Target number detection method, system, device and storage medium
By analyzing the signaling data of the number to be detected, determining whether it has regional switching and other abnormal behaviors, the problem in the prior art that needs to wait until the target number is called before analyzing is solved, and detection and containment are carried out in the early stage of fraud, improving communication security.
Patent Information
- Application Number
- CN202210546099.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-05-19
- Publication Date
- 2025-06-10
- Estimated Expiration
- 2042-05-19
AI Technical Summary
In the prior art, it is necessary to wait until the target number starts to call before the analysis can be carried out, and the fraudulent number can be accurately positioned after the fraudulent behavior occurs. The accuracy is low and may cause losses to some users.
By obtaining the signaling data of the number to be detected, it is determined whether the region switching occurs, and the switching interval is calculated. If the switching interval is greater than the preset time, it is determined that the number is the target number. Optional steps include determining whether the test card behavior occurs and the terminal replacement behavior to further determine the target number.
It can conduct effective detection before the target number is called, and telecom fraud is curbed early, thereby improving communication security.
Smart Images

Figure CN115052290B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technologies, and in particular, to a method, system, device, and storage medium for detecting a target number. Background Art
[0002] With the continuous development of communication technologies, the types of telecom fraud are also emerging in an endless stream. In order to effectively detect the target numbers for implementing fraud, a method for analyzing fraud calls based on real-time call records is proposed in related technologies. However, in related technologies, it is necessary to wait until the target number starts to make a call (that is, the current target number starts to implement fraud behavior) to start analyzing it. This post-analysis method may cause some users to suffer losses. Summary of the Invention
[0003] This application aims to solve at least one of the technical problems in related technologies to some extent. For this purpose, this application provides a method, system, device, and storage medium for detecting a target number.
[0004] In a first aspect, an embodiment of this application provides a method for detecting a target number, including: obtaining signaling data corresponding to the network mode according to the network mode of the number to be detected; judging whether the number to be detected has a geographical area switch according to the signaling data; when it is determined that the number to be detected has the geographical area switch, determining the switching interval of the number to be detected from the previous geographical area to the current geographical area; when the switching interval is greater than a preset first duration, determining the number to be detected as a target number.
[0005] Optionally, the method further includes: when the switching interval is greater than the preset first duration, judging whether the number to be detected has a SIM card testing behavior in the previous geographical area according to the signaling data; when the number to be detected has the SIM card testing behavior in the previous geographical area, determining the number to be detected as the target number; where the SIM card testing behavior is that the number to be detected only dials a SIM card testing number in the previous geographical area and generates a SIM card testing call signaling.
[0006] Optionally, the method further includes: when the number to be detected has the SIM card testing behavior in the previous geographical area, judging whether the number to be detected has a terminal replacement behavior; when the number to be detected has the terminal replacement behavior, determining the number to be detected as the target number.
[0007] Optionally, determining whether the number to be detected has performed a terminal replacement behavior includes: when the network mode of the number to be detected is the CDMA network mode and a self-registered SMS signaling is generated by the number to be detected, determining that the number to be detected has performed the terminal replacement behavior; when the network mode of the number to be detected is the VOLTE network mode, obtaining the first IMEI information in the boot signaling and the second IMEI information in the card test call signaling, and when the first IMEI information does not match the second IMEI information, determining that the number to be detected has performed the terminal replacement behavior.
[0008] Optionally, obtaining signaling data corresponding to the network mode according to the network mode of the number to be detected includes: when the network mode of the number to be detected is the CDMA network mode, obtaining at least one of the MAP 13th signaling data and the MAP 6th signaling data; when the network mode of the number to be detected is the VOLTE network mode, obtaining the initial registration signaling data.
[0009] Optionally, the method further includes: storing the obtained signaling data in a Redis cache; periodically obtaining the signaling data of the number to be detected, and updating the historical signaling data in the Redis cache with the latest signaling data.
[0010] Optionally, the method further includes: performing a shutdown process on the target number.
[0011] In a second aspect, an embodiment of the present application provides a target number detection system, including: a first module, configured to obtain signaling data corresponding to the network mode according to the network mode of the number to be detected; a second module, configured to determine whether the number to be detected has performed a geographical area switch according to the signaling data; a third module, configured to determine the switching interval of the number to be detected from the previous geographical area to the current geographical area when it is determined that the number to be detected has performed the geographical area switch; a fourth module, configured to determine that the number to be detected is a target number when the switching interval is greater than a preset first duration.
[0012] In a third aspect, an embodiment of the present application provides a target number detection device, including: at least one processor; at least one memory, configured to store at least one program; when the at least one program is executed by the at least one processor, enabling the at least one processor to implement the above-mentioned target number detection method.
[0013] In a fourth aspect, an embodiment of the present application provides a computer storage medium, in which a program executable by a processor is stored, and the program executable by the processor is used to implement the above-mentioned target number detection method when executed by the processor.
[0014] The beneficial effects of the embodiments of the present application are as follows: First, according to the network mode of the number to be detected, signaling data corresponding to the network mode is obtained, and based on the signaling data, it is determined whether the number to be detected has undergone a geographical switch; when it is determined that the number to be detected has undergone a geographical switch, the switching interval from the previous geographical area to the current geographical area of the number to be detected is determined; when the switching interval is greater than a preset first time period, the number to be detected is determined as the target number. The embodiments of the present application start from the behavior logic of the person using the target number to commit illegal acts, can effectively detect the target number before it makes a call, and can contain it at the initial stage of telecommunications fraud, thereby achieving the purpose of improving communication security. Brief Description of the Drawings
[0015] The drawings are used to provide a further understanding of the technical solutions of the present application, and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solutions of the present application, and do not constitute a limitation to the technical solutions of the present application.
[0016] Figure 1 is a flowchart of the steps of the target number detection method provided by the embodiments of the present application;
[0017] Figure 2 is a schematic diagram of the target number detection method provided by the embodiments of the present application;
[0018] Figure 3 is a schematic diagram of the target number detection system provided by the embodiments of the present application;
[0019] Figure 4 is a schematic diagram of the target number detection device provided by the embodiments of the present application. Detailed Embodiments
[0020] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.
[0021] It should be noted that although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from the module division in the system or the flowchart. Terms such as "first" and "second" in the specification, claims and the above drawings are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence.
[0022] With the continuous development of communication technologies, the types of telecommunications fraud have emerged in an endless stream. To effectively detect the target numbers involved in fraud, relevant technologies have proposed fraud call analysis methods based on real-time call records. Such methods can be roughly divided into two categories: one is to analyze the call behavior of the number to be detected based on the call signaling data or call record data of the number to be detected. The analyzed data includes the call intensity, called party dispersion, connection rate, call duration, etc. of the number to be detected; the other is to analyze the number to be detected by combining the paging signaling of the number, the number's place of registration, account opening data, historical service data, etc. According to the above content, in the relevant technologies, it is necessary to wait until the target number starts to make a call (that is, the current target number starts to commit fraud) to start analyzing it, which may lead to the accurate positioning of the fraud number only after the fraud behavior has occurred. Therefore, this post-analysis method has a low accuracy and may cause losses to some users.
[0023] Based on this, the embodiments of the present application provide a method, system, device, and storage medium for detecting a target number: First, according to the network mode of the number to be detected, obtain the signaling data corresponding to the network mode, and based on the signaling data, determine whether the number to be detected has undergone a geographical area switch; when it is determined that the number to be detected has undergone a geographical area switch, determine the switching interval of the number to be detected from the previous geographical area to the current geographical area; when the switching interval is greater than a preset first duration, determine the number to be detected as the target number. The embodiments of the present application start from the behavior logic of the person using the target number to commit illegal acts, can effectively detect the target number before it makes a call, and can contain the telecommunications fraud in the initial stage, so as to achieve the purpose of improving communication security.
[0024] The following further elaborates on the embodiments of the present application with reference to the accompanying drawings.
[0025] Reference Figure 1 , Figure 1 is the flowchart of the steps of the target number detection method provided by the embodiments of the present application. The steps include but are not limited to S100 - S140:
[0026] S100. According to the network mode of the number to be detected, obtain the signaling data corresponding to the network mode;
[0027] Specifically, in order to detect and prevent telecom fraud as early as possible, the embodiments of the present application propose to locate the target number according to the behavior logic of lawbreakers. Generally speaking, lawbreakers often purchase phone cards through online channels and mail them to the location of the card purchaser (assumed to be Place A), and the card purchaser authenticates and activates the phone card. After activation, the phone card is mailed to the location where the fraud occurs (assumed to be Place B, where Place A and Place B are often in different cities), and other members of the gang use the phone card to carry out telecom fraud. Therefore, in the embodiments of the present application, for the process of lawbreakers' handling of phone cards in telecom fraud, the embodiments of the present application propose to determine whether the currently detected number is the target number used by lawbreakers according to the location switching situation of the phone card.
[0028] In some embodiments, the obtained signaling data can be stored in the Redis cache. When new signaling data is obtained, the new signaling data is compared with the historical signaling data cached in Redis to determine the signaling trigger time, trigger interval, and other contents. In addition, the signaling data of the number to be detected is obtained periodically, and the historical signaling data in the Redis cache is updated with the latest signaling data.
[0029] In this step, first, according to the network mode of the number to be detected, the signaling data corresponding to the network mode is obtained. Currently, most operators support voice network modes based on 2G voice CDMA and 4G voice VOLTE based on LTE. Therefore, this solution takes these two network modes as examples for elaboration. It can be understood that for other possible network modes in the future, the method in the embodiments of the present application can also be referred to for target number detection.
[0030] When the network mode of the number to be detected is the CDMA network mode, if the number to be detected undergoes a geographical switch (in the present application, geographical switch mainly refers to the switch between cities, such as from City A to City B), the number to be detected needs to report MAP signaling data in the C network, and the type is 13 or 6. Among them, MAP signaling No. 13 is the registration notice of the location registration service, and MAP signaling No. 6 is the qualification application for the call processing service. Therefore, obtaining at least one of the above two types of signaling can determine whether the currently detected number has undergone a geographical switch.
[0031] When the network mode of the number to be detected is the VOLTE network mode, if the number to be detected undergoes a geographical switch. Then the number to be detected will report VOLTE initial registration signaling data. Therefore, if the initial registration signaling data is obtained, it is determined whether the currently detected number has undergone a geographical switch.
[0032] S110. According to the signaling data, determine whether the number to be detected has undergone a geographical switch;
[0033] Specifically, according to step S100, under different network modes, different types of signaling data are obtained, and based on the signaling data, it is determined whether the number to be detected has switched regions.
[0034] It can be understood that in the embodiments of the present application, all the most recent signaling data of the number to be detected can be obtained regularly, and it is queried whether there is the above-mentioned signaling data that can indicate that the number to be detected has switched regions in these signaling data.
[0035] S120. When it is determined that the number to be detected has switched regions, determine the switching interval of the number to be detected from the previous region to the current region;
[0036] Specifically, if it is determined according to the signaling data that the current number to be detected has switched regions, then according to the triggering time of each signaling in the signaling data, determine the switching interval of the current number to be detected from the previous region to the current region. For example, if the signaling data shows that the triggering time of the last signaling in the previous region is time A, and the triggering time of the first signaling when the number to be detected switches to the current region is time B, then the interval between time A and time B is the switching interval in the embodiments of the present application.
[0037] S130. When the switching interval is greater than a preset first duration, determine that the number to be detected is the target number;
[0038] Specifically, as mentioned above, lawbreakers usually conduct phone card authentication in place A and then send the authenticated phone card back to place B to carry out fraud. Therefore, in this case, the time interval between place A and place B for the phone card will be relatively long (the time occupied by mailing or other transportation methods). And if it is a phone card used by a normal user, even if the phone card follows the user to move to other regions after authentication and use (for example, a normal user takes a plane to reach other cities), the user will use it normally in other regions, and the switching interval will also be relatively short. Therefore, a first duration is preset, and this first duration represents the longest time that the phone card pauses to be used in the case of cross-region. For example, if the first duration is set to 12 hours, when the switching interval determined in step S120 is greater than 12 hours, it is determined that the switching interval of the current number to be detected is too long and it is very likely to be the target number for preparing to carry out fraud. Therefore, determine that the current number to be detected is the target number.
[0039] S140. Perform a shutdown process on the target number;
[0040] Specifically, when the target number is determined, the operator can perform a shutdown process on this target number. In the embodiments of the present application, it is not necessary to wait for the target number to initiate a call to start detection, but the target number can be accurately detected and processed before the lawbreakers use the target number to make an outbound fraud call.
[0041] Through steps S100 - S140, the embodiments of the present application provide a method for detecting a target number: First, according to the network mode of the number to be detected, obtain the signaling data corresponding to the network mode, and based on the signaling data, determine whether the number to be detected has switched regions; when it is determined that the number to be detected has switched regions, determine the switching interval when the number to be detected switches from the previous region to the current region; when the switching interval is greater than a preset first duration, determine that the number to be detected is a target number. The embodiments of the present application start from the behavior logic of the person using the target number to commit illegal acts, can effectively detect the target number before it makes a call, and can contain it in the initial stage of telecommunications fraud, thereby improving the effectiveness and accuracy of target number detection and further protecting communication security.
[0042] To further improve the accuracy of target number recognition, in some other embodiments, the target number detection method proposed by the embodiments of the present application further includes other detection steps, which are specifically described as follows.
[0043] In some embodiments, when step S130 above determines that the switching interval of the current number to be detected is greater than the preset first duration, then based on the signaling data, determine whether the number to be detected has performed a card testing behavior in the previous region. Card testing behavior refers to that when a phone card is used for the first time, it dials a card testing number (for example, the card testing number can be an operator number) to determine whether the phone card is normally activated. A call signaling will be generated during the process of dialing the card testing number, and in the embodiments of the present application, this call signaling is called a card testing call signaling. It can be understood that if it is determined through signaling data analysis that the current number to be detected only dials the card testing number in the previous region, that is, a card testing behavior occurs, it is very likely that the illegal element simply activates the phone card in place A (the location of the card purchaser) and then no longer uses it, and the phone card is transported to place B (the location where the fraud occurred) and then used. Therefore, when the number to be detected has a card testing behavior in the previous region, determine that the number to be detected is a target number.
[0044] In some other embodiments, after determining that the number to be detected has a card testing behavior, it is also possible to further determine whether the number is a target number by determining whether the number to be detected has switched mobile terminals. When the number to be detected has a card testing behavior in the previous region, determine whether the number to be detected has performed a terminal replacement behavior; if the number to be detected has performed a terminal replacement behavior, then determine that the number to be detected is a target number.
[0045] Specifically, when the network mode of the number to be detected is the CDMA network mode and the SIM card is powered on in the current area, the number to be detected will send a self-registration SMS to the operator in the background. That is to say, a self-registration SMS signaling will be generated for the number to be detected. This SMS signaling can determine that the terminal device to be detected has performed a terminal replacement behavior. Therefore, the number to be detected is determined as the target number. Additionally, when the network mode of the number to be detected is the VOLTE network mode and the SIM card is powered on in the current area, the number to be detected will generate a power-on signaling, which contains the first IMEI information representing the current terminal device. Moreover, since the number to be detected has performed a SIM card testing behavior in the previous area, the SIM card testing call signaling will carry the second IMEI information representing the previous terminal device. Therefore, the first IMEI information and the second IMEI information are matched. If the result is a mismatch, it indicates that the terminal device of the number to be detected has been replaced. Thus, the number to be detected is determined as the target number.
[0046] It can be understood that by detecting the SIM card testing behavior and the terminal replacement behavior, the accuracy of target number detection can be further improved, which is more conducive to ensuring communication security.
[0047] Next, in combination with the actual situation, the specific implementation process of the target detection method proposed in this application embodiment will be elaborated.
[0048] Refer to Figure 2 , Figure 2 which is a schematic diagram of the target number detection method provided in this application embodiment. As Figure 2 shown, this method is divided into a timing query (the part represented by the dashed box 210), a real-time monitoring (the part represented by the dashed box 220), and a detection part (the part represented by the dashed box 230).
[0049] First, in the timed query section, it is mentioned in the above content that lawbreakers usually purchase phone cards through online channels. Therefore, a timed program 01 can be used to obtain the daily sales situation of phone cards in the electronic channel every day, including information such as the numbers of these phone cards, sales time, sales location, etc. At the same time, the operator will obtain the latest billing call detail records (including call records, traffic records, and text message records) of this batch of full - volume phone card numbers in the electronic channel through the big data platform, as well as the city where the call detail records are generated, as additional information for assisting in judging the city and time of the numbers. The data obtained through the timed program 01 at regular intervals is stored in the database and Redis cache respectively. Among them, only the latest signaling data of the numbers is stored in Redis, and all signaling data of the numbers is stored in the database. If a number in the database does not exist in Redis, the signaling data of the number for the previous two days is retrieved from the database and stored in Redis. In addition, according to the VOLTE network specification, the VOLTE re - registration signaling data of mobile phone numbers in standby under normal VOLTE networks is reported once every 50 minutes. Therefore, in order to successfully write the VOLTE re - registration signaling data reported periodically every 50 minutes into Redis, a new timed program 02 needs to be added. This timed program 02 runs periodically every hour, queries the VOLTE re - registration signaling records of the full - volume phone card numbers monitored on the current day for the previous 2 hours from the database. If there are such records and the queried time is newer than the time in the current Redis, they are written into Redis.
[0050] Then, in the real - time monitoring section, signaling data in the network (specifically, MAP13 and MAP6 signaling in the C network, and initial registration signaling data in VOLTE) is obtained in real - time through Kafka, and the obtained signaling data is compared and judged with the number time in the cache redis. If there is no information about this number in the current redis, or the time is newer than the number time in the current redis, the number time and the corresponding city need to be updated and written into redis.
[0051] Finally, in the detection section, first, it is determined whether the currently detected number has undergone a geographical area switch and the switch interval exceeds the first duration. Then, it is determined whether the currently detected number has undergone a card - testing behavior. Finally, it is determined whether the currently detected number has undergone a terminal replacement behavior. If the above - mentioned judgment results are all affirmative, it is determined that the currently detected number is the target number, and the target number is shut down.
[0052] Refer to Figure 3 , Figure 3It is a schematic diagram of the target number detection system provided by the embodiment of the present application. The system 300 includes a first module 310, a second module 320, a third module 330, and a fourth module 340. The first module is used to obtain signaling data corresponding to the network mode according to the network mode of the number to be detected; the second module is used to judge whether the number to be detected has a geographical area switch according to the signaling data; the third module is used to determine the switching interval of the number to be detected from the previous geographical area to the current geographical area when it is determined that the number to be detected has a geographical area switch; the fourth module is used to determine that the number to be detected is the target number when the switching interval is greater than a preset first duration.
[0053] Reference Figure 4 , Figure 4 It is a schematic diagram of the target number detection device provided by the embodiment of the present application. The device 400 includes at least one processor 410, and also includes at least one memory 420 for storing at least one program; Figure 4 Take one processor and one memory as an example in
[0054] The processor and the memory can be connected through a bus or other means, Figure 4 Take the connection through the bus as an example in
[0055] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may optionally include a memory remotely set relative to the processor, and these remote memories can be connected to the device through a network. Examples of the above networks include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.
[0056] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0057] The embodiment of the present application also discloses a computer storage medium, in which a processor-executable program is stored, and the processor-executable program is used to implement the method proposed by the present application when executed by the processor.
[0058] Those of ordinary skill in the art will understand that all or some of the steps and systems disclosed in the above methods can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or can be implemented as hardware, or can be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include a computer storage medium (or non-transitory medium) and a communication medium (or transitory medium). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, as is well known to those of ordinary skill in the art, communication media typically includes computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium.
[0059] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the above embodiments. Those skilled in the art can make various equivalent deformations or substitutions without departing from the spirit of the present application, and these equivalent deformations or substitutions are all included within the scope defined by the claims of the present application.
Claims
1. A method for detecting a target number, characterized in that, it includes: Obtain signaling data corresponding to the network mode according to the network mode of the number to be detected; Judge whether the number to be detected has a geographical area switch according to the signaling data; When it is determined that the number to be detected has the geographical area switch, determine the switching interval from the previous geographical area to the current geographical area of the number to be detected; The step of judging whether the number to be detected has a geographical area switch according to the signaling data; When it is determined that the number to be detected has the geographical area switch, determining the switching interval from the previous geographical area to the current geographical area of the number to be detected includes: When new signaling data is obtained, compare the new signaling data with historical signaling data; When the switching interval is greater than a preset first duration, judge whether the number to be detected has a SIM card testing behavior in the previous geographical area according to the signaling data; Wherein, the SIM card testing behavior is that the number to be detected only dials a SIM card testing number in the previous geographical area and generates a SIM card testing call signaling; When the number to be detected has the SIM card testing behavior in the previous geographical area, judge whether the number to be detected has a terminal replacement behavior; When the number to be detected has the terminal replacement behavior, determine the number to be detected as the target number.
2. The method for detecting a target number according to claim 1, characterized in that, The step of judging whether the number to be detected has a terminal replacement behavior includes: When the network mode of the number to be detected is the CDMA network mode and the number to be detected generates a short message signaling for self-registration at startup, determine that the number to be detected has the terminal replacement behavior; When the network mode of the number to be detected is the VOLTE network mode, obtain the first IMEI information in the startup signaling and the second IMEI information in the SIM card testing call signaling. When the first IMEI information does not match the second IMEI information, determine that the number to be detected has the terminal replacement behavior.
3. The method for detecting a target number according to claim 2, characterized in that, The step of obtaining signaling data corresponding to the network mode according to the network mode of the number to be detected includes: When the network mode of the number to be detected is the CDMA network mode, obtain at least one of MAP 13th signaling data and MAP 6th signaling data; When the network mode of the number to be detected is the VOLTE network mode, obtain initial registration signaling data.
4. The method for detecting a target number according to claim 2, characterized in that, The method further includes: Store the obtained signaling data into a Redis cache; Periodically obtain the signaling data of the number to be detected and update the historical signaling data in the Redis cache with the latest signaling data.
5. The method for detecting a target number according to claim 1, characterized in that, The method further includes: Perform a shutdown process on the target number.
6. A target number detection system, characterized in that, it includes: A first module, configured to obtain signaling data corresponding to the network mode according to the network mode of the number to be detected; A second module, configured to determine whether the number to be detected has a geographical area switch according to the signaling data; A third module, configured to determine the switching interval of the number to be detected from the previous geographical area to the current geographical area when it is determined that the number to be detected has the geographical area switch; The second module and the third module are further configured to: when new signaling data is obtained, compare the new signaling data with historical signaling data; A fourth module, configured to determine that the number to be detected is a target number when the switching interval is greater than a preset first duration; The fourth module is further configured to: when the switching interval is greater than a preset first duration, determine whether the number to be detected has a card testing behavior in the previous geographical area according to the signaling data; wherein the card testing behavior is that the number to be detected only dials a card testing number in the previous geographical area and generates a card testing call signaling; when the number to be detected has the card testing behavior in the previous geographical area, determine whether the number to be detected has a terminal replacement behavior; when the number to be detected has the terminal replacement behavior, determine that the number to be detected is a target number.
7. A target number detection device, characterized in that, it includes: at least one processor; at least one memory, configured to store at least one program; when the at least one program is executed by the at least one processor, the at least one processor implements the target number detection method according to any one of claims 1-5.
8. A computer storage medium, in which a program executable by a processor is stored, characterized in that, the program executable by the processor is used to implement the target number detection method according to any one of claims 1-5 when being executed by the processor.
Citation Information
Patent Citations
Abnormal number identification method and equipment
CN111132144A
Number processing method and device, electronic equipment and computer readable storage medium
CN114040376A
Fraud user identification method and device, electronic equipment and computer readable medium
CN114423009A