Method and system for discovering speech samples

Abstract

The present invention belongs to the field of communication network security technology, and particularly relates to a speech sample discovery method and system, which determines whether the call initiator during the communication process is a target number in a fraudulent telephone number library. If it is a target number, multiple call contents with the target number as the call initiator are obtained; multiple call contents of the call initiator are similarly matched and aggregated based on word similarity, and multiple types of call texts that meet the similarity threshold conditions are output; multiple types of call texts are matched with fraudulent speech in a known fraud speech library. If the match is successful, it is determined to be a known fraud speech, otherwise, it is determined to be a suspected new fraud speech; the suspected new fraud speech is submitted to a third party for annotation and review and to determine whether it is a new fraud speech. The present invention does not require a high-level semantic understanding of the communication content, reduces the dependence on continuous speech recognition and natural language understanding technology, has strong robustness, and is convenient for the effective identification of fraud speech in the communication network.

Description

Technical Field

[0001] The present invention belongs to the technical field of communication network security, and in particular relates to a speech sample discovery method and system. Background Art

[0002] While communication technology brings convenience to people, it also brings opportunities for criminals. Criminals use public communication networks to call victims and pretend to be public security, procuratorial and judicial organs, e-commerce customer service, couriers, leaders, acquaintances, etc., and use carefully designed words to gain the trust of victims and then commit fraud. At present, online fraud crimes have become a recognized cancer and a social nuisance that infringes on the property safety of citizens. Fighting and controlling online fraud crimes is related to the vital interests of the people and the stability of the overall social situation. How to accurately capture fraudulent communications from massive communication information is the key to controlling online fraud. In the early days, when regulating fraud based on telecommunications networks, the main method based on black and white lists was used to identify callers. In order to evade detection based on lists, criminals often hide abroad and constantly change the caller number to evade detection based on number behavior characteristics. In online fraud based on the Internet, criminals can more conveniently change network IDs frequently to hide their identities. Therefore, detection based on communication content is an effective means to deal with online fraud.

[0003] Network fraud detection based on communication content refers to the detection of user communication content on the telecommunications network or the Internet based on the fraud scripts that have been mastered, and the communication that successfully matches the known fraud scripts will be judged as network fraud, and then intervention such as dissuasion will be carried out. It should be noted that in the process of implementing network fraud, criminals mainly communicate with victims in two ways, one is voice, including calling, voice chat in WeChat, etc.; the other is text, mainly text chat on platforms such as WeChat and QQ. In order to implement content-based network fraud detection, the content of voice communication is usually converted into text using continuous speech recognition technology, and the detection of voice network fraud is also achieved by matching the text content of the fraud script. However, in order to evade content-based detection, criminals will constantly update their words. How to discover new fraud words from massive network communications and enrich the fraud script library for detection is a difficult problem in this field. At present, the communication content is mainly traced back based on the clues reported by the victim, which is inefficient. Therefore, it is of great significance to realize the automatic discovery of new fraud words to improve the effectiveness and efficiency of content-based network fraud detection. Summary of the invention

[0004] The present invention provides a speech sample discovery method and system, which performs analysis and matching based on the underlying features of the text, does not require high-level semantic understanding of the communication content, reduces dependence on continuous speech recognition and natural language understanding technology, has strong robustness, facilitates the effective identification of fraudulent speech in the communication network, and reduces the possibility of being deceived by the caller.

[0005] According to the design scheme provided by the present invention, a method for discovering speech samples is provided, which includes the following contents:

[0006] Determine whether the call initiator during the communication process is a target number in the fraudulent phone number database, and if it is a target number, obtain multiple call contents with the target number as the call initiator;

[0007] Based on word similarity, multiple call contents of the call initiator are matched and aggregated to output multiple types of call texts that meet similarity threshold conditions;

[0008] Match the content of multiple types of call texts with the fraudulent phrases in the known fraudulent phrase library. If the match is successful, it is determined to be a known fraudulent phrase; otherwise, it is determined to be a suspected new fraudulent phrase;

[0009] Suspected new fraudulent tactics will be submitted to a third party for labeling and review, and a final determination will be made as to whether it is a new fraudulent tactics. If it is a new fraudulent tactics, it will be added to the library of known fraudulent tactics.

[0010] As a speech sample discovery method of the present invention, further, in similarity matching and aggregation based on word similarity, first, each calling voice of the call initiator in the call content is converted into a text sequence using continuous speech recognition technology; then, for the texts corresponding to any two calling voices in the text sequence, the text content similarity is analyzed and aggregated using a text matching method.

[0011] As a speech sample discovery method of the present invention, further, in analyzing the similarity of text content using a text matching method, first, the text is preprocessed, and a template and sample for text matching are set; then, based on word similarity, each character in the sample is matched with a character in the template, and the two successfully matched texts are merged and classified.

[0012] As the speech sample discovery method of the present invention, further, in the text preprocessing, first, punctuation marks in the two texts are removed, and the lengths of the two plain texts are obtained, and one of the texts is selected as a template and the other text is selected as a sample based on the length of the plain text.

[0013] As the speech sample discovery method of the present invention, further, in the matching based on word similarity, for each character in the sample, search whether there is a matching character in the template in turn. If there is a matching character, the matched template character position is recorded in the result sequence. If there is no matching character, a character marker is set at the corresponding position in the result sequence; finally, by analyzing and counting the number of elements that are not character markers in the result sequence, as the number of word matches, and counting the number of elements that are not character markers and are continuous, as the number of word matches, and calculating the ratio of the number of word matches and the number of word matches to the length of the result sequence, the two ratios are compared with the preset similarity threshold. If both are met, the two texts are matched successfully.

[0014] As a method for discovering speech samples of the present invention, further, for each type of call text, the text with the longest text length is taken as the representative text, and the representative text is matched with each text in the known fraud speech text library based on word similarity. If the match is successful, the call text speech in the current category is determined to be a known fraud speech, otherwise, it is determined to be a suspected new fraud speech.

[0015] As a method for discovering speech samples of the present invention, further, a third party conducts annotation and review of suspected new fraud speech, and it is set that experts perform manual annotation and review.

[0016] Furthermore, the present invention also provides a speech sample discovery system, comprising: a number recognition module, a call classification module, a speech matching module and a suspected review module, wherein:

[0017] The number identification module is used to determine whether the call initiator during the communication process is a target number in the fraudulent phone number database. If it is a target number, multiple call contents with the target number as the call initiator are obtained;

[0018] A call classification module is used to perform similarity matching and aggregation on multiple call contents of the call initiator based on word similarity, and output multiple types of call texts that meet similarity threshold conditions;

[0019] The speech matching module is used to match the content of multiple types of call texts with the fraud speech in the known fraud speech library. If the match is successful, it is determined to be a known fraud speech; otherwise, it is determined to be a suspected new fraud speech;

[0020] The suspected review module is used to submit suspected new fraudulent speech to a third party for labeling and review, and ultimately determine whether it is a new fraudulent speech. If it is a new fraudulent speech, it will be added to the known fraudulent speech library.

[0021] Beneficial effects of the present invention:

[0022] The present invention classifies similar communication contents by performing similarity matching analysis and aggregation on the basis of characters and words on the communication contents of a large number of communications in the network; further matches and analyzes the communication contents of each category mentioned above with the fraudulent words in the known fraudulent words library to find out new suspected fraudulent words, and finally manually reviews and confirms the new fraudulent words, without the need for high-level semantic understanding of the communication contents, and reduces the dependence on continuous speech recognition and natural language understanding technology; through the effective identification of new fraudulent words, harassing fraudulent calls or text messages can be handled in time, and communication network users can be prevented from being deceived in time, and the present invention has good application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The figure is a schematic diagram of the speech recognition process in the embodiment. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0025] Considering that when criminals defraud multiple victims based on the same fraudulent rhetoric, the content of the calls will be highly similar. Figure 1 As shown, a method for discovering speech samples is provided, which includes the following contents:

[0026] Determine whether the call initiator during the communication process is a target number in the fraudulent phone number database, and if it is a target number, obtain multiple call contents with the target number as the call initiator;

[0027] Based on word similarity, multiple call contents of the call initiator are matched and aggregated to output multiple types of call texts that meet similarity threshold conditions;

[0028] Match the content of multiple types of call texts with the fraudulent phrases in the known fraudulent phrase library. If the match is successful, it is determined to be a known fraudulent phrase; otherwise, it is determined to be a suspected new fraudulent phrase;

[0029] Suspected new fraudulent tactics will be submitted to a third party for labeling and review, and a final determination will be made as to whether it is a new fraudulent tactics. If it is a new fraudulent tactics, it will be added to the library of known fraudulent tactics.

[0030] The communication contents of the active initiators of multiple communications are matched and aggregated based on the similarity of words and characters, and multiple types of communications with highly similar call contents are found and output; then, the communication contents of each type are matched based on the already mastered fraud script library to identify suspected new fraud scripts; analysis and matching are performed based on the underlying features of the text, without the need for high-level semantic understanding of the communication content, reducing the reliance on continuous speech recognition and natural language understanding technology, and having strong robustness, which facilitates the promotion and implementation of anti-fraud applications in communication networks.

[0031] Continuous speech recognition refers to the recognition of continuous audio streams (i.e., voices directly recorded by the speaker, or audio signals from telephone or other audio and video fields), and the automatic conversion of audio information into text. Furthermore, in the embodiment of this case, in the similarity matching and aggregation based on word similarity, first, each caller voice of the call initiator in the call content is converted into a text sequence using the existing more mature continuous speech recognition technology; then, for the texts corresponding to any two caller voices in the text sequence, the text content similarity is analyzed and aggregated using the text matching method.

[0032] Furthermore, in analyzing the similarity of text content using the text matching method, first, the text is preprocessed, and the template and sample for text matching are set; then, each character in the sample is matched with the character in the template based on the word similarity, and the two successfully matched texts are merged and classified. Furthermore, in the text preprocessing, first, punctuation marks in the two texts are removed, and the lengths of the two plain texts are obtained, and one of the texts is selected as the template and the other text as the sample according to the plain text length. Furthermore, in the matching based on word similarity, for each character in the sample, a search is conducted in turn to see whether there is a matching character for the character in the template. If there is a matching character, the matched template character position is recorded in the result sequence. If there is no matching character, a character marker is set at the corresponding position in the result sequence. Finally, the number of elements that are not character markers in the result sequence is analyzed and counted as the number of word matches, and the number of elements that are not character markers and are continuous is counted as the number of word matches, and the ratio of the number of word matches and the number of word matches to the length of the result sequence is calculated, and the two ratios are compared with a preset similarity threshold. If both ratios are met, the two texts are successfully matched.

[0033] For any two texts T A and T B ,The process of analyzing text content similarity can be designed as follows:

[0034] (1) Remove the punctuation marks from the two texts respectively and get T' A and T' B ;

[0035] (2) Assume T'A The length, that is, the number of characters is L A , T' B The length is L B ;

[0036] (3) Use the long text as the template model and the short text as the sample. That is, if L A ≤L B ,model=T' B ,sample=T' A , if L A >L B ,model=T' A ,sample=T' B ;

[0037] (4) For each character s in sample i , and search for matching characters in the model. j With s i If it matches, then m j The position j is recorded in the sequence Result that stores the matching results, Result(i) = j; if there is no character in the model that matches s i If the match is successful, the corresponding position in the result sequence is marked as -1, that is, Result(i) = -1;

[0038] (5) Analyze the matching result sequence Result, count the number of elements in Result that are not -1, assume that it is cnt1, and this value reflects the number of words that are successfully matched between the two texts; count the number of elements in Result that are not -1 and continuous (1 greater than the value of the previous element), assume that it is cnt2, and this value reflects the number of words (double words) that are successfully matched between the two texts;

[0039] (6) Calculate the number of character matches cnt1 and word matches cnt2 respectively, accounting for the length L of the result sequence Result Result ratio, ratio1=cnt1 / L Result ,ratio2=cnt2 / L Result ;

[0040] (7) Ratio1 and ratio2 are compared with preset threshold values ​​Thres1 and Thres2 respectively. If ratio1>Thres1 and ratio2>Thres2, it means that the two texts match successfully.

[0041] Then, the results of similarity matching between two texts are merged. If the text TA and T B Matching success, text T A and T C Also matches successfully, then the text T A , T B and T C After the above merging, the communication content texts from the initiators of multiple communications can be divided into one or more text categories according to their similarities, and the texts in each category are judged to be from the same script.

[0042] In the embodiment of this case, further, for each type of call text, the longest text is used as the representative text, and the representative text is matched with each text in the known fraudulent speech text library based on word similarity. If the match is successful, the call text speech in the current category is determined to be a known fraudulent speech, otherwise, it is determined to be a suspected new fraudulent speech. Furthermore, the third party is conducting an annotation review of the suspected new fraudulent speech, and it is set to be manually annotated and reviewed by experts.

[0043] For each call text class, find the longest text as the representative text of this class, and each text in the known fraudulent speech text library, and make a judgment according to the similarity matching method between two texts in step 2. If the representative text of this class successfully matches a text in the known speech text library, this class is judged as a known fraudulent speech text. If the representative text of this text class fails to match all the texts in the known fraudulent speech text library, the text class is judged as a suspected new fraudulent speech, and the output is manually reviewed. The above process is described in formal language as follows: Assume that the text class c (i) There are N1 texts in The text T n The length is the longest; Assume that there are N2 texts in the known fraud script text library According to the content similarity matching method described in step 2 (1)-(7) above, the text T n and 1≤i≤N2 are matched in sequence. If a match is successful with one of the texts, it is judged as a known fraud text, otherwise it is judged as a suspected new fraud text.

[0044] Furthermore, based on the above method, an embodiment of the present invention also provides a speech sample discovery system, comprising: a number recognition module, a call classification module, a speech matching module and a suspected review module, wherein:

[0045] The number identification module is used to determine whether the call initiator during the communication process is a target number in the fraudulent phone number database. If it is a target number, multiple call contents with the target number as the call initiator are obtained;

[0046] A call classification module is used to perform similarity matching and aggregation on multiple call contents of the call initiator based on word similarity, and output multiple types of call texts that meet similarity threshold conditions;

[0047] The speech matching module is used to match the content of multiple types of call texts with the fraud speech in the known fraud speech library. If the match is successful, it is determined to be a known fraud speech; otherwise, it is determined to be a suspected new fraud speech;

[0048] The suspected review module is used to submit suspected new fraudulent speech to a third party for labeling and review, and ultimately determine whether it is a new fraudulent speech. If it is a new fraudulent speech, it will be added to the known fraudulent speech library.

[0049] To further illustrate the effectiveness of this solution, let's take the discovery of a new fraudulent rhetoric in a day's call on a certain telecommunications network as an example to explain:

[0050] First, the calling voice {V1, V2, ..., V N}The text sequence {T1,T2,...,T N}.

[0051] Then, for the text set {T1,T2,...,T N Any two texts T in i and T j , perform content similarity matching according to (1)-(7) in the above step 2. i ='Hello, hello, hello, hello, can you hear me? Hello, I am the customer service representative of the digital currency exchange. I would like to ask if you have paid attention to digital currency recently.', T j ='Hello, hello, hello, hello, I am the customer service of the digital currency trading team. I would like to ask if you have paid attention to digital currency recently. Oh, it is like this. I have a free communication group here and would like you to communicate.' is used as an example to explain:

[0052] Remove the punctuation marks from the two texts respectively and get T i '='Hello, hello, hello, hello, do you hear me? Hello, I am the customer service of the digital currency exchange. I would like to ask if you have paid attention to digital currency recently.', T' j ='Hello, hello, hello, hello. I am the customer service of the digital currency trading team. I would like to ask if you have paid attention to the digital currency recently. Oh, it is like this. I have a free communication group here and would like you to communicate';

[0053] (1)T' i Length L i =45, T'j Length L j =73;

[0054] (2) model = T' j ,sample=T' i ;

[0055] (3) Search T' in sequence i Each character in T' j Is there a corresponding character in the string? The matching result sequence Result = {0,1,2,0,0,1,2,-1,-1,42,-1,1,2,10,11,12,13,14,15,16,17,18,19,-1,21,22,23,24,25,26,27,28,29,30,31,32,33,34,14,15,16,17,11,26,41};

[0056] (4) Analyze the matching result sequence Result, count the number of elements whose value is not -1, which is cnt1 = 41; count the number of elements whose value is not -1 and is continuous, which is assumed to be cnt2 = 30;

[0057] (5) Calculate the length L of the result sequence Result occupied by cnt1 and cnt2 respectively Result =45, ratio1=cnt1 / L Result =0.911, ratio2=cnt2 / L Result =0.667;

[0058] (6) Compare ratio1 and ratio2 with the preset threshold values ​​Thres1=0.8 and Thres2=0.28 respectively. Since ratio1>Thres1 and ratio2>Thres2, it is determined that the two texts are matched successfully and the matching pair {i, j} is output. Otherwise, no result is output.

[0059] Assume that after the text set {T1,T2,...,T N}, the output results are {{3,1},{5,1},{6,2},{7,2},{8,1}}, then the merged results are {{1,3,5,8},{2,6,7}}, indicating that these texts come from two types of rhetoric. Select the longest text in {T1,T3,T5,T8}, 'I, oh, hello, is this mainly Ms. Gao Jun Gao? I'm Ms. Gao, I'm from the Henan Provincial Public Security Department' as this type of text representative c1; select the longest text in {T2,T6,T7}, 'Hello, hello, um, hello, I'm the customer service of the digital currency trading group. I would like to ask if you have been paying attention to digital currency recently. Oh, that's right, we have a free communication group here and want you to communicate' as this type of text representative c2.

[0060] The above c1 and c2 are matched with two texts in the known fraudulent speech text library: m1 = 'Hello, Ms. Zhang, I am from the Henan Provincial Public Security Department', m2 = 'Ah, hello, ah, hello, I am the WeChat Customer Service Center, because our communication system has intercepted your WeChat account and sent illegal information' according to the above steps (1)-(7). It is found that the ratio1 = 0.947 and ratio2 = 0.290 of the content matching of c1 and m1 meet ratio1>Thres1 and ratio1>Thres1, which means that the first category found is the old speech text. However, c2 fails to match both m1 and m2, so it is judged that the second category is a new speech text, and c2 is output.

[0061] In the embodiment of this case, similar communication contents are classified by performing similarity matching analysis and aggregation based on words and phrases on the communication contents of a large number of communications in the network; and the communication contents of each category are matched and analyzed with the fraudulent words in the known fraudulent words library to find new suspected fraudulent words, and finally the new fraudulent words are manually reviewed and confirmed, which is accurate and efficient, and is convenient for promotion and application in anti-fraud of communication networks. It should be noted that the above processing process is described in Chinese, and the same processing flow is also applicable to other languages.

[0062] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0063] Based on the above method and / or system, an embodiment of the present invention also provides a server, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0064] Based on the above method and / or system, an embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, wherein the above method is implemented when the program is executed by a processor.

[0065] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limiting, and thus other examples of the exemplary embodiments may have different values.

[0066] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0067] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for discovering speech samples, characterized in that: Contains the following: Determine whether the call initiator during the communication process is a target number in the fraudulent phone number database, and if it is a target number, obtain multiple call contents with the target number as the call initiator; Based on word similarity, multiple call contents of the call initiator are matched and aggregated to output multiple types of call texts that meet the similarity threshold conditions; wherein, in the similarity matching and aggregation based on word similarity, first, each caller voice of the call initiator in the call content is converted into a text sequence using continuous speech recognition technology; then, for the texts corresponding to any two caller voices in the text sequence, the text content similarity is analyzed and aggregated using a text matching method; and in the analysis of the text content similarity using a text matching method, first, the text is preprocessed, and a template and sample for text matching are set; then, each character in the sample is matched with a character in the template based on word similarity, and the two texts that are successfully matched are merged and classified; Match the contents of multiple types of call texts with the fraudulent words in the known fraudulent words library. If the match is successful, it is determined to be a known fraudulent word, otherwise, it is determined to be a suspected new fraudulent word; and for each type of call text, the text with the longest text length is used as the representative text, and the representative text is matched with each text in the known fraudulent words text library based on word similarity. If the match is successful, the call text words in the current type are determined to be known fraudulent words, otherwise, they are determined to be suspected new fraudulent words; Suspected new fraudulent tactics will be submitted to a third party for labeling and review, and a final determination will be made as to whether it is a new fraudulent tactics. If it is a new fraudulent tactics, it will be added to the library of known fraudulent tactics.

2. The method for discovering speech samples according to claim 1, characterized in that: In text preprocessing, first, punctuation marks in the two texts are removed, and the lengths of the two plain texts are obtained. Then, one of the texts is selected as a template and the other text is selected as a sample based on the length of the plain text.

3. The method for discovering speech samples according to claim 1 or 2, characterized in that: In the matching based on word similarity, for each character in the sample, search whether there is a matching character in the template. If there is a matching character, the matched template character position is recorded in the result sequence. If there is no matching character, a character marker is set at the corresponding position in the result sequence. Finally, the number of elements that are not character markers in the result sequence is analyzed and counted as the number of word matches, and the number of elements that are not character markers and are continuous is counted as the number of word matches. The ratio of the number of word matches and the number of word matches to the length of the result sequence is calculated, and the two ratios are compared with the preset similarity threshold. If both are met, the two texts are matched successfully.

4. The method for discovering speech samples according to claim 1, characterized in that: A third party is currently labeling and reviewing suspected new fraudulent tactics, and experts are set to conduct manual labeling and review.

5. A speech sample discovery system, characterized in that: The method according to claim 1 is implemented, comprising: a number identification module, a call classification module, a speech matching module and a suspected review module, wherein: The number identification module is used to determine whether the call initiator during the communication process is a target number in the fraudulent phone number database. If it is a target number, multiple call contents with the target number as the call initiator are obtained; A call classification module is used to perform similarity matching and aggregation on multiple call contents of the call initiator based on word similarity, and output multiple types of call texts that meet similarity threshold conditions; The speech matching module is used to match the content of multiple types of call texts with the fraud speech in the known fraud speech library. If the match is successful, it is determined to be a known fraud speech; otherwise, it is determined to be a suspected new fraud speech; The suspected review module is used to submit suspected new fraudulent speech to a third party for labeling and review, and ultimately determine whether it is a new fraudulent speech. If it is a new fraudulent speech, it will be added to the known fraudulent speech library.

6. A computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the steps of the speech sample discovery method described in any one of claims 1 to 4.

7. A terminal device, comprising: one or more processors; A storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the speech sample discovery method described in any one of claims 1 to 4.

Images