Method, system, device and medium for identifying abnormal users in network communication

Abstract

The present invention discloses a method for identifying abnormal network communication users, which includes the following steps: extracting SMS data, traffic data, and call data of a terminal; comparing the SMS data with pre-stored SMS feature data to obtain a first matching index; fitting the traffic data with a pre-stored traffic curve to obtain a second matching index; comparing the call data with pre-stored call data to obtain a third matching index; generating an abnormality index based on the first matching index, the second matching index, and the third matching index; if the abnormality index is greater than an abnormality threshold, associating the terminal with an identifier to indicate that the user associated with the terminal is an abnormal user. The present invention also discloses a system, device, and medium for identifying abnormal network communication users. The present invention can accurately identify abnormal network communication users.

Description

Technical Field

[0001] The present invention relates to communication technology, and in particular to a method, system, device and medium for identifying abnormal users in network communication. Background Art

[0002] With the rapid development of the Internet and mobile terminals, telecommunications fraud crimes occur frequently.

[0003] Currently, fraudulent calls are primarily identified through user reports and the establishment of a blacklist and whitelist mechanism, which identifies and blocks fraudulent calls based on the similarity between the call number and a pre-stored phone database. However, fraudulent calls often have a short lifespan, and blocking mechanisms lag in updating information, resulting in weak protection. Telephone fraud is often not addressed until victims report the crime. By then, people have already been deceived and suffered financial losses, making it difficult to prevent the fraud in a timely manner. Victims seeking to recover their losses can only wait for the police to solve the case or seek help from their banks.

[0004] Mobile phone users are increasingly demanding that fraudulent calls be filtered out. However, fraudsters are becoming increasingly covert in their calls, and the characteristics associated with their calls are becoming less clear. Simply analyzing and identifying call texts alone is unlikely to further improve the accuracy and recall rate of mobile phone systems for identifying bad calls. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to be able to accurately identify abnormal network communication users.

[0006] To solve the above technical problems, the present invention provides a method for identifying abnormal network communication users, which includes the following steps:

[0007] S1 extracts SMS data, traffic data and call data from a terminal;

[0008] S2. Compare the SMS data with pre-stored SMS feature data to obtain a first matching index;

[0009] Fitting the flow data to a pre-stored flow curve to obtain a second matching index;

[0010] Comparing the call data with pre-stored call data to obtain a third matching index;

[0011] S3. Generate an abnormality index based on the first matching index, the second matching index, and the third matching index;

[0012] S4. If the abnormality index is greater than an abnormality threshold, the terminal is associated with an identifier to indicate that the user associated with the terminal is an abnormal user.

[0013] Preferably, the pre-stored SMS feature data includes sensitive words, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of interval characters between the sensitive words;

[0014] The method of comparing the SMS data with pre-stored SMS feature data to obtain the first matching index comprises the following steps:

[0015] S211 extracts the SMS text corresponding to the SMS data according to the SMS data;

[0016] S212. Segment the text of the SMS message to extract multiple sensitive words from the SMS data, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of characters between the sensitive words;

[0017] S213. According to the sensitive words, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of interval characters between the sensitive words, the SMS data is obtained and compared with the pre-stored SMS feature data, and the highest matching index obtained is used as the first matching index.

[0018] Preferably, the pre-stored flow curve shown includes N straight line segments connected in sequence, where N is an integer greater than 1;

[0019] The method of fitting the flow data to a pre-stored flow curve to obtain the second matching index comprises the following steps:

[0020] S221. Obtain a flow curve in a flow time coordinate system based on the flow data, wherein the flow time coordinate system has time as the horizontal axis and flow velocity as the vertical axis;

[0021] S222. Fitting the flow curve into a flow broken line, wherein the flow broken line comprises N straight line segments connected in sequence;

[0022] S223. Match the traffic broken line with the pre-stored traffic curve to obtain the second matching index.

[0023] Preferably, the method of comparing the call data with pre-stored call data to obtain the third matching index comprises the following steps:

[0024] S231. The data server 13 extracts the terminal ID of another terminal for data exchange with one terminal based on the call data;

[0025] S232. Compare the extracted terminal ID of the other terminal with the terminal ID in the pre-stored call data to obtain the third matching index.

[0026] Preferably, generating an abnormality index according to the first matching index, the second matching index, and the third matching index comprises the following steps:

[0027] S31. Perform weighted accumulation on the first matching index, the second matching index, and the third matching index to obtain a weighted accumulated value;

[0028] S32. Normalize the weighted accumulated value to obtain the abnormality index.

[0029] To solve the above technical problems, the present invention provides a system for identifying abnormal network communication users, which includes:

[0030] Extraction module 701, used to extract SMS data, traffic data and call data of a terminal;

[0031] SMS module 702, configured to compare the SMS data with pre-stored SMS feature data to obtain a first matching index;

[0032] The flow module 703 is configured to fit the flow data to a pre-stored flow curve to obtain a second matching index;

[0033] A call module 704 is configured to compare the call data with pre-stored call data to obtain a third matching index;

[0034] An index module 705 is configured to generate an abnormality index based on the first matching index, the second matching index, and the third matching index;

[0035] The identification module 706 associates the terminal with an identifier based on the abnormality index being greater than an abnormality threshold, so as to indicate that the user associated with the terminal is an abnormal user.

[0036] To solve the above technical problems, the present invention provides a device for identifying abnormal network communication users, which includes a processor 810 and a memory 820;

[0037] The memory 820 stores executable instructions of the processor 810;

[0038] The processor 810 is configured to execute the steps of the above-mentioned method for identifying abnormal network communication users by executing the executable instructions.

[0039] In order to solve the above technical problems, the present invention provides a computer-readable storage medium, which is used to store a program, and when the program is executed, the steps of the above-mentioned method for identifying abnormal network communication users are implemented.

[0040] The method for identifying abnormal network communication users of the present invention can accurately identify abnormal network communication users (such as suspected fraud users) by extracting text messages, data traffic, and call status in a mobile phone terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 This is a flow chart of an embodiment of a method for identifying abnormal users in network communication according to the present invention;

[0043] Figure 2 It is a specific implementation scenario of a method for identifying abnormal network communication users;

[0044] Figure 3 This is a flow chart of a method for obtaining a first matching index according to an embodiment of a method for identifying abnormal network communication users of the present invention;

[0045] Figure 4 This is a flow chart of a method for obtaining a second matching index according to an embodiment of a method for identifying abnormal network communication users of the present invention;

[0046] Figure 5 It is a curve fitting schematic diagram;

[0047] Figure 6 This is a flow chart of a method for obtaining a third matching index according to an embodiment of a method for identifying abnormal network communication users of the present invention;

[0048] Figure 7 This is a structural block diagram of an embodiment of an abnormal user identification system of the present invention;

[0049] Figure 8 This is a structural block diagram of an abnormal user identification device according to an embodiment of the present invention;

[0050] Figure 9 It is a structural diagram of an embodiment of a computer-readable storage medium of the present invention.

[0051] The features and advantages of the present invention will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same figures identify corresponding elements. In the accompanying drawings, the same reference numerals generally indicate the same, functionally similar and / or structurally similar elements. DETAILED DESCRIPTION

[0052] The following is a clear and complete description of the technical solutions of the present invention in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of the present invention.

[0053] The terms "first", "second" and similar words used in this application do not indicate any order, quantity or importance, but are only used to distinguish different components. Words such as "include" or "comprise" mean that the elements or objects preceding the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Words such as "connect" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative position relationships. When the absolute position of the object being described changes, the relative position relationship may also change accordingly.

[0054] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0055] Example 1

[0056] like Figure 1 As shown, a method for identifying abnormal network communication users includes the following steps:

[0057] S1 extracts SMS data, traffic data and call data from a terminal;

[0058] S2. Compare the SMS data with a pre-stored SMS feature data to obtain a first matching index;

[0059] Fitting the flow data to a pre-stored flow curve to obtain a second matching index;

[0060] Comparing the call data with pre-stored call data to obtain a third matching index;

[0061] S3. Generate an abnormality index based on the first matching index, the second matching index, and the third matching index;

[0062] S4. If the abnormality index is greater than an abnormality threshold, the terminal is associated with an identifier to indicate that the user associated with the terminal is an abnormal user.

[0063] Figure 2This is a specific implementation scenario of the method for identifying abnormal users in network communications in Example 1, in which a mobile terminal 11 is associated with a user. The mobile terminal 11 can be any human-computer interaction electronic product that can interact with the user, such as a smart phone, a tablet computer, and a desktop computer. The operating system of the terminal device can be any operating system, such as an Android operating system or an IOS operating system. The mobile terminal 11 is connected to the data server 13 through a network 12. The data server 13 can also be a desktop computer, a network host, a single network server, a cluster of multiple network servers, or a cloud composed of multiple servers; here, the cloud is composed of a large number of computers or network servers based on cloud computing (Cloud Computing), wherein cloud computing is a type of distributed computing, a virtual supercomputer composed of a group of loosely coupled computers. The network 12 can be the Internet, a wide area network, a metropolitan area network, a VPN network, a wireless self-organizing network (Ad Hoc network), etc. The data server 13 is operated and maintained by a network infrastructure service provider.

[0064] The method for identifying abnormal network communication users in the first embodiment can accurately identify abnormal network communication users (eg, suspected fraud users) by extracting SMS texts, data traffic, and call status from a mobile phone terminal.

[0065] Example 2

[0066] Based on the method for identifying abnormal network communication users in embodiment 1, Figure 3 As shown, the method of comparing the SMS data with pre-stored SMS feature data to obtain the first matching index includes the following steps:

[0067] S211. Extract the text corresponding to the text message data from the text message data. For example, data server 13 extracts text message data from mobile terminal 11 over a certain period of time, such as 1 hour or 24 hours, through network 12. Data server 13 processes the text message data to obtain the corresponding text message, such as "I am ****."

[0068] S212. Segment the text of the SMS message and obtain multiple sensitive words, the number of times the sensitive words appear, the time interval between the sensitive words, and the number of characters between the sensitive words; for example, the SMS text is "I am your leader" and "Transfer me", and after segmenting it, "I", "yes", "you", "leader", and "transfer" can be obtained, among which: "leader" and "transfer" are sensitive words, the number of times "leader" appears is 1, the number of times "transfer" appears is 1, the time interval between "leader" and "transfer" is 5 minutes, and the number of characters between "leader" and "transfer" is 2.

[0069] S213. According to the sensitive words, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of interval characters between the sensitive words, the SMS data is obtained and compared with the pre-stored SMS feature data, and the highest matching index obtained is used as the first matching index.

[0070] There is a pre-stored SMS feature data that also includes sensitive words, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of characters between the sensitive words. If the sensitive words, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of characters between the sensitive words in the pre-stored SMS feature data are exactly the same as those obtained by extraction, then the first matching index is 1. For example, in both cases, "leader" and "transfer" are sensitive words, the number of occurrences of "leader" is 1, the number of occurrences of "transfer" is 1, the time interval between "leader" and "transfer" is 5 minutes, and the number of characters between "leader" and "transfer" is 2.

[0071] Example 3

[0072] Based on the method for identifying abnormal network communication users in embodiment 1, Figure 4 As shown, the method of fitting the flow data to a pre-stored flow curve to obtain the second matching index includes the following steps:

[0073] S221. Obtain a flow curve in a flow time coordinate system based on the flow data, wherein the flow time coordinate system has time as the horizontal axis and flow velocity as the vertical axis;

[0074] S222. Fit the flow curve into a flow broken line, wherein the flow broken line includes at least one straight line segment; for example, Figure 5 As shown, in the coordinate system 500 , the flow curve is fitted to form a flow broken line 510 , which includes a straight line segment 511 and a straight line segment 512 .

[0075] S223. Match the flow curve with the pre-stored flow curve to obtain the second matching index, wherein the number of straight line segments contained in the pre-stored flow curve is the same as the number of straight line segments in the flow curve. Figure 5 As shown, a pre-stored flow curve 520 also includes a straight line segment 521 and a straight line segment 522. If the angle between the straight line segment 511 and the straight line segment 521 is 0 degrees, and the angle between the straight line segment 512 and the straight line segment 52 is 0 degrees, then the second matching index is 1. If the corresponding angles are not 0, then a second matching index is obtained based on the corresponding ratio, and the second matching index is less than 1.

[0076] Example 4

[0077] Based on the method for identifying abnormal network communication users in embodiment 1, Figure 6 As shown, the method of comparing the call data with pre-stored call data to obtain the third matching index includes the following steps:

[0078] S231. The data server 13 extracts the terminal ID of another terminal that exchanges data with the terminal based on the call data. For example, if the mobile terminal 11 is in a voice call with another terminal, the terminal ID of the other terminal is extracted, which is usually a mobile phone number.

[0079] S232. Compare the extracted terminal ID of the other terminal with the terminal ID in the pre-stored call data to obtain the third matching index.

[0080] Preferably, if the pre-stored call data contains a terminal ID (eg, a mobile phone number) that is identical to the terminal ID of the other terminal, the third matching index is 1, otherwise it is 0.

[0081] Example 5

[0082] Based on the method for identifying abnormal network communication users in the first embodiment, generating an abnormality index according to the first matching index, the second matching index, and the third matching index includes the following steps:

[0083] S31. Perform weighted accumulation on the first matching index, the second matching index, and the third matching index to obtain a weighted accumulated value;

[0084] S32. Normalize the weighted accumulated value to obtain the abnormality index.

[0085] For example, if the first matching index is 1, the second matching index is 1, and the third matching index is 0, then the weighted cumulative value after weighted addition is 2, and the normalized weighted cumulative value is 0.6. In step S4, if the abnormality threshold is 0.5, then the normalized value 0.6 is greater than 0.5, and the user of the terminal is an abnormal user.

[0086] Example 6

[0087] like Figure 7 As shown, a network communication abnormal user identification system 700 includes:

[0088] Extraction module 701, extracts SMS data, traffic data and call data of a terminal;

[0089] The SMS module 702 compares the SMS data with pre-stored SMS feature data to obtain a first matching index;

[0090] The flow module 703 fits the flow data with a pre-stored flow curve to obtain a second matching index;

[0091] The call module 704 compares the call data with pre-stored call data to obtain a third matching index;

[0092] An index module 705 generates an abnormality index according to the first matching index, the second matching index, and the third matching index;

[0093] The identification module 706 associates the terminal with an identifier based on the abnormality index being greater than an abnormality threshold, so as to indicate that the user associated with the terminal is an abnormal user.

[0094] Example 7

[0095] like Figure 8 As shown, a network communication abnormal user identification device 800 includes a processor 810 and a memory 820;

[0096] a memory 820 storing executable instructions of the processor 810;

[0097] The processor 810 is configured to execute the steps of the above-mentioned method for identifying abnormal network communication users by executing the executable instructions.

[0098] Preferably, the abnormal user identification device 800 is in the form of a general computing device, and the components of the abnormal user identification device 800 may include at least one processor 810, at least one memory 820, a bus 830 connecting different platform components (including the memory 820 and the processor 810), a display unit 840, etc.

[0099] The memory stores program codes, which can be executed by the processor 810, so that the processor 810 performs the above steps of this specification. For example, the processor 810 can execute the following steps: Figure 1 Follow the steps shown in .

[0100] The memory 820 may include a readable medium in the form of a volatile memory unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0101] The memory 820 may also include a program / utility 8204 having a set (at least one) of program modules 6205, such program modules 8205 including an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0102] Bus 830 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0103] The abnormal user identification device 800 may also communicate with one or more external devices 870 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the abnormal user identification device 800, and / or any device that enables the abnormal user identification device 800 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication may be performed via an input / output (I / O) interface 850. Furthermore, the abnormal user identification device 800 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 860. The network adapter 660 may communicate with other modules of the abnormal user identification device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the abnormal user identification device 800, such as microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, or data backup storage platforms.

[0104] Example 8

[0105] like Figure 9 As shown, a computer-readable storage medium 900 is used to store a program, and when the program is executed, the steps of the above-mentioned method for identifying abnormal network communication users are implemented.

[0106] Computer-readable storage medium 900, which may be a portable compact disk read-only memory (CD-ROM) and includes program code, can be executed on a terminal device, such as a personal computer. A computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0107] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0108] Computer-readable storage media may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0109] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, and the like, as well as conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0110] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for identifying abnormal network communication users, characterized in that: It includes the following steps: S1 extracts SMS data, traffic data and call data from a terminal; S2. Compare the SMS data with pre-stored SMS feature data to obtain a first matching index; Fitting the flow data to a pre-stored flow curve to obtain a second matching index; Comparing the call data with pre-stored call data to obtain a third matching index; The pre-stored flow curve shown includes N straight line segments connected in sequence, where N is an integer greater than 1; The method of fitting the flow data to a pre-stored flow curve to obtain the second matching index comprises the following steps: S221. Obtain a flow curve in a flow time coordinate system based on the flow data, wherein the flow time coordinate system has time as the horizontal axis and flow velocity as the vertical axis; S222. Fitting the flow curve into a flow broken line, wherein the flow broken line comprises N straight line segments connected in sequence; S223. Match the traffic curve with the pre-stored traffic curve to obtain the second matching index; S3. Generate an abnormality index based on the first matching index, the second matching index, and the third matching index; S4. If the abnormality index is greater than an abnormality threshold, the terminal is associated with an identifier to indicate that the user associated with the terminal is an abnormal user.

2. The method for identifying abnormal network communication users according to claim 1, characterized in that: The pre-stored SMS feature data includes sensitive words, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of characters between the sensitive words; The method of comparing the SMS data with pre-stored SMS feature data to obtain the first matching index comprises the following steps: S211 extracts the SMS text corresponding to the SMS data according to the SMS data; S212. Segment the text of the SMS message to extract multiple sensitive words from the SMS data, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of characters between the sensitive words; S213. According to the sensitive words, the number of occurrences of the sensitive words, the time interval between the sensitive words, and the number of interval characters between the sensitive words, the SMS data is obtained and compared with the pre-stored SMS feature data, and the highest matching index obtained is used as the first matching index.

3. The method for identifying abnormal network communication users according to claim 1, characterized in that: The method of comparing the call data with pre-stored call data to obtain the third matching index comprises the following steps: S231. The data server extracts the terminal ID of another terminal for data exchange with one terminal based on the call data; S232. Compare the extracted terminal ID of the other terminal with the terminal ID in the pre-stored call data to obtain the third matching index.

4. The method for identifying abnormal network communication users according to claim 1, wherein: Generating an anomaly index according to the first matching index, the second matching index, and the third matching index comprises the following steps: S31. Perform weighted accumulation on the first matching index, the second matching index, and the third matching index to obtain a weighted accumulated value; S32. Normalize the weighted accumulated value to obtain the abnormality index.

5. A network communication abnormal user identification device, characterized in that: It includes a processor and memory; The memory stores executable instructions of the processor; The processor is configured to execute the steps of the method for identifying abnormal network communication users according to any one of claims 1 to 4 by executing the executable instructions.

6. A computer-readable storage medium, characterized in that: It is used to store a program, which implements the steps of the network communication abnormal user identification method according to any one of claims 1 to 4 when the program is executed.

Images