Abnormal communication number identification method and device, storage medium and electronic equipment

Abstract

The application belongs to the field of artificial intelligence, and relates to an abnormal communication number identification method and device, a storage medium and an electronic equipment. The method comprises the following steps: obtaining multiple groups of communication data corresponding to a target feature, preprocessing the communication data to generate a data wide table, wherein each group of the communication data corresponds to a different communication number; performing standardization processing on the communication data in the data wide table, inputting the standardized communication data into an entropy weight method model, determining an abnormal score corresponding to each communication number according to the entropy weight value corresponding to different features through the entropy weight method model; obtaining target communication data corresponding to a key feature in the target feature, inputting the target communication data corresponding to each communication number and the abnormal score into a classification model, classifying each communication number through the classification model, and outputting classification information corresponding to each communication number. The application can improve the identification accuracy of abnormal communication numbers.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method for identifying abnormal communication numbers, a system for identifying abnormal communication numbers, a computer storage medium, and an electronic device. Background Technology

[0002] Telecommunications fraud cases are frequent in society. Telecommunications fraud not only causes victims to suffer financial and even personal losses, but also damages the social trust environment and undermines social harmony and stability.

[0003] Telecommunications operators actively participate in the prevention and combating of telecommunications fraud, maintaining normal telecommunications order and protecting the legitimate rights and interests of the public. Currently, there is no comprehensive intelligent system or solution for the prevention and identification of telecommunications fraud in this field. Therefore, there is an urgent need to innovate and research a method for identifying abnormal communication numbers, so that the identified abnormal communication numbers can be provided to relevant departments for shutdown or other processing. This can effectively prevent telecommunications fraud cases, create a legal environment that effectively curbs telecommunications fraud, and also play a crucial role in reducing user complaint rates.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application. Summary of the Invention

[0005] The purpose of this application is to provide a method for identifying abnormal communication numbers, a system for identifying abnormal communication numbers, a computer storage medium, and an electronic device, thereby improving the accuracy of detecting abnormal communication numbers to at least a certain extent.

[0006] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0007] According to a first aspect of this application, a method for identifying abnormal communication numbers is provided, comprising:

[0008] Multiple sets of communication data corresponding to target features are acquired, and the communication data is preprocessed to generate a wide data table, wherein each set of communication data corresponds to a different communication number; the communication data in the wide data table is standardized, and the standardized communication data is input into an entropy weight model, which determines the anomaly score corresponding to each communication number based on the entropy weight value corresponding to different features; target communication data corresponding to key features in the target features are acquired, and the target communication data and anomaly scores corresponding to each communication number are input into a classification model, which classifies each communication number to output classification information corresponding to each communication number.

[0009] According to a second aspect of this application, an identification device for abnormal communication numbers is provided, comprising:

[0010] A wide table generation module is used to acquire multiple sets of communication data corresponding to target features, preprocess the communication data to generate a wide data table, wherein each set of communication data corresponds to a different communication number; a scoring module is used to standardize the communication data in the wide data table, and input the standardized communication data into an entropy weight model, which determines the anomaly score corresponding to each communication number based on the entropy weight value corresponding to different features; a classification module is used to acquire target communication data corresponding to key features in the target features, input the target communication data and anomaly scores corresponding to each communication number into a classification model, and classify each communication number through the classification model to output classification information corresponding to each communication number.

[0011] In one embodiment of this application, the wide table generation module is configured to perform data cleaning and data integration on the user feature data to generate the wide data table, wherein the data cleaning involves handling outliers and missing values, and the data integration involves integrating data corresponding to the same features obtained through different means.

[0012] In one embodiment of this application, the scoring module is configured as follows:

[0013] When the value of the communication data is larger, and the probability that the communication number is an abnormal number is greater, the standardization process is performed according to formula (1):

[0014]

[0015] The larger the value of the communication data, the smaller the probability that the communication number is an abnormal number. The standardization process is then performed according to formula (2):

[0016]

[0017] Among them, X ij For the communication data corresponding to the j-th feature of the i-th communication number, X ij * For X ij The data obtained after standardization, min(X) j ) represents the minimum communication data among all communication numbers corresponding to the j-th feature, max(X) j ) represents the maximum communication data among the j-th features corresponding to all communication numbers.

[0018] In one embodiment of this application, the target feature includes multiple features; the scoring module is configured to: obtain the entropy weight corresponding to each feature; multiply the entropy weight corresponding to each feature by the standardized communication data to obtain the sub-score corresponding to each feature; and add the sub-scores corresponding to all features to obtain the anomaly score.

[0019] In one embodiment of this application, the key features are outbound call dispersion and the number of rejected calls; the classification module includes: an input unit, used to input target communication data corresponding to each of the communication numbers and characterized by outbound call dispersion and the number of rejected calls, and an anomaly score corresponding to each of the communication numbers into the classification model; and a classification unit, used to process the target communication data and the anomaly score according to a preset rule through the classification model to obtain classification information corresponding to each of the communication numbers; wherein, the preset rule is a rule determined based on the anomaly score, outbound call dispersion, and the number of rejected calls.

[0020] In an exemplary embodiment of this application, the classification model is a decision tree model or a random forest model; the preset rules include a first rule, a second rule, and a third rule. The expression of the first rule is: anomaly score > anomaly score threshold and outgoing call dispersion > first outgoing call dispersion threshold and number of rejections > first number of rejections threshold. The expression of the second rule is: anomaly score > anomaly score threshold and outgoing call dispersion ∈ outgoing call dispersion interval and number of rejections > second number of rejections threshold. The expression of the third rule is: anomaly score > anomaly score threshold and outgoing call dispersion < second outgoing call dispersion threshold and number of rejections > second number of rejections threshold. Wherein, the first outgoing call dispersion threshold is different from the second outgoing call dispersion threshold, and the first number of rejections threshold is different from the second number of rejections threshold.

[0021] In an exemplary embodiment of this application, the classification unit is configured to: determine the communication number as a fraudulent harassment number when the target communication data and the anomaly score satisfy the first rule; determine the communication number as a communication number with abnormal behavior when the target communication data and the anomaly score satisfy the second rule; and determine the communication number as a targeted harassment number when the target communication data and the anomaly score satisfy the third rule.

[0022] In an exemplary embodiment of this application, when the communication number is a fraudulent harassment number, the device for identifying the abnormal communication number is further configured to: convert the abnormal score corresponding to the fraudulent harassment number into a percentage system to obtain a percentage value corresponding to the abnormal score; compare the percentage value with a first threshold and a second threshold; when the percentage value is greater than or equal to the first threshold, mark the communication number as a highly suspected fraudulent harassment number; when the percentage value is greater than or equal to the second threshold and less than the first threshold, mark the communication number as a moderately suspected fraudulent harassment number; when the percentage value is less than the second threshold, mark the communication number as a low-suspicious fraudulent harassment number.

[0023] In an exemplary embodiment of this application, the device for identifying abnormal communication numbers is further configured to: before inputting the standardized communication data into the entropy weight method model, acquire communication data samples corresponding to communication numbers marked as fraudulent harassment numbers and corresponding to the target features; preprocess and standardize the communication data samples to obtain target communication data samples; determine the feature weight of the i-th fraudulent harassment number corresponding to the j-th target feature based on the target communication data samples; determine the entropy value of the i-th fraudulent harassment number corresponding to the j-th target feature based on the feature weight; determine the difference coefficient of the i-th fraudulent harassment number corresponding to the j-th target feature based on the entropy value; and determine the entropy weight of the i-th fraudulent harassment number corresponding to the j-th target feature based on the difference coefficient; wherein i and j are both positive integers.

[0024] In an exemplary embodiment of this application, the device for identifying abnormal communication numbers is further configured to: acquire communication data corresponding to multi-dimensional features before acquiring multiple sets of communication data corresponding to target features; preprocess the communication data to generate a wide data table; perform correlation analysis on the features of each dimension in the wide data table to obtain the target features; wherein the communication data corresponding to multi-dimensional features includes communication data corresponding to communication numbers marked as fraudulent harassment numbers and communication data corresponding to communication numbers marked as non-fraudulent harassment numbers.

[0025] According to a third aspect of this application, a computer storage medium is provided, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, it implements the above-described method for identifying abnormal communication numbers.

[0026] According to a fourth aspect of this application, an electronic device is provided, characterized in that it comprises:

[0027] Processor; and

[0028] Memory for storing the executable instructions of the processor;

[0029] The processor is configured to execute the aforementioned method for identifying abnormal communication numbers by executing the executable instructions.

[0030] As can be seen from the above technical solutions, the abnormal communication number identification method, abnormal communication number identification device, computer storage medium, and electronic device in the exemplary embodiments of this application have at least the following advantages and positive effects:

[0031] The method for identifying abnormal communication numbers in this application involves acquiring multiple sets of communication data corresponding to target features, preprocessing the communication data to generate a wide data table, where each set of communication data corresponds to a different communication number; then, standardizing the communication data in the wide data table and inputting the standardized communication data into an entropy weight model, which determines the anomaly score corresponding to each communication number based on the entropy weight value corresponding to different features; next, acquiring target communication data corresponding to key features in the target features, and inputting the target communication data and anomaly scores corresponding to each communication number into a classification model, which classifies each communication number to output classification information corresponding to each communication number. The method for identifying abnormal communication numbers in this application can accurately calculate the anomaly score of communication numbers through the entropy weight model, and then accurately classify communication numbers according to preset rules through the classification model, thereby improving the accuracy of abnormal communication number identification.

[0032] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application. Attached Figure Description

[0033] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0034] Figure 1 A schematic diagram of the system architecture for applying the method for identifying abnormal communication numbers in the embodiments of this application is shown.

[0035] Figure 2 A schematic diagram illustrating the flowchart of the method for identifying abnormal communication numbers in an embodiment of this application is shown.

[0036] Figure 3 The diagram illustrates the relationship between the outgoing call dispersion of a communication number and the daily average number of outgoing calls in an embodiment of this application.

[0037] Figure 4 The diagram illustrates the relationship between the caller dispersion and the daily average of calls in an embodiment of this application.

[0038] Figure 5 The schematic diagram illustrates the process of calculating the entropy weights corresponding to different features in the embodiments of this application.

[0039] Figure 6 The entropy weights and extreme values ​​corresponding to different features in the embodiments of this application are illustrated schematically.

[0040] Figure 7 The schematic diagram illustrates the process for determining the category of fraudulent and harassing numbers in an embodiment of this application.

[0041] Figure 8 A schematic block diagram of the device for identifying abnormal communication numbers in this application is shown.

[0042] Figure 9 A schematic diagram of a computer system architecture suitable for implementing the embodiments of this application is shown. Detailed Implementation

[0043] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0044] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0045] The terms “a,” “an,” “the,” and “the” are used in this specification to indicate the presence of one or more elements / components / etc.; the terms “including” and “having” are used to indicate an open-ended inclusion and to mean that there may be other elements / components / etc. in addition to the listed elements / components / etc.; the terms “first” and “second” are used only as markings and are not a limitation on the number of objects.

[0046] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0047] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0048] Before providing a detailed description of the technical solutions in the embodiments of this application, the technical terms that may be involved in the embodiments of this application will be explained and described first.

[0049] (1) Entropy weight model: A machine learning model that uses the entropy weights corresponding to different features of the numbers marked as fraudulent or harassing numbers as model parameters.

[0050] (2) Classification model: Classification models are used to make decisions or assign items to categories.

[0051] After introducing the technical terms that may be involved in the embodiments of this application, the method for identifying abnormal communication numbers in this application will be described in detail.

[0052] Figure 1 An exemplary system architecture block diagram illustrating the application of the technical solutions of this application is shown.

[0053] like Figure 1 As shown, the system architecture 100 may include terminal device 101, server 102, and network 103. Terminal device 101 may include various electronic devices with display screens, such as smartphones, tablets, laptops, desktop computers, smart TVs, and smart vehicle terminals. Server 102 may be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. Network 103 may be a communication medium of various connection types capable of providing a communication link between terminal device 101 and server 102, such as a wired communication link or a wireless communication link.

[0054] In an exemplary embodiment of this application, the communication service provider can obtain a large number of communication numbers and corresponding multi-dimensional feature communication data through terminal device 101. Then, terminal device 101 can send the communication numbers and their corresponding communication data to server 102 via network 103. After receiving the communication numbers and corresponding communication data, server 102 can preprocess them and generate a wide data table based on the preprocessed communication data. Next, the communication data in the wide data table is standardized, and the standardized communication data is input into an entropy weight model. The entropy weight model determines the anomaly score corresponding to each communication number based on the entropy weight values ​​corresponding to different features. Then, target communication data corresponding to key features is obtained, and the target communication data and anomaly scores corresponding to each communication number are input into a classification model for classification to obtain classification information corresponding to each communication number, i.e., whether the communication number is a normal number or an abnormal number. The parameters in the entropy weight model are the entropy weight values ​​corresponding to each feature, which are calculated based on the communication data marked as fraudulent or harassing numbers.

[0055] In an exemplary embodiment of this application, the terminal device 101 may also preprocess the communication number and the multi-dimensional feature communication data corresponding to the communication number to generate a data wide table, and perform standardization processing on the communication data in the data wide table. Then, the standardized communication data is sent to the server 102 through the network 103. After receiving the standardized communication data, the server 102 inputs it into the entropy weight method model to determine the anomaly score corresponding to each communication number. Finally, the target communication data corresponding to the key features and the anomaly score are input into the classification model to classify the communication number and obtain its corresponding classification information.

[0056] Of course, the abnormal communication number identification method in this application embodiment can also be executed by the terminal device 101. After obtaining the communication number and the multi-dimensional feature communication data corresponding to the communication number, the terminal device 101 preprocesses it to generate a data wide table, performs standardization processing on the communication data in the data wide table, and inputs the standardized communication data into the entropy weight method model to determine the abnormal score corresponding to each communication number. Finally, the target communication data and abnormal score corresponding to the key features are input into the classification model to classify the communication number and obtain its corresponding classification information.

[0057] Depending on the implementation requirements, the system architecture in this application embodiment can have any number of terminal devices, networks, and servers. For example, the server can be a server group composed of multiple server devices.

[0058] The technical solutions provided in this application can be applied to terminal device 101 or server 102. The method for identifying abnormal communication numbers in this application is based on the entropy weight model and classification model, which are machine learning models involving artificial intelligence.

[0059] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0060] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0061] Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, and inductive learning.

[0062] The following detailed description, in conjunction with specific embodiments, provides a detailed explanation of the technical solutions provided in this application, including the method for identifying abnormal communication numbers, the device for identifying abnormal communication numbers, the computer-readable medium, and the electronic equipment.

[0063] Figure 2 A flowchart illustrating a method for identifying abnormal communication numbers is shown, such as... Figure 2 As shown, the methods for identifying abnormal communication numbers include:

[0064] Step S210: Obtain multiple sets of communication data corresponding to the target features, preprocess the communication data to generate a wide data table, wherein each set of communication data corresponds to a different communication number;

[0065] Step S220: Standardize the communication data in the wide data table, and input the standardized communication data into the entropy weight method model. The entropy weight method model determines the anomaly score corresponding to each communication number based on the entropy weight value corresponding to different features.

[0066] Step S230: Obtain target communication data corresponding to the key features in the target features, input the target communication data and anomaly score corresponding to each of the communication numbers into the classification model, classify each of the communication numbers through the classification model, and output the classification information corresponding to each of the communication numbers.

[0067] The method for identifying abnormal communication numbers in this application involves acquiring multiple sets of communication data corresponding to target features, preprocessing the communication data to generate a wide data table, where each set of communication data corresponds to a different communication number; then, standardizing the communication data in the wide data table, and inputting the standardized communication data into an entropy weight model. The entropy weight model determines the anomaly score corresponding to each communication number based on the entropy weight value corresponding to different features; then, acquiring target communication data corresponding to key features in the target features, and inputting the target communication data and anomaly scores corresponding to each communication number into a classification model. The classification model classifies each communication number to output classification information corresponding to each communication number. The method for identifying abnormal communication numbers in this application can accurately calculate the anomaly score of the communication number through the entropy weight model, and then accurately classify the communication number according to preset rules through the classification model, thereby improving the accuracy of identifying abnormal communication numbers.

[0068] The following is about Figure 2 The steps of the method for identifying abnormal communication numbers are explained in detail.

[0069] In step S210, multiple sets of communication data corresponding to the target features are acquired, and the communication data is preprocessed to generate a wide data table, wherein each set of communication data corresponds to a different communication number.

[0070] In an exemplary embodiment of this application, in order to classify different communication numbers and identify abnormal numbers, it is first necessary to obtain the communication data corresponding to different communication numbers. By processing and classifying the communication data corresponding to different communication numbers, the classification information corresponding to the communication numbers can be obtained. In an embodiment of this application, communication data corresponding to all features of different communication numbers can be extracted from the database of the communication service provider. Then, the communication data with all features is filtered to obtain the communication data corresponding to the target feature. The target feature is determined primarily based on the correlation between different features when filtering all features.

[0071] In the exemplary embodiments of this application, any correlation analysis method can be used to determine the correlation between different features. This application does not specifically limit this method. After obtaining the correlation between different features, features with higher correlation can be selected as target features. In the embodiments of this application, communication data can include four types of data: voice data, signaling data, DPI data, and traffic data. Voice data can be generated by lightweight aggregation of MSC data and GMSC data; signaling data can be generated by lightweight aggregation of 3G signaling and 4G signaling; DPI data can be generated by lightweight aggregation of 3G mobile DPI data and 4G mobile DPI data; and traffic data can be generated by lightweight aggregation of 3G mobile AAA data packet domain (AAA call detail records), 3G mobile AAA data packet domain (CCG call detail records), WIFI mobile AAA data, and 4G mobile AAA data (SGW / HSGW / PGW). Furthermore, among these four types of communication data, voice data and signaling data are essential, while DPI data and traffic data are optional.

[0072] In an exemplary embodiment of this application, after acquiring the communication data corresponding to all features, a correlation analysis is first performed on the communication data corresponding to each feature to determine the target features based on the correlation score obtained from the analysis. When calculating the correlation score, the correlation score between the same features is 1, and the correlation score between different features is greater than 0 and less than 1. The final target features can be obtained by filtering based on the correlation score. In the embodiment of this application, 13 target features are finally determined, namely: daily average number of outgoing calls, daily average number of outgoing numbers, total call volume during working hours on weekdays, total call volume during working hours on non-working days, number of calls from 6 PM to 6 AM, number of calls with a duration of 0-15 seconds, number of calls with a duration of 15-60 seconds, number of calls with a duration of 60-300 seconds, number of missed calls, number of rejected calls, base station format used for voice calls, number of all connected base stations, and whether there is tag depth packet detection (DPI) usage behavior. After obtaining the target features, communication data corresponding to each communication number and the 13 features can be obtained from the communication data corresponding to all features, and abnormal numbers can be identified based on the communication data corresponding to the 13 features.

[0073] In the exemplary embodiments of this application, since the acquired communication data may contain outliers or missing values, and different types of communication data contain communication data corresponding to the same features, after acquiring multiple sets of communication data corresponding to the target features, the communication data needs to be preprocessed. Specifically, the communication data can be cleaned and integrated to handle outliers and missing values, and data corresponding to the same features acquired through different means can be integrated to generate a wide data table. That is, the wide data table includes preprocessed communication data corresponding to the target features for different communication numbers. In the embodiments of this application, outlier handling involves removing communication numbers with excessively high or low communication data for each feature. Specifically, for each feature, communication numbers below the 10th percentile or above the 90th percentile can be removed. Missing value handling can be performed by filling in missing values ​​with the average communication data corresponding to each feature. Furthermore, a machine learning model can be used to predict missing values. The specific method for handling missing values ​​in the embodiments of this application is not specifically limited.

[0074] It's worth noting that before performing correlation analysis on the communication data corresponding to each feature, the distribution of the communication data corresponding to each feature can also be analyzed to gain a comprehensive understanding of the data characteristics. Specifically, scatter plots, histograms, and Quantile-Quantile plots can be used to analyze the data distribution. Taking the analysis of the distribution of communication data corresponding to outbound call dispersion as an example... Figure 3 This diagram illustrates the relationship between the outgoing call dispersion of a communication number and the daily average number of outgoing calls, as shown in the figure. Figure 3 As shown, when the outbound call dispersion is close to 0, the distribution of the daily average outbound calls is very dispersed. A small outbound call dispersion coupled with a high daily average outbound call indicates that the user only calls specific numbers, but the call frequency is very high, which may be targeted harassment. When the outbound call dispersion is between 0.1 and 0.9, the variance of the daily average outbound call gradually increases with the increase of outbound call dispersion. When the outbound call dispersion is close to 1, the distribution of the daily average outbound call is very dispersed. A high outbound call dispersion coupled with a high daily average outbound call indicates that the user calls many numbers, and the total number of calls is very high, which is consistent with the characteristics of marketing or advertising calls, and may be harassment calls. Taking the analysis of the distribution of communication data corresponding to the called party dispersion as another example... Figure 4 This diagram illustrates the relationship between the caller dispersion and the daily average number of calls to a communication number. Figure 4 As shown, when the called party dispersion is close to 0, the distribution of the daily average of called parties is very dispersed. However, as the called party dispersion increases, the daily average of called parties gradually decreases, and the variance decreases.

[0075] In step S220, the communication data in the wide data table is standardized, and the standardized communication data is input into the entropy weight method model. The entropy weight method model determines the anomaly score corresponding to each communication number based on the entropy weight value corresponding to different features.

[0076] In an exemplary embodiment of this application, after obtaining the data wide table, the communication data corresponding to different features in the data wide table can be standardized, and abnormal numbers can be identified based on the standardized communication data. Since the probability of a communication number being identified as an abnormal number varies under different trends in communication data with different features, the methods for standardizing communication data with different features also differ.

[0077] For certain features, when the larger the value of the communication data, the greater the probability that the communication number is an abnormal number, standardization can be performed according to formula (1):

[0078]

[0079] For some features, the larger the value of the communication data, the smaller the probability that the communication number is an abnormal number. Standardization can be performed according to formula (2):

[0080]

[0081] Among them, X ij For the communication data corresponding to the j-th feature of the i-th communication number, X ij * For X ij The data obtained after standardization, min(X) j) represents the minimum communication data among all communication numbers corresponding to the j-th feature, max(X) j ) represents the maximum communication data among the j-th features corresponding to all communication numbers.

[0082] As described above, there are 13 target features identified in this application embodiment. For the features other than "whether there is tag DPI usage behavior", the larger the value of the communication data, the more likely the communication number is to be an abnormal number. Therefore, the communication data corresponding to these features can be standardized according to formula (1). For the feature "whether there is tag DPI usage behavior", it is a 0-1 variable. When it is 0, the probability of the communication number being an abnormal number is higher. Therefore, the communication data corresponding to this feature can be standardized according to formula (2).

[0083] After standardization, the standardized communication data can be input into the entropy weight model, allowing the model to determine anomaly scores for different communication numbers based on the entropy weights corresponding to different features. However, before using the entropy weight model for anomaly score prediction, the parameters of the entropy weight model need to be determined. The following section explains how to determine the parameters of the entropy weight model.

[0084] In an exemplary embodiment of this application, the parameters of the entropy weight method model are the entropy weights corresponding to different features. In the embodiments of this application, the entropy weights corresponding to each feature are calculated based on the communication data samples corresponding to the communication numbers marked as fraudulent and harassing numbers and corresponding to the target features.

[0085] Figure 5 The schematic diagram illustrates the process of calculating the entropy weights corresponding to different features, such as... Figure 5 As shown, in step S501, the communication data sample is preprocessed and standardized to obtain the target communication data sample; in step S502, the feature weight of the i-th fraudulent harassment number corresponding to the j-th target feature is determined according to the target communication data sample; in step S503, the entropy value of the i-th fraudulent harassment number corresponding to the j-th target feature is determined according to the feature weight; in step S504, the difference coefficient of the i-th fraudulent harassment number corresponding to the j-th target feature is determined according to the entropy value; in step S505, the entropy weight of the i-th fraudulent harassment number corresponding to the j-th target feature is determined according to the difference coefficient; where i and j are both positive integers.

[0086] The characteristic weight in step S502 can be calculated according to formula (3):

[0087]

[0088] Among them, P ijX represents the feature weight of the i-th fraudulent and harassing number corresponding to the j-th target feature. ij * The communication data corresponding to the j-th target feature of the i-th fraudulent harassing number is standardized, and m is the total number of fraudulent harassing numbers.

[0089] The entropy value in step S503 can be calculated using formula (4):

[0090]

[0091] The difference coefficient in step S504 can be calculated using formula (5):

[0092] d j =1-e j (5)

[0093] The entropy weight in step S505 can be calculated using formula (6):

[0094]

[0095] Among them, W j Let be the entropy weight corresponding to the j-th feature, and n be the total number of features contained in the target feature.

[0096] Figure 6 The diagram illustrates the entropy weights and extreme values ​​corresponding to different features, such as... Figure 6 As shown, extreme values ​​include maximum and minimum values. After determining the entropy weights corresponding to different target features, these weights can be assigned to the entropy weight model as parameters of the entropy weight model.

[0097] In an exemplary embodiment of this application, after the entropy weight model receives the standardized communication data, it can determine the corresponding entropy weight based on the features corresponding to the communication data, and calculate the anomaly score corresponding to different communication numbers based on the entropy weights corresponding to different features. The calculation formula for the anomaly score is shown in formula (7):

[0098]

[0099] As can be seen from formula (7), the abnormal score corresponding to the communication number is obtained by adding up all the sub-scores after obtaining the sub-scores corresponding to different features.

[0100] In step S230, target communication data corresponding to the key features in the target features is obtained, and the target communication data and anomaly scores corresponding to each of the communication numbers are input into the classification model. The classification model is used to classify each of the communication numbers to output classification information corresponding to each of the communication numbers.

[0101] In an exemplary embodiment of this application, principal component analysis of the 13 target features reveals two key features: outgoing call dispersion and call rejection count. These two key features directly affect the identification of abnormal numbers. Therefore, in this embodiment, after obtaining the abnormal score corresponding to each communication number, communication data corresponding to each communication number and also corresponding to outgoing call dispersion and call rejection count can be obtained and used as target communication data. The abnormal score corresponding to each communication number is then input into the classification model for classification. During classification, the classification model processes the target communication data and abnormal score according to preset rules to obtain classification information corresponding to each communication number. These preset rules are determined based on the abnormal score, outgoing call dispersion, and call rejection count.

[0102] In the exemplary embodiments of this application, the classification model may specifically be a decision tree model or a random forest model, or of course other classification models. This application does not specifically limit the specific classification model.

[0103] In an exemplary embodiment of this application, the preset rules include a first rule, a second rule, and a third rule. The expression for the first rule is: anomaly score > anomaly score threshold and outgoing call dispersion > first outgoing call dispersion threshold and number of rejections > first number of rejections threshold. The expression for the second rule is: anomaly score > anomaly score threshold and outgoing call dispersion ∈ outgoing call dispersion interval and number of rejections > second number of rejections threshold. The expression for the third rule is: anomaly score > anomaly score threshold and outgoing call dispersion < second outgoing call dispersion threshold and number of rejections > second number of rejections threshold. Wherein, the first outgoing call dispersion threshold is different from the second outgoing call dispersion threshold, and the first number of rejections threshold is different from the second number of rejections threshold. As a specific example, the anomaly score threshold can be 0.0652, the first outgoing call dispersion threshold can be 0.6, the second outgoing call dispersion threshold can be 0.1, the outgoing call dispersion interval is [0.1, 0.6], the first rejection count threshold can be 500, and the second rejection count threshold can be 800. Accordingly, the expression for the first rule is: anomaly score > 0.0652 and outgoing call dispersion > 0.6 and rejection count > 500; the expression for the second rule is: anomaly score > 0.0652 and outgoing call dispersion ∈ [0.1, 0.6] and rejection count > 800; and the expression for the third rule is: anomaly score > 0.0652 and outgoing call dispersion < 0.1 and rejection count > 800. Furthermore, the first rule can determine whether a communication number is a fraudulent or harassing number; the second rule can determine whether a communication number exhibits abnormal behavior; and the third rule can determine whether a communication number is a targeted harassment number. In other words, when the target communication data and the abnormal score meet the first rule, the communication number is determined to be a fraudulent or harassing number; when the target communication data and the abnormal score meet the second rule, the communication number is determined to be a communication number exhibiting abnormal behavior; and when the target communication data and the abnormal score meet the third rule, the communication number is determined to be a targeted harassment number.

[0104] In an exemplary embodiment of this application, since the focus of this application is to identify high-risk numbers, that is, to identify highly suspected fraudulent numbers from fraudulent harassment numbers, after obtaining the fraudulent harassment number, the abnormal score corresponding to the fraudulent harassment number can be converted to a percentage to obtain a percentage value corresponding to the abnormal score; then the percentage value is compared with a first threshold and a second threshold, and the category of the fraudulent harassment number is determined based on the comparison result.

[0105] In an exemplary embodiment of this application, a percentage conversion can be performed according to formula (8):

[0106]

[0107] Among them, Score i * Score is the percentage data corresponding to the i-th communication number. i This is the anomaly score corresponding to the i-th communication number.

[0108] In an exemplary embodiment of this application, the result of the anomaly score is retained to the fifth decimal place, and the result of the percentage data is retained to the fourth decimal place.

[0109] Figure 7 The illustration shows a flowchart of the process for classifying fraudulent and harassing phone numbers, such as... Figure 7 As shown, in step S701, the percentage value is compared with a first threshold and a second threshold; in step S702, when the percentage value is greater than or equal to the first threshold, the communication number is marked as a highly suspected fraudulent harassment number; in step S703, when the percentage value is greater than or equal to the second threshold and less than the first threshold, the communication number is marked as a moderately suspected fraudulent harassment number; in step S704, when the percentage value is less than the second threshold, the communication number is marked as a low-suspicious fraudulent harassment number.

[0110] As a specific example, the first threshold can be 85, and the second threshold can be 60. Then, when the percentage value is greater than or equal to 85, it is a highly suspected fraudulent / harassing number; when the percentage value is greater than or equal to 60 but less than 85, it is a moderately suspected fraudulent / harassing number; and when the percentage value is less than 60, it is a low-suspicious-to-fraudulent / harassing number. Of course, the first and second thresholds can also be set to other values, and this embodiment does not specifically limit them.

[0111] In an exemplary embodiment of this application, for ease of identification, highly suspected fraudulent harassment numbers can be marked as Class A, moderately suspected fraudulent harassment numbers as Class B, low suspected fraudulent harassment numbers as Class C, communication numbers with abnormal behavior as Class D, and targeted harassment numbers as Class J. In this way, after obtaining the classification information input to the classification model, Class A numbers can be directly obtained and reported to relevant agencies for processing such as shutting down the Class A numbers.

[0112] In an exemplary embodiment of this application, abnormal numbers can also be marked based on internet data to improve identification accuracy. Specifically, tags set by some websites for caller ID numbers can be obtained. If a website tags a certain communication number as a fraudulent number, then that communication number can be directly marked as a fraudulent number.

[0113] Based on a prediction of local users (excluding those roaming out) in a certain province during a specific month of 201X, there was a greater than 75% probability that 26,900 numbers were suspected of being fraudulent or harassing numbers. However, a certain website only marked approximately 19,000 such numbers, with A / B / C category suspected fraudulent / harassing numbers accounting for 74.8% of the markings. Furthermore, in terms of sample coverage, the initial calculated coverage was 61.5%, and after removing significantly noisy samples, the corrected coverage was 80%. The high-accuracy, high-risk communication numbers output have been submitted to relevant departments for shutdown. Analysis of the reopening rate showed an approximately 10% reopening rate, demonstrating the model's significant effectiveness.

[0114] In the abnormal communication number identification method of this application embodiment, multiple sets of communication data corresponding to target features are acquired. The communication data is preprocessed to generate a wide data table, where each set of communication data corresponds to a different communication number. Then, the communication data in the wide data table is standardized, and the standardized communication data is input into an entropy weight model. The entropy weight model determines the abnormal score corresponding to each communication number based on the entropy weight value corresponding to different features. Next, target communication data corresponding to key features in the target features are acquired. The target communication data corresponding to each communication number and the abnormal score are input into a classification model. The classification model classifies each communication number to output classification information corresponding to each communication number. The abnormal communication number identification method of this application can accurately calculate the abnormal score of the communication number through the entropy weight model, and then accurately classify the communication number according to preset rules through the classification model, thereby improving the accuracy of abnormal communication number identification.

[0115] This application also provides a device for identifying abnormal communication numbers. Figure 8 A schematic diagram of the structure of an identification device for abnormal communication numbers is shown, such as... Figure 8 As shown, the abnormal communication number identification device 800 may include a wide table generation module 801, a scoring module 802, and a classification module 803. Wherein:

[0116] The wide table generation module 801 is used to acquire multiple sets of communication data corresponding to target features, and preprocess the communication data to generate a wide data table, wherein each set of communication data corresponds to a different communication number;

[0117] The scoring module 802 is used to standardize the communication data in the data wide table, and input the standardized communication data into the entropy weight method model. The entropy weight method model determines the abnormal score corresponding to each communication number based on the entropy weight value corresponding to different features.

[0118] The classification module 803 is used to acquire target communication data corresponding to the key features in the target features, input the target communication data and anomaly scores corresponding to each of the communication numbers into the classification model, classify each of the communication numbers through the classification model, and output classification information corresponding to each of the communication numbers.

[0119] In one embodiment of this application, the wide table generation module 801 is configured as follows:

[0120] The user feature data is cleaned and integrated to generate the wide data table. The data cleaning involves handling outliers and missing values, and the data integration involves combining data with the same features obtained from different sources.

[0121] In one embodiment of this application, the scoring module 802 is configured as follows:

[0122] When the value of the communication data is larger, and the probability that the communication number is an abnormal number is greater, the standardization process is performed according to formula (1):

[0123]

[0124] The larger the value of the communication data, the smaller the probability that the communication number is an abnormal number. The standardization process is then performed according to formula (2):

[0125]

[0126] Among them, X ij For the communication data corresponding to the j-th feature of the i-th communication number, X ij * For X ij The data obtained after standardization, min(X) j ) represents the minimum communication data among all communication numbers corresponding to the j-th feature, max(X) j ) represents the maximum communication data among the j-th features corresponding to all communication numbers.

[0127] In one embodiment of this application, the target feature includes multiple features; the scoring module 802 is configured as follows:

[0128] Obtain the entropy weight corresponding to each of the features, and multiply the entropy weight corresponding to each of the features with the standardized communication data to obtain the sub-score corresponding to each of the features;

[0129] The sub-scores corresponding to all the features are summed to obtain the anomaly score.

[0130] In one embodiment of this application, the key features are outgoing call dispersion and the number of rejected calls; the classification module 803 includes:

[0131] The input unit is used to input target communication data corresponding to each of the communication numbers and characterized by outbound call dispersion and number of rejections, as well as anomaly scores corresponding to each of the communication numbers, into the classification model;

[0132] A classification unit is used to process the target communication data and the anomaly score according to a preset rule through the classification model, so as to obtain classification information corresponding to each of the communication numbers;

[0133] The preset rules are determined based on anomaly scoring, outbound call dispersion, and the number of rejections.

[0134] In an exemplary embodiment of this application, the classification model is a decision tree model or a random forest model; the preset rules include a first rule, a second rule, and a third rule. The expression of the first rule is: anomaly score > anomaly score threshold and outgoing call dispersion > first outgoing call dispersion threshold and number of rejections > first number of rejections threshold. The expression of the second rule is: anomaly score > anomaly score threshold and outgoing call dispersion ∈ outgoing call dispersion interval and number of rejections > second number of rejections threshold. The expression of the third rule is: anomaly score > anomaly score threshold and outgoing call dispersion < second outgoing call dispersion threshold and number of rejections > second number of rejections threshold. Wherein, the first outgoing call dispersion threshold is different from the second outgoing call dispersion threshold, and the first number of rejections threshold is different from the second number of rejections threshold.

[0135] In an exemplary embodiment of this application, the classification unit is configured as follows:

[0136] When the target communication data and the anomaly score meet the first rule, the communication number is determined to be a fraudulent or harassing number;

[0137] When the target communication data and the anomaly score satisfy the second rule, the communication number is determined to be a communication number with abnormal behavior;

[0138] When the target communication data and the anomaly score satisfy the third rule, the communication number is determined to be a targeted harassment number.

[0139] In an exemplary embodiment of this application, when the communication number is a fraudulent or harassing number, the abnormal communication number identification device 800 is further configured to:

[0140] The abnormal score corresponding to the fraudulent and harassing number is converted to a percentage to obtain the percentage value corresponding to the abnormal score;

[0141] The percentage value is compared with a first threshold and a second threshold.

[0142] When the percentage value is greater than or equal to the first threshold, the communication number is marked as a highly suspected fraudulent harassment number;

[0143] When the percentage value is greater than or equal to the second threshold and less than the first threshold, the communication number is marked as a moderately suspected fraudulent harassment number;

[0144] When the percentage value is less than the second threshold, the communication number is marked as a low-level suspected fraudulent or harassing number.

[0145] In an exemplary embodiment of this application, the abnormal communication number identification device 800 is further configured to:

[0146] Before inputting the standardized communication data into the entropy weight method model, obtain communication data samples that correspond to the communication numbers marked as fraudulent and harassing numbers and that correspond to the target features;

[0147] The communication data samples are preprocessed and standardized to obtain target communication data samples;

[0148] Determine the feature weight of the j-th target feature corresponding to the i-th fraudulent harassment number based on the target communication data sample;

[0149] The entropy value of the j-th target feature corresponding to the i-th fraudulent harassment number is determined based on the feature weight;

[0150] The difference coefficient of the j-th target feature corresponding to the i-th fraudulent harassment number is determined based on the entropy value;

[0151] The entropy weight of the j-th target feature corresponding to the i-th fraudulent harassment number is determined based on the difference coefficient.

[0152] Where i and j are both positive integers.

[0153] In an exemplary embodiment of this application, the abnormal communication number identification device 800 is further configured to: acquire communication data corresponding to multi-dimensional features before acquiring multiple sets of communication data corresponding to target features, and preprocess the communication data to generate a wide data table;

[0154] Correlation analysis is performed on the features of each dimension in the data wide table to obtain the target features;

[0155] The communication data corresponding to the multi-dimensional features includes communication data corresponding to communication numbers marked as fraudulent or harassing numbers and communication data corresponding to communication numbers marked as non-fraudulent or harassing numbers.

[0156] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0157] Furthermore, although the steps of the method in this application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0158] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0159] Figure 9 A schematic diagram of a computer system architecture for implementing an electronic device according to embodiments of the present application is shown. The electronic device may be located in a terminal device or a server.

[0160] It should be noted that, Figure 9 The computer system 900 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0161] like Figure 9As shown, the computer system 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 902 or programs loaded from storage section 908 into random access memory (RAM). The RAM 903 also stores various programs and data required for system operation. The CPU 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output interface 905 (I / O interface) is also connected to the bus 904.

[0162] In some embodiments, the following components are connected to the input / output interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a local area network card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0163] Specifically, according to embodiments of this application, the processes described in the various method flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by central processing unit 901, it performs various functions defined in the system of this application.

[0164] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium, a computer-readable medium, or any combination of the above. A computer-readable medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0165] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0166] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0167] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, and includes several instructions to cause an electronic device to execute the method according to the embodiments of this application.

[0168] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method of identifying an abnormal communication number, characterized by, The method comprises: obtaining a plurality of groups of communication data corresponding to target features, and preprocessing the communication data to generate a data wide table, wherein each group of the communication data corresponds to a different communication number; standardizing the communication data in the data wide table, and inputting the standardized communication data into an entropy weight method model to determine an abnormal score corresponding to each communication number according to an entropy weight value corresponding to different features by the entropy weight method model; obtaining target communication data corresponding to key features in the target features, the key features being call-out dispersion and number of rejections; inputting the target communication data corresponding to each communication number and having the features of call-out dispersion and number of rejections, and the abnormal score corresponding to each communication number into a classification model; processing the target communication data and the abnormal score according to a preset rule by the classification model to obtain classification information corresponding to each communication number; wherein the preset rule is a rule determined according to the abnormal score, the call-out dispersion and the number of rejections.

2. The method of claim 1, wherein, The standardization of the communication data in the data wide table comprises: when the value of the communication data is greater, the probability that the communication number is an abnormal number is greater, and the standardization is performed according to formula (1): when the value of the communication data is greater, the probability that the communication number is an abnormal number is smaller, and the standardization is performed according to formula (2): wherein X ij is the communication data of the jth feature corresponding to the ith communication number, X ij * is the data obtained after standardizing X ij , min(X j ) is the minimum communication data in the jth feature corresponding to all communication numbers, and max(X j ) is the maximum communication data in the jth feature corresponding to all communication numbers.

3. The method according to claim 1 or 2, characterized in that, The target features include a plurality of features; The inputting of the standardized communication data into the entropy weight method model to determine the abnormal score corresponding to each communication number according to the entropy weight value corresponding to different features by the entropy weight method model comprises: obtaining an entropy weight value corresponding to each feature, multiplying the entropy weight value corresponding to each feature and the standardized communication data to obtain a sub-score corresponding to each feature; and adding the sub-scores corresponding to all the features to obtain the abnormal score.

4. The method of claim 1, wherein, The classification model is a decision tree model or a random forest model; the preset rule includes a first rule, a second rule and a third rule, the expression of the first rule is: abnormal score>abnormal score threshold and call-out dispersion>first call-out dispersion threshold and number of rejections>first number of rejections threshold, the expression of the second rule is: abnormal score>abnormal score threshold and call-out dispersion∈call-out dispersion interval and number of rejections>second number of rejections threshold, and the expression of the third rule is: abnormal score>abnormal score threshold and call-out dispersion<second call-out dispersion threshold and number of rejections>second number of rejections threshold, wherein the first call-out dispersion threshold is different from the second call-out dispersion threshold, and the first number of rejections threshold is different from the second number of rejections threshold.

5. The method of claim 4, wherein, The processing of the target communication data and the abnormal score according to the preset rule by the classification model to obtain the classification information corresponding to each communication number comprises: when the target communication data and the abnormal score satisfy the first rule, determining that the communication number is a fraud harassment number. determining that the communication number is a communication number with abnormal behavior when the target communication data and the abnormal score satisfy the second rule; determining that the communication number is a targeted harassment number when the target communication data and the abnormal score satisfy the third rule.

6. The method of claim 5, wherein, When the communication number is a fraud harassment number, the method further comprises: performing percentage conversion on the abnormal score corresponding to the fraud harassment number to obtain a percentage value corresponding to the abnormal score; comparing the percentage value with a first threshold and a second threshold; when the percentage value is greater than or equal to the first threshold, marking the communication number as a high-suspected fraud harassment number; when the percentage value is greater than or equal to the second threshold and less than the first threshold, marking the communication number as a medium-suspected fraud harassment number; when the percentage value is less than the second threshold, marking the communication number as a low-suspected fraud harassment number.

7. The method of claim 1, wherein, Before inputting the standardized communication data into the entropy weight method model, the method further comprises: obtaining communication data samples corresponding to the communication numbers marked as fraud harassment numbers and corresponding to the target features; preprocessing and standardizing the communication data samples to obtain target communication data samples; determining the feature proportion of the jth target feature corresponding to the ith fraud harassment number according to the target communication data samples; determining the entropy value of the jth target feature corresponding to the ith fraud harassment number according to the feature proportion; determining the difference coefficient of the jth target feature corresponding to the ith fraud harassment number according to the entropy value; determining the entropy weight value of the jth target feature corresponding to the ith fraud harassment number according to the difference coefficient; wherein i and j are positive integers.

8. An apparatus for identifying an abnormal communication number, characterized by comprising: comprises: a wide table generation module configured to obtain a plurality of groups of communication data corresponding to target features, and preprocess the communication data to generate a data wide table, wherein each group of the communication data corresponds to a different communication number; a scoring module configured to standardize the communication data in the data wide table, and input the standardized communication data into an entropy weight method model, and determine an abnormal score corresponding to each of the communication numbers according to the entropy weight values corresponding to different features through the entropy weight method model; a classification module configured to obtain target communication data corresponding to key features in the target features, the key features being call-out dispersion and number of rejections; input the target communication data corresponding to each of the communication numbers and having the features of call-out dispersion and number of rejections, and the abnormal scores corresponding to each of the communication numbers into a classification model; determine classification information corresponding to each of the communication numbers through the classification model according to a preset rule by processing the target communication data and the abnormal scores, wherein the preset rule is a rule determined according to the abnormal score, call-out dispersion and number of rejections.

9. An electronic device, comprising: comprises: a processor; and a memory configured to store executable instructions of the processor; The processor is configured to execute the executable instructions to perform the method for identifying an abnormal communication number according to any one of claims 1-7. The processor is configured to execute the executable instructions to perform the method for identifying an abnormal communication number according to any one of claims 1-7.

Images