Abnormal communication operation behavior area identification method, device, equipment and medium

Abstract

The present application discloses a method, device, equipment and medium for identifying an abnormal communication operation behavior area, including: obtaining call time information of a mobile phone card number suspected of abnormal communication operation behavior and location information of a base station to which it belongs; expanding the call time range based on the call time information to obtain a target call detection time range, and expanding the base station location range based on the base station location information to obtain a target call detection location range; obtaining a target calling mobile phone card number and a corresponding target called mobile phone card number whose call start time is within the target call detection time range and within the target call detection location range; determining a regional feature value based on the target calling mobile phone card number feature and the target called mobile phone card number feature, and determining the confidence of each regional feature; if it is determined that each regional feature value and the total confidence of the regional feature meet a preset condition, locating the target abnormal communication operation behavior area based on the location information of the base station to which the mobile phone card number of the target abnormal communication operation behavior belongs.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, equipment and medium for identifying an abnormal communication operation behavior area. Background Art

[0002] In the related art, a typical application of abnormal communication operation behavior is telecommunications fraud, such as telephone fraud based on GOIP (GSM Over Internet Protocol, IP-based global mobile communication system) equipment. GOIP equipment is a virtual dialing device and a new type of fraud tool commonly used by fraudsters. GOIP equipment is a hardware device for network communication that can convert traditional telephone signals into network signals. One GOIP device can be used for hundreds of SIM cards (Subscriber Identity Module) to operate simultaneously. It has functions such as batch calls, group text messages, remote control, and card-machine separation. Criminals can remotely control domestic SIM cards through domestic GOIP devices abroad to commit telecommunications fraud. At present, a typical application of GOIP equipment is the "cat pool" device. "Cat pool" equipment fraud is gradually becoming the main fraud method used by fraudsters, seriously infringing on the property safety of users. The commonly used portable "cat pool" device is to connect two ordinary mobile phones in series through an audio conversion line, and install a remote control APP (Application) on the mobile phone. By remotely controlling the mobile phone to make fraud calls, the person who implements the fraud call and the crime device can be separated.

[0003] As GOIP devices become more portable and concealed, and GOIP devices can be used to switch mobile phone numbers at will to call the victim, it is impossible to accurately locate the GOIP fraud area, that is, the area of ​​abnormal communication operation behavior. Summary of the invention

[0004] In order to solve the problem in the prior art that it is impossible to accurately locate the position of the abnormal communication operation behavior area, the embodiments of the present application provide a method, device, equipment and medium for identifying the abnormal communication operation behavior area.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying an abnormal communication operation behavior area, comprising:

[0006] For each mobile phone card number suspected of abnormal communication operation behavior in the phone number blacklist, obtain the call time information of the mobile phone card number suspected of abnormal communication operation behavior and the location information of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs;

[0007] Expanding the call time range based on the call time information to obtain a target call detection time range, and expanding the base station location range based on the base station location information to obtain a target call detection location range;

[0008] Obtaining a target calling mobile phone card number whose call start time is within the target call detection time range and within the target call detection location range, and a corresponding target called mobile phone card number called by the target calling mobile phone card number, wherein the target calling mobile phone card number includes the mobile phone card number of the suspected abnormal communication operation behavior;

[0009] Determine a regional feature value based on the target calling phone card number feature and the target called phone card number feature, and determine the confidence level of each regional feature, wherein the regional feature represents a factor for identifying a fraud area;

[0010] If it is determined that each regional feature value and the total regional feature confidence meet the preset conditions, the target calling mobile phone card number is determined to be the target abnormal communication operation behavior mobile phone card number, and the target abnormal communication operation behavior area is located based on the location information of the base station to which the target abnormal communication operation behavior mobile phone card number belongs.

[0011] In a possible implementation, determining the confidence level of each regional feature specifically includes:

[0012] The confidence level of each regional feature is determined according to the regional feature value, the preset regional feature reference value, and the ratio of the preset regional feature reference value.

[0013] In a possible implementation manner, the call time information of the mobile phone card number of the suspected abnormal communication operation behavior includes the call start time of the mobile phone card number of the suspected abnormal communication operation behavior and the call end time of the mobile phone card number of the suspected abnormal communication operation behavior;

[0014] Expanding the call time range based on the call time information to obtain a target call detection time range specifically includes:

[0015] Subtract the first preset duration from the call start time of the mobile phone number of the suspected abnormal communication operation behavior to obtain the target call detection start time;

[0016] Add the second preset time to the call end time of the mobile phone number with the suspected abnormal communication operation behavior to obtain the target call detection end time;

[0017] The time range between the target call detection start time and the target call detection end time is determined as the target call detection time range.

[0018] In a possible implementation manner, the location information of the base station to which the mobile phone number of the suspected abnormal communication operation behavior belongs includes the longitude information and latitude information of the base station;

[0019] Expanding the base station location range based on the location information of the base station to obtain a target call detection location range specifically includes:

[0020] Determining an expanded longitude range based on the longitude information and the latitude information;

[0021] Determine an expanded latitude range based on the latitude information;

[0022] The target call detection position range is determined according to the expanded longitude range and the expanded latitude range.

[0023] In a possible implementation, determining the expanded longitude range based on the longitude information and the latitude information specifically includes:

[0024] The starting longitude of the expanded longitude range is calculated by the following formula:

[0025]

[0026] Wherein, A1 represents the starting longitude of the expanded longitude range;

[0027] a represents the longitude information;

[0028] b represents the latitude information;

[0029] The end longitude of the extended longitude range is calculated by the following formula:

[0030]

[0031] Among them, A2 represents the end longitude of the expanded longitude range.

[0032] In a possible implementation, determining the expanded latitude range based on the latitude information specifically includes:

[0033] The starting latitude of the expanded dimensional range is calculated by the following formula:

[0034]

[0035] Wherein, B1 represents the starting latitude of the expanded latitude range;

[0036] b represents the latitude information;

[0037] The end latitude of the expanded dimensional range is calculated by the following formula:

[0038]

[0039] Among them, B2 represents the end latitude of the expanded latitude range.

[0040] In a possible implementation, the target calling mobile phone card number feature includes the International Mobile Equipment Identity (IMEI) corresponding to the target calling mobile phone card number, and the target called mobile phone card number feature includes the usage location identifier corresponding to the target called mobile phone card number;

[0041] The regional feature value is determined based on the target calling phone card number feature and the target called phone card number feature, specifically including:

[0042] Determine the number of usage location identifiers corresponding to all target called mobile phone card numbers as the first regional characteristic value;

[0043] Determine the number of all target called mobile phone numbers as the second area characteristic value;

[0044] Determine the number of all target calling mobile phone numbers as the third area characteristic value;

[0045] The maximum value of the number of IMEIs corresponding to each target calling mobile phone card number is determined as the fourth area characteristic value.

[0046] In a possible implementation manner, the confidence level of each regional feature is determined according to the regional feature value, the preset regional feature reference value, and the ratio of the preset regional feature reference value, specifically including:

[0047] The confidence of the feature of the i-th region is calculated by the following formula:

[0048]

[0049] Among them, ρ i represents the confidence of the feature of the i-th region;

[0050] p i represents the characteristic value of the i-th region;

[0051] o i represents the characteristic reference value of the i-th preset area;

[0052] w i Indicates the proportion of characteristic benchmark values ​​in the i-th region.

[0053] In a possible implementation, if it is determined that each regional feature value and the regional feature total confidence meet a preset condition, then determining the suspected abnormal communication operation behavior mobile phone card number as the target abnormal communication operation behavior mobile phone card number specifically includes:

[0054] If it is determined that each of the regional characteristic values ​​is greater than or equal to the corresponding set reference value, and the total confidence of the regional characteristics is greater than the total confidence of the set reference value, then the target calling mobile phone card number is determined to be the target abnormal communication operation behavior mobile phone card number.

[0055] In a second aspect, an embodiment of the present application provides a device for identifying an abnormal communication operation behavior area, comprising:

[0056] The first acquisition unit is used to acquire, for each mobile phone card number suspected of abnormal communication operation behavior in the telephone number blacklist, the call time information of the mobile phone card number suspected of abnormal communication operation behavior and the location information of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs;

[0057] An expansion unit, configured to expand a call time range based on the call time information to obtain a target call detection time range, and to expand a base station location range based on the location information of the base station to obtain a target call detection location range;

[0058] A second acquisition unit is used to acquire a target calling mobile phone card number whose call start time is within the target call detection time range and within the target call detection location range, and a corresponding target called mobile phone card number called by the target calling mobile phone card number, wherein the target calling mobile phone card number includes the mobile phone card number of the suspected abnormal communication operation behavior;

[0059] A determination unit, used to determine a regional feature value based on a target calling mobile phone card number feature and a target called mobile phone card number feature, and determine a confidence level of each regional feature, wherein the regional feature represents a factor for identifying a fraudulent area;

[0060] A positioning unit is used to determine that the target calling mobile phone card number is the target abnormal communication operation behavior mobile phone card number if it is determined that each regional feature value and the total confidence of the regional features meet the preset conditions, and locate the target abnormal communication operation behavior area based on the location information of the base station to which the target abnormal communication operation behavior mobile phone card number belongs.

[0061] In a possible implementation manner, the determining unit is specifically configured to determine the confidence level of each regional feature according to the regional feature value, the preset regional feature reference value, and the ratio of the preset regional feature reference value.

[0062] In a possible implementation manner, the call time information of the mobile phone card number of the suspected abnormal communication operation behavior includes the call start time of the mobile phone card number of the suspected abnormal communication operation behavior and the call end time of the mobile phone card number of the suspected abnormal communication operation behavior;

[0063] The expansion unit is specifically used to subtract the first preset duration from the call start time of the mobile phone card number with the suspected abnormal communication operation behavior to obtain the target call detection start time; add the second preset duration to the call end time of the mobile phone card number with the suspected abnormal communication operation behavior to obtain the target call detection end time; and determine the time range between the target call detection start time and the target call detection end time as the target call detection time range.

[0064] In a possible implementation manner, the location information of the base station to which the mobile phone number of the suspected abnormal communication operation behavior belongs includes the longitude information and latitude information of the base station;

[0065] The expansion unit is specifically used to determine the expanded longitude range based on the longitude information and the latitude information; determine the expanded latitude range based on the latitude information; and determine the target call detection position range according to the expanded longitude range and the expanded latitude range.

[0066] In a possible implementation manner, the expansion unit is specifically configured to calculate the starting longitude of the expanded longitude range by using the following formula:

[0067]

[0068] Wherein, A1 represents the starting longitude of the expanded longitude range;

[0069] a represents the longitude information;

[0070] b represents the latitude information;

[0071] The end longitude of the extended longitude range is calculated by the following formula:

[0072]

[0073] Among them, A2 represents the end longitude of the expanded longitude range.

[0074] In a possible implementation manner, the expansion unit is specifically configured to calculate the starting latitude of the expanded dimensional range by using the following formula:

[0075]

[0076] Wherein, B1 represents the starting latitude of the expanded latitude range;

[0077] b represents the latitude information;

[0078] The end latitude of the expanded dimensional range is calculated by the following formula:

[0079]

[0080] Among them, B2 represents the end latitude of the expanded latitude range.

[0081] In a possible implementation, the target calling mobile phone card number feature includes the International Mobile Equipment Identity (IMEI) corresponding to the target calling mobile phone card number, and the target called mobile phone card number feature includes the usage location identifier corresponding to the target called mobile phone card number;

[0082] The determination unit is specifically used to determine the number of usage location identifiers corresponding to all target called mobile phone card numbers as the first regional characteristic value; determine the number of all target called mobile phone card numbers as the second regional characteristic value; determine the number of all target calling mobile phone card numbers as the third regional characteristic value; determine the maximum value of the number of IMEIs corresponding to each target calling mobile phone card number as the fourth regional characteristic value.

[0083] In a possible implementation manner, the determining unit is specifically configured to calculate the confidence of the i-th region feature by using the following formula:

[0084]

[0085] Among them, ρ i represents the confidence of the feature of the i-th region;

[0086] p i represents the characteristic value of the i-th region;

[0087] o i represents the characteristic reference value of the i-th preset area;

[0088] w i Indicates the proportion of characteristic benchmark values ​​in the i-th region.

[0089] In a possible implementation, the positioning unit is specifically used to determine that the target calling mobile phone card number is the target abnormal communication operation behavior mobile phone card number if it is determined that each regional characteristic value is greater than or equal to the corresponding set reference value, and the total confidence of the regional characteristics is greater than the total confidence of the set reference value.

[0090] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the method for identifying an abnormal communication operation behavior area described in the present application is implemented.

[0091] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the method for identifying an abnormal communication operation behavior area described in the present application.

[0092] The beneficial effects of this application are as follows:

[0093] The abnormal communication operation behavior area identification method, device, equipment and medium provided in the embodiments of the present application obtain, for each mobile phone card number suspected of abnormal communication operation behavior in the phone number blacklist, the call time information of the mobile phone card number suspected of abnormal communication operation behavior and the location information of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs, expand the call time range based on the call time information to obtain the target call detection time range, expand the base station location range based on the location information of the base station to obtain the target call detection location range, obtain the target caller mobile phone card number within the target call detection time range and within the target call detection location range, and the target caller mobile phone card number within the target call detection time range and within the target call detection location range. The corresponding target called mobile phone card number called by the calling mobile phone card number, wherein the target calling mobile phone card number includes the mobile phone card number of the suspected abnormal communication operation behavior, and the regional feature value is determined based on the characteristics of the target calling mobile phone card number and the target called mobile phone card number. The regional feature represents the factors used to identify the fraud area, and the confidence of each regional feature is determined. If it is determined that each regional feature value and the total confidence of the regional feature meet the preset conditions, then the target calling mobile phone card number is determined to be the mobile phone card number of the target abnormal communication operation behavior, and the target abnormal communication operation behavior area is located based on the location information of the base station to which the mobile phone card number of the target abnormal communication operation behavior belongs, that is, the location of the target abnormal communication operation behavior area. Compared with the prior art, the call time range of the mobile phone card number suspected of abnormal communication operation behavior in the call blacklist and the location range of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs are expanded, and the expanded call time range is used as the target call detection time range, and the location range of the expanded base station is used as the target call detection location range. Based on the two dimensions of time and space, a large number of historical call records in the time-space interval are analyzed, and regional feature analysis means can be used to more accurately determine whether the mobile phone card number suspected of abnormal communication operation behavior is a real mobile phone card number for abnormal communication operation behavior, and other mobile phone card numbers for abnormal communication operation behavior within the target detection location range can be more accurately and comprehensively screened out, thereby quickly and accurately locating the position of the abnormal communication operation behavior area. In addition, in the embodiment of the present application, the call time range of the mobile phone card number suspected of abnormal communication operation behavior and the location range of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs are expanded to a certain extent, so that the identification result is more accurate.

[0094] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0095] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0096] Figure 1 A schematic diagram of the implementation process of the abnormal communication operation behavior area identification method provided in the embodiment of the present application;

[0097] Figure 2 A schematic diagram of an implementation flow for determining a target call detection time range provided in an embodiment of the present application;

[0098] Figure 3 A schematic diagram of an implementation process for determining a target call detection location range provided in an embodiment of the present application;

[0099] Figure 4 An example of a regional feature analysis diagram corresponding to a suspected GOIP fraud mobile phone number provided in an embodiment of the present application;

[0100] Figure 5 A schematic diagram of the structure of a device for identifying abnormal communication operation behavior areas provided in an embodiment of the present application;

[0101] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0102] In order to solve the problem in the background technology, the embodiments of the present application provide a method, device, equipment and medium for identifying an abnormal communication operation behavior area.

[0103] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0104] The abnormal communication operation behavior area identification method provided in the embodiment of the present application can be executed on a server or on a terminal device with computing capabilities, and the embodiment of the present application is not limited to this.

[0105] The server can be an independent physical server or a cloud server that provides basic cloud computing services such as cloud servers, cloud databases, and cloud storage. The terminal device can be, but is not limited to, a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., and the embodiments of the present application do not limit this.

[0106] like Figure 1As shown, it is a schematic diagram of the implementation process of the abnormal communication operation behavior area identification method provided in an embodiment of the present application. The abnormal communication operation behavior area identification method may include the following steps:

[0107] S11. For each mobile phone card number suspected of abnormal communication operation behavior in the telephone number blacklist, obtain the call time information of the mobile phone card number suspected of abnormal communication operation behavior and the location information of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs.

[0108] During specific implementation, a telephone number blacklist can be stored in advance. The mobile phone card numbers included in the telephone number blacklist are mobile phone card numbers suspected of abnormal communication operation behaviors. In order to determine whether the mobile phone card number suspected of abnormal communication operation behaviors is a real mobile phone card number with abnormal communication operation behaviors, steps S11 to S15 are executed for each mobile phone card number suspected of abnormal communication operation behaviors in the telephone number blacklist, thereby more accurately identifying and locating the position of the abnormal communication operation behavior area.

[0109] The abnormal communication operation behavior in the embodiment of the present application is explained by taking GOIP fraud behavior as an example, and the mobile phone card number suspected of abnormal communication operation behavior is the suspected GOIP fraud mobile phone card number.

[0110] Specifically, for each suspected GOIP fraud mobile phone card number in the telephone number blacklist, the call time information of the suspected GOIP fraud mobile phone card number and the location information of the base station to which the suspected GOIP fraud mobile phone card number belongs are obtained, wherein the call time information of the suspected GOIP fraud mobile phone card number includes the call start time of the suspected GOIP fraud mobile phone card number and the call end time of the suspected GOIP fraud mobile phone card number, and the location information of the base station to which the suspected GOIP fraud mobile phone card number belongs includes the longitude information and latitude information of the base station. During implementation, the call start time and call end time of the suspected GOIP fraud mobile phone card number can be obtained from the operator, and the longitude information and latitude information of the base station to which the suspected GOIP fraud mobile phone card number belongs can be queried from the base station location table to determine the specific location of the base station, and the base station location table records the location area code (Location are code, Lac), cell number (cell), longitude information, latitude information and other information of the base station.

[0111] S12. Expand the call time range based on the call time information to obtain a target call detection time range, and expand the base station location range based on the base station location information to obtain a target call detection location range.

[0112] When implementing it specifically, you can follow the following steps: Figure 2 The process shown expands the call time range of the mobile phone card number suspected of abnormal communication operation behavior to obtain the target call detection time range, including the following steps:

[0113] S21. Subtract a first preset duration from the call start time of the mobile phone number suspected of abnormal communication operation behavior to obtain a target call detection start time.

[0114] During specific implementation, the call start time of the suspected GOIP fraud mobile phone card number is shortened by a first preset time period to obtain the target call detection start time.

[0115] S22: Add the second preset time duration to the call end time of the mobile phone number suspected of abnormal communication operation behavior to obtain the target call detection end time.

[0116] During specific implementation, the call end time of the suspected GOIP fraud mobile phone card number is extended backward by a second preset time period to obtain the target call detection end time.

[0117] Among them, the first preset time length and the second preset time length can be set to the same value, and can be set according to actual needs. For example, they can both be set to 1 minute. This embodiment of the present application is not limited to this.

[0118] S23: Determine a time range between the target call detection start time and the target call detection end time as a target call detection time range.

[0119] During specific implementation, the time range between the target call detection start time and the target call detection end time is the expanded target call detection time range.

[0120] For example, a suspected GOIP fraud mobile phone card number is: 177xxxx4955, the call start time is: July 29, 2022, 13:56:09, the call end time is: July 29, 2022, 13:57:16, the first preset duration and the second preset duration are both 1 minute, then the target call detection time range is: July 29, 2022, 13:55:09 to July 29, 2022, 13:58:16.

[0121] In implementation, the following Figure 3 The process shown expands the base station location range to which the mobile phone number suspected of abnormal communication operation belongs to obtain the target call detection location range, including the following steps:

[0122] S31. Determine an expanded longitude range based on the longitude information and the latitude information.

[0123] In specific implementation, the expanded longitude range is determined based on the longitude information and latitude information of the base station to which the mobile phone number suspected of abnormal communication operation behavior belongs.

[0124] Specifically, the expanded longitude range can be calculated as follows:

[0125] The starting longitude of the expanded longitude range can be calculated using the following formula:

[0126]

[0127] Among them, A1 represents the starting longitude of the expanded longitude range;

[0128] a represents the longitude information of the base station to which the mobile phone number suspected of abnormal communication operation belongs, that is, the longitude information of the base station to which the mobile phone number suspected of GOIP fraud belongs;

[0129] b represents the latitude information of the base station to which the mobile phone number suspected of abnormal communication operation belongs, that is, the latitude information of the base station to which the mobile phone number suspected of GOIP fraud belongs.

[0130] The end longitude of the expanded longitude range can be calculated by the following formula:

[0131]

[0132] Among them, A2 represents the end longitude of the expanded longitude range;

[0133] a indicates the longitude information of the base station to which the mobile phone number with suspected abnormal communication operation belongs;

[0134] b indicates the latitude information of the base station to which the mobile phone number with suspected abnormal communication operation behavior belongs.

[0135] The longitude range between the start longitude and the end longitude of the expanded longitude range is the expanded longitude range.

[0136] S32. Determine an expanded latitude range based on the latitude information.

[0137] In specific implementation, the expanded dimensional range is determined based on the latitude information of the base station to which the mobile phone number suspected of abnormal communication operation behavior belongs.

[0138] Specifically, the expanded dimension range can be determined in the following ways:

[0139] The starting latitude of the expanded dimension range is calculated using the following formula:

[0140]

[0141] Among them, B1 represents the starting latitude of the expanded latitude range;

[0142] b indicates the latitude information of the base station to which the mobile phone number with suspected abnormal communication operation behavior belongs.

[0143] The end latitude of the expanded dimension range can be calculated by the following formula:

[0144]

[0145] Among them, B2 represents the end latitude of the expanded latitude range;

[0146] b indicates the latitude information of the base station to which the mobile phone number with suspected abnormal communication operation behavior belongs.

[0147] The dimensional range between the expanded starting latitude and the ending latitude is the expanded dimensional range.

[0148] S33. Determine the target call detection position range according to the expanded longitude range and the expanded latitude range.

[0149] In this step, the expanded longitude range is the longitude range of the target call detection position, and the expanded latitude range is the latitude range of the target call detection position. The expanded longitude range and the expanded latitude range together constitute the target call detection position range.

[0150] Still taking the suspected GOIP fraud mobile phone card number 177xxxx4955 as an example, the longitude a of the base station to which the mobile phone card number belongs is: 105.84341, the latitude b is: 29.01118, the location area code lac of the base station is: 13056, and the cell number cell is: 155796. After calculation, the expanded longitude range and expanded latitude range are shown in Table 1:

[0151]

[0152]

[0153] Table 1

[0154] Table 1 shows that the expanded longitude range of the base station is: 105.83311~105.85371, and the expanded latitude range is: 29.00217~29.02019.

[0155] S13. Acquire a target calling mobile phone card number whose call start time is within a target call detection time range and within a target call detection location range, and a corresponding target called mobile phone card number called by the target calling mobile phone card number.

[0156] In the specific implementation, the target calling mobile phone card number whose call start time is within the target call detection time range and within the target call detection location range, as well as the corresponding target called mobile phone card number called by the target calling mobile phone card number are obtained by querying the historical call records, wherein the target calling mobile phone card number includes the mobile phone card number of the suspected abnormal communication operation behavior.

[0157] Specifically, the target host mobile phone card number can be obtained in the following way: query the historical call records to obtain the calling mobile phone card numbers of each caller whose call start time is within the target call detection time range; based on the longitude information and latitude information of the base station to which each called mobile phone card number belongs, filter out the calling mobile phone card numbers whose longitude is within the longitude range of the target call detection location range and whose latitude is within the dimensional range of the target call detection location range; and determine the filtered calling mobile phone card numbers as the target calling mobile phone card numbers. Furthermore, the corresponding target called mobile phone card numbers called by each target host mobile phone card number are obtained. After obtaining the target calling mobile phone card number, the target calling mobile phone card number characteristics can also be obtained: the IMEI (International Mobile Equipment Identity) of the target host mobile phone card number. When the target called mobile phone card number is obtained, the target called mobile phone card number characteristics can also be obtained: the usage location identifier corresponding to the target called mobile phone card number, wherein the usage location identifier of the target called mobile phone card number can be but is not limited to the usage area code of the target called mobile phone card number, as long as the identifier can uniquely identify the location of the current usage location of the target called mobile phone card number, the embodiment of the present application does not limit this.

[0158] S14. Determine a regional feature value based on the target calling phone card number feature and the target called phone card number feature, and determine the confidence level of each regional feature.

[0159] In specific implementation, the regional characteristics represent factors used to identify fraud areas. The regional characteristics may include, but are not limited to, the following characteristics: the number of deduplicated usage location identifiers corresponding to the called mobile phone card number, the number of deduplicated called mobile phone card numbers, the number of deduplicated calling mobile phone card numbers, and the maximum number of IMEIs corresponding to each calling mobile phone card number. The number of deduplicated usage location identifiers corresponding to the called mobile phone card number may be recorded as the first regional characteristic, the number of deduplicated called mobile phone card numbers may be recorded as the second regional characteristic, the number of deduplicated calling mobile phone card numbers may be recorded as the third regional characteristic, and the maximum number of IMEIs corresponding to each calling mobile phone card number may be recorded as the fourth regional characteristic. In implementation, the setting of regional characteristics may be set according to actual needs, and the embodiments of the present application do not limit this.

[0160] Specifically, the characteristic values ​​of each region may be determined based on the characteristics of the target calling phone card number and the characteristics of the target called phone card number in the following manner:

[0161] Determine the number of usage location identifiers corresponding to all target called mobile phone card numbers as the first area characteristic value; determine the number of all target called mobile phone card numbers as the second area characteristic value; determine the number of all target calling mobile phone card numbers as the third area characteristic value; determine the maximum value of the number of IMEIs corresponding to each target calling mobile phone card number as the fourth area characteristic value.

[0162] Furthermore, the confidence level of each regional feature is determined based on the regional feature value, the preset regional feature reference value, and the ratio of the preset regional feature reference value.

[0163] In specific implementation, the corresponding regional feature baseline value and the regional feature baseline value ratio (that is, the weight of each regional feature) can be set in advance for each regional feature. Then, the corresponding baseline value confidence can be obtained according to the product of each regional feature baseline value and the regional feature baseline value ratio. The baseline value confidence corresponding to each regional feature is summed up to obtain the total confidence of the set baseline value, wherein the sum of the baseline value ratios of each regional feature is 1.

[0164] The following is an example to illustrate, as shown in Table 2:

[0165]

[0166]

[0167] Table 2

[0168] As shown in Table 1, assuming that the first regional feature called mobile phone card number corresponding to the reference value of the number of usage location identifiers after deduplication is set to 2, and the reference value accounts for 30%, the first regional feature reference value confidence is: 2×30%=0.6, the second regional feature called mobile phone card number reference value after deduplication is set to 3, and the reference value accounts for 20%, then the second regional feature reference value confidence is: 3×20%=0.6, the third regional feature calling mobile phone card number reference value after deduplication is set to 2, and the reference value accounts for 40%, then the third regional feature reference value confidence is: 2×40%=0.8, the fourth regional feature The maximum reference value of the number of IMEIs corresponding to each calling mobile phone card number is set to 2, and the reference value accounts for 10%, then the fourth regional feature reference value confidence is: 2×10%=0.2, then the total reference value confidence=0.6+0.6+0.8+0.2=2.2.

[0169] It should be noted that the characteristic baseline values ​​and baseline value ratios of each region can be set according to needs, and the embodiments of the present application do not limit this. The total confidence of the above-set baseline value can be obtained by setting the characteristic baseline values ​​and baseline value ratios of each region.

[0170] In specific implementation, the confidence of the feature of the i-th region can be calculated by the following formula:

[0171]

[0172] Among them, ρ i Represents the confidence of the feature of the i-th region;

[0173] p i represents the eigenvalue of the i-th region;

[0174] o i represents the characteristic reference value of the i-th preset area;

[0175] w i Indicates the proportion of characteristic benchmark values ​​in the ith region.

[0176] S15. If it is determined that each regional feature value and the total regional feature confidence meet the preset conditions, the target calling mobile phone card number is determined to be the target abnormal communication operation behavior mobile phone card number, and the target abnormal communication operation behavior area is located based on the location information of the base station to which the target abnormal communication operation behavior mobile phone card number belongs.

[0177] In specific implementation, if it is determined that each regional characteristic value is greater than or equal to its corresponding set reference value, and the total confidence of the regional characteristics is greater than the total confidence of the set reference value, then it is determined that each target calling mobile phone card number including the mobile phone card number of the suspected abnormal communication operation behavior is the target abnormal communication operation behavior mobile phone card number, and then, based on the location information of the base station to which each target abnormal communication operation behavior mobile phone card number belongs, the actual location of the corresponding target abnormal communication operation behavior mobile phone card number is located, that is, the location of each target abnormal communication operation behavior area is located.

[0178] The following is an example to illustrate the overall process of this application. The suspected GOIP fraud mobile phone card number 177xxxx4955 is still used as an example. Its call time is: July 29, 2022, 13:56:09~July 29, 2022, 13:57:16, and the target call detection time range after the call time is expanded is: July 29, 2022, 13:55:09~July 29, 2022, 13:58:16. The longitude a of the base station to which the mobile phone card number 177xxxx4955 belongs is: 105.84341, and the latitude b is: 29.01118. The target call detection position range after the base station expansion is: the expanded longitude range is: 105.83311~105.85371, and the expanded latitude range is: 29.00217~29.02019. After querying the historical call records, the calling mobile phone card number and the corresponding called mobile phone card number whose call time range is within the above target call detection time range are obtained as shown in Table 3:

[0179]

[0180]

[0181] Table 3

[0182] It can be seen from Table 3 that among the calling mobile phone card numbers within the target call detection time range, the longitude of the base station to which "177xxxx6955" belongs is 105.86024, which exceeds the expanded longitude range in the target call location detection range, and the calling mobile phone card number is eliminated. The longitude of the base station to which "180xxxx5102" belongs is 105.89621, which exceeds the expanded longitude range. Its latitude is: 29.02658, which also exceeds the expanded latitude range, and the calling mobile phone card number is eliminated. After eliminating these two calling mobile phone card numbers and their related information, the remaining calling mobile phone card numbers are all within the target call detection time range and the target call detection location range, that is, the target calling mobile phone card numbers, and the corresponding called mobile phone card numbers are the target called mobile phone card numbers as shown in Table 4:

[0183]

[0184] Table 4

[0185] The usage location identifiers corresponding to the target called mobile phone card numbers are: 23, 24, 26, 27, and 21, respectively. There is no duplication. The number of usage location identifiers corresponding to the target called mobile phone card numbers after deduplication is 5, that is, the first area feature value is 5; the number of target called mobile phone card numbers after deduplication is 5, that is, the second area feature value is 5; the number of target calling mobile phone card numbers after deduplication is 5, that is, the third area feature value is 5; the IMEIs corresponding to the target calling mobile phone card numbers 177xxxx4955, 151xxxx6940 and 139xxxx2948 are the same, all of which are 34659xxxx846012. The number of IMEIs of 34659xxxx846012 is 3, the number of IMEIs of 68168xxxx785292 is 1, and the number of IMEIs of 86505xxxx125407 is also 1. It can be seen that the maximum value of the number of IMEIs corresponding to each target calling mobile phone card number is 3, that is, the fourth area feature value is 3. The confidence of each regional feature and the total confidence of regional features are calculated, as shown in Table 5:

[0186]

[0187] Table 5

[0188] The reference value, reference value ratio, and total confidence of the reference value of each regional feature are still set in reference table 2. As shown in table 5, the first regional feature is 5, which is greater than the set reference value 2 corresponding to the first regional feature, the second regional feature value is 5, which is greater than the set reference value 3 corresponding to the second regional feature, the third regional feature value is 5, which is greater than the set reference value 2 corresponding to the third regional feature, the fourth regional feature value is 3, which is greater than the set reference value 2 corresponding to the fourth regional feature, and the total confidence of the regional feature is: 2.23, which is greater than the total confidence of the set reference value 2.2. Therefore, it is suspected that The credibility of the GOIP fraud mobile phone card number 177xxxx4955 and other target calling host card numbers: 151xxxx6940, 139xxxx2948, 136xxxx0074 and 136xxxx1051 as real GOIP fraud mobile phone card numbers is high. The above target calling host card numbers can be determined as GOIP fraud mobile phone card numbers (which can be called fraud-related cards). Then, by querying the base station location table, the location of each GOIP fraud mobile phone card number can be further queried, that is, the location of each fraud area, as shown in Table 6:

[0189] GOIP fraud mobile phone card number address 177xxxx4955 A residential area in Yongchuan District, Chongqing 151xxxx6940 A computer room in Yongchuan District, Chongqing 139xxxx2948 A shopping mall in Yongchuan District, Chongqing 136xxxx0074 A residential building in Yongchuan District, Chongqing 136xxxx1051 A lane in Yongchuan District, Chongqing

[0190] Table 6

[0191] By performing the above steps for each suspected GOIP fraud mobile phone card number in the phone number blacklist, the real GOIP fraud mobile phone card number and other GOIP fraud mobile phone card numbers within the target call detection time range and target call detection location range can be screened out. As shown in Table 7, based on the spatiotemporal data of multiple suspected GOIP fraud mobile phone card numbers in the phone number blacklist, the following different regional features can be obtained:

[0192]

[0193]

[0194] Table 7

[0195] As shown in Table 7, only 177xxxx4955 meets the conditions, and the other suspected GOIP fraud mobile phone card numbers are not real GOIP fraud mobile phone card numbers. The regional feature analysis diagram corresponding to the suspected GOIP fraud mobile phone card numbers in Table 7 is as follows: Figure 4 shown.

[0196] The abnormal communication operation behavior area identification method provided in the embodiment of the present application expands the call time range of the suspected GOIP fraud mobile phone card number in the call blacklist and the location range of the base station to which the suspected GOIP fraud mobile phone card number belongs, and uses the expanded call time range as the target call detection time range, and uses the expanded base station location range as the target call detection location range, and analyzes the massive historical call records in the time-space interval based on the two dimensions of time and space. The regional feature analysis method can more accurately determine whether the suspected GOIP fraud mobile phone card number is a real GOIP fraud mobile phone card number, and can more accurately and comprehensively screen out other GOIP fraud mobile phone card numbers within the target detection location range, thereby quickly and accurately locating the location of the GOIP fraud area. In addition, in the embodiment of the present application, the call time range of the suspected GOIP fraud mobile phone card number and the location range of the base station to which the suspected GOIP fraud mobile phone card number belongs are expanded to a certain extent, so that the identification result is more accurate.

[0197] Based on the same inventive concept, an embodiment of the present application also provides an abnormal communication operation behavior area identification device. Since the principle of solving the problem by the above-mentioned abnormal communication operation behavior area identification device is similar to the above-mentioned abnormal communication operation behavior area identification method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0198] like Figure 5 As shown, it is a schematic diagram of the structure of the abnormal communication operation behavior area identification device provided in an embodiment of the present application, and the abnormal communication operation behavior area identification device may include:

[0199] The first acquisition unit 41 is used to acquire, for each mobile phone card number suspected of abnormal communication operation behavior in the telephone number blacklist, the call time information of the mobile phone card number suspected of abnormal communication operation behavior and the location information of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs;

[0200] An expansion unit 42, configured to expand a call time range based on the call time information to obtain a target call detection time range, and to expand a base station location range based on the location information of the base station to obtain a target call detection location range;

[0201] The second acquisition unit 43 is used to acquire a target calling mobile phone card number whose call start time is within the target call detection time range and within the target call detection location range, and a corresponding target called mobile phone card number called by the target calling mobile phone card number, wherein the target calling mobile phone card number includes the mobile phone card number of the suspected abnormal communication operation behavior;

[0202] A determination unit 44, configured to determine a regional feature value based on the target calling mobile phone card number feature and the target called mobile phone card number feature, and determine the confidence level of each regional feature, wherein the regional feature represents a factor for identifying a fraudulent area;

[0203] The positioning unit 45 is used to determine that the target calling mobile phone card number is the target abnormal communication operation behavior mobile phone card number if it is determined that each regional feature value and the total regional feature confidence meet the preset conditions, and locate the target abnormal communication operation behavior area based on the location information of the base station to which the target abnormal communication operation behavior mobile phone card number belongs.

[0204] In a possible implementation manner, the determining unit 44 is specifically configured to determine the confidence level of each regional feature according to the regional feature value, the preset regional feature reference value, and the ratio of the preset regional feature reference value.

[0205] In a possible implementation manner, the call time information of the mobile phone card number of the suspected abnormal communication operation behavior includes the call start time of the mobile phone card number of the suspected abnormal communication operation behavior and the call end time of the mobile phone card number of the suspected abnormal communication operation behavior;

[0206] The expansion unit 42 is specifically used to subtract the first preset duration from the call start time of the mobile phone card number with the suspected abnormal communication operation behavior to obtain the target call detection start time; add the second preset duration to the call end time of the mobile phone card number with the suspected abnormal communication operation behavior to obtain the target call detection end time; and determine the time range between the target call detection start time and the target call detection end time as the target call detection time range.

[0207] In a possible implementation manner, the location information of the base station to which the mobile phone number of the suspected abnormal communication operation behavior belongs includes the longitude information and latitude information of the base station;

[0208] The expansion unit 42 is specifically used to determine the expanded longitude range based on the longitude information and the latitude information; determine the expanded latitude range based on the latitude information; and determine the target call detection position range according to the expanded longitude range and the expanded latitude range.

[0209] In a possible implementation manner, the expansion unit 42 is specifically configured to calculate the starting longitude of the expanded longitude range by using the following formula:

[0210]

[0211] Wherein, A1 represents the starting longitude of the expanded longitude range;

[0212] a represents the longitude information;

[0213] b represents the latitude information;

[0214] The end longitude of the extended longitude range is calculated by the following formula:

[0215]

[0216] Among them, A2 represents the end longitude of the expanded longitude range.

[0217] In a possible implementation manner, the expansion unit 42 is specifically configured to calculate the starting latitude of the expanded dimensional range by using the following formula:

[0218]

[0219] Wherein, B1 represents the starting latitude of the expanded latitude range;

[0220] b represents the latitude information;

[0221] The end latitude of the expanded dimensional range is calculated by the following formula:

[0222]

[0223] Among them, B2 represents the end latitude of the expanded latitude range.

[0224] In a possible implementation, the target calling mobile phone card number feature includes the International Mobile Equipment Identity (IMEI) corresponding to the target calling mobile phone card number, and the target called mobile phone card number feature includes the usage location identifier corresponding to the target called mobile phone card number;

[0225] The determination unit 44 is specifically used to determine the number of usage location identifiers corresponding to all target called mobile phone card numbers as the first regional characteristic value; determine the number of all target called mobile phone card numbers as the second regional characteristic value; determine the number of all target calling mobile phone card numbers as the third regional characteristic value; determine the maximum value of the number of IMEIs corresponding to each target calling mobile phone card number as the fourth regional characteristic value.

[0226] In a possible implementation manner, the determining unit 44 is specifically configured to calculate the confidence of the i-th region feature by using the following formula:

[0227]

[0228] Among them, ρ i represents the confidence of the feature of the i-th region;

[0229] p i represents the characteristic value of the i-th region;

[0230] o i represents the characteristic reference value of the i-th preset area;

[0231] w i Indicates the proportion of characteristic benchmark values ​​in the i-th region.

[0232] In a possible implementation, the positioning unit 45 is specifically used to determine that the target calling mobile phone card number is the target abnormal communication operation behavior mobile phone card number if it is determined that each regional characteristic value is greater than or equal to the corresponding set reference value, and the total confidence of the regional characteristics is greater than the total confidence of the set reference value.

[0233] Based on the same technical concept, the embodiment of the present application also provides an electronic device 500, referring to Figure 6 As shown, the electronic device 500 is used to implement the abnormal communication operation behavior area identification method recorded in the above method embodiment. The electronic device 500 of this embodiment may include: a memory 501, a processor 502, and a computer program stored in the memory and executable on the processor, such as an abnormal communication operation behavior area identification program. When the processor executes the computer program, the steps in the above abnormal communication operation behavior area identification method embodiments are implemented, such as Figure 1 Step S11 is shown.

[0234] The specific connection medium between the memory 501 and the processor 502 is not limited in the embodiment of the present application. Figure 6 In the embodiment, the memory 501 and the processor 502 are connected via a bus 503. The bus 503 is connected to the processor 502 via a bus 503. Figure 6 The connection between other components is shown by bold lines, which is only for schematic illustration and is not intended to be limiting. The bus 503 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0235] The memory 501 may be a volatile memory, such as a random-access memory (RAM); the memory 501 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 501 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 501 may be a combination of the above memories.

[0236] The processor 502 is used to implement the abnormal communication operation behavior area identification method provided in the embodiment of the present application.

[0237] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0238] In some possible implementations, various aspects of the abnormal communication operation behavior area identification method provided in the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the abnormal communication operation behavior area identification method according to various exemplary embodiments of the present application described above in this specification.

[0239] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0240] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0241] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0242] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0243] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0244] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying abnormal communication operation behavior areas, characterized in that: include: For each mobile phone card number suspected of abnormal communication operation behavior in the phone number blacklist, obtain the call time information of the mobile phone card number suspected of abnormal communication operation behavior and the location information of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs; Expanding the call time range based on the call time information to obtain a target call detection time range, and expanding the base station location range based on the base station location information to obtain a target call detection location range; Obtaining a target calling mobile phone card number whose call start time is within the target call detection time range and within the target call detection location range, and a corresponding target called mobile phone card number called by the target calling mobile phone card number, wherein the target calling mobile phone card number includes the mobile phone card number of the suspected abnormal communication operation behavior; Determine a regional feature value based on the target calling phone card number feature and the target called phone card number feature, and determine the confidence level of each regional feature, wherein the regional feature represents a factor for identifying a fraud area; If it is determined that each regional feature value and the total regional feature confidence meet the preset conditions, the target calling mobile phone card number is determined to be the target abnormal communication operation behavior mobile phone card number, and the target abnormal communication operation behavior area is located based on the location information of the base station to which the target abnormal communication operation behavior mobile phone card number belongs.

2. The method according to claim 1, characterized in that Determine the confidence level of each regional feature, including: The confidence level of each regional feature is determined according to the regional feature value, the preset regional feature reference value, and the ratio of the preset regional feature reference value.

3. The method according to claim 1, characterized in that The call time information of the mobile phone card number of the suspected abnormal communication operation behavior includes the call start time of the mobile phone card number of the suspected abnormal communication operation behavior and the call end time of the mobile phone card number of the suspected abnormal communication operation behavior; Expanding the call time range based on the call time information to obtain a target call detection time range specifically includes: Subtract the first preset duration from the call start time of the mobile phone number of the suspected abnormal communication operation behavior to obtain the target call detection start time; Add the second preset time to the call end time of the mobile phone number with the suspected abnormal communication operation behavior to obtain the target call detection end time; The time range between the target call detection start time and the target call detection end time is determined as the target call detection time range.

4. The method according to claim 1, characterized in that The location information of the base station to which the mobile phone number of the suspected abnormal communication operation belongs includes the longitude and latitude information of the base station; Expanding the base station location range based on the location information of the base station to obtain a target call detection location range specifically includes: Determining an expanded longitude range based on the longitude information and the latitude information; Determine an expanded latitude range based on the latitude information; The target call detection position range is determined according to the expanded longitude range and the expanded latitude range.

5. The method according to claim 4, characterized in that Determining the expanded longitude range based on the longitude information and the latitude information specifically includes: The starting longitude of the expanded longitude range is calculated by the following formula: Wherein, A1 represents the starting longitude of the expanded longitude range; a represents the longitude information; b represents the latitude information; The end longitude of the extended longitude range is calculated by the following formula: Among them, A2 represents the end longitude of the expanded longitude range.

6. The method according to claim 4, characterized in that Determining the expanded latitude range based on the latitude information specifically includes: The starting latitude of the expanded dimensional range is calculated by the following formula: Wherein, B1 represents the starting latitude of the expanded latitude range; b represents the latitude information; The end latitude of the expanded dimensional range is calculated by the following formula: Among them, B2 represents the end latitude of the expanded latitude range.

7. The method according to claim 2, characterized in that The target calling mobile phone card number feature includes the International Mobile Equipment Identity (IMEI) corresponding to the target calling mobile phone card number, and the target called mobile phone card number feature includes the usage location identifier corresponding to the target called mobile phone card number; The regional feature value is determined based on the target calling phone card number feature and the target called phone card number feature, specifically including: Determine the number of usage location identifiers corresponding to all target called mobile phone card numbers as the first regional characteristic value; Determine the number of all target called mobile phone numbers as the second area characteristic value; Determine the number of all target calling mobile phone numbers as the third area characteristic value; The maximum value of the number of IMEIs corresponding to each target calling mobile phone card number is determined as the fourth area characteristic value.

8. The method according to claim 7, characterized in that The confidence level of each regional feature is determined according to the regional feature value, the preset regional feature reference value, and the ratio of the preset regional feature reference value, specifically including: The confidence of the feature of the i-th region is calculated by the following formula: Among them, ρ i represents the confidence of the feature of the i-th region; p i represents the characteristic value of the i-th region; o i represents the characteristic reference value of the i-th preset area; w i Indicates the proportion of characteristic benchmark values ​​in the ith region.

9. The method according to claim 1 or 8, characterized in that If it is determined that each regional feature value and the regional feature total confidence meet the preset conditions, then the mobile phone card number of the suspected abnormal communication operation behavior is determined to be the target abnormal communication operation behavior mobile phone card number, specifically including: If it is determined that each of the regional characteristic values ​​is greater than or equal to the corresponding set reference value, and the total confidence of the regional characteristics is greater than the total confidence of the set reference value, then the target calling mobile phone card number is determined to be the target abnormal communication operation behavior mobile phone card number.

10. A device for identifying abnormal communication operation behavior areas, characterized in that: include: The first acquisition unit is used to acquire, for each mobile phone card number suspected of abnormal communication operation behavior in the telephone number blacklist, the call time information of the mobile phone card number suspected of abnormal communication operation behavior and the location information of the base station to which the mobile phone card number suspected of abnormal communication operation behavior belongs; An expansion unit, configured to expand a call time range based on the call time information to obtain a target call detection time range, and to expand a base station location range based on the location information of the base station to obtain a target call detection location range; A second acquisition unit is used to acquire a target calling mobile phone card number whose call start time is within the target call detection time range and within the target call detection location range, and a corresponding target called mobile phone card number called by the target calling mobile phone card number, wherein the target calling mobile phone card number includes the mobile phone card number of the suspected abnormal communication operation behavior; A determination unit, used to determine a regional feature value based on a target calling mobile phone card number feature and a target called mobile phone card number feature, and determine a confidence level of each regional feature, wherein the regional feature represents a factor for identifying a fraudulent area; A positioning unit is used to determine that the target calling mobile phone card number is the target abnormal communication operation behavior mobile phone card number if it is determined that each regional feature value and the total confidence of the regional features meet the preset conditions, and locate the target abnormal communication operation behavior area based on the location information of the base station to which the target abnormal communication operation behavior mobile phone card number belongs.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the abnormal communication operation behavior area identification method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in the abnormal communication operation behavior area identification method according to any one of claims 1 to 9 are implemented.

Images