A method, apparatus and readable storage medium for identifying a number

Abstract

This invention provides a method, apparatus, and readable storage medium for number identification. The method includes: acquiring a blacklist of fraudulent numbers and a whitelist of legitimate numbers; using fraudulent numbers in the blacklist and legitimate numbers in the whitelist as seed data, and extracting features corresponding to each seed data based on a pre-obtained graph database; training a classification model based on the extracted features to obtain a trained classification model; analyzing the communication structure of legitimate number nodes obtained by the classification model according to pre-set expert rules to obtain a legitimate number communication graph; and identifying the number to be identified based on the legitimate number communication graph. This method, apparatus, and readable storage medium can solve the problem of false judgments and false detections in existing identification methods, which can easily affect user experience.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus and readable storage medium for number identification. Background Technology

[0002] In recent years, various types of nuisance calls made through telecom operator networks have become increasingly rampant, seriously damaging the brand image of operators and causing significant economic losses to both operators and users. Nuisance calls, due to their diverse types (such as intermediary agents and advertising sales calls), are often difficult to identify accurately using conventional methods, leading to misjudgments and false positives for legitimate users, thus impacting user experience. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the prior art by providing a number identification method, apparatus and readable storage medium to solve the problem that the existing identification methods have the problem of misjudgment and false detection, which can easily affect the user's perception.

[0004] In a first aspect, the present invention provides a method for identifying numbers, comprising:

[0005] Obtain a blacklist of fraudulent phone numbers and a whitelist of legitimate phone numbers;

[0006] Using fraudulent numbers in the blacklist and normal numbers in the whitelist as seed data, features corresponding to each seed data are extracted based on a pre-obtained graph database.

[0007] The classification model is trained based on the extracted features to obtain a well-trained classification model.

[0008] The communication structure of normal number nodes obtained by the classification model is analyzed according to the pre-set expert rules to obtain the normal number communication map;

[0009] The number to be identified is based on the normal number communication map.

[0010] Furthermore, before using fraudulent numbers from the blacklist and legitimate numbers from the whitelist as seed data, and extracting features corresponding to each seed data based on a pre-obtained graph database, the method further includes:

[0011] Collect call detail records (CDRs) for all mobile phone numbers. The CDRs include the calling number, the called number, the call date, and the location of the caller.

[0012] Using the calling number and called number in the call detail record data as entities, the location as an attribute of the entity, the call behavior as a relationship, and the call date as an attribute of the call relationship, the call detail record data is stored in the graph database.

[0013] Furthermore, the extracted features include: whether the peer is a fraudulent number, whether the peer is a suspected fraudulent number, whether the peer is a normal number, out-degree, in-degree, and minimum common neighbor count. The out-degree represents the number of times the corresponding number makes a call as the caller, the in-degree represents the number of times the corresponding number answers a call as the called party, and the minimum common neighbor count represents the minimum number of common neighbors between the corresponding number and adjacent number nodes in the graph database.

[0014] Furthermore, the classification model conforms to the following formula:

[0015] y = ω1x1 + ... + ω n x n +b

[0016] Where n is the total number of features extracted, x1 represents the first extracted feature, and x n Let x1 represent the nth extracted feature, and ω1 represent the weight corresponding to x1. n x represents n The corresponding weights are b, which is the bias coefficient, and y, which is the corresponding category.

[0017] Furthermore, the step of analyzing the communication structure of normal number nodes obtained from the classification model according to pre-set expert rules to obtain a normal number communication map specifically includes:

[0018] Based on the classification model, nodes in the graph database that are classified as normal numbers and nodes with adjacent relationships are extracted;

[0019] The communication structure of nodes with the extracted category of normal numbers and adjacent nodes is analyzed according to the expert rules to obtain the normal number communication map.

[0020] Furthermore, the identification of the number to be identified based on the normal number communication map specifically includes:

[0021] If the number to be identified is located in the normal number communication map, then the number to be identified is determined to be a normal number.

[0022] Furthermore, the method also includes:

[0023] The whitelist is expanded based on the normal number communication map.

[0024] Secondly, the present invention provides a number identification device, comprising:

[0025] The blacklist / whitelist acquisition module is used to acquire a blacklist of fraudulent numbers and a whitelist of legitimate numbers.

[0026] The feature extraction module, connected to the blacklist / whitelist acquisition module, is used to extract the features corresponding to each seed data by taking the fraudulent numbers in the blacklist and the normal numbers in the whitelist as seed data and extracting the features corresponding to each seed data according to the pre-obtained graph database.

[0027] A classification model training module, connected to the feature extraction module, is used to train a classification model based on the extracted features to obtain a trained classification model.

[0028] A communication graph generation module, connected to the classification model training module, is used to analyze the communication structure of normal number nodes obtained by the classification model according to pre-set expert rules, and obtain a normal number communication graph.

[0029] The number recognition module is connected to the communication map generation module and is used to recognize the number to be recognized based on the normal number communication map.

[0030] Thirdly, the present invention provides a number identification device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the number identification method described in the first aspect above.

[0031] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the number identification method described in the first aspect.

[0032] The present invention provides a method, apparatus, and readable storage medium for number identification. First, a blacklist of fraudulent numbers and a whitelist of legitimate numbers are obtained. Fraudulent numbers in the blacklist and legitimate numbers in the whitelist are used as seed data. Features corresponding to each seed data are extracted based on a pre-obtained graph database. Then, a classification model is trained based on the extracted features to obtain a trained classification model. Next, the communication structure of legitimate number nodes obtained by the classification model is analyzed according to pre-set expert rules to obtain a legitimate number communication graph. Finally, the number to be identified is identified based on the legitimate number communication graph. This application studies the communication behavior characteristics of legitimate user numbers through a graph database, enabling the identification of legitimate numbers. This reduces the false positive rate in fraud identification scenarios, improves user perception, and solves the problem of false positives and false negatives in existing identification methods, which easily affect user experience. Attached Figure Description

[0033] Figure 1 This is a flowchart of a number identification method according to Embodiment 1 of the present invention;

[0034] Figure 2This is a schematic diagram of the structure of a number recognition device according to Embodiment 2 of the present invention;

[0035] Figure 3 This is a schematic diagram of the structure of a number recognition device according to Embodiment 3 of the present invention. Detailed Implementation

[0036] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0037] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0038] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0039] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0040] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0041] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0042] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0043] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0044] Example 1:

[0045] This embodiment provides a method for identifying phone numbers, such as... Figure 1 As shown, the method includes:

[0046] Step S101: Obtain the blacklist of fraudulent numbers and the whitelist of legitimate numbers.

[0047] In this embodiment, the blacklist stores fraudulent numbers that have been reported in advance, while the whitelist stores legitimate numbers belonging to high-loyalty, high-value service plans. Telecommunications operators can periodically or irregularly add known fraudulent numbers to the blacklist and save legitimate numbers belonging to high-loyalty, high-value service plans to the whitelist.

[0048] Step S102: Using the fraudulent numbers in the blacklist and the normal numbers in the whitelist as seed data, extract the features corresponding to each seed data according to the pre-obtained graph database.

[0049] In this embodiment, fraudulent numbers in the blacklist and normal numbers in the whitelist are used as seed data. Features of each data are extracted. The extracted features are shown in Table 1, including: whether the peer is a fraudulent number, whether the peer is a suspected fraudulent number, whether the peer is a normal number, out-degree, in-degree, and minimum number of common neighbors.

[0050] Table 1, Extracted Features

[0051]

[0052] Among them, "Is the peer number a fraudulent number?" indicates whether the peer number of the current number is a fraudulent number in the blacklist, with a value of {0, 1}, where 1 represents yes and 0 represents no; "Is the peer number a suspected fraudulent number?" indicates whether the peer number of the current number is a suspected fraudulent number in the blacklist, with a value of {0, 1}, where 1 represents yes and 0 represents no; "Is the peer number a normal number?" indicates whether the peer number of the current number is a number in the whitelist, with a value of {0, 1}, where 1 represents yes and 0 represents no; "Out-degree" indicates the number of calls made by the corresponding number as the caller; "In-degree" indicates the number of calls answered by the corresponding number as the callee; "Minimum number of common neighbors" indicates the minimum number of common neighbors between the corresponding number and adjacent number nodes in the graph database. For example, if A has a call relationship with B, B has a call relationship with C, and A has a call relationship with C, then the minimum number of common neighbors of A is 1.

[0053] Optionally, before using fraudulent numbers in the blacklist and legitimate numbers in the whitelist as seed data, and extracting features corresponding to each seed data based on a pre-obtained graph database, the method may further include:

[0054] Collect call detail records (CDRs) for all mobile phone numbers. The CDRs include the calling number, the called number, the call date, and the location of the caller.

[0055] Using the calling number and called number in the call detail record data as entities, the location as an attribute of the entity, the call behavior as a relationship, and the call date as an attribute of the call relationship, the call detail record data is stored in the graph database.

[0056] In this embodiment, a corresponding graph database is constructed for subsequent identification of the communication graph structure. A graph database is a data management system designed for efficient storage and querying of graph data, using points and edges as basic storage units. It clearly expresses the relationships between independent entities by constructing a graph structure of "points" as entities and "edges" as relationships, reflecting dependencies and enabling rapid response to complex relational queries. It is a superior method for storing, querying, and analyzing interconnected data. Specifically, the telecom operator collects call detail records (CDRs) for all mobile phone numbers, including caller ID, called ID, call date, and location. The location can be the province corresponding to the number or the user. The metadata is stored in the graph database, with the number as the entity and its attributes including "location" and "phone number," the call behavior as the relationship, and the call date as the call relationship attribute.

[0057] Step S103: Train the classification model based on the extracted features to obtain the trained classification model.

[0058] Specifically, the classification model conforms to the following formula:

[0059] y = ω1x1 + ... + ω n x n +b

[0060] Where n is the total number of features extracted, x1 represents the first extracted feature, and x n Let x1 represent the nth extracted feature, and ω1 represent the weight corresponding to x1. n x represents n The corresponding weights are b, which is the bias coefficient, and y, which is the corresponding category.

[0061] In this embodiment, a classification model is constructed using a known sample set, which includes positive and negative samples. A sample (X, Y) is selected from the sample set and input into the classification model, where X is a set of values ​​for multiple features, and n is preferably equal to 6, i.e., x1 to x2. n These represent whether the peer is a fraudulent number, whether the peer is a suspected fraudulent number, whether the peer is a legitimate number, out-degree, in-degree, and minimum number of common neighbors, respectively. When the sample category Y = 1, i.e., a legitimate number, and the calculated result y <= 0, the weights ω and b are updated; when the sample category Y = -1, i.e., a fraudulent number, and the calculated result y >= 0, the weights ω and b are updated and training is repeated until the above conditions are no longer met for all samples in the training sample set, at which point convergence is achieved.

[0062] Step S104: Analyze the communication structure of the normal number nodes obtained by the classification model according to the pre-set expert rules to obtain the normal number communication map.

[0063] Optionally, the step of analyzing the communication structure of normal number nodes obtained from the classification model according to pre-set expert rules to obtain a normal number communication map specifically includes:

[0064] Based on the classification model, nodes in the graph database that are classified as normal numbers and nodes with adjacent relationships are extracted;

[0065] The communication structure of nodes with the extracted category of normal numbers and adjacent nodes is analyzed according to the expert rules to obtain the normal number communication map.

[0066] In this embodiment, the communication structure of normal user nodes obtained by the classification model is studied according to expert rules. This is used to assist other user classification models and common call behavior patterns to obtain a communication graph that can be used to determine normal users. This graph can be used to correct misjudged black numbers in new call detail records / user communication data generated in subsequent services.

[0067] It should be noted that as fraudulent behaviors and characteristics continue to evolve, this step can also be adjusted periodically according to the classification model to ensure the timeliness and accuracy of the map features.

[0068] Step S105: Identify the number to be identified based on the normal number communication map.

[0069] In this embodiment, if the number to be identified is located in the normal number communication map, then the number to be identified is determined to be a normal number; otherwise, the number to be identified is determined to be an abnormal number.

[0070] In this embodiment, in order to reduce the false positive rate in fraud identification scenarios, the whitelist can be expanded according to the normal number communication map, and then normal numbers can be further identified through the whitelist.

[0071] In one specific embodiment, the method for identifying the number may include the following steps:

[0072] (1) Telecommunication operators collect call detail records (CDRs) of numbers, including indicators such as caller ID, called number, call date, and location. In order to identify the communication graph structure, the metadata is stored in the graph database with the number as the entity and its attributes including "location" and "telephone number". The call behavior is used as the relationship and the call date is used as the call relationship attribute.

[0073] (2) Import the blacklist of reported fraudulent numbers and the whitelist of high-loyalty, high-value package phone numbers as seed data for identification. Extract the features of each data point, including: whether the other end is a fraudulent number, whether the other end is a suspected fraudulent number, whether the other end is a normal number, out-degree, in-degree, and minimum number of common neighbors.

[0074] Among them, "Is the peer number a fraudulent number?" indicates whether the peer number of the current number is a fraudulent number in the blacklist, with a value of {0, 1}, where 1 represents yes and 0 represents no; "Is the peer number a suspected fraudulent number?" indicates whether the peer number of the current number is a suspected fraudulent number in the blacklist, with a value of {0, 1}, where 1 represents yes and 0 represents no; "Is the peer number a normal number?" indicates whether the peer number of the current number is a number in the whitelist, with a value of {0, 1}, where 1 represents yes and 0 represents no; "Out-degree" indicates the number of calls made by the corresponding number as the caller; "In-degree" indicates the number of calls answered by the corresponding number as the called party; "Minimum number of common neighbors" indicates the minimum number of common neighbors between the corresponding number and adjacent number nodes in the graph database.

[0075] (3) Construct a classification model using the known dataset, where x represents the extracted relevant features. Select a sample (X, Y) from the sample set and input it into the model, where X is the set of values ​​for multiple features and Y represents the class of the current sample.

[0076] y = ω1x1 + ... + ω n x n +b

[0077] When the sample category Y = 1, which is a normal user, and the calculated result y <= 0, update the weights ω and b; when the sample category Y = -1, which is an abnormal user, and the calculated result y >= 0, update the weights ω and b and repeat the training until the above conditions are no longer met for all samples in the training sample set, then convergence is achieved.

[0078] The above provides a classification model based on blacklist / whitelist databases and existing data, which determines the category of a normal user based on their communication behavior.

[0079] (4) Based on the classification model completed above, nodes labeled as normal users and their adjacent relationship nodes are extracted. After expert research, the most representative graph structure is obtained to assist the above model in identifying normal users. For example, preliminary research found that stable triangular communication relationships in the graph database can be used as a standard communication graph for determining normal phone numbers.

[0080] (5) Identify normal numbers through normal number communication graphs, expand the enterprise whitelist, and reduce the false judgment rate in fraud identification scenarios.

[0081] The number identification method provided in this invention first obtains a blacklist of fraudulent numbers and a whitelist of legitimate numbers; then, using the fraudulent numbers in the blacklist and the legitimate numbers in the whitelist as seed data, features corresponding to each seed data are extracted based on a pre-obtained graph database; next, a classification model is trained based on the extracted features to obtain a trained classification model; then, the communication structure of the legitimate number nodes obtained by the classification model is analyzed according to pre-set expert rules to obtain a legitimate number communication graph; finally, the number to be identified is identified based on the legitimate number communication graph. This application studies the communication behavior characteristics of legitimate user numbers through a graph database, and can obtain a legitimate number communication graph. The legitimate number communication graph enables the identification of legitimate numbers, reduces the false positive rate in fraud identification scenarios, improves user perception, and solves the problem of false positives and false negatives in existing identification methods, which easily affect user perception.

[0082] Example 2:

[0083] like Figure 2 As shown, this embodiment provides a number identification device for performing the above-described number identification method, including:

[0084] The blacklist / whitelist acquisition module 11 is used to acquire a blacklist of fraudulent numbers and a whitelist of legitimate numbers.

[0085] Feature extraction module 12, connected to blacklist / whitelist acquisition module 11, is used to extract features corresponding to each seed data by taking fraudulent numbers in the blacklist and normal numbers in the whitelist as seed data and extracting features corresponding to each seed data according to a pre-obtained graph database.

[0086] The classification model training module 13 is connected to the feature extraction module 12 and is used to train the classification model based on the extracted features to obtain the trained classification model.

[0087] The communication graph generation module 14 is connected to the classification model training module 13 and is used to analyze the communication structure of the normal number nodes obtained by the classification model according to the pre-set expert rules to obtain the normal number communication graph.

[0088] The number recognition module 15 is connected to the communication map generation module 14 and is used to recognize the number to be identified based on the normal number communication map.

[0089] Optionally, the device further includes:

[0090] The call detail record (CDR) data acquisition module is used to collect call detail records for all mobile phone numbers. The call detail records include the calling number, the called number, the call date, and the location of the caller.

[0091] The graph database module is used to store call detail records (CDRs) in the graph database, with the calling number and called number in the call detail record data as entities, the location as an attribute of the entity, the call behavior as a relationship, and the call date as an attribute of the call relationship.

[0092] Optionally, the extracted features include: whether the peer is a fraudulent number, whether the peer is a suspected fraudulent number, whether the peer is a normal number, out-degree, in-degree, and minimum common neighbor count, wherein the out-degree represents the number of times the corresponding number makes a call as the caller, the in-degree represents the number of times the corresponding number answers a call as the called party, and the minimum common neighbor count represents the minimum number of common neighbors between the corresponding number and adjacent number nodes in the graph database.

[0093] Optionally, the classification model conforms to the following formula:

[0094] y = ω1x1 + ... + ω n x n +b

[0095] Where n is the total number of features extracted, x1 represents the first extracted feature, and x n Let x1 represent the nth extracted feature, and ω1 represent the weight corresponding to x1. n x represents n The corresponding weights are b, which is the bias coefficient, and y, which is the corresponding category.

[0096] Optionally, the communication map generation module 14 specifically includes:

[0097] The extraction unit is used to extract nodes in the graph database that are classified as normal numbers and nodes with adjacent relationships based on the classification model.

[0098] The communication structure analysis unit is used to analyze the communication structure of nodes with the extracted category of normal numbers and nodes with adjacent relationships according to the expert rules, so as to obtain the normal number communication map.

[0099] Optionally, the number recognition module 15 is specifically used for:

[0100] If the number to be identified is located in the normal number communication map, then the number to be identified is determined to be a normal number.

[0101] Optionally, the device further includes:

[0102] The whitelist expansion module is used to expand the whitelist based on the normal number communication map.

[0103] Example 3:

[0104] refer to Figure 3This embodiment provides a number identification device, including a memory 21 and a processor 22. The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the number identification method in Embodiment 1.

[0105] The memory 21 is connected to the processor 22. The memory 21 can be a flash memory, a read-only memory or other memory, and the processor 22 can be a central processing unit or a microcontroller.

[0106] Example 4:

[0107] This embodiment provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the number identification method in Embodiment 1 above.

[0108] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0109] The number identification device and readable storage medium provided in Examples 2 to 4 first acquire a blacklist of fraudulent numbers and a whitelist of normal numbers; then, using the fraudulent numbers in the blacklist and the normal numbers in the whitelist as seed data, features corresponding to each seed data are extracted based on a pre-obtained graph database; a classification model is then trained based on the extracted features to obtain a trained classification model; next, the communication structure of the normal number nodes obtained by the classification model is analyzed according to pre-set expert rules to obtain a normal number communication graph; finally, the number to be identified is identified based on the normal number communication graph. This application studies the communication behavior characteristics of normal user numbers through a graph database, and can obtain a normal number communication graph. The normal number communication graph enables the identification of normal numbers, reduces the false positive rate in fraud identification scenarios, improves user perception, and solves the problem of false positives and false negatives in existing identification methods, which easily affect user perception.

[0110] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying a number, characterized in that, include: Obtain a blacklist of fraudulent phone numbers and a whitelist of legitimate phone numbers; Using fraudulent numbers in the blacklist and normal numbers in the whitelist as seed data, features corresponding to each seed data are extracted based on a pre-obtained graph database. The classification model is trained based on the extracted features to obtain a well-trained classification model. The communication structure of normal number nodes obtained by the classification model is analyzed according to the pre-set expert rules to obtain the normal number communication map; Identify the number to be identified based on the normal number communication map; The step of analyzing the communication structure of normal number nodes obtained from the classification model according to pre-set expert rules to obtain a normal number communication map specifically includes: Based on the classification model, nodes in the graph database that are classified as normal numbers and nodes with adjacent relationships are extracted; The communication structure of nodes with the extracted category of normal numbers and adjacent nodes is analyzed according to the expert rules to obtain the normal number communication map; The process of identifying the number to be identified based on the normal number communication map specifically includes: If the number to be identified is located in the normal number communication map, then the number to be identified is determined to be a normal number.

2. The method according to claim 1, characterized in that, Before using the fraudulent numbers in the blacklist and the legitimate numbers in the whitelist as seed data, and extracting the features corresponding to each seed data based on the pre-obtained graph database, the method further includes: Collect call detail records (CDRs) for all mobile phone numbers. The CDRs include the calling number, the called number, the call date, and the location of the caller. Using the calling number and called number in the call detail record data as entities, the location as an attribute of the entity, the call behavior as a relationship, and the call date as an attribute of the call relationship, the call detail record data is stored in the graph database.

3. The method according to claim 2, characterized in that, The extracted features include: whether the peer is a fraudulent number, whether the peer is a suspected fraudulent number, whether the peer is a normal number, out-degree, in-degree, and minimum common neighbor count. The out-degree represents the number of times the corresponding number makes a call as the caller, the in-degree represents the number of times the corresponding number answers a call as the called party, and the minimum common neighbor count represents the minimum number of common neighbors between the corresponding number and adjacent number nodes in the graph database.

4. The method according to claim 3, characterized in that, The classification model conforms to the following formula: y=ω1x1+…+ω n x n +b Where n is the total number of features extracted, x1 represents the first extracted feature, and x n Let x1 represent the nth extracted feature, and ω1 represent the weight corresponding to x1. n x represents n The corresponding weights are b, which is the bias coefficient, and y, which is the corresponding category.

5. The method according to claim 1, characterized in that, The method further includes: The whitelist is expanded based on the normal number communication map.

6. A number identification device, characterized in that, include: The blacklist / whitelist acquisition module is used to acquire a blacklist of fraudulent numbers and a whitelist of legitimate numbers. The feature extraction module, connected to the blacklist / whitelist acquisition module, is used to extract the features corresponding to each seed data by taking the fraudulent numbers in the blacklist and the normal numbers in the whitelist as seed data and extracting the features corresponding to each seed data according to the pre-obtained graph database. A classification model training module, connected to the feature extraction module, is used to train a classification model based on the extracted features to obtain a trained classification model. A communication graph generation module, connected to the classification model training module, is used to analyze the communication structure of normal number nodes obtained by the classification model according to pre-set expert rules, and obtain a normal number communication graph. The number recognition module is connected to the communication map generation module and is used to recognize the number to be identified based on the normal number communication map; The communication map generation module specifically includes: The extraction unit is used to extract nodes in the graph database that are classified as normal numbers and nodes with adjacent relationships based on the classification model. The communication structure analysis unit is used to analyze the communication structure of the extracted nodes of the category of normal numbers and the nodes of adjacent relationships according to the expert rules, so as to obtain the normal number communication map; The number recognition module is specifically used for: If the number to be identified is located in the normal number communication map, then the number to be identified is determined to be a normal number.

7. A number identification device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to implement the number identification method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the number identification method as described in any one of claims 1-5.

Images