A fraud number identification method and device based on real-time call bill big data

Abstract

This application relates to a fraudulent number identification method based on real-time call bill big data. The method segments call bill data into time periods T, aligning with sample extraction, shortening the calculation scope, and reducing computing resource investment. By adding various suspicious and trusted knowledge bases to the calculation, the comprehensiveness of indicators is improved, reducing interference from legitimate promotional numbers. By using the probability distribution of indicator items across fraudulent numbers and across all numbers, the weights of each indicator and the overall degree of suspicion can be more quantitatively analyzed. This improves the efficiency and real-time nature of fraudulent number identification, achieving timely early warning with minimal computing resources. This method can reduce the incidence of fraud and prevent more people from being defrauded.

Description

Technical Field

[0001] The present application relates to the technical field of network communications, and in particular to a method and device for identifying fraudulent numbers based on real-time call bill big data. Background Art

[0002] Telecom fraud involves making numerous phone calls promoting attractive products and services, such as credit loans and shopping refunds, to initially identify victims. Further inducement is then used to achieve the fraudulent intent. Telephone promotion is a common method and a key component of telecom fraud. Combating fraudulent promotion numbers is an effective measure to curb the range of scams that rely on this method. The most common approach involves analyzing call records to identify suspicious numbers, conducting further investigation and confirmation, and then conducting offline surveillance and arrests based on their location. After years of crackdowns by law enforcement agencies nationwide, these operators have become more sophisticated, evading enforcement abroad or hiding in remote mountainous areas, making countermeasures more difficult. Therefore, the most direct and effective approach is to quickly identify the numbers, immediately restrict their calls, and halt their external communications. Detecting these numbers more quickly is crucial. Existing call record data analysis technologies typically analyze data over a period of time to identify patterns in certain types of call numbers. Although this requires offline computation, the daily data volume, in the billions, requires continuous analysis across various dimensions, consuming significant resources.

[0003] In reality, to avoid detection, scammers typically change their numbers every day or two. Therefore, even daily analysis is significantly delayed. By the time the analysis results are available, the scam may have already succeeded, or the number may have been abandoned to evade detection. Furthermore, the characteristics of these scam numbers are very similar to those used in legitimate advertising and promotional numbers, making it difficult to eliminate this interference. Summary of the Invention

[0004] In response to the above technical problems, this application proposes a fraud number identification method and device based on real-time call bill big data, in order to discover fraud numbers more quickly and ensure improved identification efficiency, thereby reducing the crime rate and preventing more people from being defrauded.

[0005] First, this application proposes a fraud number identification method based on real-time call bill big data, comprising the following steps:

[0006] S1: Establish a big data knowledge base for call records;

[0007] S2: Access the call bill data and use the call bill big data knowledge base to determine whether the accessed call bill data is on the whitelist. If so, execute S8; otherwise, execute S3;

[0008] S3: Pre-statistics of conversation data by time segmentation;

[0009] S4: Filter data that exceeds the boundary;

[0010] S5: Calculate the suspicious weight value of each behavior indicator of the current access number: Q(x) = P(x) / G(x);

[0011] For constant indicators:

[0012] P(x)=(Mp / Np);

[0013] G(x)=(Ma / Na);

[0014] Among them, Mp represents the number of fraudulent numbers that meet the conditions, Np represents the number of fraudulent numbers, Ma represents the number of all numbers that meet the conditions, and Na represents the number of all numbers;

[0015] For non-constant indicators:

[0016]

[0017]

[0018] Where x1 represents the indicator value -1, x2 represents the indicator value +1, μ1 represents the mathematical expectation of the indicator in the fraudulent numbers, σ1 represents the variance of the indicator in the fraudulent numbers, μ2 represents the mathematical expectation of the indicator in all numbers, and σ2 represents the variance of the indicator in all numbers.

[0019] S6: Add up the weights of each indicator to get the total suspiciousness:

[0020] S7: Using the total suspiciousness level to identify and verify the suspicious number, and iteratively updating the big data knowledge base based on the identification and verification results;

[0021] S8: End recognition.

[0022] By adopting the above technical solution, the present application provides a fraudulent number identification method based on real-time call bill big data. By segmenting call bill data by time period T, the method complies with sample extraction, shortens the calculation scope, and reduces computing resource investment. By adding various suspicious and trusted knowledge bases for calculation, the comprehensiveness of indicators is improved, reducing interference from legitimate promotional numbers. By using the probability distribution of indicator items in fraudulent numbers / the probability distribution of all numbers, the weight of each indicator and the overall suspicion level can be more quantitatively analyzed. This improves the efficiency and real-time nature of fraudulent number identification, achieving the goal of timely early warning with less computing resources. This can reduce the incidence of fraud and prevent more people from being defrauded.

[0023] Preferably, the call bill big data knowledge base in S1 includes:

[0024] Historical fraud number database, storing the set S of identified fraud numbers;

[0025] Suspicious base station database, storing the set ST of base stations where identified fraud numbers have appeared;

[0026] Suspicious IMEI database, storing the set R of IMEIs associated with identified fraud numbers;

[0027] Normal marketing promotion number database, storing the identified normal marketing promotion numbers, and summarizing to form the set W of reliable numbers;

[0028] Normal marketing promotion base station database, storing the base stations where identified normal marketing promotion numbers have appeared,

[0029] Summarizing to form the set WT of reliable base stations.

[0030] Preferably, the S3 specifically includes:

[0031] Storing the first call time T0 of each number every day, and calculating the T-period record of this number using T0:

[0032] Ts = (Math.floor(Tx – T0) / T)*T + T0;

[0033] Te = Ts + T;

[0034] Where, Ts represents the start time of the T period, and Te represents the end time of the T period.

[0035] Preferably, the data exceeding the boundary in the S4 specifically includes:

[0036] Call times < MIN(Call times of known fraud numbers) / 2;

[0037] Called times > MAX(Called times of known fraud numbers)*2.

[0038] Preferably, the constant metrics in the S5 include shared IMEI, located at suspicious base stations, and located at reliable base stations.

[0039] Preferably, the non-constant metrics in the S5 include total communication times, frequent calling, call object dispersion, call number attribution dispersion, unchanged base station location, and recent activity.

[0040] Preferably, the S7 specifically includes: sorting the suspicious numbers from high to low by total suspicion, calling the suspicious numbers to verify whether the suspicious numbers are fraudulent numbers; if confirmed to be fraudulent numbers, iteratively updating the data of the historical fraudulent number library, the suspicious base station library and the suspicious IMEI library; if confirmed to be a normal promotion number, iteratively updating the data of the normal marketing promotion number library and the normal marketing promotion base station library.

[0041] In a second aspect, the present application also proposes a fraud number identification device based on real-time call bill big data, characterized in that the device includes:

[0042] A call record big data knowledge base module is configured to establish a call record big data knowledge base;

[0043] The call bill data access module is configured to access the call bill data and use the call bill big data knowledge base to determine whether the accessed call bill data is on the whitelist;

[0044] The time segmentation pre-statistics module is configured to perform time segmentation pre-statistics on the conversation order data;

[0045] A boundary data filtering module configured to filter data exceeding a boundary;

[0046] A suspicion calculation module is configured to calculate the suspicion weight value of each behavior indicator of the current access number: Q(x)=P(x) / G(x);

[0047] For constant indicators:

[0048] P(x)=(Mp / Np);

[0049] G(x)=(Ma / Na);

[0050] Among them, Mp represents the number of fraudulent numbers that meet the conditions, Np represents the number of fraudulent numbers, Ma represents the number of all numbers that meet the conditions, and Na represents the number of all numbers;

[0051] For non-constant indicators:

[0052]

[0053]

[0054] Where x1 represents the indicator value -1, x2 represents the indicator value +1, μ1 represents the mathematical expectation of the indicator in the fraudulent numbers, σ1 represents the variance of the indicator in the fraudulent numbers, μ2 represents the mathematical expectation of the indicator in all numbers, and σ2 represents the variance of the indicator in all numbers.

[0055] The suspicion calculation module is also used to accumulate the weights of each indicator to obtain the total suspicion:

[0056]

[0057] The identification and verification module is configured to use the total suspiciousness to identify and verify the suspicious number, and iteratively update the big data knowledge base based on the identification and verification results.

[0058] In a third aspect, the present application further proposes an electronic device, comprising:

[0059] one or more processors;

[0060] a storage device for storing one or more programs;

[0061] When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to the first aspect.

[0062] In a fourth aspect, the present application further proposes a computer-readable storage medium having a computer program stored thereon, which implements the method described in the first aspect when the program is executed by a processor.

[0063] In summary, this application has at least the following beneficial technical effects:

[0064] 1. The conversation data is divided into time periods T, which is consistent with sample extraction, shortens the calculation scope, and reduces computing resource investment;

[0065] 2. Increase the calculation of various suspicious and credible knowledge bases to improve the comprehensiveness of indicators and reduce the interference of normal promotion numbers;

[0066] 3. Use the probability distribution of indicators in fraudulent numbers / the probability distribution of all numbers to more quantitatively analyze the weight of each indicator and the overall suspicion level;

[0067] 4. It improves the efficiency and real-time performance of fraud number identification, achieves timely warning with less computing resources, reduces the crime rate, and prevents more people from being defrauded. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and, together with the description, serve to explain the principles of the present application. Other embodiments and many of the expected advantages of the embodiments will be readily apparent as they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with respect to each other. Like reference numerals designate corresponding similar parts.

[0069] Figure 1 This is a flowchart of a fraud number identification method based on real-time call bill big data in this application.

[0070] Figure 2 This is a schematic diagram of a specific embodiment of a fraud number identification method based on real-time call bill big data that can be applied to the present application.

[0071] Figure 3 This is a schematic diagram of the module structure of a fraud number identification device based on real-time call bill big data in one embodiment of the present application.

[0072] Figure 4 It is a structural diagram of a computer system suitable for implementing the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0073] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0074] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0075] Figure 1 The following is a flowchart of a fraud number identification method based on real-time call bill big data. Figure 2 A schematic diagram showing a specific embodiment of a fraud number identification method based on real-time call bill big data that can be applied to this application is shown. Figure 1 and Figure 2 , the method specifically comprises the following steps:

[0076] S1: Establish a big data knowledge base for call records;

[0077] The call record big data knowledge base in S1 includes:

[0078] Historical fraud number database, storing the confirmed fraud number set S;

[0079] Suspicious base station database, which stores the base stations where confirmed fraudulent numbers have appeared as ST;

[0080] Suspicious IMEI database, which stores the IMEI set R associated with confirmed fraudulent numbers;

[0081] Normal marketing promotion number database, which stores confirmed normal marketing promotion numbers and aggregates them into a trusted number set W;

[0082] The normal marketing promotion base station database stores the base stations where the confirmed normal marketing promotion numbers have appeared, and aggregates them into a trusted base station set called WT.

[0083] S2: Access the call record data, and use the call record big data knowledge base to determine whether the accessed call record data is in the whitelist. If so, execute S8; otherwise, execute S3.

[0084] S3: Perform pre-statistics on the call record data by time period segmentation.

[0085] The specific steps of S3 include:

[0086] Store the first call time T0 of each number every day, and calculate the T-period record of this number using T0:

[0087] Ts = (Math.floor(Tx – T0) / T)*T + T0;

[0088] Te = Ts + T;

[0089] Among them, Ts represents the start time of the T period, and Te represents the end time of the T period.

[0090] S4: Filter the data that exceeds the boundary.

[0091] The data that exceeds the boundary in S4 specifically includes:

[0092] The number of calls < MIN(the number of calls of known fraud numbers) / 2;

[0093] The number of called times > MAX(the number of called times of known fraud numbers)*2.

[0094] S5: Calculate the suspicious weight value Q(x) of each behavior index of the currently accessed number: Q(x) = P(x) / G(x);

[0095] For the constant index:

[0096] P(x) = (Mp / Np);

[0097] G(x) = (Ma / Na);

[0098] Among them, Mp represents the number of fraud numbers that meet the conditions, Np represents the number of fraud numbers, Ma represents the number of all numbers that meet the conditions, and Na represents the number of all numbers;

[0099] For the non-constant index:

[0100]

[0101]

[0102] Where x1 represents the indicator value -1, x2 represents the indicator value +1, μ1 represents the mathematical expectation of the indicator in the fraudulent numbers, σ1 represents the variance of the indicator in the fraudulent numbers, μ2 represents the mathematical expectation of the indicator in all numbers, and σ2 represents the variance of the indicator in all numbers.

[0103] The constant indicators in S5 include shared IMEI, location at a suspicious base station, and location at a trusted base station. The non-constant indicators in S5 include total number of calls, calling frequency, call destination dispersion, call number location dispersion, base station location stability, and recent activity.

[0104] S6: Add up the weights of each indicator to get the total suspiciousness:

[0105] S7: Using the total suspiciousness level to identify and verify the suspicious number, and iteratively updating the big data knowledge base based on the identification and verification results;

[0106] The S7 specifically includes: sorting the suspicious numbers from high to low by the overall suspicion, calling the suspicious numbers to verify whether the suspicious numbers are fraudulent numbers, and if it is confirmed to be a fraudulent number, iteratively updating the data of the historical fraudulent number database, the suspicious base station database, and the suspicious IMEI database; if it is confirmed to be a normal promotion number, iteratively updating the data of the normal marketing promotion number database and the normal marketing promotion base station database.

[0107] S8: End recognition.

[0108] In a specific embodiment, the following is a detailed description of a method for deep recovery of vehicle driving recorder data disclosed in this application:

[0109] The implementation process of this embodiment can be as follows:

[0110] 1) Establish a big data knowledge base for call records. Use big data to calculate the probability distribution of behavioral characteristics of historically suspicious numbers, eliminate interference from legitimate marketing numbers, and improve identification efficiency. The big data knowledge base for call records specifically includes:

[0111] Historical fraud number database: stores a set S of confirmed fraud numbers.

[0112] Suspicious base station database: stores the base station collection where confirmed fraudulent numbers have appeared as ST.

[0113] Suspicious IMEI database: stores the IMEI set R associated with confirmed fraudulent numbers.

[0114] Normal marketing promotion number database: stores confirmed normal marketing promotion numbers and aggregates them into a trusted number set W.

[0115] Normal marketing promotion base station library: stores the base stations where the confirmed normal marketing promotion numbers have appeared, and aggregates them into a trusted base station set called WT.

[0116] 2) Aggregate and manage data. Access real-time data, record the time of the first incoming call from each number, and aggregate and store the behavioral characteristics of the data by fixed time period (e.g., 1 hour).

[0117] In this embodiment, the managed data is mainly real-time mobile phone data. After filtering the numbers in the normal marketing promotion number library W, it is aggregated and managed into a call bill T period statistical information resource library based on the characteristics of fraudulent behavior.

[0118] Call record statistics for time period T. During data management, caller numbers are pre-counted by time period, as shown in Table 1.

[0119] The time period T is fixed, that is, the start time and the end time always differ by T (e.g., 1 hour). Pre-statistical behavioral characteristics include the number of calls, the number of callers and callees, the first occurrence time, the last occurrence time, etc.

[0120]

[0121]

[0122] When the daily data starts to aggregate, the first call time T0 of each number needs to be stored in the cache to calculate the subsequent T-period records for that number. At the same time, a T-period statistical record is generated for the first record. The start time Ts = T0, and the end time Te = T0 + T (e.g., 1 hour). Then, for the subsequent call data call time Tx, the start time Ts and end time Te of the period to which it belongs can be calculated using the formula:

[0123] Ts=(Math.floor(Tx–T0) / T)*T+T0;

[0124] Te=Ts+T=(Math.floor(Tx–T0) / T)*T+T0+T;

[0125] First, calculate the difference between the current recorded call time and the first call time of each day, T0. Divide and round the difference to determine the span of the time period, and then add T0 to determine the start time, Ts, of the time period. For example, if a number's first call occurred at 8:40 a.m. on a given day, and the time period T = 1 hour, then T0 = 8:40. Therefore, the start time, Ts, of the first T-period statistics record will be 8:40, and the end time, Te, of the record will be 9:40. All call records from 8:40 to 9:40 that day will be included in the first T-period statistics record. Call records from 9:40 to 10:40 will be included in the second T-period statistics record for that number. This process continues in the same manner for all subsequent call records.

[0126] After determining the T time period for each call record, each indicator item can be pre-statisticed. For example, the number of calls, the number of calls received, and the total number of calls can be continuously accumulated. The other party's number, the other party's location, the call base station, and the associated IMEI can also be sorted and merged into the corresponding fields.

[0127] The advantage of this split pre-statistics approach is that analysis and statistics can be performed immediately after the fixed period T ends. For example, if the first record for a certain number ends at 9:40, the scheduled task can immediately perform subsequent statistics on this record after 9:40, providing high timeliness. Furthermore, the entire T period is covered, providing sufficient sample analysis and preventing errors caused by a short time period. This allows for the goal of "finding problems as soon as they emerge."

[0128] 3) Comprehensive Analysis: Regularly process the data for each completed fixed period, calculate the suspicious weight value of each behavioral characteristic of the current access number based on the probability distribution of the behavioral characteristics of historical suspicious numbers, and determine the suspicion level.

[0129] Model behavior law definition:

[0130] N imei :The number of times the fraudsters’ mobile phone numbers share imei.

[0131] N calling : The cumulative number of calls within time period T.

[0132] N called : The cumulative number of called calls within time period T.

[0133] N call : The cumulative number of calls within time period T.

[0134] N st : Cumulative number of active base stations.

[0135] N fac :The number of locations where the other party’s number belongs.

[0136] N fd : The other party’s number.

[0137] F st : Whether it appears near the suspicious base station.

[0138] F imei : Whether to share the IMEI of the suspicious number.

[0139] During the real-time call record access process, starting from the call time when the number first comes in, and then using the fixed time period T as the cut-off point, pre-statistics the call record information for the T time period.

[0140] Filter data that exceeds the boundary too much, reduce the computational workload, and do not analyze data that meets the following conditions:

[0141] Number of calls < MIN(number of calls of known fraud numbers) / 2;

[0142] Number of called times > MAX(number of called times of known fraud numbers)*2;

[0143] By calculating the behavioral patterns of the model, calculate the proportional values of each condition. The index items are shown in the following table:

[0144] [[ID=2,7]]

[0145] To facilitate the calculation of various non-constant indicators, such as: total number of communications, frequency of calling the main party, dispersion of calling the other party, etc. In the case of limited samples, prevent a lack of sufficient data volume in a certain numerical interval from affecting the result calculation. By fitting the data into a normal distribution function f(x) with a mathematical expectation of μ and a variance of σ2, the formula for the curve density function is denoted as:

[0146]

[0147] Fit the existing data to obtain the normal distributions of each indicator for fraud numbers and all numbers. Calculate the distribution probability P(x) of the index item x in the fraud number distribution and the distribution probability G(x) in all numbers, and the weight can be calculated: Q(x) = P(x) / G(x).

[0148] For non-constant indicators:

[0149]

[0150]

[0151] Among them, x1 represents the index item value -1, x2 represents the index item value +1, μ1 represents the mathematical expectation of the index item in the fraud number, σ1 represents the variance of the index item in the fraud number, μ2 represents the mathematical expectation of the index item in all numbers, and σ2 represents the variance of the index item in all numbers.

[0152] Normal distribution is to calculate interval probability. For the convenience of calculation, when we calculate the probability distribution of a certain value, we calculate the interval probability of adding or subtracting 1 before and after the value. For example, the total number of calls of a number in period T is 30, then the probability of calculating this indicator in the fraudulent number can be P(29 <x<31)。

[0153] For example, if the probability of a call number of 30 during time period T being a fraudulent number is 20%, and the probability of its distribution among all numbers is 4%, then the weight Q = 20% ÷ 4% = 5, so this number is more likely to be a fraudulent number.

[0154] For the constant indicators, including shared IMEI, located at a suspicious base station, and located at a trusted base station, the weights are calculated as follows:

[0155] Q(x)=P(x) / G(x)=(Mp / Np) / (Ma / Na);

[0156] Mp: number of fraud numbers that meet the conditions;

[0157] Np: number of fraudulent numbers;

[0158] Ma: the number of all numbers that meet the conditions;

[0159] Na: total number of numbers;

[0160] The total suspiciousness is obtained by adding up the weights of each indicator:

[0161] In practice, by ranking suspicious numbers from highest to lowest suspicion, we can verify whether they are fraudulent. If a number is confirmed to be fraudulent, we then use this data to improve the database of historical fraudulent numbers, the database of suspicious base stations, and the database of trusted base stations. If a number is confirmed to be legitimate, we then improve the database of legitimate marketing numbers and base stations. By continuously iterating the model's behavioral characteristics, we can calculate more accurate indicators for the distribution probability P(x) of fraudulent numbers and the distribution probability G(x) of all numbers, forming a closed loop.

[0162] This application utilizes a knowledge base, rule extraction, and big data technologies to analyze fraudulent numbers in detail using a comprehensive analytical model. The rule calculation, threshold setting, and iterative calculation within the analytical model provide excellent analytical results, improving law enforcement efficiency. This application not only analyzes individual fraudulent numbers but also leverages the accumulated knowledge base for other, more significant functions, such as managing key areas. Furthermore, the invention relies solely on real-time call records, requiring relatively few computing resources. This makes it suitable for widespread adoption by diverse users.

[0163] To sum up, the present application includes at least the following beneficial technical effects: 1. The conversation data is cut according to the time period T, which is in line with the sample extraction, shortens the calculation range, and reduces the input of computing resources; 2. The calculation of various types of suspicious and credible knowledge bases is increased, the comprehensiveness of the indicators is improved, and the interference of normal promotion numbers is reduced; 3. The probability distribution of indicator items in fraudulent numbers / the probability distribution of all numbers is used to more quantitatively analyze the weight of each indicator and the total suspicion; 4. The efficiency and real-time performance of fraudulent number identification are improved, and the purpose of timely warning is achieved with smaller computing resources, which can reduce the crime rate and prevent more people from being defrauded.

[0164] Further references Figure 3 As an implementation of the above-mentioned method, the present application provides an embodiment of a fraud number identification device based on real-time call bill big data. Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0165] refer to Figure 3 , a fraud number identification device based on real-time call bill big data, comprising:

[0166] The call record big data knowledge base module 101 is configured to establish a call record big data knowledge base;

[0167] The call bill data access module 102 is configured to access the call bill data and use the call bill big data knowledge base to determine whether the accessed call bill data is on the whitelist;

[0168] The time segmentation pre-statistics module 103 is configured to perform time segmentation pre-statistics on the call order data;

[0169] a boundary data filtering module 104 configured to filter data exceeding a boundary;

[0170] The suspicion calculation module 105 is configured to calculate the suspicion weight value of each behavior indicator of the current access number: Q(x)=P(x) / G(x);

[0171] For constant indicators:

[0172] P(x)=(Mp / Np);

[0173] G(x)=(Ma / Na);

[0174] Among them, Mp represents the number of fraudulent numbers that meet the conditions, Np represents the number of fraudulent numbers, Ma represents the number of all numbers that meet the conditions, and Na represents the number of all numbers;

[0175] For non-constant indicators:

[0176]

[0177]

[0178] Where x1 represents the indicator value -1, x2 represents the indicator value +1, μ1 represents the mathematical expectation of the indicator in the fraudulent numbers, σ1 represents the variance of the indicator in the fraudulent numbers, μ2 represents the mathematical expectation of the indicator in all numbers, and σ2 represents the variance of the indicator in all numbers.

[0179] The suspicion calculation module 105 is further configured to accumulate the weights of the indicators to obtain a total suspicion:

[0180]

[0181] The identification and verification module 106 is configured to use the total suspiciousness to identify and verify the suspicious number, and iteratively update the big data knowledge base according to the identification and verification results.

[0182] Reference below Figure 4 , which shows a structural diagram of a computer system 200 suitable for implementing an electronic device of an embodiment of the present application. Figure 4 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0183] like Figure 4 As shown, the computer system 200 includes a central processing unit (CPU) 201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 202 or a program loaded from a storage unit 208 into a random access memory (RAM) 203. Various programs and data required for the operation of the system 200 are also stored in the RAM 203. The CPU 201, the ROM 202, and the RAM 203 are connected to each other via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0184] The following components are connected to the I / O interface 205: an input section 206 including a keyboard, a mouse, and the like; an output section 207 including a liquid crystal display (LCD) and speakers; a storage section 208 including a hard disk; and a communication section 209 including a network interface card such as a LAN card or a modem. The communication section 209 performs communication processing via a network such as the Internet. A drive 220 is also connected to the I / O interface 205 as needed. A removable medium 211, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 220 as needed, so that a computer program read therefrom can be installed in the storage section 208 as needed.

[0185] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 209, and / or installed from a removable medium 211. When the computer program is executed by the central processing unit (CPU) 201, the above-mentioned functions defined in the method of the present application are performed.

[0186] As another aspect, the present application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed by the electronic device, the electronic device implements the following when executing. Figure 1 The method shown in .

[0187] It should be noted that the computer-readable storage medium described in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, or any suitable combination thereof.

[0188] Computer program code for performing the operations of the present application can be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0189] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0190] The above describes the specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0191] In the description of this application, it should be understood that the terms "upper", "lower", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limiting this application. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The simple fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used for improvement. Any reference signs in the claims should not be interpreted as limiting the scope.

Claims

1. A fraud number identification method based on real-time call bill big data, characterized by: The method includes the following steps: S1: Establish a call record big data knowledge base; S2: Access call record data, and use the call record big data knowledge base to determine whether the accessed call record data is in the whitelist. If so, execute S8; otherwise, execute S3; S3: Perform pre-statistics on time period segmentation of call record data; S4: Filter data exceeding the boundary; S5: Calculate the suspicious weight value Q(x) of each behavior index of the currently accessed number: Q(x) = P(x) / G(x); where the constant indexes include shared IMEI, located at suspicious base stations, and located at trusted base stations; the non-constant indexes include the total number of communications, frequent calling, call object dispersion, call number attribution dispersion, unchanged base station location, and recent activity; For the constant indexes: P(x) = (Mp / Np); G(x) = (Ma / Na); where Mp represents the number of fraud numbers satisfying the conditions, Np represents the number of fraud numbers, Ma represents the number of all numbers satisfying the conditions, and Na represents the number of all numbers; For the non-constant indexes: where x1 represents the index item value -1, x2 represents the index item value +1, μ1 represents the mathematical expectation of the index item in fraud numbers, σ1 represents the variance of the index item in fraud numbers, μ2 represents the mathematical expectation of the index item in all numbers, and σ2 represents the variance of the index item in all numbers; S6: Add up the weights of each indicator to get the total suspiciousness: S7: Use the total suspiciousness to identify and verify suspicious numbers, and perform data iterative update on the big data knowledge base according to the identification and verification results; S8: End the identification.

2. The method for identifying fraudulent numbers based on real-time call bill big data according to claim 1, characterized in that: The call record big data knowledge base in S1 includes: Historical fraud number library, storing the set S of determined fraud numbers; Suspicious base station library, storing the set ST of base stations where determined fraud numbers have appeared; Suspicious IMEI library, storing the set R of IMEIs associated with determined fraud numbers; Normal marketing promotion number library, storing determined normal marketing promotion numbers, and summarizing to form a set of reliable numbers W; Normal marketing promotion base station library, storing base stations where determined normal marketing promotion numbers have appeared, and summarizing to form a set of trusted base stations WT.

3. The fraudulent number identification method based on real-time call bill big data according to claim 1 is characterized by: S3 specifically includes: Store the first call time T0 of each number every day, and use T0 to calculate the T time period record of this number: Ts = (Math.floor(Tx – T0) / T)*T + T0; Te = Ts + T; where Ts represents the start time of the T time period, and Te represents the end time of the T time period.

4. The method for identifying fraudulent numbers based on real-time call bill big data according to claim 3, characterized in that: The data exceeding the boundary in S4 specifically includes: Number of calls < MIN(number of calls of known fraud numbers) / 2; Number of called times > MAX(number of called times of known fraud numbers)*2.

5. The method for identifying fraudulent numbers based on real-time call bill big data according to claim 1, characterized in that: S7 specifically includes: Sort in descending order according to the total suspiciousness, make a call to the suspicious number to verify whether the suspicious number is a fraud number. If it is confirmed as a fraud number, perform iterative update on the data in the historical fraud number library, suspicious base station library, and suspicious IMEI library. If it is confirmed as a normal promotion number, perform iterative update on the data in the normal marketing promotion number library and normal marketing promotion base station library.

6. A fraud number identification device based on real-time call bill big data, characterized by: Including the method according to any one of claims 1-5, the device includes: A call record big data knowledge base module is configured to establish a call record big data knowledge base; The call bill data access module is configured to access the call bill data and use the call bill big data knowledge base to determine whether the accessed call bill data is on the whitelist; The time segmentation pre-statistics module is configured to perform time segmentation pre-statistics on the conversation order data; A boundary data filtering module configured to filter data exceeding a boundary; A suspicion calculation module is configured to calculate the suspicion weight value of each behavior indicator of the current access number: Q(x)=P(x) / G(x); For constant indicators: P(x)=(Mp / Np); G(x)=(Ma / Na); Among them, Mp represents the number of fraudulent numbers that meet the conditions, Np represents the number of fraudulent numbers, Ma represents the number of all numbers that meet the conditions, and Na represents the number of all numbers; For non-constant indicators: Where x1 represents the indicator value -1, x2 represents the indicator value +1, μ1 represents the mathematical expectation of the indicator in the fraudulent numbers, σ1 represents the variance of the indicator in the fraudulent numbers, μ2 represents the mathematical expectation of the indicator in all numbers, and σ2 represents the variance of the indicator in all numbers. The suspicion calculation module is also used to accumulate the weights of each indicator to obtain the total suspicion: The identification and verification module is configured to use the total suspiciousness to identify and verify the suspicious number, and iteratively update the big data knowledge base based on the identification and verification results.

7. An electronic device comprising: one or more processors; a storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images