A method, system and readable storage medium for identifying group fraud relationships

Abstract

The present invention provides a group fraud relationship identification method, system and readable storage medium, the method comprising: obtaining a group fraud relationship identification request sent by a terminal, the group fraud relationship identification request carrying a target mobile phone number; determining whether the target mobile phone number is a black market; if so, obtaining multiple pieces of associated information corresponding to the target mobile phone number; inputting the multiple pieces of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis, and obtaining a group fraud relationship graph corresponding to the target mobile phone number; and sending the group fraud relationship graph to the terminal. The method, system and readable storage medium can solve the problems of the existing group fraud relationship identification method being prone to post-processing, low accuracy in fraud relationship judgment, and low coverage of fraud relationship judgment.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method and system for identifying group fraud relationships and a readable storage medium. Background Art

[0002] At present, the identification of group fraud relationships mainly relies on technical means such as intelligence collection, malicious information collection, user business layer data behavior analysis, and abnormal information (IP and mobile phone number) database, which are prone to problems such as post-processing, low accuracy in fraud relationship judgment, and low coverage of fraud relationship judgment. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a group fraud relationship identification method, system and readable storage medium in view of the above-mentioned deficiencies in the prior art, which can realize pre-processing and has high accuracy in fraud relationship judgment.

[0004] In a first aspect, the present invention provides a method for identifying group fraud relationships, comprising:

[0005] Obtaining a group fraud relationship identification request sent by a terminal, wherein the group fraud relationship identification request carries a target mobile phone number;

[0006] Determine whether the target mobile phone number is a black market one;

[0007] If yes, then obtain multiple pieces of associated information corresponding to the target mobile phone number;

[0008] Input the plurality of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis to obtain a group fraud relationship graph corresponding to the target mobile phone number;

[0009] The group fraud relationship map is sent to the terminal.

[0010] Furthermore, the determining whether the target mobile phone number is a black market number specifically includes:

[0011] Obtain the target IP address and the target International Mobile Subscriber Identity (IMSI) number corresponding to the target mobile phone number;

[0012] The target mobile phone number is identified as a black market according to the preset black market account database, the target IP address, and the target IMSI number, and a black market identification result is obtained.

[0013] Furthermore, the black market identification of the target mobile phone number is performed according to the preset black market account library, the target IP address, and the target IMSI number, and the black market identification result is obtained, which specifically includes:

[0014] The exact matching distance between the target mobile phone number and each first black market mobile phone number in the black market account database is calculated according to the following formula:

[0015]

[0016] x=1,2,3,…,C

[0017] Where C is the number of the first black market mobile phone numbers in the black market account database, for The transpose of The value is the converted value of the target IP address and target IMSI number corresponding to the target mobile phone number. is the converted value of the first IP address and the first IMSI number corresponding to the xth first black market mobile phone number in the black market account database, η is the adjustment coefficient, M is the autonomous adjustment time range, is the start time of the illegal activity corresponding to the xth first illegal mobile phone number, is the end time of the illegal activity corresponding to the xth first illegal mobile phone number, d x is the precise matching distance between the target mobile phone number and the xth first black market mobile phone number;

[0018] Obtaining a minimum value among all the precise matching distances, and determining whether the minimum value among the precise matching distances is less than or equal to a preset distance threshold;

[0019] If so, it is determined that the target mobile phone number is a black industry, otherwise, it is not a black industry.

[0020] Furthermore, the group fraud relationship identification model includes a convolution part, a pooling part and a fully connected part. The inputting of the plurality of associated information into the preset group fraud relationship identification model to perform group fraud relationship graph analysis to obtain the group fraud relationship graph corresponding to the target mobile phone number specifically includes:

[0021] Obtaining a matrix U composed of eigenvectors of a normalized graph Laplacian matrix corresponding to the plurality of pieces of association information through the convolution part;

[0022] Performing average pooling processing on the U through the pooling part to obtain a pooling result;

[0023] The pooling results after the average pooling process are connected into a one-dimensional vector through the fully connected part to obtain the group fraud relationship map.

[0024] Furthermore, the matrix U composed of eigenvectors of the normalized graph Laplacian matrix corresponding to the plurality of pieces of association information obtained through the convolution part specifically includes:

[0025] The abnormal relationship judgment accuracy W and the abnormal relationship judgment coverage C corresponding to each piece of associated information are obtained through the convolution part, and the U is obtained according to the vector composed of W and C, where U=[W,C].

[0026] Furthermore, the graph Laplacian matrix L satisfies the following formula:

[0027]

[0028] In the formula, I N is the identity matrix, D is the degree matrix of the graph, A is the adjacency matrix of the graph, ∧ is the diagonal matrix composed of the features of L, and U T is the matrix transpose of the eigenvectors of the normalized graph Laplacian matrix.

[0029] Furthermore, each piece of the associated information includes the following attributes: user unique identifier, black market behavior start time, black market behavior end time, call type, billing party IMSI number, target mobile phone number, local area code, regularized other party number, other party area code and call duration;

[0030] The eigenvalue function g of L θ (∧) satisfies the following formula:

[0031]

[0032] in,

[0033] T k (∧)=2∧T k-1 (∧)-T k-2 (^), T0(^)=1, T1(^)=∧

[0034] In the formula, θ1, θ2, θ3, θ4, θ5, θ6, θ7, θ8, θ9, θ 10 They are mapped to the user's unique ID, the start time of the illegal activity, the end time of the illegal activity, the call type, the IMSI number of the billing party, the target mobile phone number, the local area code, the regularized other party's number, the other party's area code, and the call duration, θ k ∈R k is the Chebyshev coefficient vector, Λ is the Chebyshev maximum eigenvalue matrix change of Λ, T k (∧) is the Chebyshev polynomial, λ max is the largest eigenvalue of L, T k-1 (∧), T k-2 (^) is the recursive Chebyshev polynomial;

[0035] The Chebyshev maximum eigenvalue matrix variation of L satisfies the following formula:

[0036] L=2L / λ max -I N =UΛU T .

[0037] In a second aspect, the present invention provides a group fraud relationship identification system, comprising:

[0038] An identification request acquisition module, used to acquire a group fraud relationship identification request sent by a terminal, wherein the group fraud relationship identification request carries a target mobile phone number;

[0039] A black market judgment module, connected to the identification request acquisition module, for judging whether the target mobile phone number is a black market;

[0040] A related information acquisition module, connected to the black market judgment module, is used to obtain multiple pieces of related information corresponding to the target mobile phone number;

[0041] A graph analysis module, connected to the associated information acquisition module, for inputting the plurality of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis, and obtain a group fraud relationship graph corresponding to the target mobile phone number;

[0042] The identification result sending module is connected to the graph analysis module and is used to send the group fraud relationship graph to the terminal.

[0043] In a third aspect, the present invention provides a group fraud relationship identification system, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the group fraud relationship identification method described in the first aspect above.

[0044] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for identifying group fraud relationships described in the first aspect above is implemented.

[0045] The group fraud relationship identification method, system and readable storage medium provided by the present invention first obtain a group fraud relationship identification request sent by a terminal, the group fraud relationship identification request carries a target mobile phone number, and then determines whether the target mobile phone number is a black market. If so, multiple pieces of associated information corresponding to the target mobile phone number are obtained, and then the multiple pieces of associated information are input into a preset group fraud relationship identification model for group fraud relationship graph analysis, so that a group fraud relationship graph corresponding to the target mobile phone number can be obtained, and finally the group fraud relationship graph is sent to the terminal. The present invention can achieve pre-processing, and has the advantages of high accuracy in fraud relationship judgment and high coverage of fraud relationship judgment, and solves the problems of the existing group fraud relationship identification method being prone to post-processing, low accuracy in fraud relationship judgment, and low coverage of fraud relationship judgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A scene diagram of a group fraud relationship identification method according to an embodiment of the present invention;

[0047] Figure 2 This is a flow chart of a group fraud relationship identification method according to Embodiment 1 of the present invention;

[0048] Figure 3 This is a schematic diagram of the structure of a group fraud relationship identification system according to Embodiment 2 of the present invention;

[0049] Figure 4 This is a structural diagram of a group fraud relationship identification system according to Example 3 of the present invention. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0051] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0052] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0053] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0054] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0055] It can be understood that, in the absence of conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0056] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0057] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0058] like Figure 1 As shown, it is a scene diagram of a group fraud relationship identification method provided by an embodiment of the present application, wherein each part is described as follows:

[0059] (1) Mobile network signaling and 3A logs: Mobile network signaling is the underlying signaling data unique to the operator. In the wireless communication system, signaling is a control signal required to ensure normal communication in order to make the entire network work in an orderly manner, in addition to transmitting user information. 3A logs are original data information unique to the operator.

[0060] (2) Signaling and 3A data extraction and conversion server: used to continuously filter the black market data in the mobile network signaling and / or 3A logs and add them to the black market account database. Specifically, the signaling and 3A data extraction and conversion server continuously classifies, extracts, and converts data such as the user's unique identification, the start time of the black market behavior, the end time of the black market behavior, the call type (caller 1, called 2), the billing party's IMSI (International Mobile Subscriber Identity) number, the mobile phone number, the local area code, the regularized other party's number, the other party's area code, the call duration, the IP (Internet Protocol) address, and the IP login time (year, month, day, hour, minute, and second), and sends them to the black market account database.

[0061] (3) Black market account database: used to store black market data, which may include user unique identifier, black market behavior start time, black market behavior end time, call type (caller 1, called 2), billing party IMSI number, mobile phone number, local area code, regularized other party number, other party area code, call duration, IP address, IP login time (year, month, day, hour, minute, second), and other data.

[0062] (4) Website / APP: used to provide an interface for interacting with the group fraud relationship identification system. Users can send group fraud relationship identification requests to the group fraud relationship identification system through the website / APP on the terminal device.

[0063] (5) Group fraud relationship identification system: used to analyze the group fraud relationship map based on the user's group fraud relationship identification request, and feed back the corresponding group fraud relationship map to the terminal.

[0064] based on Figure 1 The scene diagram is shown, and the relevant embodiments of the group fraud relationship identification method involved in this application are introduced below.

[0065] Embodiment 1:

[0066] This embodiment provides a method for identifying group fraud relationships. Figure 2 As shown, the method includes:

[0067] Step S101: Obtain a group fraud relationship identification request sent by a terminal, wherein the group fraud relationship identification request carries a target mobile phone number.

[0068] In this embodiment, the user can send a group fraud relationship identification request to the group fraud relationship identification system through the website / APP on the terminal device, such as a mobile phone, tablet, etc. The group fraud relationship identification request carries the target mobile phone number, and may also carry the IP address or IP login time (year, month, day, hour, minute, and second). The IP address is the IP address assigned to the target mobile phone number through the telecommunications access network, which can be an IPV4 address or an IPV6 address. The terminal submits an identification application by sending a group fraud relationship identification request to the group fraud relationship identification system.

[0069] Step S102: Determine whether the target mobile phone number is a black market one.

[0070] In this embodiment, after receiving the group fraud relationship identification request, the group fraud relationship identification system first determines whether the target mobile phone number is a black industry. Specifically, the group fraud relationship identification system first obtains the target IP address and target IMSI number corresponding to the target mobile phone number, and then performs black industry identification on the target mobile phone number according to the preset black industry account library, the target IP address, and the target IMSI number, and obtains the black industry identification result. Among them, the IMSI number is used to uniquely identify a mobile user in the global mobile communication network. It is an international identification code. The IMSI number and IP address associated with all mobile phone numbers are pre-stored in the operator database; the black industry account library is generated based on the operator's unique underlying signaling data, which stores the currently acquired black industry data.

[0071] Optionally, performing black market identification on the target mobile phone number according to a preset black market account library, the target IP address, and the target IMSI number, and obtaining a black market identification result, specifically includes:

[0072] The exact matching distance between the target mobile phone number and each first black market mobile phone number in the black market account database is calculated according to the following formula:

[0073]

[0074] x=1,2,3,…,C

[0075] Where C is the number of the first black market mobile phone numbers in the black market account database, for The transpose of The value is the converted value of the target IP address and target IMSI number corresponding to the target mobile phone number. is the converted value of the first IP address and the first IMSI number corresponding to the xth first black market mobile phone number in the black market account database, η is the adjustment coefficient, M is the autonomous adjustment time range, is the start time of the illegal activity corresponding to the xth first illegal mobile phone number, is the end time of the illegal activity corresponding to the xth first illegal mobile phone number, d x is the precise matching distance between the target mobile phone number and the xth first black market mobile phone number;

[0076] Obtaining a minimum value among all the precise matching distances, and determining whether the minimum value among the precise matching distances is less than or equal to a preset distance threshold;

[0077] If so, it is determined that the target mobile phone number is a black industry, otherwise, it is not a black industry.

[0078] In this embodiment, in order to achieve accurate identification of black market users, the above-mentioned precise matching distance formula is used for judgment. It should be noted that the above-mentioned precise matching distance formula is only an example. This embodiment can also use other distance calculation formulas to calculate the precise matching distance between the target mobile phone number and each first black market mobile phone number in the black market account library.

[0079] Step S103: If yes, obtain multiple pieces of associated information corresponding to the target mobile phone number.

[0080] In this embodiment, each piece of the associated information includes the following attributes: user unique identification, black industry behavior start time, black industry behavior end time, call type (caller 1, called 2), billing party IMSI number, target mobile phone number, local area code, regularized other party number, other party area code and call duration, and may also include IP address and IP login time (year, month, day, hour, minute and second). Each attribute information can be obtained from the black industry account library or other account library, wherein the regularized other party number refers to a number that meets the preset format, such as some numbers with incomplete digits can be supplemented accordingly, or some numbers with excessive digits (such as an extra 0 in front) can be removed accordingly. The billing party IMSI number can be the calling party's IMSI number or the called party's IMSI number, which is obtained according to the operator's regulations.

[0081] Step S104: input the plurality of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis to obtain a group fraud relationship graph corresponding to the target mobile phone number.

[0082] In this embodiment, the preset group fraud relationship identification model is a model based on a graph neural network, and the group fraud relationship identification model includes a convolution part, a pooling part and a fully connected part.

[0083] Optionally, inputting the plurality of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis to obtain a group fraud relationship graph corresponding to the target mobile phone number may specifically include:

[0084] Obtaining a matrix U composed of eigenvectors of a normalized graph Laplacian matrix corresponding to the plurality of pieces of association information through the convolution part;

[0085] Performing average pooling processing on the U through the pooling part to obtain a pooling result;

[0086] The pooling results after the average pooling process are connected into a one-dimensional vector through the fully connected part to obtain the group fraud relationship map.

[0087] In this embodiment, each piece of associated information is input as a record into the group fraud relationship identification model, the record is a node, the column value of the record is an attribute, and the attributes of each piece of associated information are shown in Table 1, where the mobile phone number is specifically the target mobile phone number.

[0088] Table 1: Attributes of association information

[0089]

[0090] Optionally, the matrix U composed of eigenvectors of the normalized graph Laplacian matrix corresponding to the multiple pieces of association information obtained through the convolution part may specifically include:

[0091] The abnormal relationship judgment accuracy W and the abnormal relationship judgment coverage C corresponding to each piece of associated information are obtained through the convolution part, and the U is obtained according to the vector composed of W and C, where U=[W,C].

[0092] In this embodiment, the convolution part maps the user unique identifier associated with the target mobile phone number, the start time of the black market behavior, the end time of the black market behavior, the call type (caller 1, called 2), the billing party IMSI number, the target mobile phone number, the local area code, the regularized other party number, the other party area code, and the call duration to θ1, θ2, θ3, θ4, θ5, θ6, θ7, θ8, θ9, θ10, θ11, θ12, θ13, θ14, θ15, θ16, θ17, θ18, θ19, θ20, θ21, θ22, θ23, θ24, θ25, θ26, θ27, θ28, θ29, θ30, θ31, θ32, θ33, θ34, θ35, θ36, θ37, θ38, θ39, θ40, θ41, θ42, θ43, θ44, θ45, θ46, θ47, θ48, θ49, θ51, θ52, θ53, θ54, θ55, θ56, θ57, θ58, θ59, θ60, θ61, θ62, θ63, θ64, θ65, θ66, θ67, θ68, θ9, θ9 10 , the abnormal relationship judgment accuracy W and abnormal relationship judgment coverage C of each record are combined into a vector mapping U, that is, U = [W, C], where U is a matrix composed of the eigenvectors of the normalized graph Laplacian matrix.

[0093] Specifically, the graph Laplacian matrix L satisfies the following formula:

[0094]

[0095] In the formula, I N is the identity matrix, D is the degree matrix of the graph (the Laplace matrix is ​​defined as L = DA, the degree matrix represents the degree of each point in the original graph, that is, the number of edges emitted by the point), N is the number of nodes in the graph, A is the adjacency matrix of the graph, ^ is the diagonal matrix composed of the features of L, U T is the matrix transpose of the eigenvectors of the normalized graph Laplacian matrix.

[0096] Specifically, the eigenvalue function g of L θ (^) satisfies the following formula:

[0097]

[0098] in,

[0099] T k (∧)=2∧T k-1 (∧)-T k-2 (∧), T0(∧)=1, T1(∧)=∧

[0100] In the formula, θ k refers to the kth attribute of the associated information, where θ1, θ2, θ3, θ4, θ5, θ6, θ7, θ8, θ9, θ 10 They are mapped to the user's unique ID, the start time of the illegal activity, the end time of the illegal activity, the call type, the IMSI number of the billing party, the target mobile phone number, the local area code, the regularized other party's number, the other party's area code, and the call duration, θ k ∈R k is the Chebyshev coefficient vector, Λ is the Chebyshev maximum eigenvalue matrix change of Λ, T k (∧) is the Chebyshev polynomial, λ max is the largest eigenvalue of L, T k-1 (∧), T k-2 (∧) is the recursive Chebyshev polynomial;

[0101] The Chebyshev maximum eigenvalue matrix variation of L satisfies the following formula:

[0102] L=2L / λ max -I N =UΛU T .

[0103] Optionally, the formula for normalizing the matrix composed of eigenvectors of the graph Laplacian matrix is:

[0104]

[0105] In this embodiment, in order to reduce redundant parameters, the pooling part performs average pooling processing on the matrix composed of the eigenvectors of the normalized graph Laplacian matrix output by the convolution part to obtain the pooling result, and then the pooling result after the average pooling processing is connected into a one-dimensional vector, namely, the group fraud relationship map, through the fully connected part.

[0106] Step S105: Send the group fraud relationship map to the terminal.

[0107] In this embodiment, the group fraud relationship map is specifically generated according to the call type (caller 1, called 2) in the association information, the mobile phone number and the regularized other party number. The group fraud relationship map can be a relationship map including the mobile phone number and other black industry mobile phone numbers associated with the mobile phone number, or a relationship map including the user unique identifier corresponding to the mobile phone number and the user unique identifier corresponding to other black industry mobile phone numbers associated with the mobile phone number. The group fraud relationship map can be stored in a sparse matrix.

[0108] The group fraud relationship identification method provided by the embodiment of the present invention first obtains a group fraud relationship identification request sent by a terminal, the group fraud relationship identification request carries a target mobile phone number, and then determines whether the target mobile phone number is a black market. If so, multiple pieces of associated information corresponding to the target mobile phone number are obtained, and then the multiple pieces of associated information are input into a preset group fraud relationship identification model for group fraud relationship graph analysis, so that a group fraud relationship graph corresponding to the target mobile phone number can be obtained, and finally the group fraud relationship graph is sent to the terminal. The present invention can achieve pre-processing, and has the advantages of high accuracy in fraud relationship judgment and high coverage rate of fraud relationship judgment, and solves the problems of the existing group fraud relationship identification method being prone to post-processing, low accuracy in fraud relationship judgment, and low coverage rate of fraud relationship judgment.

[0109] Embodiment 2:

[0110] like Figure 3 As shown, this embodiment provides a group fraud relationship identification system, which is used to execute the above group fraud relationship identification method, including:

[0111] An identification request acquisition module 11 is used to acquire a group fraud relationship identification request sent by a terminal, wherein the group fraud relationship identification request carries a target mobile phone number;

[0112] A black market determination module 12, connected to the identification request acquisition module 11, is used to determine whether the target mobile phone number is a black market;

[0113] The associated information acquisition module 13 is connected to the black market determination module 12 and is used to obtain multiple pieces of associated information corresponding to the target mobile phone number;

[0114] A graph analysis module 14, connected to the associated information acquisition module 13, is used to input the plurality of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis, and obtain a group fraud relationship graph corresponding to the target mobile phone number;

[0115] The identification result sending module 15 is connected to the graph analysis module 14 and is used to send the group fraud relationship graph to the terminal.

[0116] Optionally, the black market determination module 12 specifically includes:

[0117] A first acquisition unit is used to acquire a target IP address and a target International Mobile Subscriber Identity IMSI number corresponding to the target mobile phone number;

[0118] The black industry identification unit is used to identify the black industry of the target mobile phone number according to the preset black industry account library, the target IP address, and the target IMSI number, and obtain the black industry identification result.

[0119] Optionally, the black market identification unit specifically includes:

[0120] A calculation unit is used to calculate the exact matching distance between the target mobile phone number and each first black market mobile phone number in the black market account library according to the following formula:

[0121]

[0122] x=1,2,3,…,C

[0123] Where C is the number of the first black market mobile phone numbers in the black market account database, for The transpose of The value is the converted value of the target IP address and target IMSI number corresponding to the target mobile phone number. is the converted value of the first IP address and the first IMSI number corresponding to the xth first black market mobile phone number in the black market account database, η is the adjustment coefficient, M is the autonomous adjustment time range, is the start time of the illegal activity corresponding to the xth first illegal mobile phone number, is the end time of the illegal activity corresponding to the xth first illegal mobile phone number, d x is the precise matching distance between the target mobile phone number and the xth first black market mobile phone number;

[0124] A judging unit, used to obtain a minimum value among all the precise matching distances, and to judge whether the minimum value among the precise matching distances is less than or equal to a preset distance threshold;

[0125] The determination unit is used to determine that if so, the target mobile phone number is a black product, otherwise, it is not a black product.

[0126] Optionally, the group fraud relationship identification model includes a convolution part, a pooling part and a fully connected part, and the graph analysis module 14 specifically includes:

[0127] A convolution processing unit, used for obtaining, through the convolution part, a matrix U composed of eigenvectors of a normalized graph Laplacian matrix corresponding to the plurality of pieces of association information;

[0128] A pooling processing unit, used for performing average pooling processing on the U through the pooling part to obtain a pooling result;

[0129] The fully connected processing unit is used to connect the pooling results after the average pooling processing into a one-dimensional vector through the fully connected part to obtain the group fraud relationship map.

[0130] Optionally, the convolution processing unit is specifically used to:

[0131] The abnormal relationship judgment accuracy W and the abnormal relationship judgment coverage C corresponding to each piece of associated information are obtained through the convolution part, and the U is obtained according to the vector composed of W and C, where U=[W,C].

[0132] Optionally, the graph Laplacian matrix L satisfies the following formula:

[0133]

[0134] In the formula, I N is the identity matrix, D is the degree matrix of the graph, A is the adjacency matrix of the graph, ∧ is the diagonal matrix composed of the features of L, and U T is the matrix transpose of the eigenvectors of the normalized graph Laplacian matrix.

[0135] Optionally, each piece of the associated information includes the following attributes: user unique identifier, black market behavior start time, black market behavior end time, call type, billing party IMSI number, target mobile phone number, local area code, regularized other party number, other party area code and call duration;

[0136] The eigenvalue function g of L θ (∧) satisfies the following formula:

[0137]

[0138] in,

[0139] T k (∧)=2∧T k-1 (∧)-T k-2 (∧), T0(∧)=1, T1(∧)=∧

[0140] In the formula, θ1, θ2, θ3, θ4, θ5, θ6, θ7, θ8, θ9, θ 10 They are mapped to the user's unique ID, the start time of the illegal activity, the end time of the illegal activity, the call type, the IMSI number of the billing party, the target mobile phone number, the local area code, the regularized other party's number, the other party's area code, and the call duration, θk ∈R k is the Chebyshev coefficient vector, Λ is the Chebyshev maximum eigenvalue matrix change of Λ, T k (∧) is the Chebyshev polynomial, λ max is the largest eigenvalue of L, T k-1 (∧), T k-2 (^) is the recursive Chebyshev polynomial;

[0141] The Chebyshev maximum eigenvalue matrix variation of L satisfies the following formula:

[0142] L=2L / λ max -I N =UΛU T .

[0143] Embodiment 3:

[0144] refer to Figure 4 This embodiment provides a group fraud relationship identification system, including a memory 21 and a processor 22, the memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the group fraud relationship identification method in Example 1.

[0145] The memory 21 is connected to the processor 22. The memory 21 may be a flash memory, a read-only memory or other memory. The processor 22 may be a central processing unit or a single-chip microcomputer.

[0146] Embodiment 4:

[0147] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the group fraud relationship identification method in the above-mentioned embodiment 1 is implemented.

[0148] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0149] The group fraud relationship identification system and readable storage medium provided in Examples 2 to 4 first obtain a group fraud relationship identification request sent by a terminal, the group fraud relationship identification request carries a target mobile phone number, and then determines whether the target mobile phone number is a black market. If so, multiple pieces of associated information corresponding to the target mobile phone number are obtained, and then the multiple pieces of associated information are input into a preset group fraud relationship identification model for group fraud relationship graph analysis, so that a group fraud relationship graph corresponding to the target mobile phone number can be obtained, and finally the group fraud relationship graph is sent to the terminal. The present invention can achieve pre-processing, and has the advantages of high accuracy in fraud relationship judgment and high coverage of fraud relationship judgment, and solves the problems that the existing group fraud relationship identification method is prone to post-processing, low accuracy in fraud relationship judgment, and low coverage of fraud relationship judgment.

[0150] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying group fraud relationships, characterized in that: include: Obtaining a group fraud relationship identification request sent by a terminal, wherein the group fraud relationship identification request carries a target mobile phone number; Determine whether the target mobile phone number is a black market one; If yes, then obtain multiple pieces of associated information corresponding to the target mobile phone number, wherein each piece of associated information includes the following attributes: user unique identifier, black market behavior start time, black market behavior end time, call type, billing party IMSI number, target mobile phone number, local area code, regularized other party number, other party area code and call duration; Input the plurality of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis to obtain a group fraud relationship graph corresponding to the target mobile phone number; sending the group fraud relationship map to the terminal; The group fraud relationship identification model includes a convolution part, a pooling part and a fully connected part. The plurality of associated information are input into a preset group fraud relationship identification model to perform group fraud relationship graph analysis to obtain a group fraud relationship graph corresponding to the target mobile phone number, specifically including: Obtaining a matrix U composed of eigenvectors of a normalized graph Laplacian matrix corresponding to the plurality of pieces of association information through the convolution part; Performing average pooling processing on the U through the pooling part to obtain a pooling result; The pooling results after the average pooling process are connected into a one-dimensional vector through the fully connected part to obtain the group fraud relationship map; The matrix U composed of the eigenvectors of the normalized graph Laplacian matrix corresponding to the plurality of pieces of association information obtained through the convolution part specifically includes: The abnormal relationship judgment accuracy W and the abnormal relationship judgment coverage C corresponding to each piece of associated information are obtained through the convolution part, and the U is obtained according to the vector composed of W and C, where U=[W,C].

2. The group fraud relationship identification method according to claim 1 is characterized in that: The step of judging whether the target mobile phone number is a black market number specifically includes: Obtain the target IP address and the target International Mobile Subscriber Identity (IMSI) number corresponding to the target mobile phone number; The target mobile phone number is identified as a black market according to the preset black market account database, the target IP address, and the target IMSI number, and a black market identification result is obtained.

3. The group fraud relationship identification method according to claim 2 is characterized in that: The step of performing black market identification on the target mobile phone number according to the preset black market account database, the target IP address, and the target IMSI number, and obtaining the black market identification result, specifically includes: The exact matching distance between the target mobile phone number and each first black market mobile phone number in the black market account database is calculated according to the following formula: Where C is the number of the first black market mobile phone numbers in the black market account database, for The transpose of The value is the converted value of the target IP address and target IMSI number corresponding to the target mobile phone number. is the converted value of the first IP address and the first IMSI number corresponding to the xth first black market mobile phone number in the black market account database, η is the adjustment coefficient, M is the autonomous adjustment time range, is the start time of the illegal activity corresponding to the xth first illegal mobile phone number, is the end time of the illegal activity corresponding to the xth first illegal mobile phone number, d x is the precise matching distance between the target mobile phone number and the xth first black market mobile phone number; Obtaining a minimum value among all the precise matching distances, and determining whether the minimum value among the precise matching distances is less than or equal to a preset distance threshold; If so, it is determined that the target mobile phone number is a black industry, otherwise, it is not a black industry.

4. The group fraud relationship identification method according to claim 1 is characterized in that: The graph Laplacian matrix L satisfies the following formula: In the formula, I N is the identity matrix, D is the degree matrix of the graph, A is the adjacency matrix of the graph, ∧ is the diagonal matrix composed of the features of L, and U T is the matrix transpose of the eigenvectors of the normalized graph Laplacian matrix.

5. The group fraud relationship identification method according to claim 4 is characterized in that: The eigenvalue function g of L θ (∧) satisfies the following formula: in, T k (∧)=2∧T k-1 (∧)-T k-2 (∧),T0(∧)=1,T1(∧)=∧ In the formula, θ1, θ2, θ3, θ4, θ5, θ6, θ7, θ8, θ9, θ 10 They are mapped to the user's unique ID, the start time of the illegal activity, the end time of the illegal activity, the call type, the IMSI number of the billing party, the target mobile phone number, the local area code, the regularized other party's number, the other party's area code, and the call duration, θ k ∈R k is the Chebyshev coefficient vector, Λ is the Chebyshev maximum eigenvalue matrix change of Λ, T k (∧) is the Chebyshev polynomial, λ max is the largest eigenvalue of L, T k-1 (∧), T k-2 (∧) is the recursive Chebyshev polynomial; The Chebyshev maximum eigenvalue matrix variation of L satisfies the following formula: L=2L / λ max -I N =UΛU T 。 6. A group fraud relationship identification system, characterized in that: include: An identification request acquisition module, used to acquire a group fraud relationship identification request sent by a terminal, wherein the group fraud relationship identification request carries a target mobile phone number; A black market judgment module, connected to the identification request acquisition module, for judging whether the target mobile phone number is a black market; A correlation information acquisition module is connected to the black industry judgment module, and is used to obtain multiple pieces of correlation information corresponding to the target mobile phone number, wherein each piece of the correlation information includes the following attributes: user unique identification, black industry behavior start time, black industry behavior end time, call type, billing party IMSI number, target mobile phone number, local end area code, regularized other party number, other end area code and call duration; A graph analysis module, connected to the associated information acquisition module, for inputting the plurality of associated information into a preset group fraud relationship identification model to perform group fraud relationship graph analysis, and obtain a group fraud relationship graph corresponding to the target mobile phone number; An identification result sending module, connected to the graph analysis module, for sending the group fraud relationship graph to the terminal; The group fraud relationship identification model includes a convolution part, a pooling part and a fully connected part, and the graph analysis module specifically includes: A convolution processing unit, used for obtaining, through the convolution part, a matrix U composed of eigenvectors of a normalized graph Laplacian matrix corresponding to the plurality of pieces of association information; A pooling processing unit, used for performing average pooling processing on the U through the pooling part to obtain a pooling result; A fully connected processing unit, used to connect the pooling results after the average pooling process into a one-dimensional vector through the fully connected part to obtain the group fraud relationship map; The convolution processing unit is specifically used for: The abnormal relationship judgment accuracy W and the abnormal relationship judgment coverage C corresponding to each piece of associated information are obtained through the convolution part, and the U is obtained according to the vector composed of W and C, where U=[W,C].

7. A group fraud relationship identification system, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the group fraud relationship identification method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for identifying group fraud relationships according to any one of claims 1 to 5 is implemented.

Images