A method and apparatus for determining device location information, and an electronic device

Abstract

Embodiments of the present application disclose a method and device for determining device location information and electronic equipment. The method comprises: obtaining number location information of each communication number in a pre-established communication number database, the communication numbers in the communication number database being fraud numbers determined based on communication data and a pre-trained number detection model, the number detection model being obtained by training a model constructed by a preset machine learning algorithm based on historical communication data of historical communication numbers; obtaining device location information of a communication device corresponding to each communication device information in a pre-established communication device information database; determining a target device corresponding to the device location information matched with the number location information, and obtaining device location information of the target device, the target device being a device that frauds users by converting Internet calls into mobile network calls. Through the method, the positioning efficiency and positioning accuracy of fraud devices can be improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, and electronic device for determining device location information. Background Technology

[0002] Fraudulent devices, primarily GOIP devices (i.e., virtual dialers), can switch phone numbers arbitrarily from overseas to call victims. A single GOIP device can operate hundreds of SIM cards simultaneously. Malicious third parties typically transmit SIM card dialing data to the GOIP device via the network, and then the GOIP device connects to the local communication base station to conduct voice calls and carry out fraudulent activities.

[0003] Because of the separation between humans and machines, combating GOIP fraud is quite difficult. Usually, it is necessary to find GOIP devices after a fraud incident has occurred, through the testimony of a malicious third party. However, by this time the victim has already been harmed, and finding GOIP devices through the testimony of a malicious third party is highly passive, inefficient, and has a low success rate. Therefore, a solution is needed to improve the efficiency and accuracy of locating fraudulent devices. Summary of the Invention

[0004] The purpose of this invention is to provide a method, apparatus, and electronic device for determining device location information, so as to solve the problems of low positioning efficiency and poor accuracy of fraudulent devices in the prior art.

[0005] To solve the above-mentioned technical problems, the embodiments of the present invention are implemented as follows:

[0006] In a first aspect, an embodiment of the present invention provides a method for determining device location information, the method comprising: acquiring the location information of each communication number in a pre-established communication number database, wherein the communication numbers in the communication number database are fraudulent numbers determined based on communication data and a pre-trained number detection model, and the number detection model is obtained by training a model constructed by a preset machine learning algorithm based on historical communication data of historical communication numbers;

[0007] Obtain the device location information of each communication device in the pre-established communication device information database. The communication devices corresponding to the communication device information in the communication device information database are fraudulent devices determined based on device Internet call detail records, mobile network call detail records and traffic data, as well as a preset device identification model.

[0008] Identify the target device corresponding to the device location information that matches the number location information, and obtain the device location information of the target device, wherein the target device is a device that defrauds users by converting Internet calls into mobile network calls.

[0009] Optionally, determining the target device corresponding to the device location information that matches the number location information includes:

[0010] Obtain the server location information of each communication server in a pre-established communication server information database, wherein the communication server is the server that sends Internet calls to the target device;

[0011] Identify the target device corresponding to the device location information that matches the number location information and the server location information.

[0012] Optionally, before obtaining the server location information of each communication server in the pre-established communication server information database, the method further includes:

[0013] Obtain server information of the first communication server, wherein the server information includes at least protocol information and port information;

[0014] Based on preset server detection rules and the server information of the first communication server, determine whether the first communication server is the communication server.

[0015] Obtain the determined server location information of the communication server, and construct the communication server information database based on the communication server and the corresponding server location information.

[0016] Optionally, before obtaining the number location information of each communication number in the pre-established communication number database, the method further includes:

[0017] Obtain the first communication number to be detected and its corresponding communication data;

[0018] The communication data of the first communication number is input into the pre-trained number detection model to obtain the detection result of the first communication number;

[0019] Based on the detection results, determine whether the first communication number is the communication number;

[0020] Obtain the location information of the determined communication number, and construct the communication number database based on the communication number and the corresponding location information.

[0021] Optionally, before obtaining the device location information of the communication device corresponding to each piece of communication device information in the pre-established communication device information database, the method further includes:

[0022] Obtain internet call detail records, mobile network call detail records, and traffic data from the first communication device;

[0023] Based on the Internet call detail records and mobile network call detail records of the first communication device, the call detail record matching degree of the first communication device is determined;

[0024] Based on the traffic data of the first communication device, determine the protocol usage information of the first communication device;

[0025] Based on the preset device identification model, the call detail record matching degree of the first communication device, and the protocol usage information, it is determined whether the first communication device is the communication device.

[0026] Obtain the determined device location information of the communication device, and construct the communication device information database based on the communication device and the corresponding device location information.

[0027] Optionally, determining whether the first communication device is the communication device based on the preset device identification model, the call detail record (CDR) matching degree of the first communication device, and the protocol usage information includes:

[0028] Based on preset device detection rules, the call detail record matching degree of the first communication device, and protocol usage information, determine whether the first communication device is the second communication device;

[0029] Acquire preset feature information of the second communication device, wherein the preset features include at least one or more of the following: behavior information, location information, and access information;

[0030] Based on the preset device identification model and the preset feature information, it is determined whether the second communication device is the communication device.

[0031] Optionally, before inputting the communication data of the first communication number into the pre-trained number detection model to obtain the detection result of the first communication number, the method further includes:

[0032] Retrieve historical communication numbers and corresponding historical communication data;

[0033] Based on the historical communication data of the historical communication number, determine the first scenario corresponding to the historical communication number;

[0034] Obtain the first number detection model corresponding to the first scenario;

[0035] Based on the historical communication data of the historical communication number, the first number detection model is trained, and the training results are obtained;

[0036] Based on the preset evaluation model and the training results, determine whether the first number detection model meets the preset detection requirements;

[0037] The first number detection model that meets the preset detection requirements is determined as the number detection model corresponding to the first scenario;

[0038] The step of inputting the communication data of the first communication number into the pre-trained number detection model to obtain the detection result of the first communication number includes:

[0039] Obtain the target scenario in the first scenario that matches the communication data of the first communication number;

[0040] Obtain the number detection model corresponding to the target scenario, and input the communication data of the first communication number into the number detection model to obtain the detection result of the first communication number.

[0041] Secondly, embodiments of the present invention provide a device for determining device location information, the device comprising:

[0042] The first acquisition module is used to acquire the location information of each communication number in a pre-established communication number database. The communication numbers in the communication number database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed by a pre-set machine learning algorithm based on historical communication data of historical communication numbers.

[0043] The second acquisition module is used to acquire the device location information of the communication device corresponding to each communication device information in the pre-established communication device information database. The communication device corresponding to the communication device information in the communication device information database is a fraud device determined based on device Internet call detail records, mobile network call detail records and traffic data, as well as a preset device identification model.

[0044] The information determination module is used to determine the target device corresponding to the device location information that matches the number location information, and to obtain the device location information of the target device, wherein the target device is a device that defrauds users by converting Internet calls into mobile network calls.

[0045] Optionally, the information determination module is used to:

[0046] Obtain the server location information of each communication server in a pre-established communication server information database, wherein the communication server is the server that sends Internet calls to the target device;

[0047] Identify the target device corresponding to the device location information that matches the number location information and the server location information.

[0048] Optionally, the device further includes:

[0049] The third acquisition module is used to acquire server information of the first communication server, wherein the server information includes at least protocol information and port information;

[0050] The server determination module is used to determine whether the first communication server is the communication server based on preset server detection rules and the server information of the first communication server.

[0051] The first construction module is used to obtain the determined server location information of the communication server, and construct the communication server information database based on the communication server and the corresponding server location information.

[0052] Optionally, the device further includes:

[0053] The fourth acquisition module is used to acquire the first communication number to be detected and the corresponding communication data;

[0054] The detection module is used to input the communication data of the first communication number into the pre-trained number detection model to obtain the detection result of the first communication number;

[0055] The determining module is used to determine, based on the detection result, whether the first communication number is the communication number;

[0056] The second construction module is used to obtain the location information of the determined communication number, and construct the communication number database based on the communication number and the corresponding location information.

[0057] Optionally, the device further includes:

[0058] The fifth acquisition module is used to acquire the Internet call detail records, mobile network call detail records, and traffic data of the first communication device;

[0059] The matching module is used to determine the call detail record (CDR) matching degree of the first communication device based on the Internet CDR and mobile network CDR of the first communication device.

[0060] The information determination module is used to determine the protocol usage information of the first communication device based on the traffic data of the first communication device;

[0061] The device determination module is used to determine whether the first communication device is the communication device based on the preset device identification model, the call detail record matching degree of the first communication device, and the protocol usage information of the first communication device.

[0062] The third construction module is used to obtain the determined device location information of the communication device, and construct the communication device information database based on the communication device and the corresponding device location information.

[0063] Optionally, the device determination module is configured to:

[0064] Based on preset device detection rules, the call detail record matching degree of the first communication device, and protocol usage information, determine whether the first communication device is the second communication device;

[0065] Acquire preset feature information of the second communication device, wherein the preset features include at least one or more of the following: behavior information, location information, and access information;

[0066] Based on the preset device identification model and the preset feature information, it is determined whether the second communication device is the communication device.

[0067] Optionally, the device further includes:

[0068] The sixth acquisition module is used to acquire historical communication numbers and corresponding historical communication data;

[0069] The scenario determination module is used to determine the first scenario corresponding to the historical communication number based on the historical communication data of the historical communication number;

[0070] The model acquisition module is used to acquire the first number detection model corresponding to the first scenario;

[0071] The training module is used to train the first number detection model based on the historical communication data of the historical communication number and obtain the training results;

[0072] The first determining module is used to determine whether the first number detection model meets the preset detection requirements based on the preset evaluation model and the training results.

[0073] The second determining module is used to determine the first number detection model that meets the preset detection requirements as the number detection model corresponding to the first scenario.

[0074] The detection module is used for:

[0075] Obtain the target scenario in the first scenario that matches the communication data of the first communication number;

[0076] Obtain the number detection model corresponding to the target scenario, and input the communication data of the first communication number into the number detection model to obtain the detection result of the first communication number.

[0077] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the method for determining device location information provided in the above embodiments.

[0078] Fourthly, embodiments of the present invention provide a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, it implements the steps of the method for determining device location information provided in the above embodiments.

[0079] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention obtain the number location information of each communication number in a pre-established communication number database. The communication numbers in the communication number database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed by a preset machine learning algorithm based on historical communication data of historical communication numbers. The embodiments of the present invention also obtain the device location information of each communication device information in a pre-established communication device information database. The communication devices corresponding to the communication device information in the communication device information database are fraudulent devices determined based on device Internet call detail records, mobile network call detail records, and traffic data, as well as a preset device identification model. The embodiments of the present invention further determine the target device corresponding to the device location information that matches the number location information and obtain the device location information of the target device. The target device is a device that defrauds users by converting Internet calls into mobile network calls. In this way, by matching the location information of fraudulent numbers (i.e., communication numbers in the communication number database) with the location information of fraudulent devices (i.e., communication devices corresponding to communication device information in the communication device information database), the target device used to convert Internet calls into mobile network calls for fraud can be quickly and accurately identified, and the location information of the target device can be obtained. This improves the efficiency and accuracy of locating fraudulent devices (i.e., target devices). At the same time, it also enables proactive discovery of fraudulent devices, reducing the success rate of fraud incidents. Attached Figure Description

[0080] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0081] Figure 1 This is a flowchart illustrating a method for determining device location information according to the present invention.

[0082] Figure 2 This is a flowchart illustrating another method for determining device location information according to the present invention;

[0083] Figure 3 This is a flowchart illustrating a method for determining a number detection model according to the present invention.

[0084] Figure 4This is a flowchart illustrating a method for determining detection results according to the present invention.

[0085] Figure 5 This is a schematic diagram of the structure of a target device determination system according to the present invention;

[0086] Figure 6 This is a schematic diagram of the structure of a device for determining location information according to the present invention;

[0087] Figure 7 This is a schematic diagram of the structure of an electronic device according to the present invention. Detailed Implementation

[0088] This invention provides a method, apparatus, and electronic device for determining device location information.

[0089] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0090] Example 1

[0091] like Figure 1 As shown, this embodiment of the invention provides a method for determining device location information. The execution subject of this method can be a server, which can be an independent server or a server cluster composed of multiple servers. Specifically, the method may include the following steps:

[0092] In S102, the location information of each communication number in the pre-established communication number database is obtained.

[0093] The communication numbers in the communication number database can be fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model can be obtained by training a model constructed through a preset machine learning algorithm based on historical communication data of historical communication numbers. The communication data can be data generated by users using communication numbers. For example, communication data can include call behavior (such as caller ID, call duration, call time, called ID, etc.) and number characteristics (such as number location, number length, number operator information, etc.). The number detection model can be obtained by training a model constructed through a preset machine learning algorithm based on the aforementioned historical communication data of historical communication numbers. The preset machine learning algorithm can be any machine learning algorithm. For example, the preset machine learning algorithm can be a neural network algorithm, a decision tree algorithm, etc. The preset machine learning algorithm can vary depending on the actual application scenario, and this embodiment of the invention does not limit it.

[0094] In practice, fraudulent devices, primarily GOIP devices (i.e., virtual dialing devices), can switch phone numbers arbitrarily from overseas to make calls to victims. A single GOIP device can operate hundreds of mobile phone SIM cards simultaneously. Malicious third parties typically transmit SIM card dialing data to the GOIP device via the network, and then the GOIP device connects to the local communication base station to conduct voice calls and carry out fraudulent activities.

[0095] Because of the separation between humans and machines, combating GOIP fraud is quite difficult. Typically, it requires locating the GOIP device after a fraud incident, relying on the testimony of a malicious third party. However, by this time, the victim has already been victimized, and finding the device through malicious third-party testimony is highly reactive, inefficient, and has a low success rate. Therefore, a solution is needed to improve the efficiency and accuracy of locating fraudulent devices. To this end, this invention provides another implementation scheme, which may include the following:

[0096] Since fraudulent devices connect to a communication base station in the device's location to make voice calls using received SIM card dialing data via a communication base station, the communication numbers in the communication number database can be communication numbers capable of making mobile network calls.

[0097] The location information of each communication number in the communication number database can be obtained. The location information can be the registration location information when the communication number was activated, or the location information of the communication base station that has the most connections with the communication number. There can be a variety of methods to determine the location information of the communication number, which can vary depending on the actual application scenario. This embodiment of the invention does not make specific limitations on this.

[0098] In S104, the device location information of the communication device corresponding to each communication device information in the pre-established communication device information database is obtained.

[0099] Among them, the communication devices corresponding to the communication device information in the communication device information database can be fraudulent devices determined based on device Internet call detail records, mobile network call detail records and traffic data, as well as a preset device identification model. The preset device identification model can be a model obtained by training a model constructed by a preset machine learning algorithm using historical device Internet call detail records, historical mobile network call detail records and historical traffic data.

[0100] In implementation, the device location information of the communication device can be determined based on the traffic data of the communication device. For example, the traffic data of the communication device can be parsed to obtain the corresponding account information, and the corresponding location information (i.e., the location information determined when the account is opened) can be obtained based on the determined account information. The determined location information can be used as the device location information of the communication device. There are many methods for determining the device location information of the communication device, which can vary depending on the actual application scenario. This embodiment of the invention does not make specific limitations on this.

[0101] In S106, the target device corresponding to the device location information that matches the number location information is determined, and the device location information of the target device is obtained.

[0102] Among them, the target device can be a device that defrauds users by converting Internet calls into mobile network calls. For example, the target device can be a GOIP device, which can realize the exchange of voice information between Internet VoIP and telecommunications networks, support dozens or even hundreds of phone cards to make calls at the same time, and support functions such as mass texting and remote control.

[0103] In practice, the location information of the communication number can be matched one by one with the location information of the communication device. If the location information of the communication number and the location information of the device match, then the communication device corresponding to the location information can be considered as the target device for fraud.

[0104] Furthermore, since a target device can support simultaneous calls from multiple communication numbers, a preset quantity threshold can be used to improve the accuracy of target device location. For example, the number of number location information matching the device location information of each communication device can be obtained. If the number of matching numbers for a certain communication device exceeds the preset quantity threshold, then that communication device can be identified as the target device. For instance, if the number of number location information matching the device location information of communication device 1 is 10, and the preset quantity threshold is 3, then communication device 1 can be identified as the target device.

[0105] The above-mentioned method for determining the target device is an optional and feasible method. In actual application scenarios, there can be multiple methods for determining the target device, which may vary depending on the actual application scenario. This embodiment of the invention does not impose any specific limitations on this method.

[0106] This invention provides a method for determining device location information. The method involves: acquiring the location information of each communication number in a pre-established communication number database, where the communication numbers in the database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed using a preset machine learning algorithm based on historical communication data of historical communication numbers; acquiring the device location information of each communication device in a pre-established communication device information database, where the communication devices are fraudulent devices determined based on device internet call detail records, mobile network call detail records, and traffic data, as well as a preset device identification model; determining the target device corresponding to the device location information matching the number location information, and acquiring the device location information of the target device, where the target device is a device that defrauds users by converting internet calls into mobile network calls. In this way, by matching the location information of fraudulent numbers (i.e., communication numbers in the communication number database) with the location information of fraudulent devices (i.e., communication devices corresponding to communication device information in the communication device information database), the target device used to convert Internet calls into mobile network calls for fraud can be quickly and accurately identified, and the location information of the target device can be obtained. This improves the efficiency and accuracy of locating fraudulent devices (i.e., target devices). At the same time, it also enables proactive discovery of fraudulent devices, reducing the success rate of fraud incidents.

[0107] Example 2

[0108] like Figure 2 As shown, this embodiment of the invention provides a method for determining device location information. The execution subject of this method can be a server, which can be an independent server or a server cluster composed of multiple servers. Specifically, the method may include the following steps:

[0109] In S202, the first communication number to be detected and the corresponding communication data are obtained.

[0110] The first communication number can be any communication number within the detection period, and the detection period can be of any duration, such as the last 3 days or the last week.

[0111] In S204, the communication data of the first communication number is input into the pre-trained number detection model to obtain the detection result of the first communication number.

[0112] In practice, the processing of S204 can be varied. One optional implementation is provided below, which can be found in steps one through eight:

[0113] Step 1: Obtain historical communication numbers and corresponding historical communication data.

[0114] Step two: Based on the historical communication data of the historical communication number, determine the first scenario corresponding to the historical communication number.

[0115] The first scenario can include scenarios such as fraudulent number detection, harassing call detection, counterfeit express delivery and food delivery detection, and abnormal user behavior analysis.

[0116] In implementation, features can be extracted from historical communication data using a preset feature extraction method, and the first scenario corresponding to the historical communication number can be determined based on the extracted features. The extracted features may include the ratio of callers to called parties, average call duration, etc.

[0117] Step 3: Obtain the first number detection model corresponding to the first scenario.

[0118] In practice, there can be multiple first number detection models corresponding to the first scenario, and different first number detection models can be built based on different machine learning classification algorithms.

[0119] Step 4: Train the first number detection model based on historical communication data of historical communication numbers and obtain the training results.

[0120] In practice, when there are multiple first number detection models, historical communication data can be input into different first number detection models for training, and multiple training results can be obtained.

[0121] Step 5: Based on the preset evaluation model and training results, determine whether the first number detection model meets the preset detection requirements.

[0122] In implementation, each first number detection model can be evaluated to see if it meets the preset detection requirements based on a preset evaluation model. Since the first number detection model is used to solve a binary classification problem (i.e., to determine whether a communication number is a fraudulent number), the first number detection model can be evaluated to see if it meets the preset detection requirements based on preset evaluation criteria.

[0123] For example, precision and recall can be determined based on the training results of each first number detection model, and then the model score of each first number detection model can be determined based on precision and recall.

[0124] The type of each training result can be determined based on the training results. The type of each training result can be determined by comparing the predicted result and the actual result. For example, as shown in Table 1 below, if the predicted result of the training result is a positive sample (assuming that the positive sample is a fraudulent number and the negative sample is a non-fraudulent number), and the corresponding actual result is a negative sample, then the type of the training result is FP.

[0125] Table 1

[0126]

[0127] Based on Table 1 above, the type of each training result can be determined. By summarizing the types of all training results corresponding to each first number detection model, the number of TPs, FPs, FNs, and TNs corresponding to each first number detection model can be determined.

[0128] Substitute the number of TPs, FPs, FNs, and TNs into the following formula to determine the precision, recall, and model score for each first number detection model.

[0129]

[0130] Where Precision is the accuracy, Recall is the recall, F1 score is the model score, and TP, FP, FN and TN represent the number of TPs, the number of FPs, the number of FNs and the number of TNs, respectively.

[0131] Based on the model score of each first-digit detection model, it can be determined whether the first-digit detection model meets the preset detection requirements. For example, if the model score of the first-digit detection model is greater than the preset model detection threshold, then it can be determined that the first-digit detection model meets the preset detection requirements.

[0132] The method for determining whether the first number detection model meets the preset detection requirements is an optional and implementable method. In actual application scenarios, there can be a variety of different methods, which may vary depending on the actual application scenario. This embodiment of the invention does not impose specific limitations on this.

[0133] Step 6: Determine the first number detection model that meets the preset detection requirements as the number detection model corresponding to the first scenario.

[0134] In implementation, there may be one or more number detection models corresponding to the first scenario. The first number detection model that meets the preset detection requirements can be determined as the number detection model corresponding to the first scenario, and the number detection model can be fixed and saved.

[0135] like Figure 3 As shown, if none of the first number detection models corresponding to the first scenario meet the preset detection requirements, steps two through five can be continued. This involves re-analyzing the communication data of historical communication numbers to redetermine the first scenario corresponding to the historical communication numbers, obtaining the first number detection model corresponding to that first scenario, and training it. This process continues until a first number detection model meets the preset detection requirements.

[0136] Step 7: Obtain the target scenario in the first scenario that matches the communication data of the first communication number.

[0137] In implementation, features can be extracted from the communication data of the first communication number according to a preset feature extraction method, and the target scenario matching the communication data of the first communication number can be determined based on the extracted features. There can be one or more target scenarios.

[0138] Step 8: Obtain the number detection model corresponding to the target scenario, and input the communication data of the first communication number into the number detection model to obtain the detection result of the first communication number.

[0139] In implementation, such as Figure 4 As shown, the communication data of the first communication number can be input into one or more number detection models corresponding to the target scenario. That is, the first communication number can correspond to one or more target scenarios, and each target scenario can correspond to one or more number detection models.

[0140] When multiple number detection models match the first communication number, multiple sub-detection results can be obtained. If the multiple sub-detection results are inconsistent, the communication data of the first communication number can be input into the number detection model again based on a preset number of calls to obtain sub-detection results. The sub-detection result with the larger number of sub-detection results is determined as the detection result of the first communication number.

[0141] For example, if the preset number of calls is M, and there are N number detection models that match the first communication number, then M*N sub-detection results will be obtained in the end. If among the M*N sub-detection results, A sub-detection results indicate that the first communication number is a fraudulent number, and B sub-detection results indicate that the first communication number is not a fraudulent number, assuming that A is not less than B, then it can be determined that the detection result of the first communication number is that the first communication number is a fraudulent number.

[0142] The method for determining the detection result of the first communication number is an optional and implementable method. In actual application scenarios, there can be a variety of different methods, which may vary depending on the actual application scenario. This embodiment of the invention does not impose any specific limitations on this method.

[0143] In S206, based on the detection results, it is determined whether the first communication number is a communication number.

[0144] In S208, the location information of a given communication number is obtained, and a communication number database is constructed based on the communication number and its corresponding location information.

[0145] In S210, the location information of each communication number in the pre-established communication number database is obtained.

[0146] In S212, the Internet call detail records, mobile network call detail records, and traffic data of the first communication device are obtained.

[0147] In implementation, since the target device needs to convert internet calls into mobile network calls, the first communication device used to identify the target device can be a device using the Session Initiation Protocol (SIP). SIP is an IETF standard for establishing VoIP connections and is an application-layer control protocol for multimedia communication (voice and video) over IP networks. It can be used to create, modify, and terminate sessions with one or more devices. SIP parsing can be performed on home broadband traffic data to find traffic data that frequently sends SIP messages, and the device corresponding to this traffic data can be identified as the first communication device.

[0148] After locating the first communication device, the Internet call detail records (CDRs) and mobile network call detail records (CDRs) of that first communication device within a preset detection period can be obtained.

[0149] In S214, the call detail record (CDR) matching degree of the first communication device is determined based on the Internet CDR and the mobile network CDR of the first communication device.

[0150] In practice, since GOIP devices can convert received internet calls into mobile network calls, when a target device commits fraud against a user, it will generate two identical call detail records (CDRs): the internet CDR corresponding to the received internet call and the mobile network CDR corresponding to the forwarded mobile network call. Therefore, based on the internet CDR and mobile network CDR of the first communication device, a consistency match can be performed on the internet CDR and mobile network CDR of the first communication device to obtain the CDR matching degree of the first communication device.

[0151] In S216, the protocol usage information of the first communication device is determined based on the traffic data of the first communication device.

[0152] In practice, the traffic data (such as home broadband internet access logs) of the first communication device can be analyzed to determine the number of sessions using each protocol by the first communication device, and SIP usage information (such as the number of sessions used and / or the percentage of sessions used) can be obtained. The SIP usage information can be identified as the protocol usage information of the first communication device.

[0153] In S218, based on the preset device identification model, the call detail record matching degree of the first communication device, and the protocol usage information, it is determined whether the first communication device is a communication device.

[0154] In implementation and practical applications, the processing method of S218 above can be varied. The following is one optional implementation method, which can be found in steps one through three below:

[0155] Step 1: Based on the preset device detection rules, the call detail record (CDR) matching degree of the first communication device, and the protocol usage information, determine whether the first communication device is the second communication device.

[0156] In practice, if the call unit matching degree of the first communication device is higher than the preset matching degree threshold, and the protocol usage information meets the preset usage information conditions (such as the number of SIP uses being greater than the preset usage number threshold), then the first communication device can be considered as the second communication device.

[0157] Step 2: Obtain the preset feature information of the second communication device.

[0158] The preset features may include at least one or more of the following: behavioral information, location information, and access information.

[0159] For example, behavioral information may include device behavioral information, call behavioral information, SMS behavioral information, etc. Among them, device behavioral information may include the number of times the SIM card installed in the second communication device is turned off within a preset time, the time spent in flight mode, the number of devices associated within the preset time, the number of days it is powered on, the number of days it communicates, etc.

[0160] Call behavior information can include the similarity of the calling and called numbers within a preset time period, the similarity of the number of calls per month, the similarity of the minutes of calls per month after rounding, the call social circle, the number of times the most frequent caller number is the same, and the number of times the same area code and cell identification code are used for mutual calls.

[0161] SMS behavior information can include the number of times automatic replies are sent, the number of SMS contacts, the number of spam and / or fraudulent SMS messages, the number of financial SMS messages, the number of SMS messages sent, and the number of messages initiated by applications.

[0162] Location information can include the number of connections to location area codes and cell identification codes within a preset time period, the number of times the same location area code and cell identification code are connected and move at the same speed within a preset time period, the number of cards with the same highest frequency communication base station, whether the device registration location matches the signaling location, and the density of IoT cards and / or virtual operator cards within a unit area.

[0163] If a communication device makes more calls than a preset number within a preset time period, and its location remains unchanged, it can be considered a potentially fraudulent device. In other words, communication devices can be detected using location information and call behavior information.

[0164] In addition, the preset features may also include whether the communication number corresponding to the SIM card installed in the second communication device is a low-cost number, the network duration of the communication number, and network information, etc.

[0165] Step 3: Based on the preset device identification model and preset feature information, determine whether the second communication device is a communication device.

[0166] In practice, the preset device identification model can be obtained by training a model built by a preset machine learning algorithm based on preset historical feature information. The preset feature information of the second communication device can be input into the pre-trained device identification model to determine whether the second communication device is a communication device used to build a communication device information database.

[0167] In S220, the device location information of the determined communication device is obtained, and a communication device information database is constructed based on the communication device and its corresponding device location information.

[0168] In implementation, the communication number and / or communication number group associated with a specific communication device can be obtained, along with the location information corresponding to the associated communication number and / or communication number group, as the device location information of that communication device. Alternatively, the IP address of the communication device accessing the external network can also be obtained as the corresponding device location information. Based on the communication device and its corresponding device location information, a communication device information database is constructed.

[0169] In S222, the device location information of the communication device corresponding to each communication device information in the pre-established communication device information database is obtained.

[0170] In S224, the server information of the first communication server is obtained.

[0171] The server information includes at least protocol information and port information.

[0172] In practice, normally used communication devices are typically configured on the intranet, while fraudulent communication devices connect to the VoIP server as clients. Therefore, it's generally impossible to actively detect fraudulent devices under normal circumstances. Typically, GOIP devices only have web page configurations for preset ports (such as port 80) open on the intranet. Users must log in with a username and password to view device information. However, for the small number of GOIP devices exposed on the external network (with an external IP address), testing can be conducted using the device's default password and brute-force attacks.

[0173] In GOIP application scenarios, GOIP devices and VoIP servers usually coexist (the two are usually not located together), so you can actively probe and "penetrate" the corresponding VoIP server to assist in passive traffic analysis to find possible GOIP devices.

[0174] In S226, based on the preset server detection rules and the server information of the first communication server, it is determined whether the first communication server is a communication server.

[0175] In practice, based on the GoIP gateway for traffic discovery, or on the premise of knowing a batch of public IP addresses, IP scanning and probing can be performed using server information such as protocol information and port information. Methods such as PING scanning, operating system probing, port scanning, vulnerability scanning, and protocol scanning can be applied to determine whether the first communication server is a communication server.

[0176] In S228, the server location information of the determined communication server is obtained, and a communication server information database is constructed based on the communication server and the corresponding server location information.

[0177] In implementation, the operating system type, main services, VoIP protocol type, version number, and manufacturer information of a specific communication server can be obtained, along with banner information returned after communication with certain specific ports. Based on this information, a communication server information database can be constructed. Furthermore, the server location information can be determined by the mapping between public and private networks.

[0178] In S230, the server location information of each communication server in the pre-established communication server information database is obtained.

[0179] Among them, such as Figure 2 As shown, there is no restriction on the execution order among the above steps S202~S210, S212~S222, and S224~S230.

[0180] In S232, the target device corresponding to the device location information that matches the number location information and the server location information is determined, and the device location information of the target device is obtained.

[0181] In implementation, such as Figure 5 As shown, a device location information determination system can be built based on the above steps. This system can adopt a three-layer architecture, including a data access layer, a big data processing layer, and an application layer.

[0182] The establishment of this system enables comprehensive location tracking of GOIP fraud devices and monitoring of fraudulent mobile phone numbers. By creating a number detection model, fraudulent numbers used for scams can be monitored. Through the analysis of device internet call detail records, mobile network call detail records, and traffic data, combined with passive monitoring and active detection, fraudulent devices can be detected.

[0183] By performing correlation analysis on the location information of the number, the location information of the device, and the location information of the server, the target device can be identified and its location information, as well as the corresponding communication number, can be output.

[0184] The identified target device and its location information can be sent to a pre-defined management department to reduce the success rate of fraud incidents.

[0185] This invention provides a method for determining device location information. The method involves: acquiring the location information of each communication number in a pre-established communication number database, where the communication numbers in the database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed using a preset machine learning algorithm based on historical communication data of historical communication numbers; acquiring the device location information of each communication device in a pre-established communication device information database, where the communication devices are fraudulent devices determined based on device internet call detail records, mobile network call detail records, and traffic data, as well as a preset device identification model; determining the target device corresponding to the device location information matching the number location information, and acquiring the device location information of the target device, where the target device is a device that defrauds users by converting internet calls into mobile network calls. In this way, by matching the location information of fraudulent numbers (i.e., communication numbers in the communication number database) with the location information of fraudulent devices (i.e., communication devices corresponding to communication device information in the communication device information database), the target device used to convert Internet calls into mobile network calls for fraud can be quickly and accurately identified, and the location information of the target device can be obtained. This improves the efficiency and accuracy of locating fraudulent devices (i.e., target devices). At the same time, it also enables proactive discovery of fraudulent devices, reducing the success rate of fraud incidents.

[0186] Example 3

[0187] The above describes a method for determining device location information according to embodiments of the present invention. Based on the same idea, embodiments of the present invention also provide a device for determining device location information, such as... Figure 6 As shown.

[0188] The device for determining the location information of the equipment includes: a first acquisition module 601, a second acquisition module 602, and an information determination module 603, wherein:

[0189] The first acquisition module 601 is used to acquire the number location information of each communication number in a pre-established communication number database. The communication numbers in the communication number database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed by a pre-set machine learning algorithm based on historical communication data of historical communication numbers.

[0190] The second acquisition module 602 is used to acquire the device location information of the communication device corresponding to each communication device information in the pre-established communication device information database. The communication device corresponding to the communication device information in the communication device information database is a fraud device determined based on device Internet call detail records, mobile network call detail records and traffic data, as well as a preset device identification model.

[0191] The information determination module 603 is used to determine the target device corresponding to the device location information that matches the number location information, and to obtain the device location information of the target device, wherein the target device is a device that defrauds users by converting Internet calls into mobile network calls.

[0192] In this embodiment of the invention, the information determination module 603 is used for:

[0193] Obtain the server location information of each communication server in a pre-established communication server information database, wherein the communication server is the server that sends Internet calls to the target device;

[0194] Identify the target device corresponding to the device location information that matches the number location information and the server location information.

[0195] In this embodiment of the invention, the device further includes:

[0196] The third acquisition module is used to acquire server information of the first communication server, wherein the server information includes at least protocol information and port information;

[0197] The server determination module is used to determine whether the first communication server is the communication server based on preset server detection rules and the server information of the first communication server.

[0198] The first construction module is used to obtain the determined server location information of the communication server, and construct the communication server information database based on the communication server and the corresponding server location information.

[0199] In this embodiment of the invention, the device further includes:

[0200] The fourth acquisition module is used to acquire the first communication number to be detected and the corresponding communication data;

[0201] The detection module is used to input the communication data of the first communication number into the pre-trained number detection model to obtain the detection result of the first communication number;

[0202] The determining module is used to determine, based on the detection result, whether the first communication number is the communication number;

[0203] The second construction module is used to obtain the location information of the determined communication number, and construct the communication number database based on the communication number and the corresponding location information.

[0204] In this embodiment of the invention, the device further includes:

[0205] The fifth acquisition module is used to acquire the Internet call detail records, mobile network call detail records, and traffic data of the first communication device;

[0206] The matching module is used to determine the call detail record (CDR) matching degree of the first communication device based on the Internet CDR and mobile network CDR of the first communication device.

[0207] The information determination module is used to determine the protocol usage information of the first communication device based on the traffic data of the first communication device;

[0208] The device determination module is used to determine whether the first communication device is the communication device based on the preset device identification model, the call detail record matching degree of the first communication device, and the protocol usage information of the first communication device.

[0209] The third construction module is used to obtain the determined device location information of the communication device, and construct the communication device information database based on the communication device and the corresponding device location information.

[0210] In this embodiment of the invention, the device determination module is used for:

[0211] Based on preset device detection rules, the call detail record matching degree of the first communication device, and protocol usage information, determine whether the first communication device is the second communication device;

[0212] Acquire preset feature information of the second communication device, wherein the preset features include at least one or more of the following: behavior information, location information, and access information;

[0213] Based on the preset device identification model and the preset feature information, it is determined whether the second communication device is the communication device.

[0214] In this embodiment of the invention, the device further includes:

[0215] The sixth acquisition module is used to acquire historical communication numbers and corresponding historical communication data;

[0216] The scenario determination module is used to determine the first scenario corresponding to the historical communication number based on the historical communication data of the historical communication number;

[0217] The model acquisition module is used to acquire the first number detection model corresponding to the first scenario;

[0218] The training module is used to train the first number detection model based on the historical communication data of the historical communication number and obtain the training results;

[0219] The first determining module is used to determine whether the first number detection model meets the preset detection requirements based on the preset evaluation model and the training results.

[0220] The second determining module is used to determine the first number detection model that meets the preset detection requirements as the number detection model corresponding to the first scenario.

[0221] The detection module is used for:

[0222] Obtain the target scenario in the first scenario that matches the communication data of the first communication number;

[0223] Obtain the number detection model corresponding to the target scenario, and input the communication data of the first communication number into the number detection model to obtain the detection result of the first communication number.

[0224] This invention provides a device for determining device location information. It acquires the location information of each communication number in a pre-established communication number database, where the communication numbers in the database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed using a preset machine learning algorithm based on historical communication data of historical communication numbers. It also acquires the device location information of each communication device in a pre-established communication device information database, where the communication devices are fraudulent devices determined based on device internet call detail records, mobile network call detail records, and traffic data, as well as a preset device identification model. Finally, it determines a target device corresponding to the device location information matching the number location information and acquires the device location information of the target device, which is a device that defrauds users by converting internet calls into mobile network calls. In this way, by matching the location information of fraudulent numbers (i.e., communication numbers in the communication number database) with the location information of fraudulent devices (i.e., communication devices corresponding to communication device information in the communication device information database), the target device used to convert Internet calls into mobile network calls for fraud can be quickly and accurately identified, and the location information of the target device can be obtained. This improves the efficiency and accuracy of locating fraudulent devices (i.e., target devices). At the same time, it also enables proactive discovery of fraudulent devices, reducing the success rate of fraud incidents.

[0225] Example 4

[0226] Figure 7 This is a schematic diagram of the hardware structure of a device according to various embodiments of the present invention.

[0227] The device 700 includes, but is not limited to, components such as: a radio frequency unit 701, a network module 702, an audio output unit 703, an input unit 704, a sensor 705, a display unit 706, a user input unit 707, an interface unit 708, a memory 709, a processor 710, and a power supply 711. Those skilled in the art will understand that... Figure 7 The device structure shown does not constitute a limitation on the device. The device may include more or fewer components than shown, or combine certain components, or have different component arrangements. In embodiments of the present invention, the device includes, but is not limited to, mobile phones, tablet computers, laptops, PDAs, in-vehicle terminals, wearable devices, and pedometers.

[0228] The processor 710 is configured to: acquire the location information of each communication number in a pre-established communication number database, wherein the communication numbers in the database are fraudulent numbers determined based on communication data and a pre-trained number detection model, and the number detection model is obtained by training a model constructed through a preset machine learning algorithm based on historical communication data of historical communication numbers; acquire the device location information of each communication device in a pre-established communication device information database, wherein the communication devices corresponding to the communication device information in the database are fraudulent devices determined based on device internet call detail records, mobile network call detail records, and traffic data, as well as a preset device identification model; determine a target device corresponding to the device location information that matches the number location information, and acquire the device location information of the target device, wherein the target device is a device that defrauds users by converting internet calls into mobile network calls.

[0229] In addition, the processor 710 is also configured to: acquire server location information of each communication server in a pre-established communication server information database, wherein the communication server is a server that sends Internet calls to the target device; and determine the target device corresponding to the device location information that matches the number location information and the server location information.

[0230] In addition, the processor 710 is also configured to: acquire server information of a first communication server, the server information including at least protocol information and port information; determine whether the first communication server is the communication server based on a preset server detection rule and the server information of the first communication server; acquire the server location information of the determined communication server, and construct the communication server information database based on the communication server and the corresponding server location information.

[0231] In addition, the processor 710 is also configured to: acquire a first communication number to be detected and corresponding communication data; input the communication data of the first communication number into the pre-trained number detection model to obtain the detection result of the first communication number; determine whether the first communication number is the communication number based on the detection result; acquire the number location information of the determined communication number, and construct the communication number database based on the communication number and the corresponding number location information.

[0232] In addition, the processor 710 is also configured to: acquire Internet call detail records (CDRs), mobile network call detail records (CDRs), and traffic data of the first communication device; determine the CDR matching degree of the first communication device based on the Internet CDRs and mobile network CDRs of the first communication device; determine the protocol usage information of the first communication device based on the traffic data of the first communication device; determine whether the first communication device is the communication device based on the preset device identification model, the CDR matching degree of the first communication device, and the protocol usage information; acquire the device location information of the determined communication device, and construct the communication device information database based on the communication device and the corresponding device location information.

[0233] In addition, the processor 710 is further configured to: determine whether the first communication device is a second communication device based on preset device detection rules, the call detail record (CDR) matching degree of the first communication device, and protocol usage information; acquire preset feature information of the second communication device, wherein the preset features include at least one or more of behavior information, location information, and access information; and determine whether the second communication device is the communication device based on the preset device identification model and the preset feature information.

[0234] Furthermore, the processor 710 is also configured to: acquire historical communication numbers and corresponding historical communication data; determine a first scenario corresponding to the historical communication number based on the historical communication data of the historical communication number; acquire a first number detection model corresponding to the first scenario; train the first number detection model based on the historical communication data of the historical communication number and acquire training results; determine whether the first number detection model meets preset detection requirements based on a preset evaluation model and the training results; determine the first number detection model that meets the preset detection requirements as the number detection model corresponding to the first scenario; acquire a target scenario in the first scenario that matches the communication data of the first communication number; acquire a number detection model corresponding to the target scenario, and input the communication data of the first communication number into the number detection model to obtain the detection result of the first communication number.

[0235] This invention provides a device that acquires the location information of each communication number in a pre-established communication number database, wherein the communication numbers in the database are fraudulent numbers determined based on communication data and a pre-trained number detection model, and the number detection model is obtained by training a model constructed through a preset machine learning algorithm based on historical communication data of historical communication numbers; acquires the device location information of each communication device in a pre-established communication device information database, wherein the communication devices corresponding to the communication device information in the communication device information database are fraudulent devices determined based on device internet call detail records, mobile network call detail records, and traffic data, as well as a preset device identification model; determines the target device corresponding to the device location information matching the number location information, and acquires the device location information of the target device, wherein the target device is a device that defrauds users by converting internet calls into mobile network calls. In this way, by matching the location information of fraudulent numbers (i.e., communication numbers in the communication number database) with the location information of fraudulent devices (i.e., communication devices corresponding to communication device information in the communication device information database), the target device used to convert Internet calls into mobile network calls for fraud can be quickly and accurately identified, and the location information of the target device can be obtained. This improves the efficiency and accuracy of locating fraudulent devices (i.e., target devices). At the same time, it also enables proactive discovery of fraudulent devices, reducing the success rate of fraud incidents.

[0236] It should be understood that, in this embodiment of the invention, the radio frequency unit 701 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink data from the base station and processes it with the processor 710; additionally, it transmits uplink data to the base station. Typically, the radio frequency unit 701 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, etc. Furthermore, the radio frequency unit 701 can also communicate with networks and other devices through a wireless communication system.

[0237] The device provides users with wireless broadband internet access through the network module 702, enabling them to send and receive emails, browse web pages, and access streaming media.

[0238] The audio output unit 703 can convert audio data received by the radio frequency unit 701 or the network module 702 or stored in the memory 709 into audio signals and output them as sound. Furthermore, the audio output unit 703 can also provide audio output related to specific functions performed by the device 700 (e.g., call signal reception sound, message reception sound, etc.). The audio output unit 703 includes a speaker, a buzzer, and a receiver, etc.

[0239] Input unit 704 is used to receive audio or video signals. Input unit 704 may include a graphics processing unit (GPU) 7041 and a microphone 7042. The GPU 7041 processes image data of still images or videos acquired by an image capture device (such as a camera) in video capture mode or image capture mode. The processed image frames can be displayed on display unit 706. The image frames processed by GPU 7041 can be stored in memory 709 (or other storage medium) or transmitted via radio frequency unit 701 or network module 702. Microphone 7042 can receive sound and process such sound into audio data. The processed audio data can be converted into a format that can be transmitted to a mobile communication base station via radio frequency unit 701 in telephone call mode.

[0240] Device 700 also includes at least one sensor 705, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 7061 according to the ambient light level, and the proximity sensor can turn off the display panel 7061 and / or backlight when the device 700 is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used to identify device posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc. Sensor 705 may also include fingerprint sensors, pressure sensors, iris sensors, molecular sensors, gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., which will not be described in detail here.

[0241] The display unit 706 is used to display information input by the user or information provided to the user. The display unit 706 may include a display panel 7061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0242] User input unit 707 can be used to receive input numeric or character information, and generate key signal inputs related to user settings and function control of the device. Specifically, user input unit 707 includes a touch panel 7071 and other input devices 7072. Touch panel 7071, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near touch panel 7071). Touch panel 7071 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 710, which receives and executes commands from the processor 710. In addition, touch panel 7071 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. Besides touch panel 7071, user input unit 707 may also include other input devices 7072. Specifically, other input devices 7072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, joysticks, etc., which will not be described in detail here.

[0243] Furthermore, the touch panel 7071 can cover the display panel 7061. When the touch panel 7071 detects a touch operation on or near it, it transmits the information to the processor 710 to determine the type of touch event. Subsequently, the processor 710 provides corresponding visual output on the display panel 7061 based on the type of touch event. Although in Figure 7 In this embodiment, the touch panel 7071 and the display panel 7061 are two independent components to realize the input and output functions of the device. However, in some embodiments, the touch panel 7071 and the display panel 7061 can be integrated to realize the input and output functions of the device. The specific implementation is not limited here.

[0244] Interface unit 708 serves as an interface for connecting external devices to device 700. For example, external devices may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, and so on. Interface unit 708 can be used to receive input from external devices (e.g., data, power, etc.) and transmit the received input to one or more components within device 700, or it can be used to transmit data between device 700 and external devices.

[0245] The memory 709 can be used to store software programs and various data. The memory 709 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback, image playback, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). Furthermore, the memory 709 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0246] The processor 710 is the control center of the device, connecting various parts of the device through various interfaces and lines. It performs various functions and processes data by running or executing software programs and / or modules stored in the memory 709, and by calling data stored in the memory 709, thereby providing overall monitoring of the device. The processor 710 may include one or more processing units; preferably, the processor 710 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor 710.

[0247] The device 700 may also include a power supply 711 (such as a battery) for supplying power to various components. Preferably, the power supply 711 can be logically connected to the processor 710 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system.

[0248] Preferably, the present invention also provides a device including a processor 710, a memory 709, and a computer program stored in the memory 709 and executable on the processor 710. When the computer program is executed by the processor 710, it implements the various processes of the above-described method embodiment for determining device location information and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0249] Example 5

[0250] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described method for determining device location information, achieving the same technical effects. To avoid repetition, these processes will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0251] This invention provides a computer-readable storage medium that acquires the location information of each communication number in a pre-established communication number database, wherein the communication numbers in the database are fraudulent numbers determined based on communication data and a pre-trained number detection model, and the number detection model is obtained by training a model constructed through a preset machine learning algorithm based on historical communication data of historical communication numbers; acquires the device location information of each communication device in a pre-established communication device information database, wherein the communication devices corresponding to the communication device information in the communication device information database are fraudulent devices determined based on device internet call detail records, mobile network call detail records, and traffic data, as well as a preset device identification model; determines the target device corresponding to the device location information matching the number location information, and acquires the device location information of the target device, wherein the target device is a device that defrauds users by converting internet calls into mobile network calls. In this way, by matching the location information of fraudulent numbers (i.e., communication numbers in the communication number database) with the location information of fraudulent devices (i.e., communication devices corresponding to communication device information in the communication device information database), the target device used to convert Internet calls into mobile network calls for fraud can be quickly and accurately identified, and the location information of the target device can be obtained. This improves the efficiency and accuracy of locating fraudulent devices (i.e., target devices). At the same time, it also enables proactive discovery of fraudulent devices, reducing the success rate of fraud incidents.

[0252] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0253] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0254] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0255] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0256] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0257] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0258] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0259] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0260] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0261] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A method for determining equipment location information, characterized in that, The method includes: Obtain the location information of each communication number in a pre-established communication number database. The communication numbers in the database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed using a pre-set machine learning algorithm based on historical communication data of historical communication numbers. Obtain the device location information of each communication device in the pre-established communication device information database. The communication devices corresponding to the communication device information in the communication device information database are fraudulent devices determined based on device Internet call detail records, mobile network call detail records and traffic data, as well as a preset device identification model. Identify the target device corresponding to the device location information that matches the number location information, and obtain the device location information of the target device, wherein the target device is a device that defrauds users by converting Internet calls into mobile network calls.

2. The method according to claim 1, characterized in that, The step of determining the target device corresponding to the device location information that matches the number location information includes: Obtain the server location information of each communication server in a pre-established communication server information database, wherein the communication server is the server that sends Internet calls to the target device; Identify the target device corresponding to the device location information that matches the number location information and the server location information.

3. The method according to claim 2, characterized in that, Before obtaining the server location information of each communication server in the pre-established communication server information database, the method further includes: Obtain server information of the first communication server, wherein the server information includes at least protocol information and port information; Based on preset server detection rules and the server information of the first communication server, determine whether the first communication server is the communication server. Obtain the determined server location information of the communication server, and construct the communication server information database based on the communication server and the corresponding server location information.

4. The method according to claim 3, characterized in that, Before obtaining the number location information of each communication number in the pre-established communication number database, the method further includes: Obtain the first communication number to be detected and its corresponding communication data; The communication data of the first communication number is input into the pre-trained number detection model to obtain the detection result of the first communication number; Based on the detection results, determine whether the first communication number is the communication number; Obtain the location information of the determined communication number, and construct the communication number database based on the communication number and the corresponding location information.

5. The method according to claim 4, characterized in that, Before obtaining the device location information of the communication device corresponding to each communication device information in the pre-established communication device information database, the method further includes: Obtain internet call detail records, mobile network call detail records, and traffic data from the first communication device; Based on the Internet call detail records and mobile network call detail records of the first communication device, the call detail record matching degree of the first communication device is determined; Based on the traffic data of the first communication device, determine the protocol usage information of the first communication device; Based on the preset device identification model, the call detail record matching degree of the first communication device, and the protocol usage information, it is determined whether the first communication device is the communication device. Obtain the determined device location information of the communication device, and construct the communication device information database based on the communication device and the corresponding device location information.

6. The method according to claim 5, characterized in that, The step of determining whether the first communication device is the communication device based on the preset device identification model, the call detail record (CDR) matching degree of the first communication device, and the protocol usage information includes: Based on preset device detection rules, the call detail record matching degree of the first communication device, and protocol usage information, determine whether the first communication device is the second communication device; Acquire preset feature information of the second communication device, wherein the preset features include at least one or more of the following: behavior information, location information, and access information; Based on the preset device identification model and the preset feature information, it is determined whether the second communication device is the communication device.

7. The method according to claim 6, characterized in that, Before inputting the communication data of the first communication number into the pre-trained number detection model to obtain the detection result of the first communication number, the method further includes: Retrieve historical communication numbers and corresponding historical communication data; Based on the historical communication data of the historical communication number, determine the first scenario corresponding to the historical communication number; Obtain the first number detection model corresponding to the first scenario; Based on the historical communication data of the historical communication number, the first number detection model is trained, and the training results are obtained; Based on the preset evaluation model and the training results, determine whether the first number detection model meets the preset detection requirements; The first number detection model that meets the preset detection requirements is determined as the number detection model corresponding to the first scenario; The step of inputting the communication data of the first communication number into the pre-trained number detection model to obtain the detection result of the first communication number includes: Obtain the target scenario in the first scenario that matches the communication data of the first communication number; Obtain the number detection model corresponding to the target scenario, and input the communication data of the first communication number into the number detection model to obtain the detection result of the first communication number.

8. A device for determining equipment location information, characterized in that, The device includes: The first acquisition module is used to acquire the location information of each communication number in a pre-established communication number database. The communication numbers in the communication number database are fraudulent numbers determined based on communication data and a pre-trained number detection model. The number detection model is obtained by training a model constructed by a pre-set machine learning algorithm based on historical communication data of historical communication numbers. The second acquisition module is used to acquire the device location information of the communication device corresponding to each communication device information in the pre-established communication device information database. The communication device corresponding to the communication device information in the communication device information database is a fraud device determined based on device Internet call detail records, mobile network call detail records and traffic data, as well as a preset device identification model. The information determination module is used to determine the target device corresponding to the device location information that matches the number location information, and to obtain the device location information of the target device, wherein the target device is a device that defrauds users by converting Internet calls into mobile network calls.

9. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method for determining device location information as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the method for determining device location information as described in any one of claims 1 to 7.

Images