Abnormal number detection processing method and device
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA TELECOM CORP LTD
- Filing Date
- 2022-12-30
- Publication Date
- 2026-05-29
AI Technical Summary
Existing technologies struggle to accurately detect suspicious numbers using virtual dialing devices for VoIP fraud, resulting in low efficiency in combating telecom fraud and the potential for harming legitimate users.
By obtaining call identification information from telephone network calls, including the caller's number, caller's voiceprint identifier, and call location, voiceprint recognition technology is used to mark suspected abnormal numbers, and abnormal numbers are accurately located and shut down based on call location.
It enables accurate identification and shutdown of abnormal numbers, effectively combating telephone fraud and reducing the time lag and false positive rate of anti-fraud measures.
Smart Images
Figure CN116095235B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication security technology, and more specifically, to an abnormal number detection and processing method and apparatus. Background Technology
[0002] After years of development, telecommunications fraud has gradually evolved to exhibit characteristics such as organized operation, sophisticated division of labor, and cross-border deployment, making it difficult to combat. A primary technical method in everyday telecommunications fraud is the use of GOIP (GSM Over Internet Protocol) devices to separate the SIM card from the user, allowing fraudsters to remotely control SIM cards from overseas using GOIP devices located in mainland China to make calls and send / receive text messages. Because this technique is deployed in flexible and varied ways, it is difficult to dismantle its source.
[0003] The main technical means used by public security and telecommunications departments to investigate and combat GOIP devices is through high-frequency, intensive calls to identify SIM cards suspected of being used for fraud. However, this method is inefficient, time-consuming, and prone to false positives against legitimate users. Furthermore, fraudsters can counter this anti-fraud strategy by employing counter-surveillance techniques to reduce call frequency and by deploying mobile operations in more locations to evade police detection. Therefore, all indications suggest that current technical investigation and prevention methods are insufficient to effectively combat VoIP fraud.
[0004] There is currently no effective solution to the above problems. Summary of the Invention
[0005] This application provides an abnormal number detection and processing method and apparatus to at least solve the technical problem in related technologies that it is difficult to accurately detect abnormal numbers that use virtual dialing devices to commit VoIP fraud.
[0006] According to one aspect of the embodiments of this application, an abnormal number detection and processing method is provided, comprising: acquiring call identification information of each call in a telephone network, wherein the call identification information includes at least: a caller ID number, a caller ID voiceprint identifier, and a call location; marking multiple suspected abnormal numbers among multiple caller ID numbers based on the correspondence between the caller ID number and the caller ID voiceprint identifier, wherein each suspected abnormal number corresponds to multiple caller ID voiceprint identifiers; marking multiple groups of abnormal numbers among multiple suspected abnormal numbers based on the correspondence between the suspected abnormal numbers and the call location, wherein each abnormal number in each group of abnormal numbers corresponds to the same call location; and performing shutdown processing on the abnormal numbers.
[0007] Optionally, obtain call identification information for each call in the telephone network, including: for each call in the telephone network, determine the caller ID and call location corresponding to the call; extract the speech within a preset duration in the call and convert it into a Mel-Cepstral Coefficient feature file; perform voiceprint recognition based on the Mel-Cepstral Coefficient feature file to obtain the caller voiceprint identifier corresponding to the call.
[0008] Optionally, based on the correspondence between the calling number and the calling voiceprint identifier, multiple suspected abnormal numbers among multiple calling numbers are identified, including: summarizing all calling numbers and identifying the calling voiceprint identifier corresponding to each calling number; for any calling number, if the number of calling voiceprint identifiers corresponding to the calling number exceeds a first preset threshold within a preset time period, the calling number is identified as a suspected abnormal number.
[0009] Optionally, based on the correspondence between suspected abnormal numbers and call locations, multiple groups of abnormal numbers are determined from among multiple suspected abnormal numbers, including: grouping multiple suspected abnormal numbers according to the call location corresponding to each suspected abnormal number; for any call location, if the number of suspected abnormal numbers corresponding to the call location exceeds a second preset threshold, the suspected abnormal numbers corresponding to the call location are determined as a group of abnormal numbers.
[0010] Optionally, after marking multiple groups of abnormal numbers among multiple suspected abnormal numbers, the method further includes: for suspected abnormal numbers that have not been marked as abnormal numbers, sending the suspected abnormal numbers to the manual review module for review; and determining whether the suspected abnormal numbers are abnormal numbers based on the review results fed back by the manual review module.
[0011] Optionally, before shutting down the abnormal number, the method further includes: determining whether the abnormal number is in a preset number whitelist; if the abnormal number is in the number whitelist, then remarking the abnormal number as a normal number; if the abnormal number is not in the number whitelist, then continuing to shut down the abnormal number.
[0012] Optionally, after shutting down the abnormal number, the method further includes: determining the user identity information, user address information, and call record information corresponding to the abnormal number; and sending the user identity information, user address information, and call record information to law enforcement agencies so that law enforcement agencies can take action against the user using the abnormal number.
[0013] According to another aspect of the embodiments of this application, an abnormal number detection and processing device is also provided, comprising: an acquisition module, configured to acquire call identification information of each call in a telephone network, wherein the call identification information includes at least: a caller ID number, a caller ID voiceprint identifier, and a call location; a first marking module, configured to mark multiple suspected abnormal numbers among multiple caller ID numbers according to the correspondence between the caller ID number and the caller ID voiceprint identifier, wherein each suspected abnormal number corresponds to multiple caller ID voiceprint identifiers; a second marking module, configured to mark multiple groups of abnormal numbers among multiple suspected abnormal numbers according to the correspondence between the suspected abnormal numbers and the call locations, wherein each abnormal number in each group of abnormal numbers corresponds to the same call location; and a processing module, configured to perform shutdown processing on the abnormal numbers.
[0014] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein the device where the non-volatile storage medium is located executes the above-described abnormal number detection processing method by running the program.
[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described abnormal number detection processing method through the computer program.
[0016] In this embodiment, call identification information for each call in a telephone network is obtained. This call identification information includes at least: the caller ID, the caller's voiceprint identifier, and the call location. Based on the correspondence between the caller ID and the caller's voiceprint identifier, multiple suspected abnormal numbers among multiple caller IDs are marked, where each suspected abnormal number corresponds to multiple caller voiceprint identifiers. Based on the correspondence between the suspected abnormal numbers and the call location, multiple groups of abnormal numbers among the multiple suspected abnormal numbers are marked, where each abnormal number in each group corresponds to the same call location. The abnormal numbers are then shut down. By recognizing the caller's voiceprint in the call identification information, suspected abnormal numbers can be effectively identified, and based on the call location, multiple groups of abnormal numbers among the suspected abnormal numbers can be accurately located, thereby shutting down the abnormal numbers and effectively combating telephone fraud. This solves the technical problem in related technologies where it is difficult to accurately detect abnormal numbers using virtual dialing devices for VoIP fraud. Attached Figure Description
[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0018] Figure 1This is a flowchart of an optional abnormal number detection and processing method according to an embodiment of this application;
[0019] Figure 2 This is a schematic diagram of an optional abnormal number detection and processing device according to an embodiment of this application. Detailed Implementation
[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.
[0021] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0022] To better understand the embodiments of this application, the following is a translation and explanation of some nouns or terms that appear in the description of the embodiments of this application:
[0023] GOIP devices, or "virtual dialing devices," are hardware devices used in network communication. They support SIM card access and convert traditional telephone signals into network signals. A single device can operate hundreds of SIM cards simultaneously and can remotely control SIM cards in different locations to make calls and send / receive text messages. This separates the person from the SIM card, allowing them to conceal their identity and evade detection. Furthermore, its ability to make virtual calls and switch phone numbers at will to call victims makes it extremely difficult for police to intercept and trace the signals, thus becoming a new tool for fraudsters.
[0024] Example 1
[0025] Currently, more and more fraudsters are using a new, simplified network-based GOIP method, which connects multiple mobile phones, to commit fraud. The main technical means for public security departments or telecommunications investigation departments to combat GOIP is to use high-frequency, intensive calls to find suspected fraudulent SIM cards. However, this method is inefficient, has a long time delay, and causes significant harm to normal users. In addition, fraudsters can easily circumvent the counter-investigation methods of public security departments, making it difficult to effectively combat VoIP fraud.
[0026] To address the aforementioned technical problems, this application provides an abnormal number detection and processing method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.
[0027] Figure 1 This is a flowchart illustrating an optional abnormal number detection and processing method according to an embodiment of this application, as shown below. Figure 1 As shown, the method includes at least steps S102-S108, wherein:
[0028] Step S102: Obtain call identification information for each call in the telephone network, wherein the call identification information includes at least: caller ID number, caller voiceprint identifier and call location.
[0029] In the technical solution provided in step S102 of the present invention, the telephone network is a telecommunications network that transmits telephone information and is capable of interactive voice communication and open telephone services. When public security or relevant telecommunications departments detect abnormal numbers, they can obtain call information and corresponding call identification information from the telephone network for subsequent countermeasures, interception, and signal tracing of the abnormal numbers.
[0030] Step S104: Based on the correspondence between the calling number and the calling voiceprint identifier, mark multiple suspected abnormal numbers among multiple calling numbers, wherein each suspected abnormal number corresponds to multiple calling voiceprint identifiers.
[0031] In the technical solution provided by step S104 of the present invention, by associating the calling number with the calling voiceprint identifier, when the same calling number corresponds to multiple calling voiceprint identifiers, the calling number is determined to be a suspected abnormal number.
[0032] Step S106: Based on the correspondence between suspected abnormal numbers and call locations, mark multiple groups of abnormal numbers among multiple suspected abnormal numbers, wherein the call locations corresponding to each abnormal number in each group of abnormal numbers are the same.
[0033] In the technical solution provided by step S106 of the present invention, after identifying the suspected abnormal number, the suspected abnormal number can be matched with the call location to identify multiple abnormal numbers among the suspected abnormal numbers, thereby improving the detection rate of abnormal numbers.
[0034] Step S108: Shut down the abnormal number.
[0035] In the technical solution provided by step S108 of the present invention, in order to prevent criminals from continuing to use abnormal numbers for VoIP fraud, the system can shut down the abnormal numbers through the relevant business support system such as CRM (Customer Relationship Management) in the telecommunications operator.
[0036] In the embodiments of steps S102-S108 of this application, call identification information for each call in the telephone network is obtained. This call identification information includes at least: the caller ID number, the caller ID voiceprint identifier, and the call location. Based on the correspondence between the caller ID number and the caller ID voiceprint identifier, multiple suspected abnormal numbers among multiple caller ID numbers are marked, where each suspected abnormal number corresponds to multiple caller ID voiceprint identifiers. Based on the correspondence between the suspected abnormal numbers and the call location, multiple groups of abnormal numbers among the multiple suspected abnormal numbers are marked, where each abnormal number in each group corresponds to the same call location. The abnormal numbers are then shut down. By recognizing the caller ID voiceprint in the call identification information, suspected abnormal numbers can be effectively identified, and multiple groups of abnormal numbers among the suspected abnormal numbers can be accurately located based on the call location, thereby shutting down the abnormal numbers and effectively combating telephone fraud. This solves the technical problem in related technologies where it is difficult to accurately detect abnormal numbers using virtual dialing devices for VoIP fraud.
[0037] The method described in this embodiment will be further described below.
[0038] As an optional implementation, in the technical solution provided in step S102 of the present invention, the method may include: for each call in the telephone network, determining the caller ID and call location corresponding to the call; extracting the speech within a preset duration in the call and converting it into a Mel-Cepstral Coefficient feature file; performing voiceprint recognition based on the Mel-Cepstral Coefficient feature file to obtain the caller's voiceprint identifier corresponding to the call.
[0039] In this embodiment, the characteristic of outbound calls using GOIP devices is the separation of the caller and the SIM card, meaning the caller and the SIM card are not in a one-to-one correspondence. Therefore, it differs from normal mobile phone calls and can be defined as an abnormal call traffic model. A normal mobile phone call traffic model refers to a situation where one calling number corresponds to only one voiceprint within a certain time period, while an abnormal call traffic model refers to a situation where one calling number corresponds to several different voiceprints within a certain time period. Therefore, in this application, for each call in the telephone network, the calling number, the call location matching the calling number, and the device serial number are first determined, thus facilitating accurate location of abnormal numbers when identifying them. Then, the media and signaling information of the voice call within a preset duration are collected in real time on the mobile core network side. The preset duration only needs to satisfy voiceprint analysis; to avoid privacy leaks, the shorter the preset duration, the better. Then, segmented call audio is extracted and converted into binary MFCC (Mel-Frequency Cepstral Coefficient) files. Voiceprint recognition technology is then used to analyze the MFCC files, obtaining the caller's voiceprint identifier for each call, thereby effectively identifying GOIP devices within the telephone network. Voiceprint recognition technology is a technique that identifies the speaker through their voice; it is a type of biometric technology. Using voiceprint recognition to identify GOIP devices can significantly reduce the impact of VoIP fraud.
[0040] As an optional implementation, in the technical solution provided in step S104 of the present invention, the method may include: summarizing all calling numbers and determining the calling voiceprint identifier corresponding to each calling number; for any calling number, if the number of calling voiceprint identifiers corresponding to the calling number exceeds a first preset threshold within a preset time period, the calling number is determined to be a suspected abnormal number.
[0041] In this embodiment, all calling numbers within the same time period are aggregated, and the corresponding caller voiceprint is identified. If the same calling number corresponds to multiple caller voiceprint identifiers within a system-defined time period, the calling number is identified as a suspected abnormal number. For example, if the same calling number corresponds to three different caller voiceprint identifiers within one hour, the system identifies the calling number as an abnormal call traffic model number. Furthermore, the first preset threshold can be set according to the actual application scenario; no specific restrictions are imposed here.
[0042] As an optional implementation, in the technical solution provided in step S106 of the present invention, the method may include: grouping multiple suspected abnormal numbers according to the call location corresponding to each suspected abnormal number; for any call location, if the number of suspected abnormal numbers corresponding to the call location exceeds a second preset threshold, determining the suspected abnormal numbers corresponding to the call location as a group of abnormal numbers.
[0043] In this embodiment, based on the determined call locations of each suspected abnormal number, when multiple suspected abnormal numbers are in the same location, the suspected abnormal numbers corresponding to that call location are determined to be a group of abnormal numbers, thereby avoiding a large amount of data mining.
[0044] As an optional implementation, in the technical solution provided in step S106 of the present invention, after marking multiple groups of abnormal numbers among multiple suspected abnormal numbers, for suspected abnormal numbers that have not been marked as abnormal numbers, the suspected abnormal numbers can also be sent to the manual review module for review; and the review results fed back by the manual review module are used to determine whether the suspected abnormal numbers are abnormal numbers.
[0045] In this embodiment, to ensure accurate identification of all suspected abnormal numbers, for suspected abnormal numbers that have not been marked as abnormal numbers, a manual review module can be used to make manual outbound calls for further identification. This prevents fraudsters from using counter-investigation methods such as multi-point deployment and reduced call frequency to evade anti-fraud detection, and ensures that GOIP devices deployed within the telephone network are basically eliminated, thereby accurately combating telephone fraud crimes.
[0046] Optionally, based on the review results provided by the manual review module, the system can further refine its identification by using strategies such as called number dispersion, calling frequency of the calling number, and device serial number, thereby improving the accuracy of data mining. For example, if a suspected abnormal number calls more than 15 called numbers within an hour, and the geographical range of each called number is large, then the suspected abnormal number is considered abnormal; or if a suspected abnormal number makes 300 calls within an hour, then the suspected abnormal number is considered abnormal.
[0047] As an optional implementation, in the technical solution provided in step S108 of the present invention, before performing shutdown processing on the abnormal number, it can be determined whether the abnormal number is in a preset number whitelist; if the abnormal number is in the number whitelist, the abnormal number is remarked as a normal number; if the abnormal number is not in the number whitelist, the shutdown processing on the abnormal number continues.
[0048] In this embodiment, to prevent misidentification of normal user numbers, the system can determine whether the abnormal number is in the whitelist of normal call center numbers before shutting down the abnormal number. If the abnormal number is in the whitelist, the abnormal number is remarked as a normal number; otherwise, the abnormal number is shut down.
[0049] As an optional implementation, in the technical solution provided in step S108 of the present invention, after the abnormal number is shut down, the user identity information, user address information and call record information corresponding to the abnormal number can be determined; the user identity information, user address information and call record information are sent to law enforcement agencies so that law enforcement agencies can take action against the user using the abnormal number.
[0050] In this embodiment, after shutting down the abnormal number, intervention can be performed on the called party to alert them to fraudulent voice messages without interrupting the call, and continue matching. This will output a special file containing user identity information, user address information, and call record information corresponding to the abnormal number. After further verification by professional technicians, the special file will be provided to law enforcement agencies so that they can arrest criminals who use abnormal numbers to commit telephone network fraud.
[0051] By following the steps above, the caller ID corresponding to each caller ID number is determined, which identifies all suspected abnormal caller ID numbers within the telephone network. Multiple abnormal numbers within this suspected abnormal number group are then identified using location information. Furthermore, a manual review module determines whether the suspected abnormal numbers not marked as abnormal are indeed abnormal, thus improving the accuracy of data mining. After identifying abnormal numbers, to avoid misjudging legitimate user numbers, the abnormal numbers are matched against a pre-defined number whitelist. Abnormal numbers within the whitelist are re-marked, while those not in the whitelist are shut down to prevent fraudsters from continuing to use them for telephone network fraud. Simultaneously, relevant information about the abnormal numbers is fed back to law enforcement for arrest operations, effectively combating fraudsters.
[0052] Example 2
[0053] According to an embodiment of this application, an abnormal number detection and processing device is also provided for implementing the abnormal number detection and processing method in Embodiment 1. Figure 2 This is a schematic diagram of an optional abnormal number detection and processing device according to an embodiment of this application, as shown below. Figure 2 As shown, the abnormal number detection and processing device includes at least an acquisition module 21, a first marking module 22, a second marking module 23, and a processing module 24, wherein:
[0054] The acquisition module 21 is used to acquire call identification information for each call in the telephone network, wherein the call identification information includes at least: the caller's number, the caller's voiceprint identifier, and the call location.
[0055] The telephone network is a telecommunications network that transmits telephone information; it is a telecommunications network capable of interactive voice communication and providing open telephone services. When public security or relevant telecommunications departments detect abnormal numbers, they can obtain call information and corresponding call identification information from the telephone network for subsequent countermeasures, interception, and signal tracing of the abnormal numbers.
[0056] As an optional implementation, for each call in the telephone network, the acquisition module 21 can determine the caller's number and the call location; extract the voice within a preset duration during the call and convert it into a Mel-Cepstral Coefficient feature file; perform voiceprint recognition based on the Mel-Cepstral Coefficient feature file to obtain the caller's voiceprint identifier corresponding to the call.
[0057] In this embodiment, the characteristic of outbound calls using GOIP devices is the separation of the caller and the SIM card, meaning the caller and the SIM card are not in a one-to-one correspondence. Therefore, it differs from normal mobile phone calls and can be defined as an abnormal call traffic model. A normal mobile phone call traffic model refers to a situation where one calling number corresponds to only one voiceprint within a certain time period, while an abnormal call traffic model refers to a situation where one calling number corresponds to several different voiceprints within a certain time period. Therefore, in this application, for each call in the telephone network, the calling number, the call location matching the calling number, and the device serial number are first determined, thus facilitating accurate location of abnormal numbers. Next, the medium and signaling information of the voice call are collected in real time on the mobile core network side, and a portion of the call voice is extracted and converted into a binary MFCC (Mel-Frequency Cepstral Coefficient) file. Voiceprint recognition technology is used to perform voiceprint recognition on the MFCC file to obtain the calling voiceprint identifier for each call, thereby effectively identifying the GOIP devices within the telephone network.
[0058] The first marking module 22 is used to mark multiple suspected abnormal numbers among multiple calling numbers based on the correspondence between calling numbers and calling voiceprint identifiers, wherein each suspected abnormal number corresponds to multiple calling voiceprint identifiers.
[0059] Optionally, the first marking module 22 can aggregate all calling numbers and determine the calling voiceprint identifier corresponding to each calling number; for any calling number, if the number of calling voiceprint identifiers corresponding to the calling number exceeds a first preset threshold within a preset time period, the calling number is determined to be a suspected abnormal number.
[0060] In this embodiment, all calling numbers within the same time period are aggregated, and the corresponding caller voiceprint is identified. If the same calling number corresponds to multiple caller voiceprint identifiers within a system-defined time period, the calling number is identified as a suspected abnormal number. For example, if the same calling number corresponds to ten different caller voiceprint identifiers within one hour, the system identifies the calling number as an abnormal call traffic model number. Furthermore, the first preset threshold can be set according to the actual application scenario; no specific restrictions are imposed here.
[0061] The second marking module 23 is used to mark multiple groups of abnormal numbers among multiple suspected abnormal numbers based on the correspondence between suspected abnormal numbers and call locations, wherein each abnormal number in each group of abnormal numbers corresponds to the same call location.
[0062] As an optional implementation, after marking multiple sets of abnormal numbers among multiple suspected abnormal numbers, the second marking module 23 can also send the suspected abnormal numbers that have not been marked as abnormal numbers to the manual review module for review; and determine whether the suspected abnormal numbers are abnormal numbers based on the review results fed back by the manual review module.
[0063] In this embodiment, to ensure accurate identification of all suspected abnormal numbers, for suspected abnormal numbers that have not been marked as abnormal numbers, a manual review module can be used to make manual outbound calls for further identification. This prevents fraudsters from using counter-investigation methods such as multi-point deployment and reduced call frequency to evade anti-fraud detection, and ensures that GOIP devices deployed within the telephone network are basically eliminated, thereby accurately combating telephone fraud crimes.
[0064] Optionally, based on the review results provided by the manual review module, the system can also use strategies such as called number dispersion, calling frequency of the calling number, and device serial number for further identification, thereby improving the accuracy of data mining.
[0065] Processing module 24 is used to shut down abnormal numbers.
[0066] As an optional implementation, before performing shutdown processing on abnormal numbers, the processing module 24 can also determine whether the abnormal number is in a preset number whitelist; if the abnormal number is in the number whitelist, the abnormal number is remarked as a normal number; if the abnormal number is not in the number whitelist, the shutdown processing on the abnormal number continues.
[0067] In this embodiment, to prevent misidentification of normal user numbers, the system can determine whether the abnormal number is in the whitelist of normal call center numbers before shutting down the abnormal number. If the abnormal number is in the whitelist, the abnormal number is remarked as a normal number; otherwise, the abnormal number is shut down.
[0068] As an optional implementation, after the processing module 24 performs the shutdown process on the abnormal number, it can also determine the user identity information, user address information, and call record information corresponding to the abnormal number; and send the user identity information, user address information, and call record information to law enforcement agencies so that law enforcement agencies can take action against the user using the abnormal number.
[0069] In this embodiment, after shutting down the abnormal number, intervention can be performed on the called party to alert them to fraudulent voice messages without interrupting the call, and continue matching. This will output a special file containing user identity information, user address information, and call record information corresponding to the abnormal number. After further verification by professional technicians, the special file will be provided to law enforcement agencies so that they can arrest criminals who use abnormal numbers to commit telephone network fraud.
[0070] It should be noted that each module in the abnormal number detection and processing device in this application embodiment corresponds one-to-one with each implementation step of the abnormal number detection and processing method in embodiment 1. Since embodiment 1 has been described in detail, some details not shown in this embodiment can be referred to embodiment 1, and will not be elaborated further here.
[0071] Example 3
[0072] According to an embodiment of this application, a non-volatile storage medium is also provided, which includes a stored program, wherein the device where the non-volatile storage medium is located executes the abnormal number detection processing method in Embodiment 1 by running the program.
[0073] Optionally, the device containing the non-volatile storage medium executes the following steps by running the program: obtaining call identification information for each call in the telephone network, wherein the call identification information includes at least: caller ID number, caller ID voiceprint identifier, and call location; marking multiple suspected abnormal numbers among multiple caller ID numbers based on the correspondence between caller ID numbers and caller ID voiceprint identifiers, wherein each suspected abnormal number corresponds to multiple caller ID voiceprint identifiers; marking multiple groups of abnormal numbers among multiple suspected abnormal numbers based on the correspondence between suspected abnormal numbers and call locations, wherein each abnormal number in each group of abnormal numbers corresponds to the same call location; and performing shutdown processing on the abnormal numbers.
[0074] According to an embodiment of this application, a processor is also provided for running a program, wherein the program executes the abnormal number detection processing method in Embodiment 1 during runtime.
[0075] Optionally, the program executes the following steps during runtime: obtaining call identification information for each call in the telephone network, wherein the call identification information includes at least: caller ID number, caller ID voiceprint identifier, and call location; marking multiple suspected abnormal numbers among multiple caller ID numbers based on the correspondence between caller ID numbers and caller ID voiceprint identifiers, wherein each suspected abnormal number corresponds to multiple caller ID voiceprint identifiers; marking multiple groups of abnormal numbers among multiple suspected abnormal numbers based on the correspondence between suspected abnormal numbers and call locations, wherein each abnormal number in each group of abnormal numbers corresponds to the same call location; and performing shutdown processing on the abnormal numbers.
[0076] According to an embodiment of this application, an electronic device is also provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the abnormal number detection processing method of Embodiment 1 through the computer program.
[0077] Optionally, the processor is configured to execute the following steps via a computer program: obtaining call identification information for each call in the telephone network, wherein the call identification information includes at least: caller ID number, caller ID voiceprint identifier, and call location; marking multiple suspected abnormal numbers among multiple caller ID numbers based on the correspondence between caller ID numbers and caller ID voiceprint identifiers, wherein each suspected abnormal number corresponds to multiple caller ID voiceprint identifiers; marking multiple groups of abnormal numbers among multiple suspected abnormal numbers based on the correspondence between suspected abnormal numbers and call locations, wherein each abnormal number in each group of abnormal numbers corresponds to the same call location; and performing shutdown processing on the abnormal numbers.
[0078] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0079] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0080] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.
[0081] The units described as separate components may or may not be physically separate. Similarly, the components shown as units may or may not be physical units; they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.
[0082] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0083] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0084] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A method for detecting and processing abnormal phone numbers, characterized in that, include: Obtain call identification information for each call in the telephone network, wherein the call identification information includes at least: caller ID number, caller voiceprint identifier, and call location; Based on the correspondence between the calling number and the calling voiceprint identifier, multiple suspected abnormal numbers among the multiple calling numbers are marked. Specifically, all calling numbers are aggregated, and the calling voiceprint identifier corresponding to each calling number is determined. For any given calling number, if the number of calling voiceprint identifiers corresponding to the calling number exceeds a first preset threshold within a preset time period, the calling number is determined to be a suspected abnormal number. Each suspected abnormal number corresponds to multiple calling voiceprint identifiers, and the same suspected abnormal number corresponds to multiple different voiceprints. Based on the correspondence between the suspected abnormal numbers and the call locations, multiple groups of abnormal numbers are marked among the multiple suspected abnormal numbers, wherein the call locations corresponding to each abnormal number in each group of abnormal numbers are the same; The abnormal number will be shut down.
2. The method according to claim 1, characterized in that, Obtain call identification information for each call in the telephone network, including: For each call in the telephone network, determine the calling number and the call location corresponding to the call; The speech within a preset duration of the call is extracted and converted into a Mel-Cepstral Coefficient (MCC) feature file. Voiceprint recognition is then performed based on the MCC feature file to obtain the caller's voiceprint identifier corresponding to the call.
3. The method according to claim 1, characterized in that, Based on the correspondence between the suspected abnormal numbers and the call location, multiple groups of abnormal numbers are identified from among the suspected abnormal numbers, including: The suspected abnormal numbers are grouped according to the call location corresponding to each of the suspected abnormal numbers; For any of the call locations, if the number of suspected abnormal numbers corresponding to the call location exceeds a second preset threshold, the suspected abnormal numbers corresponding to the call location are determined to be a group of abnormal numbers.
4. The method according to claim 1, characterized in that, After marking multiple sets of abnormal numbers among the multiple suspected abnormal numbers, the method further includes: For the suspected abnormal numbers that have not been marked as abnormal numbers, the suspected abnormal numbers will be sent to the manual review module for review; Based on the review results provided by the manual review module, determine whether the suspected abnormal number is indeed an abnormal number.
5. The method according to claim 1, characterized in that, Before shutting down the abnormal number, the method further includes: Determine whether the abnormal number is within a preset number whitelist; If the abnormal number is in the number whitelist, then the abnormal number will be remarked as a normal number; If the abnormal number is not in the number whitelist, the abnormal number will continue to be shut down.
6. The method according to claim 1, characterized in that, After shutting down the abnormal number, the method further includes: Determine the user identity information, user address information, and call record information corresponding to the abnormal number; The user's identity information, user address information, and call record information are sent to law enforcement agencies so that the law enforcement agencies can take action against the user using the abnormal number.
7. An abnormal number detection and processing device, characterized in that, include: The acquisition module is used to acquire call identification information for each call in the telephone network, wherein the call identification information includes at least: caller ID number, caller voiceprint identifier and call location; A first marking module is used to mark multiple suspected abnormal numbers among multiple calling numbers based on the correspondence between the calling number and the calling voiceprint identifier. Specifically, it aggregates all calling numbers and determines the calling voiceprint identifier corresponding to each calling number. For any given calling number, if the number of calling voiceprint identifiers corresponding to that calling number exceeds a first preset threshold within a preset time period, the calling number is determined to be a suspected abnormal number. Each suspected abnormal number corresponds to multiple calling voiceprint identifiers, and each suspected abnormal number corresponds to multiple different voiceprints. The second marking module is used to mark multiple groups of abnormal numbers among the multiple suspected abnormal numbers according to the correspondence between the suspected abnormal numbers and the call location, wherein the call location corresponding to each abnormal number in each group of abnormal numbers is the same; The processing module is used to shut down the abnormal number.
8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein the device containing the non-volatile storage medium executes the abnormal number detection and processing method according to any one of claims 1 to 6 by running the program.
9. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the abnormal number detection processing method according to any one of claims 1 to 6 through the computer program.