiment, before performing telephone fraud identification and early warning, it also includes using the fraud terminal IP identification model to determine the historical fraud terminal IP information through historical telephone data and the historical fraud victim database. Specifically, the first suspicious caller number whose time interval between two adjacent fraud calls is within a preset time period is screened out from the historical telephone data; the second suspicious caller number whose corresponding number of victims is greater than a preset threshold is screened out from the historical fraud victim database; the historical fraud terminal IP information is determined based on the first suspicious caller number and the second suspicious caller number. In a specific embodiment, the first suspicious caller number whose time interval between two adjacent fraud calls is within two days is screened out from the historical telephone data, and the second suspicious caller number whose corresponding number of victims is greater than 1 is screened out from the historical fraud database, and the historical fraud terminal IP information is determined based on the first suspicious caller number and the second suspicious caller number. Through the above technical solution, the historical fraud terminal IP information is determined, so that the intelligence data of the real-time fraud call can be filtered out from the intelligence data of the real-time call through the historical fraud terminal IP information.

[0047] Step S12: storing the real-time fraud call intelligence data into a preset database.

[0048] In this embodiment, after the real-time fraudulent call intelligence data is determined, the real-time fraudulent call intelligence data is stored in a preset database. The preset database includes but is not limited to Mysql (i.e., a relational database) and MongoDB (i.e., a database based on distributed file storage). Through the above technical solution, the real-time fraudulent call intelligence data is stored in the preset database, so that the real-time fraudulent call intelligence data can be obtained through the preset database during subsequent data processing, and then the fraudulent call can be identified and warned based on the real-time fraudulent call intelligence data.

[0049] Step S13: Determine the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the portrait of the fraud victim, and use the intelligence data stored in the preset database in the previous time period to determine the second warning information corresponding to the called user, so as to provide a telephone fraud warning based on the first warning information and the second warning information.

[0050] In this embodiment, a corresponding first warning message is determined based on real-time fraudulent call intelligence data and a profile of the fraud victim. Specifically, when real-time fraudulent call intelligence data is acquired, the intelligence data is immediately processed, analyzed using the real-time fraudulent call intelligence data and a preset fraud victim profile, and the corresponding first warning message is obtained. Simultaneously, second warning messages corresponding to the called user are determined using intelligence data stored in a preset database during the previous time period. Specifically, at a preset time point, the intelligence data stored during the previous time period is uniformly processed, and fraudulent information about the called user corresponding to the intelligence data stored during the previous time period is obtained and the corresponding second warning message is determined. The first and second warning messages are then used in conjunction to provide a telephone fraud warning. Through the above technical solution, a stream-batch integrated data processing method is employed. While timely data processing is performed upon acquisition of real-time fraudulent call intelligence data, the intelligence data stored during the previous time period is batch-processed at a preset time point. This ensures both timely data processing and the accuracy and comprehensiveness of the output warning messages by using the batch-processed data to correct the stream-processed data.

[0051] It can be seen that in this embodiment, when making a telephone fraud warning, when the intelligence data of the real-time telephone is obtained, the intelligence data of the real-time fraud telephone is determined through the historical fraud-related terminal IP, and the warning information corresponding to the real-time fraud telephone is determined through the portrait of the fraud victim to make a telephone fraud warning. Thus, in the process of identifying fraudulent telephone calls, the warning information corresponding to the real-time telephone fraud is determined through the portrait of the fraud victim, avoiding the problem of slow warning speed through voice content recognition or voiceprint annotation and the problem of warning limitations caused by excessive reliance on historical fraud case information for telephone fraud warning, so that the victim information corresponding to the real-time telephone fraud can be quickly grasped; on the other hand, through the collaborative method of stream processing and batch processing, the real-time fraud telephone is timely identified and the warning information of the fraud telephone is corrected through batch processing, thereby ensuring the timeliness of the telephone fraud warning. In summary, this application can quickly identify telephone fraud and make telephone fraud warnings in a timely manner.

[0052] See also Figure 2 As shown, the embodiment of the present invention discloses a specific telephone fraud early warning method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution.

[0053] Step S21: Acquire intelligence data of real-time calls, and determine intelligence data of real-time fraudulent calls based on the intelligence data of real-time calls and historical fraud-related terminal IP information.

[0054] Step S22: storing the real-time fraud call intelligence data into a preset database.

[0055] Step S23: Using a telephone fraud warning model constructed by the Lambda architecture, Flink is used to process the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the portrait of the fraud victim, and Hive is used to determine the second warning information corresponding to the called user based on the intelligence data stored in the preset database in the previous time period.

[0056] In this embodiment, before performing telephone fraud identification and early warning, it also includes: portraying a fraud victim portrait based on the historical victims in the historical fraud victim database, and determining the fraud victim classification label in the fraud victim portrait. Specifically, portray the fraud victim portrait based on the behavioral labels of the Internet fraud victims, telephone fraud victims, and application fraud victims in the historical fraud victim database, and construct the fraud victim urgency level label in the fraud victim portrait. The people who are susceptible to fraud are profiled through the historical fraud victim database, and the people are calculated through behavioral labels. In a specific embodiment, the fraud victim entity is defined as its corresponding mobile phone number, and the behavior of logging in and / or registering on the order-brushing website and the fraud website is analyzed, and the fraud victim portrait is portrayed through behavioral labels, such as Figure 3 As shown, the behavioral characteristic labels in the victim portrait include high-risk group, medium-risk group and low-risk group.

[0057] In this embodiment, a telephone fraud warning model built by Lambda architecture is used, such as Figure 4 As shown, the Lambda architecture's batch processing layer uses Hadoop, specifically Spark Hive for offline processing of big data computing, and HDFS (Hadoop Distributed File System) for big data storage. In one specific implementation, batch data is processed daily, with related data processing tasks for the previous day performed every morning after data collection and synchronization. According to the pre-designed ETL (Extract-Transform-Load, data warehouse technology), data is extracted, transformed, loaded, cleaned, associated, and normalized. The topological relationships between ETL tasks are sequentially invoked, and the processed data is ultimately written to the ES (ElasticSearch) offline database. The Lambda architecture's stream processing layer uses Flink. Data collection pushes data to Kafka as a data cache layer, with Flink or Storm acting as Kafka consumers for real-time data processing.

[0058] In this embodiment, the urgency level label of the fraud victim corresponding to the called user corresponding to the real-time fraud call is determined; the first warning information corresponding to the real-time fraud call is determined based on the behavioral information of the called user and the urgency level label of the fraud victim. The total duration of the fraud call by the called user during the preset time period is determined using the intelligence data set of the real-time fraud call in the preset time period; the second warning information corresponding to the called user is determined based on the total duration of the fraud call by the fraud call during the preset time period. In a specific embodiment, the first warning information is specifically determined by whether the called user corresponding to the real-time fraud call has logged in / registered on the fraud website on that day, and whether the fraud call has been made on that day; the second warning information is specifically determined by the total duration of the fraud call by the called user during that day. Through the above technical solution, the behavioral labels of the victims of online fraud, telephone fraud, and application fraud in the historical fraud victim database are used to portray the profile of the fraud victim, and at the same time, the historical data of the fraud victims in various scenarios are combined to make the profile of the fraud victim more comprehensive.

[0059] Step S24: issuing a telephone fraud warning based on the first warning information and the second warning information.

[0060] In this embodiment, a telephone fraud warning is performed based on the first warning information and the second warning information. Specifically, Figure 5 As shown, the telephone fraud warning level is determined based on the first warning information and the second warning information. When the first warning information shows that the called user corresponding to the real-time fraud call is a high-risk group or a low-risk group or above, and logs in or registers on the fraud website on the same day, and the second warning information shows that the cumulative call duration of the fraudulent call on the same day reaches the emergency preset interval, the telephone fraud warning level is determined to be urgent; when the first warning information shows that the called user corresponding to the real-time fraud call is a medium-risk group or a group that does not fall within the fraud victim profile, and logs in or registers on the fraud website on the same day, and the second warning information shows that the cumulative call duration of the fraudulent call on the same day reaches the high-risk preset interval, the telephone fraud warning level is determined to be high-risk; when the first warning information shows that the called user corresponding to the real-time fraud call is a low-risk group, and the second warning information shows that the cumulative call duration of the fraudulent call on the same day reaches the medium-risk preset interval, the telephone fraud warning level is determined to be medium-risk; when the conditions of emergency, high-risk, and medium-risk are met, the default mark is low-risk. It should be noted that meeting any one of the conditions in the first and second warning information means that the corresponding level is reached. Telephone fraud warning level, such as Figure 6As shown, after the first warning information and the second warning are used to determine the telephone fraud warning level, a corresponding warning is issued based on the telephone fraud warning level. The above technical solution ensures the timeliness of real-time telephone fraud warnings, and the process from data collection to warning result output can be completed within 10 seconds.

[0061] It can be seen that in this embodiment, the victims are classified by using their portraits of fraud victims, and the portraits of fraud victims are portrayed by using the behavioral labels of online fraud victims, telephone fraud victims, and application fraud victims in the historical fraud victim database. Compared with traditional telephone fraud warnings, more fraud victim information is accumulated, making the victim portrait more comprehensive; by pre-classifying the victim portraits, the victim information can be quickly grasped, providing more information support for subsequent dissuasion; at the same time, the telephone fraud warning level is determined by the first warning information and the second warning information, so that the real-time warning of telephone fraud is faster and the warning level is clearer.

[0062] See also Figure 7 The embodiment of the present application discloses a telephone fraud warning device, comprising:

[0063] The intelligence data acquisition module 11 is used to obtain intelligence data of real-time calls and determine the intelligence data of real-time fraudulent calls based on the intelligence data of real-time calls and historical fraud-related terminal IP information;

[0064] An intelligence data storage module 12 is used to store the intelligence data of the real-time fraudulent calls into a preset database;

[0065] The telephone fraud warning module 13 is used to determine the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the portrait of the fraud victim, and to use the intelligence data stored in the preset database in the previous time period to determine the second warning information corresponding to the called user, so as to facilitate telephone fraud warning based on the first warning information and the second warning information.

[0066] It can be seen that in this embodiment, when making a telephone fraud warning, when the intelligence data of the real-time telephone is obtained, the intelligence data of the real-time fraud telephone is determined through the historical fraud-related terminal IP, and the warning information corresponding to the real-time fraud telephone is determined through the portrait of the fraud victim to make a telephone fraud warning. Thus, in the process of identifying fraudulent telephone calls, the warning information corresponding to the real-time telephone fraud is determined through the portrait of the fraud victim, avoiding the problem of slow warning speed through voice content recognition or voiceprint annotation and the problem of warning limitations caused by excessive reliance on historical fraud case information for telephone fraud warning, so that the victim information corresponding to the real-time telephone fraud can be quickly grasped; on the other hand, through the collaborative method of stream processing and batch processing, the real-time fraud telephone is timely identified and the warning information of the fraud telephone is corrected through batch processing, thereby ensuring the timeliness of the telephone fraud warning. In summary, this application can quickly identify telephone fraud and make telephone fraud warnings in a timely manner.

[0067] In some specific embodiments, the telephone fraud warning device further includes:

[0068] A first suspicious calling number determination module is used to screen out a first suspicious calling number from historical phone data, where the time interval between two adjacent fraudulent calls is within a preset time period;

[0069] A second suspicious calling number determination module is used to screen out second suspicious calling numbers whose corresponding number of victims is greater than a preset threshold from a historical fraud victim database;

[0070] The historical fraud-involved terminal IP determination module is configured to determine the historical fraud-involved terminal IP information based on the first suspicious calling number and the second suspicious calling number.

[0071] In some specific embodiments, the telephone fraud warning device further includes:

[0072] The victim portrait characterization module is used to characterize a fraud victim portrait based on the historical victims in the historical fraud victim database and determine the fraud victim classification label in the fraud victim portrait.

[0073] In some specific embodiments, the victim portrait characterization module is specifically used to: characterize the fraud victim portrait based on the behavioral labels of the Internet fraud victims, telephone fraud victims, and application fraud victims in the historical fraud victim database, and construct an urgency level label for the fraud victim in the fraud victim portrait.

[0074] In some specific embodiments, the telephone fraud warning module 13 specifically includes:

[0075] A victim urgency level label determination unit, configured to determine the fraud victim urgency level label corresponding to the called user corresponding to the real-time fraud call;

[0076] The first warning information determining unit is used to determine the first warning information corresponding to the real-time fraud call based on the behavior information of the called user and the urgency level label of the fraud victim.

[0077] In some specific embodiments, the telephone fraud warning module 13 specifically includes:

[0078] A total call duration confirmation unit, configured to determine the total duration of calls to the called user by fraudulent calls within the preset time period using the intelligence data set of the real-time fraudulent calls within the preset time period;

[0079] The second warning information determining unit is used to determine the second warning information corresponding to the called user based on the total duration of fraudulent phone calls within a preset time period.

[0080] In some specific embodiments, the telephone fraud warning module 13 is specifically used to: adopt a telephone fraud warning model constructed by the Lambda architecture, use Flink processing to determine the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the portrait of the fraud victim, and use Hive to determine the second warning information corresponding to the called user based on the intelligence data stored in the preset database in the previous time period.

[0081] Figure 8 An electronic device 20 provided in an embodiment of the present application is shown. The electronic device 20 may further include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the telephone fraud early warning method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0082] In this embodiment, the power supply 23 is used to provide voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0083] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0084] The operating system 221 is used to manage and control the hardware devices on the electronic device 20, and the computer program 222 can be Windows Server, NetWare, Unix, Linux, etc. In addition to including a computer program capable of implementing the telephone fraud early warning method performed by the electronic device 20 as disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0085] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned telephone fraud warning method. The specific steps of this method can be referred to the corresponding content disclosed in the aforementioned embodiments and will not be repeated here.

[0086] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0087] The above is a detailed introduction to the telephone fraud warning method, device, equipment and medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A telephone fraud early warning method, characterized in that: include: Acquire real-time phone intelligence data, and determine real-time fraudulent phone intelligence data based on the real-time phone intelligence data and historical fraud-related terminal IP information; Storing the real-time fraud call intelligence data in a preset database; Using a data processing method that integrates stream and batch processing, first warning information corresponding to the real-time fraud call is determined based on the intelligence data of the real-time fraud call and the profile of the fraud victim, and second warning information corresponding to the called user is determined using the intelligence data stored in the preset database in the previous time period, so as to provide a telephone fraud warning based on the first warning information and the second warning information; The method of determining the first warning information corresponding to the real-time fraudulent call based on the intelligence data of the real-time fraudulent call and the fraud victim portrait, and determining the second warning information corresponding to the called user using the intelligence data stored in the preset database in the previous time period, includes: A telephone fraud warning model constructed using the Lambda architecture is used. The Lambda architecture's Flink stream processing layer is used to process the real-time fraud call intelligence data and the fraud victim's profile to determine the first warning information corresponding to the real-time fraud call. The Lambda architecture's batch processing layer, Hive, is used to determine the second warning information corresponding to the called user based on the intelligence data stored in the preset database in the previous time period. The method further comprises: Use batch processed data to correct stream processed data.

2. The telephone fraud early warning method according to claim 1, characterized in that: Before determining the intelligence data of the real-time fraudulent call based on the intelligence data of the real-time call and the historical fraud-related terminal IP information, the method further includes: Filter out the first suspicious calling number whose time interval between two consecutive fraudulent calls is within a preset time period from the historical call data; Screening out a second suspicious calling number from a historical fraud victim database, the second suspicious calling number corresponding to which the number of victims is greater than a preset threshold; The historical fraud-related terminal IP information is determined based on the first suspicious calling number and the second suspicious calling number.

3. The telephone fraud early warning method according to claim 2, characterized in that: Also includes: A fraud victim portrait is drawn based on the historical victims in the historical fraud victim database, and a fraud victim classification label in the fraud victim portrait is determined.

4. The telephone fraud early warning method according to claim 3, characterized in that: The step of creating a fraud victim portrait based on historical victims in the historical fraud victim database and determining a fraud victim classification label in the fraud victim portrait includes: A fraud victim portrait is portrayed based on the behavioral labels of the online fraud victims, telephone fraud victims, and application fraud victims in the historical fraud victim database, and an urgency level label of the fraud victim in the fraud victim portrait is constructed.

5. The telephone fraud early warning method according to claim 4, characterized in that: The determining of the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the fraud victim portrait includes: Determine the urgency level label of the fraud victim corresponding to the called user corresponding to the real-time fraud call; The first warning information corresponding to the real-time fraud call is determined based on the behavior information of the called user and the urgency level label of the fraud victim.

6. The telephone fraud early warning method according to claim 1, characterized in that: The determining of the second warning information corresponding to the called user by using the intelligence data stored in the preset database in the previous time period includes: Determine the total duration of fraudulent calls to the called user during the preset time period using the real-time fraudulent call intelligence data set during the preset time period; The second warning information corresponding to the called user is determined based on the total duration of fraudulent phone calls within a preset time period.

7. A telephone fraud warning device, characterized in that: include: An intelligence data acquisition module is used to obtain intelligence data of real-time calls and determine intelligence data of real-time fraudulent calls based on the intelligence data of real-time calls and historical fraud-related terminal IP information; An intelligence data storage module, used to store the intelligence data of the real-time fraud calls into a preset database; A telephone fraud warning module is configured to utilize a stream-batch integrated data processing method to determine a first warning message corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the fraud victim's profile, and simultaneously utilize intelligence data stored in the preset database within the previous time period to determine a second warning message corresponding to the called user, so as to provide a telephone fraud warning based on the first and second warning messages; The method of determining the first warning information corresponding to the real-time fraud call based on the intelligence data of the real-time fraud call and the fraud victim portrait, and determining the second warning information corresponding to the called user using the intelligence data stored in the preset database in the previous time period, includes: A telephone fraud warning model constructed using the Lambda architecture is used. The Lambda architecture's Flink stream processing layer is used to process the real-time fraud call intelligence data and the fraud victim's profile to determine the first warning information corresponding to the real-time fraud call. The Lambda architecture's batch processing layer, Hive, is used to determine the second warning information corresponding to the called user based on the intelligence data stored in the preset database in the previous time period. The method further comprises: Use batch processed data to correct stream processed data.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the telephone fraud early warning method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the telephone fraud warning method as described in any one of claims 1 to 6 are implemented.

Images