A fraud number identification method, device and electronic equipment

Abstract

This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, and electronic device for identifying fraudulent numbers. The method includes: obtaining a communication dataset corresponding to a number to be detected; matching each communication data point in the communication dataset with each normal feature in a normal feature set and each abnormal feature in an abnormal feature set to obtain a normal feature parameter set and an abnormal feature parameter set corresponding to the communication dataset; calculating a fraud probability value corresponding to the number to be detected based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set; and determining that the number to be detected is a fraudulent number if the fraud probability value is greater than a preset fraud probability value. This method classifies and detects communication datasets and determines the fraud probability value of the number to be detected, improving the detection efficiency and ensuring the accuracy of identifying the number to be detected as a fraudulent number.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus and electronic device for identifying fraudulent phone numbers. Background Technology

[0002] With the development of artificial intelligence technology, the number of telecommunications frauds is increasing. To prevent telecommunications fraud, the current method is as follows: obtain the attribute information of the number to be detected, such as network access information, customized package, call duration within a preset time period, SMS statistics, data traffic statistics, and active time periods. Analyze this attribute information according to a phone number prediction model and generate at least one random combination feature set based on the attribute information. Then, detect each combination feature set to determine the risk factor corresponding to each combination feature set. This risk factor is used to indicate the probability of predicting that the number to be detected is a fraudulent number. Based on each risk factor, determine the risk index of the number to be detected. When the risk index is greater than the risk threshold, the number to be detected is identified as a fraudulent number that can have a negative impact on the user. When the number to be identified is a fraudulent number, it is processed.

[0003] In the methods described above, the attribute information can be offline data or real-time data. When the attribute information is offline data, since the offline data is data from an hour or a day ago, by the time the attribute information corresponding to the offline data is identified as containing fraudulent data, the fraudulent activity has already ended, thus preventing timely interception of fraudulent calls. Furthermore, there are cases where the same feature appears in multiple combined features, resulting in repeated detection of the same feature multiple times. Detecting various randomly combined feature sets will take a significant amount of time. When the attribute information is real-time data, it is impossible to determine whether the number to be detected is a fraudulent number before the fraudulent activity ends. Summary of the Invention

[0004] This application provides a method, apparatus, and electronic device for identifying fraudulent numbers, which improves the efficiency and accuracy of detecting fraudulent numbers, thereby enabling the identification of fraudulent numbers before the fraudulent activity ends.

[0005] Firstly, this application provides a method for identifying fraudulent phone numbers, the method comprising:

[0006] Obtain the communication dataset corresponding to the number to be detected;

[0007] Each communication data in the communication dataset is matched with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset. The normal feature parameter set contains normal feature parameters associated with the normal features matched by the communication data, and the abnormal feature parameter set contains abnormal feature parameters associated with the abnormal features matched by the communication data.

[0008] Based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set, the fraud probability value corresponding to the number to be detected is calculated.

[0009] In response to the fraud probability value being greater than a preset fraud probability value, the number to be detected is determined to be a fraudulent number.

[0010] In one possible design, each communication data in the communication dataset is matched with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set, including:

[0011] Obtain a training feature set, wherein the training feature set includes a normal communication dataset and an abnormal communication dataset;

[0012] Determine the weight value corresponding to each training feature in the training feature set, and associate each training feature with its corresponding weight value to obtain the associated training feature set corresponding to the training feature set;

[0013] The normal feature set and the abnormal feature set are determined based on each associated training feature in the associated training feature set that meets the preset conditions;

[0014] Each communication data in the communication dataset is matched with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set.

[0015] In one possible design, determining the weight value corresponding to each training feature in the training feature set includes:

[0016] Determine the initial weight value corresponding to each training feature in the training feature set;

[0017] The training feature set and the initial weight values ​​corresponding to the training feature set are input into a preset iterative model to obtain the weight values ​​corresponding to each training feature in the training feature set.

[0018] In one possible design, obtaining the weight values ​​corresponding to each training feature in the training feature set includes:

[0019] In response to the initial weight value's iteration count reaching a preset iteration count, each current weight value corresponding to the training feature set is used as the weight value corresponding to each training feature in the training feature set; or

[0020] The loss value of the training feature set is determined. In response to the loss value being less than a preset loss threshold, the current weight value corresponding to the training feature set is used as the weight value corresponding to each training feature of the training feature set. The loss value represents the accuracy of the training feature set in detecting that the number to be detected is a fraudulent number.

[0021] In one possible design, the normal feature set and the abnormal feature set are determined based on each associated training feature in the associated training feature set that meets preset conditions, including:

[0022] The first parameter of each associated training feature is determined based on the first preset formula, and the second parameter of each associated training feature is determined based on the second preset formula.

[0023] Extract each first association training feature and each second association training feature where the first parameter is lower than the first preset threshold and the second parameter is lower than the second preset threshold, wherein the first association training feature is a feature in the normal communication dataset and the second association training feature is a feature in the abnormal communication dataset.

[0024] A normal feature set corresponding to the associated training feature set is generated based on each of the first associated training features, and an abnormal feature set corresponding to the associated training feature set is generated based on each of the second associated training features.

[0025] In one possible design, the first preset formula is as follows:

[0026]

[0027] Among them, w k Indicates the associated training features, std(w) represents the coefficient of variation of the associated training features. k ) represents the standard deviation of the associated training features corresponding to each user number, mean(w k ) represents the mean of the associated training features corresponding to each user number.

[0028] In one possible design, the second preset formula is as follows:

[0029]

[0030]

[0031] Among them, w kIndicates the associated training features, Indicates the association of training features w k stability, w represents the (n-1)th associated training feature k , The nth associated training feature w k , This represents the stability of the (n-1)th associated training feature and the nth associated training feature.

[0032] In one possible design, each communication data in the communication dataset is matched with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the image dataset, including:

[0033] In response to each communication data in the communication dataset being matched with a normal feature in the normal feature set, the normal feature parameters corresponding to each normal feature are recorded, and a normal feature parameter set is generated based on each normal feature parameter; and

[0034] In response to each communication data in the communication dataset being matched with an anomaly feature in the anomaly feature set, the anomaly feature parameters corresponding to each anomaly feature are recorded, and an anomaly feature parameter set is generated based on each anomaly feature parameter.

[0035] Secondly, this application provides a fraudulent number identification device, the device comprising:

[0036] The acquisition module is used to obtain the communication dataset corresponding to the number to be detected.

[0037] The matching module is used to match each communication data in the communication dataset with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset.

[0038] The calculation module is used to calculate the fraud probability value corresponding to the number to be detected based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set.

[0039] The response module is used to determine that the number to be detected is a fraudulent number in response to the fraud probability value being greater than a preset fraud probability value.

[0040] In one possible design, the matching module is specifically used to obtain a training feature set, determine the weight value corresponding to each training feature in the training feature set, associate each training feature with its corresponding weight value to obtain an associated training feature set corresponding to the training feature set, determine the normal feature set and the abnormal feature set based on each associated training feature in the associated training feature set that meets preset conditions, and match each communication data in the communication data set with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set.

[0041] In one possible design, the matching module is further configured to determine the initial weight values ​​corresponding to each training feature in the training feature set, input the training feature set and the initial weight values ​​corresponding to the training feature set into a preset iterative model, and obtain the weight values ​​corresponding to each training feature in the training feature set.

[0042] In one possible design, the matching module is further configured to, in response to the number of iterations of the initial weight value reaching a preset number of iterations, use each current weight value corresponding to the training feature set as the weight value corresponding to each training feature of the training feature set, or determine the loss value of the training feature set, and in response to the loss value being less than a preset loss threshold, use the current weight value corresponding to the training feature set as the weight value corresponding to each training feature of the training feature set.

[0043] In one possible design, the matching module is further configured to determine a first parameter of each associated training feature based on a first preset formula, and a second parameter of each associated training feature based on a second preset formula; extract each first associated training feature and each second associated training feature whose first parameter is lower than a first preset threshold and whose second parameter is lower than a second preset threshold; wherein the first associated training feature is a feature in a normal communication dataset, and the second associated training feature is a feature in an abnormal communication dataset; generate a normal feature set corresponding to the associated training feature set based on each first associated training feature, and generate an abnormal feature set corresponding to the associated training feature set based on each second associated training feature.

[0044] In one possible design, the first preset formula is as follows:

[0045]

[0046] Among them, w k Indicates the associated training features, std(w) represents the coefficient of variation of the associated training features. k ) represents the standard deviation of the associated training features corresponding to each user number, mean(wk ) represents the mean of the associated training features corresponding to each user number.

[0047] In one possible design, the second preset formula is as follows:

[0048]

[0049]

[0050] Among them, w k Indicates the associated training features, Indicates the association of training features w k stability, w represents the (n-1)th associated training feature k , The nth associated training feature w k , This represents the stability of the (n-1)th associated training feature and the nth associated training feature.

[0051] In one possible design, the matching module is further configured to, in response to each communication data in the communication dataset being matched with a normal feature in the normal feature set, record the normal feature parameters corresponding to each normal feature, and generate a normal feature parameter set based on each normal feature parameter; and in response to each communication data in the communication dataset being matched with an abnormal feature in the abnormal feature set, record the abnormal feature parameters corresponding to each abnormal feature, and generate an abnormal feature parameter set based on each abnormal feature parameter.

[0052] Thirdly, this application provides an electronic device, comprising:

[0053] Memory, used to store computer programs;

[0054] When the processor executes the computer program stored in the memory, it implements the steps of the fraudulent number identification method described above.

[0055] Fourthly, a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the fraudulent number identification method described above.

[0056] Fifthly, this application provides a computer program product that, when run on a computer, causes the computer to perform the steps of the above-described fraudulent number identification method. Attached Figure Description

[0057] Figure 1 A flowchart of the steps of a fraudulent number identification method provided in this application;

[0058] Figure 2 A schematic diagram of the structure of a fraud number identification device provided in this application;

[0059] Figure 3 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operational methods in the method embodiments can also be applied to the device embodiments or system embodiments. It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A connected to B can represent: A and B directly connected, and A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for distinguishing the purpose of description and should not be construed as indicating or implying relative importance or order.

[0061] In previous technologies, the method for identifying fraudulent numbers was to obtain the attribute information of the number to be identified, randomly combine the information in the attribute information to generate multiple combined feature sets, determine the risk factors corresponding to each combined feature set, and then determine the risk index corresponding to the number to be identified based on each risk factor. However, when the attribute information is offline data, if the number to be identified is a fraudulent number, the fraudulent behavior has already ended by the time the number to be identified is detected, thus failing to intercept the fraudulent number in time. When the attribute information is real-time data, since multiple combined feature sets need to be detected, the same feature may appear in at least one combined feature set, resulting in multiple detections of the same feature. Consequently, it is impossible to determine that the number to be identified is a fraudulent number before the fraudulent behavior ends, thus delaying the opportunity to intercept the fraudulent number.

[0062] To address the aforementioned problems, this application provides a method for identifying fraudulent numbers, enabling efficient and accurate identification of such numbers. The methods and apparatus described in this application are based on the same technical concept. Since the principles underlying the problems solved by the methods and apparatus are similar, embodiments of the apparatus and methods can be mutually referenced, and repeated details will not be elaborated upon. The acquisition, storage, use, and processing of data in this application's technical solution all comply with relevant national laws and regulations.

[0063] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0064] Reference Figure 1This application provides a method for identifying fraudulent numbers, which can efficiently and accurately identify fraudulent numbers. The implementation process of this method is as follows:

[0065] Step S1: Obtain the communication dataset corresponding to the number to be detected.

[0066] The embodiments of this application are designed to efficiently and accurately identify fraudulent numbers. First, it is necessary to obtain the communication dataset corresponding to the number to be detected. This communication dataset includes device information, access port information, geographical location, network access time, package information, and the number's place of origin, which are not limited here.

[0067] Step S2: Match each communication data in the communication dataset with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset.

[0068] In order to detect the communication dataset corresponding to the number to be detected, a training feature set is needed. This training feature set includes normal communication datasets and abnormal communication datasets. To ensure the accuracy of identifying the number to be detected as a fraudulent number, the training feature set needs to be trained. The specific training process is as follows:

[0069] Since the training feature set includes both normal and abnormal communication datasets, in order to select effective features from each dataset—specifically, features that can identify a detected number as either a fraudulent number or a non-fraudulent number—it is necessary to filter the normal and abnormal communication datasets separately. The specific filtering process is as follows:

[0070] Each mobile phone number corresponds to a communication dataset. To ensure the accuracy of the detection communication dataset, multiple communication datasets corresponding to each mobile phone number will be obtained. The communication datasets corresponding to each of the multiple mobile phone numbers will be identified as normal communication datasets or abnormal communication datasets. The communication datasets corresponding to each of the multiple mobile phone numbers will be put into a training feature set.

[0071] For example: the training feature set is T, T = {(t1, y1), (t2, y2), ..., (t...} n y n )}, t1 represents the communication dataset of the first mobile phone number, t2 represents the communication dataset of the second mobile phone number, t n The communication dataset represents the nth mobile phone number. The value of y1 is 0 or 1. When y1 is 0, it means that the t1 corresponding to y1 is a normal communication dataset. When y1 is 1, it means that the t1 corresponding to y1 is an abnormal communication dataset.

[0072] After obtaining the training feature set, each training feature in the training feature set is assigned the same initial weight value. Since the normal communication dataset in the training feature set contains data where a number is determined to be non-fraudulent based on a single communication data point, and data where multiple communication data points determine a non-fraudulent number, and the abnormal communication dataset also contains data where a number is determined to be fraudulent based on a single communication data point, and data where multiple communication data points determine a fraudulent number, for example, communication data A, B, and C in the abnormal communication dataset. The probability of determining a number to be fraudulent based on A is 80%, based on B is 60%, and based on C is 40%. Clearly, the probabilities of determining a number to be fraudulent based on different communication data points are not consistent. Therefore, to more accurately identify a number as fraudulent, the weight values ​​of each communication data point in the abnormal communication dataset need to be reassigned. The communication data in the normal communication dataset also exhibits the above-described situation; therefore, the weight values ​​of each communication data point in the normal communication dataset also need to be reassigned. The specific process is as follows:

[0073] The normal communication dataset is obtained from the training feature set. The normal communication dataset includes features of multiple non-fraudulent numbers over multiple time periods, such as call count, call duration, average call duration, and terminal usage time. The normal communication dataset is shown in Table 1.

[0074] a b c d ...... X1 a1 b1 c1 d1 ...... X2 a2 b2 c2 d2 ...... X3 a3 b3 c3 d3 ...... X4 a4 b4 c4 d4 ...... ...... ...... ...... ...... ...... ......

[0075] Table 1

[0076] Table 1 above describes the relationship between each feature in the normal communication dataset and each mobile phone number. Table 1 describes four features a, c, d, and X1, X2, X3, and X4, which are four different normal mobile phone numbers. a1 is the data corresponding to feature a in mobile phone number X1, and b1 is the data corresponding to feature b in mobile phone number X1. The data corresponding to the features in other collected numbers can be referred to the examples of a1 and b1 described above. The relationship between other mobile phone numbers and each feature is referred to in Table 1 above, and will not be elaborated here.

[0077] The initial weight values ​​of each feature in the normal communication dataset are consistent. The normal communication dataset and the initial weight values ​​corresponding to each feature in the normal communication dataset are input into the preset iterative model. In this embodiment, the preset iterative model is the AdaBoost algorithm model. Since iterating the initial weight values ​​of each feature in the normal communication dataset using the AdaBoost algorithm is a technique known to those skilled in the art, the iteration of the initial weight values ​​will not be described in detail here.

[0078] After inputting the normal communication dataset and the initial weight values ​​corresponding to each feature in the normal communication dataset into the preset iterative model, when the number of iterations of each initial weight value reaches the preset number of iterations, the iterative model will output the weight value corresponding to the current normal communication data, thus obtaining the weight value corresponding to each feature in the normal communication dataset.

[0079] In one possible design, during the iteration process of the preset iterative model on the initial weight values ​​of each feature in the normal communication dataset, a loss value is calculated after each iteration. The smaller the loss value, the more accurate the weight values ​​corresponding to each feature in the iterative normal communication dataset are. When the loss value is less than the preset loss threshold, the preset iterative model obtains the weight value corresponding to the current normal communication dataset and outputs the current weight value as the training result of the initial weight value, thereby obtaining the weight values ​​corresponding to each feature in the normal communication dataset.

[0080] The above describes how to obtain the weight values ​​corresponding to each feature in a normal communication dataset. The method for obtaining the weight values ​​in an abnormal communication dataset is the same as the method for obtaining the weight values ​​corresponding to each feature in a normal communication dataset. The specific process is as follows:

[0081] An abnormal communication dataset was obtained from the training feature set. This dataset includes features of multiple fraudulent numbers over multiple time periods, such as: caller ID, percentage of out-of-province callers, number of terminal changes, SMS sending volume, SMS receiving volume, and the city where the user is roaming. The abnormal communication dataset is shown in Table 2.

[0082] A B C D ...... Y1 a1 b1 c1 d1 ...... Y2 a2 b2 c2 d2 ...... Y3 a3 b3 c3 d3 ...... Y4 a4 b4 c4 d4 ...... ...... ...... ...... ...... ...... ......

[0083] Table 2

[0084] Table 2 above describes the relationship between each feature in the abnormal communication dataset and each mobile phone number. Table 2 describes four features A, B, C, and D, and Y1, Y2, Y3, and Y4 are four different fraudulent mobile phone numbers. a1 is the data corresponding to feature a in mobile phone number Y1, and b1 is the data corresponding to feature b in mobile phone number Y1. The data corresponding to the features in other collected numbers are the same as the examples of a1 and b1 described above. The relationship between other mobile phone numbers and each feature is the same as in Table 2 above, and will not be elaborated here.

[0085] The initial weight values ​​of each feature in the abnormal communication dataset are consistent. The abnormal communication dataset and the initial weight values ​​corresponding to each feature in the abnormal communication dataset are input into the preset iterative model. In this embodiment, the preset iterative model is the AdaBoost algorithm model. Since iterating the initial weight values ​​of each feature in the abnormal communication dataset using the AdaBoost algorithm is a technique known to those skilled in the art, the iterative process of the initial weight values ​​is not described in detail here.

[0086] After inputting the abnormal communication dataset and the initial weight values ​​corresponding to each feature in the abnormal communication dataset into the preset iterative model, when the number of iterations of each initial weight value reaches the preset number of iterations, the iterative model will output the weight value corresponding to the current abnormal communication data, thus obtaining the weight value corresponding to each feature in the abnormal communication dataset.

[0087] In one possible design, during the iteration process of the preset iterative model on the initial weight values ​​of each feature in the abnormal communication dataset, a loss value is calculated after each iteration. The smaller the loss value, the more accurate the weight values ​​corresponding to each feature in the iterative abnormal communication dataset are. When the loss value is less than the preset loss threshold, the preset iterative model obtains the weight value corresponding to the current abnormal communication dataset and outputs the current weight value as the training result of the initial weight value, thereby obtaining the weight values ​​corresponding to each feature in the abnormal communication dataset.

[0088] It should be noted that the features in the normal communication dataset and the abnormal communication dataset in the training feature set can be the same or different; this is not limited here. The data for the same training feature corresponding to each mobile phone number in the training feature set can be the same or different. The specific training feature set is shown in Table 3.

[0089]

[0090] Table 3

[0091] Table 3 above describes one training feature in the training feature set—the number of calls. It records the number of calls for a non-fraudulent mobile phone number X1 in different time periods and the number of calls for a fraudulent number Y1 in different time periods. The number of calls for each mobile phone number in Table 1 above is based on the actual number of calls for that mobile phone number. Therefore, the number of calls for each mobile phone number can be the same or different. The communication data of other mobile phone numbers in the training feature set and the corresponding training features are shown in Table 3 above, and will not be described in detail here.

[0092] Furthermore, Table 3 above uses call count as an example. The feature parameter corresponding to call count represents the number of calls made by the mobile phone number within a certain time period. When the training feature in the training feature set is call duration, the feature parameter corresponding to call duration represents the call duration of the mobile phone number within a certain time period. Each training feature in the training feature set corresponds to a value, which is used as the feature parameter. Each feature parameter is obtained after iterating through a preset iterative model based on the initial weight values ​​of the training feature set. Each training feature in the training feature set will have a corresponding weight value. Each training feature is associated with its corresponding weight value to generate an associated training feature set, as shown in Table 4.

[0093] Number of calls SMS Received SMS sending volume Talk minutes ...... X1 Communication data 1 Communication Data 21 Communication data 31 Communication data 41 ...... X2 Communication Data 2 Communication data 22 Communication data 32 Communication data 42 ...... ...... ...... ...... ...... ...... ...... weight value 0.12 0.10 0.31 0.22

[0094] Table 4

[0095] Table 4 above describes the communication data corresponding to each mobile phone number and each feature in the association training feature set. Each training feature corresponds to a weight value. Table 4 only describes the communication data corresponding to two mobile phone numbers and four training features respectively. This is just an example of two mobile phone numbers and four training features. Other mobile phone numbers and other training features are similar to the examples in Table 4 above and will not be elaborated here. The cumulative weight value of all training features in the training feature set is 1. Furthermore, since the training feature set includes normal communication datasets and abnormal communication datasets, the form of the feature association weight values ​​in the normal communication dataset and the feature association weight values ​​in the abnormal communication dataset is consistent with the form of the association weight values ​​of each training feature in the training feature set. Therefore, the association weight values ​​of each normal communication data in the normal communication dataset and the association weight values ​​of each abnormal communication data in the abnormal communication dataset are similar to those in Table 4 above and will not be elaborated here.

[0096] Furthermore, since each associated training feature in the associated training feature set corresponds to a feature parameter, which is obtained based on the weight value of each associated training feature, the gradient descent algorithm is used in this embodiment to calculate the feature parameter of each associated training feature. Since the gradient descent algorithm is a well-known technique to those skilled in the art, it will not be described in detail here. Each associated training feature is associated with its corresponding feature parameter. The feature parameters corresponding to each associated training feature in the associated training feature set are shown in Table 5.

[0097]

[0098]

[0099] Table 5

[0100] Table 5 above is the associated training feature set. Table 5 lists two mobile phone numbers and four training features: number of calls, number of SMS received, number of SMS sent, and number of call minutes. It also lists the communication data corresponding to each mobile phone number and each associated training feature. The communication data corresponding to each mobile phone number is data from different time periods. This communication data can be obtained from the telecommunications operation platform. Each associated training feature is associated with a feature parameter. The associated feature parameters of other associated training features are referred to in Table 5 above, and will not be explained in detail here.

[0101] After obtaining the associated training feature set, to avoid the inclusion of a large amount of invalid data (i.e., features that fail to identify whether the number to be detected is a non-fraudulent or fraudulent number), it is necessary to filter the various associated training features in the set to select those that meet preset conditions. The specific filtering process is as follows:

[0102] The specific process of selecting a normal feature set that meets the preset conditions from the associated training feature set is as follows:

[0103] Based on the non-fraudulent mobile phone numbers, the associated training feature set corresponding to the non-fraudulent mobile phone numbers is extracted from the associated training feature set. Then, the first parameter of each associated training feature is determined based on the first preset formula, and the second parameter of each associated training feature is determined based on the second preset formula.

[0104] The first preset formula is as follows:

[0105]

[0106] Among them, w k Indicates the associated training features, std(w) represents the coefficient of variation of the associated training features. k ) represents the standard deviation of the associated training features corresponding to each user number, mean(wk ) represents the mean of the associated training features corresponding to each user number.

[0107] The second preset formula is shown below:

[0108]

[0109]

[0110] Among them, w k Indicates the associated training features, Indicates the association of training features w k stability, w represents the (n-1)th associated training feature k , The nth associated training feature w k , This represents the stability of the (n-1)th associated training feature and the nth associated training feature.

[0111] To illustrate the process of obtaining the first parameter more clearly, an example will be given:

[0112]

[0113] Table 6

[0114] Table 6 above lists one association training feature in the association training feature set—the number of calls. Table 6 only lists the number of calls in each of the four time periods. Other association training features in the association training feature set are shown in Table 6, and will not be described in detail here.

[0115] Based on Table 6 above, since the training feature set is collected from the telecommunications operation platform, the operating hours of the telecommunications operation platform can be 8 hours or 24 hours, which is not limited here. In order to obtain the first parameter of the number of calls, the mean and standard deviation of the number of calls will be calculated. Taking 8 hours as an example, the mean of the number of calls = (4 + 5 / 8 + 10 / (8*7) + 30 / (8*30))1 / 4 = 1.23. Then, based on 1.23, the standard deviation is calculated to be 1.61. Therefore, the first parameter of the number of calls is 1.61 / 1.23 = 1.31.

[0116] Furthermore, when calculating the second parameter of the number of calls based on Table 6 above, it is necessary to determine the time period in Table 6 where there are 4 calls in the past hour, the number of calls in the same time period in the past day, the number of calls in the same time period in the past week, and the number of calls in the same time period in the past month.

[0117] If the four calls made in the past hour occurred between 10:00 and 11:00 on June 8, 2022, then... From the call count of the past day, the number of calls made between 10:00 and 11:00 on June 7, 2022, was found to be 4. The average number of calls within the same time period was determined from the number of calls made over the past week. The specific determination process is shown in Table 7.

[0118] Time period Number of calls June 1, 2022, 10:00 to 11:00 5 June 2, 2022, 10:00 AM to 11:00 AM 0 June 3, 2022, 10:00 to 11:00 6 June 4, 2022, 10:00 AM to 11:00 AM 2 June 5, 2022, 10:00 AM to 11:00 AM 3 June 6, 2022, 10:00 AM to 11:00 AM 5 June 7, 2022, 10:00 AM to 11:00 AM 3

[0119] Table 7

[0120] Table 7 above records the number of calls made in the same time period on each day of the past week, as shown in Table 6 above. Based on Table 7, the average number of calls can be calculated to be (5+0+6+2+3+5+3) / 7≈3.43.

[0121] Based on Table 6 above, the average number of calls made in the past month within the same time period on each day of the past month is determined. Since the method for determining the average number of calls made in the past month within the same time period on each day of the past month is the same as the method for determining the average number of calls made in the past week within the same time period on each day of the past month, the process for determining the average number of calls made in the past month within the same time period on each day of the past month is the same as the process for determining the average number of calls made in the past week within the same time period described above. It will not be elaborated here. If the average number of calls made in the past month within the same time period is 4.02.

[0122] The stability of the number of calls in different time periods within the training features is described above. The process of obtaining the second parameter, the number of calls, from Table 6 above is as follows:

[0123] and The stability between them is:

[0124]

[0125] and The stability between them is:

[0126]

[0127] and The stability between them is:

[0128]

[0129] In conclusion, Therefore, the second parameter for the number of calls in Table 6 above is 0.287.

[0130] The above describes the process of obtaining the second parameter of the number of calls based on Table 6. The process of determining the second parameter corresponding to other associated training features is the same as the process of determining the second parameter of the number of calls described above, and will not be elaborated here.

[0131] The above describes the process of obtaining the first and second parameters of the number of calls. The process of obtaining the first and second parameters of other training features in the associated training feature set is the same as the process of obtaining the first and second parameters of the number of calls. Since the process of obtaining the first and second parameters of the training features is the same, it will not be described in detail here.

[0132] The above describes obtaining the first parameter and the second parameter of each training feature in the associated training feature set. The first parameter is lower than the first preset threshold and the second parameter is lower than the second preset threshold from the associated training feature set corresponding to non-fraudulent mobile phone numbers. The training feature is used as the first associated training feature, and a normal feature set corresponding to the associated training feature set is generated based on each first associated training feature.

[0133] In the process of obtaining the abnormal feature set from the associated training feature set, it is necessary to obtain the associated training feature set corresponding to the fraudulent number, then determine the first parameter of each associated training feature based on the first preset formula, and determine the second parameter of each associated training feature based on the second preset formula. Each associated training feature whose first parameter is lower than the first preset threshold and whose second parameter is lower than the second preset threshold is taken as the second associated training feature, and an abnormal feature set corresponding to the associated training feature set is generated based on each second associated training feature.

[0134] Since the process of obtaining the abnormal feature set is the same as the process of obtaining the normal feature set, the process of obtaining the abnormal feature set from the associated training feature set is the same as the process of obtaining the normal feature set from the associated training feature set described above. To avoid a lot of repetitive content, it will not be elaborated here.

[0135] It should be noted that in this embodiment, the first preset threshold is 1 and the second preset threshold is 0.3. The first and second preset thresholds can be adjusted according to the actual situation. In order to improve the accuracy of identifying the number to be detected as a fraudulent number, the particle swarm optimization algorithm can be used to optimize the first and second preset thresholds in this embodiment. Since optimizing the first and second preset thresholds based on the particle swarm optimization algorithm is a well-known technique to those skilled in the art, it will not be described in detail here.

[0136] Having obtained the normal and abnormal feature sets corresponding to the associated training feature sets, the server will parse out each communication data in the communication dataset corresponding to the number to be detected. This communication data contains the features corresponding to the number to be detected. Each communication data is matched with each normal feature in the normal feature set and with each abnormal feature in the abnormal feature set. The server will record the normal and abnormal features matched by the communication data. Since each normal feature in the normal feature set corresponds to a normal feature parameter and each abnormal feature in the abnormal feature set corresponds to an abnormal feature parameter, the normal or abnormal feature parameter corresponding to each communication data can be determined based on the normal or abnormal feature matched by each communication data. Thus, the normal feature parameter set and abnormal feature parameter set corresponding to the communication dataset can be determined based on the normal or abnormal feature parameter corresponding to each communication data.

[0137] For example, the normal feature set is shown in Table 8:

[0138] Normal feature set Normal feature 1 Normal feature 2 Normal feature 3 Normal feature 4 Normal characteristic parameters 0.2 0.2 0.34 0.43

[0139] Table 8

[0140] Table 8 above records four normal features in the normal feature set and the normal feature parameters corresponding to each normal feature. This is just an example using four normal features. Other normal features and their corresponding normal feature parameters can be found in Table 8, which will not be elaborated here.

[0141] The abnormal feature set is shown in Table 9:

[0142] Anomaly Feature Set Abnormal Feature 1 Abnormal Feature 2 Abnormal Feature 3 Abnormal Feature 4 Abnormal feature parameters 0.23 0.21 0.33 0.44

[0143] Table 9

[0144] Table 8 above records four anomalous features in the anomalous feature set and the anomalous feature parameters corresponding to each anomalous feature. This is just an example using four anomalous features. Other anomalous features and their corresponding anomalous feature parameters can be found in Table 9, which will not be elaborated here.

[0145] If the communication data in the communication dataset matches normal feature 1 and normal feature 2 in Table 8 above, and matches abnormal feature 2 and abnormal feature 3 in Table 9 above, then the corresponding normal feature parameter set in the communication dataset is {0.2, 0.2}, and the corresponding abnormal feature parameter set in the communication dataset is {0.21, 0.33}.

[0146] Based on the above description, the communication data in the communication dataset is classified and matched with normal feature sets and abnormal feature sets respectively, and the normal feature parameter sets and abnormal feature parameter sets corresponding to the communication dataset are obtained, thereby improving the efficiency and accuracy of detecting the communication dataset.

[0147] Step S3: Based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set, calculate the fraud probability value corresponding to the number to be detected.

[0148] The above description has determined the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset of the number to be detected. In order to calculate the fraud probability value of the number to be detected, it is also necessary to obtain the number of normal features in the communication dataset of the number to be detected. After obtaining the number of normal features in the communication dataset, the number of normal features, the normal feature parameters in the normal feature parameter set, and the abnormal feature parameters in the abnormal feature parameter set are substituted into the third preset formula to calculate the fraud probability value corresponding to the number to be detected. The third preset formula is as follows:

[0149]

[0150] Where P represents the fraud probability value of the number to be detected, N is the number of normal features in the communication dataset corresponding to the number to be detected, and w vi Normal feature parameters w represent the normal features corresponding to the communication dataset. ti Anomaly feature parameters represent the abnormal characteristics corresponding to the communication dataset.

[0151] For example, based on Tables 8 and 9 above, if the number of normal features in the communication dataset is 2, and the normal feature parameter set of the communication dataset is known to be {0.2, 0.2}, and the corresponding abnormal feature parameter set of the communication dataset is {0.21, 0.33}, then the fraud probability value of the communication dataset calculated using the third preset formula above is P = (0.2 / 0.21 + 0.2 / 0.33) * 1 / 2 = 0.78.

[0152] Based on the above method, the fraud probability value corresponding to the number to be detected is calculated based on normal feature parameters and abnormal feature parameters. By combining the normal and abnormal features corresponding to the communication dataset of the number to be detected, the accuracy of the obtained fraud probability value is ensured.

[0153] Step S4: In response to the fraud probability value being greater than the preset fraud probability value, determine that the number to be detected is a fraudulent number.

[0154] After determining the fraud probability corresponding to the communication dataset of the number to be detected, the fraud probability value is compared with the preset fraud probability value. When the fraud probability value is greater than the preset fraud probability value, the number to be detected corresponding to the fraud probability value is regarded as a fraud number.

[0155] Based on the above method, the communication data in the communication dataset of the number to be detected is matched with the normal features in the normal feature set and the abnormal features in the abnormal feature set to obtain the normal feature parameters corresponding to the matched normal features and the abnormal feature parameters corresponding to the matched abnormal features. Based on the normal feature parameters and the abnormal feature parameters, the fraud probability value is calculated, ensuring the accuracy of the obtained fraud probability value. This enables the real-time identification of the number to be detected as a fraudulent number, which is beneficial for the rapid interception of the number to be detected.

[0156] Based on the same inventive concept, this application also provides a fraudulent number identification device, which implements the function of a fraudulent number identification method, as described above. Figure 2 The device includes:

[0157] Module 201 is used to obtain the communication dataset corresponding to the number to be detected;

[0158] The matching module 202 is used to match each communication data in the communication dataset with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset.

[0159] The calculation module 203 is used to calculate the fraud probability value corresponding to the number to be detected based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set.

[0160] The response module 204 is used to determine that the number to be detected is a fraudulent number in response to the fraud probability value being greater than a preset fraud probability value.

[0161] In one possible design, the matching module 202 is specifically used to obtain a training feature set, determine the weight value corresponding to each training feature in the training feature set, associate each training feature with its corresponding weight value to obtain an associated training feature set corresponding to the training feature set, determine the normal feature set and the abnormal feature set based on each associated training feature in the associated training feature set that meets preset conditions, and match each communication data in the communication data set with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set.

[0162] In one possible design, the matching module 202 is further configured to determine the initial weight values ​​corresponding to each training feature in the training feature set, input the training feature set and the initial weight values ​​corresponding to the training feature set into a preset iterative model, and obtain the weight values ​​corresponding to each training feature in the training feature set.

[0163] In one possible design, the matching module 202 is further configured to, in response to the number of iterations of the initial weight value reaching a preset number of iterations, use each current weight value corresponding to the training feature set as the weight value corresponding to each training feature of the training feature set, or determine the loss value of the training feature set, and in response to the loss value being less than a preset loss threshold, use the current weight value corresponding to the training feature set as the weight value corresponding to each training feature of the training feature set.

[0164] In one possible design, the matching module 202 is further configured to determine a first parameter of each associated training feature based on a first preset formula, and a second parameter of each associated training feature based on a second preset formula; extract each first associated training feature and each second associated training feature whose first parameter is lower than a first preset threshold and whose second parameter is lower than a second preset threshold; wherein the first associated training feature is a feature in a normal communication dataset, and the second associated training feature is a feature in an abnormal communication dataset; generate a normal feature set corresponding to the associated training feature set based on each first associated training feature, and generate an abnormal feature set corresponding to the associated training feature set based on each second associated training feature.

[0165] In one possible design, the first preset formula is as follows:

[0166]

[0167] Among them, w k Indicates the associated training features, std(w) represents the coefficient of variation of the associated training features. k ) represents the standard deviation of the associated training features corresponding to each user number, mean(w k ) represents the mean of the associated training features corresponding to each user number.

[0168] In one possible design, the second preset formula is as follows:

[0169]

[0170]

[0171] Among them, w k Indicates the associated training features, Indicates the association of training features w k stability, w represents the (n-1)th associated training feature k , The nth associated training feature w k , This represents the stability of the (n-1)th associated training feature and the nth associated training feature.

[0172] In one possible design, the matching module 202 is further configured to, in response to each communication data in the communication dataset being matched with a normal feature in the normal feature set, record the normal feature parameters corresponding to each normal feature, and generate a normal feature parameter set based on each normal feature parameter; and in response to each communication data in the communication dataset being matched with an abnormal feature in the abnormal feature set, record the abnormal feature parameters corresponding to each abnormal feature, and generate an abnormal feature parameter set based on each abnormal feature parameter.

[0173] Based on the same inventive concept, this application also provides an electronic device that can realize the function of the aforementioned fraudulent number identification device. (Refer to...) Figure 3 The electronic device includes:

[0174] At least one processor 301 and a memory 302 connected to at least one processor 301. In this embodiment, the specific connection medium between the processor 301 and the memory 302 is not limited. Figure 3 The example shown is the connection between processor 301 and memory 302 via bus 300. Bus 300 is... Figure 3 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Bus 300 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 3 The term 301 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 301 can also be called a controller; there is no restriction on the name.

[0175] In this embodiment, the memory 302 stores instructions executable by at least one processor 301. By executing the instructions stored in the memory 302, the at least one processor 301 can perform a fraudulent number identification method discussed above. The processor 301 can implement... Figure 2 The functions of each module in the device shown.

[0176] The processor 301 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 302 and calling data stored in memory 302, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0177] In one possible design, processor 301 may include one or more processing units. Processor 301 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 301. In some embodiments, processor 301 and memory 302 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0178] Processor 301 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of a fraudulent number identification method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0179] Memory 302, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 302 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 302 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 302 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0180] By designing and programming the processor 301, the code corresponding to the fraudulent number identification method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during operation. Figure 1 The illustrated embodiment presents steps of a fraudulent number identification method. How to design and program the processor 301 is a technique well-known to those skilled in the art and will not be described further here.

[0181] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a fraudulent number identification method described above.

[0182] In some possible implementations, various aspects of the fraudulent number identification method provided by this application can also be implemented in the form of a program product, which includes program code that, when the program product is run on a device, causes the control device to perform the steps in a fraudulent number identification method according to various exemplary embodiments of this application described above.

[0183] The program product may take the form of any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be—but is not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0184] The program product of the data processing method provided in the embodiments of the present invention can be a portable compact disc read-only memory (CD-ROM) and include program code, and can run on a computing device. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0185] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take many forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0186] The program code contained on the readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wired, optical fiber, RF, or any suitable combination thereof.

[0187] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0188] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0189] Furthermore, although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0190] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0191] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0192] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0193] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0194] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for identifying fraudulent phone numbers, characterized in that, include: Obtain the communication dataset corresponding to the number to be detected; Each communication data in the communication dataset is matched with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset. The normal feature parameter set contains normal feature parameters associated with the normal features matched by the communication data, and the abnormal feature parameter set contains abnormal feature parameters associated with the abnormal features matched by the communication data. Based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set, the fraud probability value corresponding to the number to be detected is calculated. In response to the fraud probability value being greater than a preset fraud probability value, the number to be detected is determined to be a fraudulent number; The step of matching each communication data in the communication dataset with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set includes: Obtain a training feature set, wherein the training feature set includes a normal communication dataset and an abnormal communication dataset; Determine the weight value corresponding to each training feature in the training feature set, and associate each training feature with its corresponding weight value to obtain the associated training feature set corresponding to the training feature set; The normal feature set and the abnormal feature set are determined based on each associated training feature in the associated training feature set that meets the preset conditions; Each communication data in the communication dataset is matched with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set. The step of calculating the fraud probability value corresponding to the number to be detected based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set includes: The quantity of normal features in the communication dataset of the number to be detected is obtained. These quantity values, along with the normal feature parameters from the normal feature parameter set and the abnormal feature parameters from the abnormal feature parameter set, are then input into a third preset formula to calculate the fraud probability value corresponding to the number to be detected. The third preset formula is as follows: Where P represents the fraud probability value of the number to be detected, and N is the number of normal features in the communication dataset corresponding to the number to be detected. Normal feature parameters representing normal features corresponding to the communication dataset. Anomaly feature parameters represent the abnormal characteristics corresponding to the communication dataset.

2. The method as described in claim 1, characterized in that, Determining the weight value corresponding to each training feature in the training feature set includes: Determine the initial weight value corresponding to each training feature in the training feature set; The training feature set and the initial weight values ​​corresponding to the training feature set are input into a preset iterative model to obtain the weight values ​​corresponding to each training feature in the training feature set.

3. The method as described in claim 2, characterized in that, Obtaining the weight values ​​corresponding to each training feature in the training feature set includes: In response to the initial weight value's iteration count reaching a preset iteration count, each current weight value corresponding to the training feature set is used as the weight value corresponding to each training feature in the training feature set; or The loss value of the training feature set is determined. In response to the loss value being less than a preset loss threshold, the current weight value corresponding to the training feature set is used as the weight value corresponding to each training feature of the training feature set. The loss value represents the accuracy of the training feature set in detecting that the number to be detected is a fraudulent number.

4. The method as described in claim 1, characterized in that, Based on each associated training feature in the associated training feature set that meets preset conditions, the normal feature set and the abnormal feature set are determined, including: The first parameter of each associated training feature is determined based on the first preset formula, and the second parameter of each associated training feature is determined based on the second preset formula. Extract each first association training feature and each second association training feature where the first parameter is lower than the first preset threshold and the second parameter is lower than the second preset threshold, wherein the first association training feature is a feature in the normal communication dataset and the second association training feature is a feature in the abnormal communication dataset. A normal feature set corresponding to the associated training feature set is generated based on each of the first associated training features, and an abnormal feature set corresponding to the associated training feature set is generated based on each of the second associated training features.

5. The method as described in claim 4, characterized in that, The first preset formula is as follows: in, Indicates the associated training features, The coefficient of variation represents the associated training features. This represents the standard deviation of the associated training features corresponding to each user's number. This represents the mean of the associated training features corresponding to each user number.

6. The method as described in claim 4, characterized in that, The second preset formula is as follows: in, Indicates the associated training features, Representing associated training features stability, This represents the (n-1)th associated training feature. , Represents the nth associated training feature , This represents the stability of the (n-1)th associated training feature and the nth associated training feature.

7. The method as described in claim 1, characterized in that, Each communication data point in the communication dataset is matched with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset, including: In response to each communication data in the communication dataset being matched with a normal feature in the normal feature set, the normal feature parameters corresponding to each normal feature are recorded, and a normal feature parameter set is generated based on each normal feature parameter; and In response to each communication data in the communication dataset being matched with an anomaly feature in the anomaly feature set, the anomaly feature parameters corresponding to each anomaly feature are recorded, and an anomaly feature parameter set is generated based on each anomaly feature parameter.

8. A fraudulent number identification device, characterized in that, The device includes: The acquisition module is used to obtain the communication dataset corresponding to the number to be detected. The matching module is used to match each communication data in the communication dataset with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set to obtain the normal feature parameter set and the abnormal feature parameter set corresponding to the communication dataset; wherein, the normal feature parameter set contains normal feature parameters associated with the normal features matched by the communication data, and the abnormal feature parameter set contains abnormal feature parameters associated with the abnormal features matched by the communication data. The calculation module is used to calculate the fraud probability value corresponding to the number to be detected based on each normal feature parameter in the normal feature parameter set and each abnormal feature parameter in the abnormal feature parameter set. The response module is used to determine that the number to be detected is a fraudulent number in response to the fraud probability value being greater than a preset fraud probability value; Specifically, the matching module is used to obtain a training feature set, determine the weight value corresponding to each training feature in the training feature set, associate each training feature with its corresponding weight value to obtain an associated training feature set corresponding to the training feature set, determine the normal feature set and the abnormal feature set based on each associated training feature in the associated training feature set that meets preset conditions, and match each communication data in the communication dataset with each normal feature in the normal feature set and each abnormal feature in the abnormal feature set; wherein, the training feature set includes a normal communication dataset and an abnormal communication dataset. Specifically, the calculation module is used for: The quantity of normal features in the communication dataset of the number to be detected is obtained. These quantity values, along with the normal feature parameters from the normal feature parameter set and the abnormal feature parameters from the abnormal feature parameter set, are then input into a third preset formula to calculate the fraud probability value corresponding to the number to be detected. The third preset formula is as follows: Where P represents the fraud probability value of the number to be detected, and N is the number of normal features in the communication dataset corresponding to the number to be detected. Normal feature parameters representing normal features corresponding to the communication dataset. Anomaly feature parameters represent the abnormal characteristics corresponding to the communication dataset.

9. The apparatus as claimed in claim 8, characterized in that, The matching module is further configured to determine the initial weight values ​​corresponding to each training feature in the training feature set, input the training feature set and the initial weight values ​​corresponding to the training feature set into a preset iterative model, and obtain the weight values ​​corresponding to each training feature in the training feature set.

10. The apparatus as claimed in claim 9, characterized in that, The matching module is further configured to, in response to the number of iterations of the initial weight value reaching a preset number of iterations, use each current weight value corresponding to the training feature set as the weight value corresponding to each training feature of the training feature set, or determine the loss value of the training feature set, and in response to the loss value being less than a preset loss threshold, use the current weight value corresponding to the training feature set as the weight value corresponding to each training feature of the training feature set.

11. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method according to any one of claims 1-7.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

13. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1-7.

Images