An information processing method, device and storage medium

Abstract

The application discloses an information processing method, which comprises the following steps: obtaining a communication feature of a target number; judging whether the target number belongs to a first type of device based on the communication feature of the target number; the first type of device is a device for illegal activities; and determining whether the target number is a black and gray production number through the communication feature of the target number in the case that the target number does not belong to the first type of device. In addition, the application also discloses a device and a storage medium. The information processing method, device and storage medium provided by the application can not only judge the numbers in the cat pool device, but also judge other abnormal numbers, so that the problem of missed judgment can be avoided.

Description

Technical Field

[0001] This application relates to the field of information processing, and includes, but is not limited to, an information processing method, device, and storage medium. Background Technology

[0002] In related technologies, when determining whether a number belongs to a SIM card pool device, a second set of numbers is formed by first filtering out numbers from a first set of numbers that include the given number and identifying those with fewer than a predetermined number of online days per month. Then, numbers that are running synchronously are selected from this second set and identified as belonging to the SIM card pool device. However, this method can only identify numbers belonging to the SIM card pool device and cannot identify other abnormal numbers, leading to missed detections. Summary of the Invention

[0003] This application provides an information processing method, device, and storage medium to solve at least one problem existing in the related technology. It can not only identify numbers belonging to the SIM card pool device, but also identify other abnormal numbers, thereby avoiding the problem of missed identification.

[0004] The technical solution of this application is implemented as follows:

[0005] In a first aspect, embodiments of this application provide an information processing method, the method comprising:

[0006] Obtain the communication characteristics of the target number;

[0007] Based on the communication characteristics of the target number, it is determined whether the target number belongs to the first type of device; the first type of device is a device used for illegal activities.

[0008] If the target number does not belong to the first type of device, the communication characteristics of the target number are used to determine whether the target number is a black or gray market number.

[0009] Secondly, embodiments of this application provide an information processing apparatus, the apparatus comprising:

[0010] Acquisition unit, used to acquire the communication characteristics of the target number;

[0011] The determination unit is used to determine whether the target number belongs to a first type of device based on the communication characteristics of the target number; the first type of device is a device that is engaged in illegal activities.

[0012] The determining unit is configured to determine whether the target number is a black or gray market number based on the communication characteristics of the target number when the target number does not belong to the first type of device.

[0013] Thirdly, embodiments of this application provide an electronic device, a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described information processing method.

[0014] Fourthly, embodiments of this application provide a storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described information processing method.

[0015] This application provides an information processing method, device, and storage medium to acquire the communication characteristics of a target number; based on the communication characteristics of the target number, determine whether the target number belongs to a first type of device; the first type of device is a device used for illegal activities; if the target number does not belong to the first type of device, determine whether the target number is a black market or gray market number based on the communication characteristics of the target number. Thus, the determination of whether a target number belongs to a first type of device or is a black market or gray market number is based on the communication characteristics of the target number. Because the determination is based on the communication characteristics of the target number, it can not only determine whether the target number belongs to a first type of device, but also determine whether the target number is a black market or gray market number even if it does not belong to a first type of device, thereby avoiding the problem of missed detections. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of an optional structure of an information processing system provided in an embodiment of this application;

[0017] Figure 2 A schematic diagram of an optional flow of an information processing system provided in an embodiment of this application;

[0018] Figure 3 A schematic diagram of an optional flow of an information processing system provided in an embodiment of this application;

[0019] Figure 4 A schematic diagram of an optional flow of an information processing system provided in an embodiment of this application;

[0020] Figure 5 A schematic diagram of an optional flow of an information processing system provided in an embodiment of this application;

[0021] Figure 6 A schematic diagram of an optional flow of an information processing system provided in an embodiment of this application;

[0022] Figure 7 A schematic diagram of an optional flow of an information processing system provided in an embodiment of this application;

[0023] Figure 8 This is a schematic diagram of an optional structure of an information processing device provided in an embodiment of this application;

[0024] Figure 9 This is a schematic diagram of an optional structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the specific technical solutions of the application will be further described in detail below with reference to the accompanying drawings of the embodiments of this application. The following embodiments are used to illustrate this application, but are not intended to limit the scope of this application.

[0026] Embodiments of this application may provide information processing methods, apparatus (e.g., electronic devices), and storage media (e.g., computer-readable storage media). In practical applications, information processing methods may be implemented using information processing devices.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0028] The information processing method in this application embodiment can be applied to... Figure 1 The information processing device 100 shown, such as Figure 1 As shown, the information processing device 100 includes a server 10, multiple clients 20, and a network 30. The server 10 and the multiple clients 20 communicate via the network 30.

[0029] For each of the multiple clients, a Subscriber Identity Module (SIM) card can be set up in the client, which can represent a number, so that the user can communicate through the SIM card set in the client.

[0030] For the server, it can obtain the communication data generated by the client during the communication process and process the obtained communication data.

[0031] The information processing method provided in this application embodiment is applied to an information processing device, which can be a server.

[0032] The information processing device acquires the communication characteristics of the target number; based on the communication characteristics of the target number, it determines whether the target number belongs to a first type of device; the first type of device is a device used for illegal activities; if the target number does not belong to the first type of device, it determines whether the target number is a black or gray market number based on the communication characteristics of the target number.

[0033] Before providing a further detailed description of this application, the nouns and terms used in the embodiments of this application will be explained, and the nouns and terms used in the embodiments of this application shall be interpreted as follows.

[0034] 1) The first category of devices is those used for illegal activities. These devices can be those that simultaneously hold multiple SIM cards, for example, dozens.

[0035] In one example, the first type of device is a SIM card pool device, which can simultaneously hold dozens of SIM cards. Users can use this SIM card pool device to conduct illegal activities such as telecommunications fraud.

[0036] 2) Black and gray market phone numbers are those used for illegal activities. These illegal activities include: making continuous calls over a period of time, even if the recipient hangs up, and then calling again, making it impossible for the recipient to use their phone normally; sending mass text messages; registering internet accounts in bulk; and at least one of the following: "coupon hunting" (or "profiteering") involves users earning money by promoting various online financial products or promotional activities to a referral network.

[0037] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0038] Figure 2 This is a schematic diagram illustrating the implementation flow of an information processing method provided in an embodiment of this application. This method can be applied to information processing devices, such as... Figure 2 As shown, the method may include the following steps:

[0039] S201. The information processing equipment acquires the communication characteristics of the target number.

[0040] Here, the target number is the number corresponding to the target device, which is the device used for communication.

[0041] The number of target numbers can be one or multiple.

[0042] When there is only one target number, the information processing device will acquire the communication characteristics of that target number.

[0043] When there are multiple target numbers, the information processing device will acquire multiple communication characteristics of the multiple target numbers, wherein each communication characteristic corresponds to one target number.

[0044] In one example, multiple target numbers include: number 1, number 2, and number 3, and multiple communication features include: communication feature 1, communication feature 2, and communication feature 3. Specifically, communication feature 1 corresponds to number 1, communication feature 2 corresponds to number 2, and communication feature 3 corresponds to number 3.

[0045] Communication features are used to characterize the behavioral characteristics of a target number during communication and the location characteristics at the time of the behavior.

[0046] Communication characteristics may include: call characteristics, text message characteristics, and location characteristics.

[0047] Here, call characteristics may include at least one of the following: social characteristics, call volume characteristics, duration characteristics, and behavioral characteristics. Social characteristics may include: the number of calling contacts, the number of out-of-town contacts, and the number of out-of-town contact locations. Call volume characteristics may include: the number of calls made, the number of calls received, and the number of out-of-town calls. Duration characteristics may include: average call duration, total call duration, call duration distribution, call volume distribution by time period, average ring duration, and release duration, where release duration represents the duration from the start of a call to the end of the call from the target number. Behavioral characteristics may include: calling rate, active days, callback rate, calling frequency, number of caller releases, number of caller releases, and number of active base stations. The number of caller releases represents the number of times the target number dials a number until the call ends.

[0048] In one example, communication characteristics include: social characteristics.

[0049] In another example, communication characteristics include: social characteristics and call volume characteristics.

[0050] In yet another example, communication features include: social features, call volume features, call duration features, and behavioral features.

[0051] SMS characteristics may include at least one of the following: number of SMS messages sent, SMS sending frequency, number of SMS messages received from platforms starting with 106, number of SMS messages received, number of contacts who sent SMS messages, number of contacts who received SMS messages, and number of active base stations.

[0052] In one example, SMS characteristics include: the number of SMS messages sent.

[0053] In another example, SMS characteristics include the number of SMS messages sent and the number of SMS messages received.

[0054] Location characteristics may include at least one of: active cells and the number of active cells. The active cells characterize the cell in which the target number is located when it initiates communication behavior, and the number of active cells characterizes the number of cells in which the target number initiates communication behavior.

[0055] In one example, location features include: active cells.

[0056] In another example, location features include: active cells and the number of active cells.

[0057] S202. The information processing device determines whether the target number belongs to the first type of device based on the communication characteristics of the target number.

[0058] Here, after acquiring the communication characteristics of the target number, the information processing device can determine whether the target number belongs to the first category of devices based on these characteristics. The first category of devices refers to devices used for illegal activities.

[0059] S203. If the target number does not belong to the first type of device, the information processing device determines whether the target number is a black or gray market number based on the communication characteristics of the target number.

[0060] Here, if the target number does not belong to the first type of device, the target number may be a normal number or a black and gray market number. In this case, the information processing device will determine whether the target number is a normal number or a black and gray market number by using the communication characteristics of the target number.

[0061] This application provides an information processing method that acquires the communication characteristics of a target number; based on the communication characteristics of the target number, determines whether the target number belongs to a first type of device; the first type of device is a device used for illegal activities; if the target number does not belong to the first type of device, it determines whether the target number is a black market or gray market number based on the communication characteristics. Thus, the determination of whether a target number belongs to a first type of device or is a black market or gray market number is based on the communication characteristics of the target number. Because the determination is based on the communication characteristics of the target number, it can not only determine whether the target number belongs to a first type of device, but also determine whether the target number is a black market or gray market number even if it does not belong to a first type of device, thereby avoiding the problem of missed detections.

[0062] In some embodiments, such as Figure 3 As shown, S201 above includes:

[0063] S301. The information processing device acquires the communication data of the target number.

[0064] Here, during the communication process of the target number, the information processing device will acquire the signaling data generated by the target number during the communication process. After acquiring the signaling data, the information processing device will extract the communication data of the target number from the signaling data.

[0065] After acquiring signaling data, the information processing equipment stores the acquired signaling data in the operator's data table, enabling the information processing equipment to retrieve the communication data of the target number from the operator's data table. The data operator's data table may include: voice call event details (MC_VoiceCall_Event), SMS send / receive event details (MC_SmsSendRecerve_Event), and 4G SMS / MMS details (4G_XDR_SGs).

[0066] Here, the data processing device can obtain the call data of the target number from the MC_VoiceCall_Event details, and the data processing device can obtain the SMS data of the target number from the MC_SmsSendRecerve_Event and 4G_XDR_SGs details.

[0067] S302. The information processing device determines whether the communication data meets the set conditions.

[0068] Here, the setting conditions are Voice over Long-Term Evolution (Volte) signaling or Mobile Change (MC) signaling. If the communication data is VoLTE signaling or MC signaling, the information processing device determines that the communication data meets the setting conditions; if the communication data is not VoLTE signaling or MC signaling, the information processing device determines that the communication data does not meet the setting conditions.

[0069] S303. When the communication data meets the set conditions, the information processing device obtains the communication characteristics of the target number based on the communication data.

[0070] The information processing device extracts information characterizing communication behavior from the VoLTE signaling or MC signaling included in the communication data, and determines the communication characteristics of the target number based on the extracted information.

[0071] Here, the information extracted from the communication data may include: the number of outgoing calls, the number of incoming calls, event identifiers, the duration of outgoing calls, and the release duration.

[0072] In practical applications, information processing devices can extract information based on predefined key fields. In one example, the key fields include: btime, callingnum, callednum, eventID, answerdur, and reloffset. Here, btime represents the call start time, callingnum represents the number of calls made by the calling party, callednum represents the number of calls made by the called party, eventID represents the event identifier (Identity Document, ID), answerdur represents the duration of the calling party's call, and reloffset represents the release time.

[0073] In this embodiment, after extracting information, the information processing device can directly use the extracted information as a communication feature, or it can aggregate information of the same type extracted from different time periods and use the aggregated information as a communication feature. During the aggregation process, a predefined function can be used to process information of the same type from different time periods. This predefined function may include: an average (avg) function, a sum (sum) function, a count (count) function, and a distinct function.

[0074] In one example, the key field is the calling call duration (answerdur), and the function is the avg function. Then, avg(answerdur) can represent the average calling call duration calculated over a period of time.

[0075] In another example, the key field is the calling call duration (answerdur), and the function is the sum function. Then sum(answerdur) can represent the total calling call duration calculated within a time period.

[0076] In some embodiments, such as Figure 4 As shown, prior to S202 above, the method further includes:

[0077] S401. The information processing device determines whether the target device is a device of the first type.

[0078] Here, the information processing equipment can determine whether the target device is a Class I device based on the device identifier. If the device identifier does not correspond to multiple numbers, the target device is not a Class I device; if the device identifier corresponds to multiple numbers, the target device is a Class I device.

[0079] Among them, the device identifier is used to identify the target device. For example, the device identifier is the International Mobile Equipment Identity (IMEI).

[0080] S402. If the device identifier is not the first type of device, the information processing device obtains the device identifier of the target device.

[0081] S403. The information processing device determines the number corresponding to the device identifier as the target number.

[0082] Here, after obtaining the device identifier of the target device, the information processing device can identify the number corresponding to the device identifier as the target number.

[0083] In some embodiments, S202 includes: inputting the communication characteristics of the target number into a first model to obtain a classification identifier output by the first model; the classification identifier is used to indicate whether the target number belongs to a first type of device; and determining whether the target number belongs to a first type of device based on the classification identifier.

[0084] Here, the first model is the model that can perform classification.

[0085] In one example, the first model is a Support Vector Machine (SVM) model.

[0086] Here, after obtaining the communication characteristics of the target number, the first model will output the classification identifier of the target number based on the communication characteristics of the target number, so that the information processing device can determine whether the target number belongs to the first type of device according to the classification identifier.

[0087] In this embodiment of the application, the process of establishing the SVM model is as follows: a training set is obtained, which includes features and labels, wherein the labels are used to indicate the category to which the features belong; the SVM model analyzes the features included in the training set and predicts the category to which the features belong; the SVM model continuously trains the features included in the training set based on the actual category and the predicted category, thereby determining the first model.

[0088] In some embodiments, such as Figure 5 As shown, S203 above includes:

[0089] S501. The information processing device determines the application scenario of the target number through the second model.

[0090] Here, the second model is a model that can determine the application scenario of the target number.

[0091] In one example, the second model is a scenario-specific decision tree model.

[0092] Here, the information processing device inputs the communication characteristics of the target number into the second model, which then determines the application scenario of the target number.

[0093] In this embodiment of the application, the training process of the scenario-specific decision tree model is as follows: A training dataset is obtained, wherein the training dataset D = {(x1, y1), (x2, y2), ..., (x...} N y N )}, where x i For communication characteristics, y i Let i ∈ [1, N] be the application scenario to which the communication feature belongs. The scenario-specific decision tree model analyzes the communication features included in the training dataset and predicts the application scenario to which the communication feature belongs. The scenario-specific decision tree model is continuously trained on the communication features included in the training dataset based on the actual application scenario and the predicted application scenario, thereby determining the scenario-specific decision tree model.

[0094] Here, communication characteristics may include at least one of the following: total call duration, number of times the phone is turned off, number of times the phone is turned on, average call duration, number of outgoing calls, average release duration, number of contacts, number of out-of-town contacts, outgoing call rate, number of SMS messages sent, number of SMS messages received, SMS sending frequency, monthly call charges, and monthly data charges.

[0095] In one example, communication characteristics include: total call duration.

[0096] In another example, communication characteristics include: total call duration and number of times the device was switched off.

[0097] S502. When the application scenario belongs to the set reference scenario, the information processing device determines that the target number is a black and gray industry number.

[0098] In one example, the reference scenarios are set as follows: scenario A and scenario B. The application scenario of the target number is scenario B. Then, the application scenario B of the target number belongs to the set reference scenario B, and the information processing device can determine that the target number is a black and gray market number.

[0099] The reference scenarios set here can include: group control of credit card accounts, harassment of a single user with a single ring or a fixed duration, harassment of multiple users with a single ring or a fixed duration, and "coupon hunting." Group control of credit card accounts involves simultaneously controlling dozens or even hundreds of mobile phones via computer to send text messages or make harassing calls. "Coupon hunting" refers to users earning money by promoting various online financial products or promotional activities and recruiting others.

[0100] For the group-controlled SIM card farming scenario, scenario characteristics may include: number of active cells, active cells, mobile device number, mobile phone number, and number of outgoing calls. Table 1 below lists the scenario characteristics, scenario characteristic thresholds, and necessity corresponding to the group-controlled SIM card farming scenario.

[0101] Table 1

[0102] Scene features Scene feature threshold necessity Number of active communities ≤10 per week yes Activity Community Not empty yes Mobile device number Not empty yes Phone number yes Number of calls made ≥20 times / day yes

[0103] If the necessity is yes, it means that the communication characteristics of the target number must meet the scenario characteristic threshold before it can be determined that the application scenario of the target number belongs to the set reference scenario.

[0104] For scenarios involving one-ring or fixed-duration harassment against a single user, scenario characteristics may include: communication days, number of active cells, number of caller contacts, number of out-of-town contact locations for the caller, caller rate, number of calls made, average call duration, call frequency, and callback rate. Table 2 below lists the scenario characteristic thresholds and necessity for each characteristic corresponding to the one-ring or fixed-duration harassment scenario against a single user.

[0105] Table 2

[0106]

[0107]

[0108] If the necessity is yes, it means that the communication characteristics of the target number must meet the scenario characteristic threshold before it can be determined that the application scenario of the target number belongs to the set reference scenario; if the necessity is no, it means that the application scenario of the target number can be determined to belong to the set reference scenario even if the communication characteristics of the target number do not meet the scenario characteristic threshold.

[0109] For scenarios involving one-ring or fixed-duration harassment of multiple users, scenario characteristics may include: communication days, number of active cells, number of caller contacts, number of out-of-town contact locations of the caller, caller rate, number of calls made by the caller, and average call duration of the caller. Table 3 below lists the scenario characteristic thresholds and necessity for each scenario characteristic corresponding to the one-ring or fixed-duration harassment scenario involving multiple users.

[0110] Table 3

[0111]

[0112] For the "coupon-grabbing" scenario, scenario characteristics may include: number of communication days, number of active cells, number of contacts sending SMS messages, number of contacts receiving SMS messages, SMS sending volume, SMS receiving volume, number of SMS messages received from platforms starting with 106, and the percentage of SMS messages received from platforms starting with 106. Table 4 below lists the feature thresholds and necessity of each scenario characteristic corresponding to the coupon-grabbing scenario.

[0113] Table 4

[0114]

[0115] S503. When the application scenario does not belong to the set reference scenario, the information processing device determines that the target number is not a black or gray market number.

[0116] In one example, the reference scenarios are set as scenario A and scenario B, and the application scenario of the target number is scenario C. Then, the application scenario C of the target number does not belong to the set reference scenarios A and B, and the information processing device can determine that the target number is not a black or gray market number.

[0117] In some embodiments, the method further includes: obtaining the communication content of the target number; and determining whether the target number is a black market or gray market number based on the communication content.

[0118] Here, the information processing equipment can obtain the communication content of the target number by monitoring the communication content of the target number, and determine whether the target number is a black or gray market number based on the communication content.

[0119] In some embodiments, the communication content includes: SMS content, and determining whether the target number is the black and gray market number based on the communication content includes: if the SMS content contains a set keyword, then determining that the target number is the black and gray market number.

[0120] Here, keywords can include: default, non-payment, due, and overdue.

[0121] If the text message contains set keywords, the information processing device can determine that the target number is a black or gray market number.

[0122] In some embodiments, the communication content includes: telephone test results, which are used to characterize the results generated by conducting telephone tests. The step of determining whether the target number is the black and gray market number based on the communication content includes: determining whether the telephone test result is a preset result; if the telephone test result is the preset result, then the target number is determined to be the black and gray market number.

[0123] Here, the possible outcomes can include: no answer, transfer to Artificial Intelligence (AI) voice, and service interruption, etc.

[0124] After obtaining the telephone test results, the information processing device determines whether the telephone test results are the preset results. If the telephone test results are the preset results, the information processing device can determine that the target number is a black and gray market number; if the telephone test results are not the preset results, the information processing device can determine that the target number is a normal number.

[0125] In this embodiment of the application, after determining that the target number is a black and gray market number based on the communication content, the information processing device can also classify the target number into levels and share the target number and its level with the telecommunications administration bureau or operator.

[0126] After receiving the target number and its risk level, the telecommunications authority or operator can set different handling strategies according to the different risk levels. For example, low-risk numbers can be allowed to pass, medium-risk numbers can be blocked, and high-risk numbers can be shut down, blacklisted, or subject to key monitoring.

[0127] Alternatively, after receiving the target number and its rating, the telecommunications authority or operator may provide the target number and its rating to banks, microfinance institutions, or e-commerce platforms to provide risk identification strategies for bank credit cards, microfinance institutions, and e-commerce platforms.

[0128] In this embodiment of the application, the risk level of the target number may include: low risk level I1, medium risk level I2, and high risk level I3. For low risk level I1, the suggested handling is that the user's risk is low and no action should be taken. For medium risk level I2, the suggested handling is that the customer can decide whether to provide service or not based on the business scenario. For high risk level I3, the suggested handling is that it is not recommended to provide service to this number.

[0129] Here, if the target number has been cancelled, the risk level of the target number is risklevelI0, and the suggested handling is: Please check the target number again.

[0130] In recent years, the internet has developed rapidly, and in particular, scenarios such as fake orders on shopping platforms and "coupon hunting" on e-commerce platforms all rely on mobile phone numbers for account registration, password retrieval, and identity verification. Mobile phone numbers have become a breakthrough point for black and gray industries to seek profits. According to statistics, black and gray industry groups in China currently control more than 100 million mobile phone numbers.

[0131] The black and gray industries operate using various tools, from early methods like using SIM card pool devices and captcha-solving platforms for SIM card farming fraud, mass texting, and bulk registration of internet accounts, to more recent methods such as using group control software and ROM-flashing tools to simulate normal user behavior for mobile internet marketing purposes like liking and forwarding in entertainment applications. This has formed a complete industrial chain from SIM card farming to application development. Timely identification of mobile phone numbers controlled by the black and gray industries is of great significance for protecting the economic interests of enterprises, combating telecommunications fraud, and maintaining the healthy development of internet businesses.

[0132] In related technologies, methods for identifying abnormal phone numbers in SIM card pools may include the following:

[0133] 1. Collect device features by embedding data points to determine whether it is a cat pool device.

[0134] However, collecting user information through tracking can easily lead to adverse effects such as infringing on user privacy and high collection costs.

[0135] 2. By filtering out numbers that have fewer online days per month than the predetermined number of days and numbers that are running synchronously, the numbers used for maintaining accounts in the same SIM card pool can be determined.

[0136] However, using monthly online days and synchronous operation characteristics to identify numbers belonging to the same SIM card pool can easily lead to misjudgments and omissions in black and gray market group control scenarios.

[0137] To address the aforementioned issues, this application provides an information processing method that categorizes black market phone numbers according to novel modus operandi characteristics into three main categories: IMEI-abnormal card numbers, card farming using SIM card pool devices, and black market phone numbers using non-SIM card pool devices. The latter category is further subdivided into four subcategories: group-controlled card farming, one-ring / fixed-duration harassment targeting a single user, group-calling one-ring / fixed-duration harassment, and coupon fraud. In other words, this application categorizes black market phone numbers into six scenarios based on novel modus operandi characteristics.

[0138] Based on the above six scenarios, this application uses call behavior, location information, power on / off behavior, and SMS sending and receiving to perform integrated analysis and modeling, and incorporates SMS pre-evaluation verification, which can effectively identify malicious numbers used for black and gray market activities, thereby preventing individual users from being deceived and enterprises from suffering losses in marketing resources.

[0139] This application proposes a technical solution for operators to effectively identify malicious phone numbers used for black and gray market activities such as SIM card farming using SIM card pool devices, group SIM card farming, one-ring harassment calls, and fraudulent activities by utilizing data such as call behavior, location information, power on / off behavior, and SMS sending and receiving.

[0140] This application utilizes call behavior data from signaling data, which may include activity and social behavior. Social behavior includes caller ID, caller contacts, average call duration, caller ID rate, lac-ci location information, power on / off behavior and SMS sending / receiving in the data, and the proportion of special numbers to integrate and analyze the model. The application also uses methods such as call callback and SMS pre-evaluation to optimize and validate the model.

[0141] The information processing method provided in this application will be described in detail below.

[0142] like Figure 6As shown, the information processing method provided in this application may include the following steps:

[0143] S601, The information processing equipment acquires the signaling data of the target number.

[0144] S602. The information processing device extracts the features of the target number based on the signaling data.

[0145] S603. The information processing device determines whether an IMEI corresponds to multiple numbers.

[0146] If so, then execute S604: The information processing device performs SMS pre-evaluation, or telephone test.

[0147] If not, then execute S605: The information processing device determines whether the target number belongs to the SIM card pool device based on the SVM support vector machine model.

[0148] Here, the SVM support vector machine model is the first model described in the above embodiments.

[0149] If it belongs to a cat pool device, then execute S604.

[0150] If it does not belong to the cat pool device, then execute S606: The information processing device determines whether the target number is a black and gray industry number based on the scenario-based decision tree overlay model.

[0151] Here, the scenario-based decision tree overlay model is the second model described in the above embodiments.

[0152] After executing S604, execute S607: Output the abnormal number of black and gray industry activities.

[0153] This application includes: an IMEI identification strategy module, an SVM support vector machine model, a scenario-specific decision tree overlay model, an SMS pre-evaluation module, and a telephone dialing test module.

[0154] Here, the IMEI identification strategy module is used to determine whether a target device corresponds to multiple numbers, and these multiple numbers share the same LAC-CI for their communication activities, exhibiting obvious clustering characteristics. If a target device corresponds to multiple numbers, and the location area code (LAC)-CI for the communication activities of these multiple numbers is the same, then the target device is determined to be a SIM card pool device (i.e., the first type of device described in the above embodiments); if the target device does not correspond to multiple numbers, then the target device is determined not to be a SIM card pool device.

[0155] The IMEI identification strategy module calculates whether the IMEI is empty. If the IMEI is empty, it means that the target device corresponds to multiple numbers.

[0156] If the IMEI is empty, the multiple numbers corresponding to that IMEI will be processed through the SMS pre-evaluation module or the telephone dialing test module.

[0157] If the IMEI is not empty, the SVM (Support Vector Machine) model is used to determine whether the number in the target device belongs to the number in the SIM card pool or not.

[0158] The SVM (Support Vector Machine) model is used to extract multi-dimensional features from signaling data, such as social features, call volume information, call duration information, communication behavior, and location features, based on the SIM card nurturing behavior characteristics of SIM card nurturing devices. The SVM classifier is used to build a binary classification model to identify SIM card nurturing numbers from SIM card nurturing devices.

[0159] The following will be through Figure 7 The methods for obtaining various communication characteristics are described in detail.

[0160] In the embodiments of this application, such as Figure 7 As shown, after acquiring communication data, the information processing device will perform the following steps:

[0161] S701, the information processing equipment determines whether VoLTE signaling exists in the communication data.

[0162] If it does not exist, then execute S702: The information processing device determines whether there is MC signaling in the communication data.

[0163] If VoLTE signaling and MC signaling are present in the communication data, then execute S703: Extract fields from VoLTE signaling and MC signaling.

[0164] S704. The information processing equipment determines whether the event type is a calling party.

[0165] If the caller is the one making the call, then execute one or more steps from S705 to S708, or execute one or more steps from S709 to S712, or execute one or more steps from S713 to S714:

[0166] S705: The function count(calling num) is used to calculate the number of outgoing calls.

[0167] S706. Use the function count(distinct(calling num)) to calculate the number of calling contacts.

[0168] S707. The number of external contact locations is calculated using the intermediate table phone_num_area.

[0169] S708. Use the function distinct(calling num) to calculate the caller's contact.

[0170] S709. Use the function avg(answerdur) to calculate the average call duration of the calling party.

[0171] S710. Use the function sum(answerdur) to calculate the total call duration.

[0172] S711. The average release time is calculated using the function avg(reloffset).

[0173] S712. The function count(distinct(CONCAT(TAC,ECI))) is used to calculate the number of active base stations.

[0174] S713. Use the function count(SUBSTRING(btime, 11, 3)) to calculate hour_callingnums. Here, hour_callingnums represents the number of calls made in one hour.

[0175] S714. Use the function max(hour calling nums) to calculate the calling frequency.

[0176] If you are not the caller, then perform one or more steps from S715 to S716:

[0177] S715. Use the function count(callednum) to calculate the number of called calls.

[0178] S716. Use the function distinct(callednum) to calculate the contact person for the called party.

[0179] After S705, execute S717: calculate the calling rate.

[0180] The calling rate is calculated as: (Number of calling calls / (Number of calling calls + Number of called calls)).

[0181] After S708, execute S718: Use the compare function to calculate the number of people in the calling party's contact list who are the same as the called party's contact list.

[0182] After S718, execute S719: calculate the clawback rate.

[0183] The callback rate is calculated as: number of repeat callers / number of caller contacts.

[0184] Following S712, execute S720: use the function count(distinct(CONCAT(lac, ci))) to calculate the number of active base stations.

[0185] After performing the above steps, execute S721: output the communication characteristics through the join function.

[0186] Card numbers identified as potentially being used for SIM card farming on SIM card pools are entered into the SMS pre-evaluation module for monitoring. At the same time, card numbers identified as not being used for SIM card farming on SIM card pools are input into the scenario-specific decision tree model to further refine the identification of black and gray market numbers not associated with SIM card pools.

[0187] The scenario-based decision tree module is used to identify black market phone numbers on non-SIM card pool devices. It constructs a scenario-based decision tree model using the Gini index as the standard for four scenarios: one-ring or fixed-duration harassment of a single user (i.e., one-ring or fixed-duration harassment of a single user as described in the above embodiments), one-ring / fixed-duration harassment of multiple users as described in the above embodiments, fraudulent activities, and group-controlled card farming. This model identifies black market phone numbers on non-SIM card pool devices in each scenario, especially those used for group-controlled card farming. For descriptions of the four scenarios, please refer to the descriptions in the above embodiments; they will not be repeated here.

[0188] For scenarios involving a single user receiving a single ring or a fixed-duration call, modeling can be performed using the scenario features shown in Table 5 below.

[0189] Table 5

[0190]

[0191] In this context, social information refers to the social features described in the above embodiments, and call information refers to the call features described in the above embodiments.

[0192] For the scenarios of mass dialing with a single ring / fixed-duration call bombardment, modeling can be performed using the scenario features shown in Table 6 below.

[0193] Table 6

[0194]

[0195]

[0196] In scenarios involving group-controlled SIM card farming, if a large number of phone numbers and IMEI numbers appear consecutively under the same base station, the scenario can be identified as group-controlled SIM card farming. These scenarios can include both active and silent SIM card farming.

[0197] Here, the methods for determining whether a card-raising scenario is active or silent card-raising may include: determining whether the communication data includes location features and communication features; if it includes location features and communication features, then the card-raising scenario is determined to be active card-raising; if it does not include location features and communication features, then the card-raising scenario is determined to be silent card-raising.

[0198] Here, for active card-raising scenarios, modeling can be performed using the scenario features shown in Table 7 below.

[0199] Table 7

[0200]

[0201] The location information refers to the location features described in the above embodiments, and the device information refers to the device identifier of the target device described in the above embodiments.

[0202] For the "wool-gathering" scenario, modeling can be performed using the scenario features shown in Table 8 below.

[0203] Table 8

[0204]

[0205] The SMS message is the SMS feature described in the above embodiments.

[0206] In this embodiment, decision tree modeling can be used based on feature extraction from the above-mentioned scenarios.

[0207] Based on feature training modeling and continuous optimization of feature thresholds, the final feature threshold values ​​and necessity for black and gray market phone numbers to harass a single user with one ring / fixed duration harassment are shown in Table 9:

[0208] Table 9

[0209]

[0210]

[0211] For the group dialing model, the threshold values ​​and necessity of some features are shown in Table 10:

[0212] Table 10

[0213]

[0214] For the group-controlled card-raising identification model, the threshold values ​​and necessity of some features are shown in Table 11:

[0215] Table 11

[0216] Feature number Scene features Scene feature threshold necessity A8 Number of active communities ≤10 per week yes A14 Activity Community Not empty A15 Mobile device number Not empty yes A16 Phone number yes A12 Number of calls made ≥20 times / day yes

[0217] For the "wool-gathering" model, the threshold values ​​and necessity of some features are shown in Table 12:

[0218] Table 12

[0219]

[0220] The SMS pre-evaluation module is used to input the abnormal IMEI card numbers and suspected SIM card pool device card numbers identified by the above three modules into the SMS pre-evaluation. It monitors abnormal SMS content weekly through keywords such as "default", "unpaid", "expired", and "overdue", and finally outputs black and gray market numbers related to SIM card pools.

[0221] The call testing module is used to test calls to numbers that conform to IMEI identification policies and are black market numbers from SIM card pools used for one-ring, call bombing, and fraudulent calls. If the result is no answer, AI intelligent voice, or out of service, it is identified as abnormal and can be shut down or blacklisted.

[0222] In addition to the modules mentioned above, to further combat black and gray market activities, this application proposes a scheme for comprehensive risk assessment based on the above scenario recognition results, using a three-tiered approach (high, medium, and low). This scheme achieves the sharing of black and gray market capabilities by outputting phone numbers and their risk ratings.

[0223] 1) Share number details and risk levels with the telecommunications administration and operators: different handling strategies can be set according to the risk levels of high, medium and low, such as: low risk means let it go, medium risk means block it, and high risk means shut down / blacklist or key monitoring.

[0224] 2) Profiting from phone numbers and ratings: supplementing risk identification strategies for bank credit cards, microloans, e-commerce, etc.

[0225] The main innovation of this application lies in providing a machine learning superposition model based on operator signaling data, including call data, location data, and SMS data, to identify abnormal IMEI card numbers, card numbers used for SIM card farming in SIM card pools, group control card farming, one-ring harassment and call bombing, and black and gray industry card numbers for exploiting loopholes.

[0226] This method can compensate for the incomplete identification of SIM card numbers used in black and gray market activities related to SIM card pools. It can help identify whether users are on the same SIM card pool device by using the SIM card number, or identify abnormal users of SIM card pools based on the characteristics of the SIM card pool device, thus preventing missed or false positives.

[0227] This application first uses relevant data such as IMEI device characteristics and location characteristics to identify card numbers with abnormal IMEI.

[0228] Meanwhile, by extracting features such as call behavior, SMS behavior, social information, and activity level, a first-level SVM support vector machine model and a second-level decision tree model for different scenarios are constructed. By superimposing the two-level models, five types of suspected black and gray market numbers in scenarios such as SIM card farming using SIM card pool devices, one-ring / fixed-duration call bombardment of a single user, one-ring / fixed-duration call bombardment of group calls, coupon exploitation, and group control for SIM card farming are identified.

[0229] Finally, the suspected black market numbers identified by the model are input into the SMS pre-evaluation system. This system monitors for abnormal SMS behavior weekly to confirm the identification of these black market numbers. The accuracy rate of identification is over 90%.

[0230] In addition, a telephone testing step has been added to verify malicious harassment and fraudulent black market numbers. Once confirmed, black market numbers used for harassment and fraud, such as those identified as "cat pools," have been shut down or blacklisted.

[0231] This application is based on a two-level machine learning model and SMS pre-evaluation and telephone dialing test judgment. Finally, it performs risk classification on the identified black and gray market numbers in the cat pool, and realizes the sharing of black and gray market capabilities and further countermeasures by outputting the numbers and their risk classifications.

[0232] Figure 8 An information processing apparatus provided in the embodiments of this application, such as Figure 8 As shown, the information processing device 800 includes:

[0233] Acquisition unit 801 is used to acquire the communication characteristics of the target number;

[0234] The determination unit 802 is used to determine whether the target number belongs to a first type of device based on the communication characteristics of the target number; the first type of device is a device that is engaged in illegal activities.

[0235] The determining unit 803 is used to determine whether the target number is a black and gray market number based on the communication characteristics of the target number when the target number does not belong to the first type of device.

[0236] In some embodiments, the acquiring unit 801 is further configured to:

[0237] Obtain the communication data of the target number;

[0238] Determine whether the communication data meets the set conditions; the set conditions are LTE Voice Bearer (Volte) signaling or Mobile Switching (MC) signaling.

[0239] When the communication data meets the set conditions, the communication characteristics of the target number are obtained based on the communication data.

[0240] In some embodiments, the determining unit 802 is further configured to:

[0241] Based on the communication characteristics of the target number, before determining whether the target number belongs to the first type of device, it is determined whether the target device is the first type of device;

[0242] If the target device is not a device of the first type, then obtain the device identifier of the target device;

[0243] The number corresponding to the device identifier is determined as the target number.

[0244] In some embodiments, the determining unit 802 is further configured to:

[0245] The communication characteristics of the target number are input into the first model to obtain the classification identifier output by the first model; the classification identifier is used to indicate whether the target number belongs to the first type of device;

[0246] Based on the classification identifier, determine whether the target number belongs to the first type of device.

[0247] In some embodiments, the determining unit 803 is further configured to:

[0248] The application scenario of the target number is determined using the second model;

[0249] If the application scenario belongs to the set reference scenario, then the target number is determined to be a black and gray market number;

[0250] If the application scenario does not belong to the set reference scenario, then the target number is determined not to be a black or gray market number.

[0251] In some embodiments, the acquisition unit 801 is further configured to:

[0252] Obtain the communication content of the target number;

[0253] Determine whether the target number belongs to the black and gray market based on the communication content.

[0254] In some embodiments, the determining unit 802 is further configured to:

[0255] If the communication content includes SMS messages, and the SMS messages contain set keywords, then the target number is determined to be a black and gray market number.

[0256] In some embodiments, the determining unit 802 is further configured to:

[0257] Determine whether the telephone test result included in the communication content is a preset result; the telephone test result is used to characterize the result generated by the telephone test.

[0258] If the telephone test result is the set result, then the target number is determined to be the black and gray market number.

[0259] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the information processing method provided in the above embodiments.

[0260] This application also provides a storage medium, namely a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the information processing method provided in the above embodiments.

[0261] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0262] It should be noted that, Figure 9 This is a schematic diagram of a hardware entity of an electronic device according to an embodiment of this application, such as... Figure 9 As shown, the electronic device 900 includes: a processor 901, at least one communication bus 902, at least one external communication interface 904, and a memory 905. The communication bus 902 is configured to enable communication between these components. In one example, the electronic device 900 further includes: a user interface 903, which may include a display screen, and the external communication interface 904 may include standard wired and wireless interfaces.

[0263] The memory 905 is configured to store instructions and applications executable by the processor 901, and can also cache data to be processed or already processed by the processor 901 and various modules in the electronic device (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0264] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0265] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0266] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0267] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0268] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0269] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0270] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0271] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An information processing method, characterized in that, The method includes: Obtain the device identifier of the target device; If the device identifier does not correspond to multiple numbers, and the target device is determined not to be a first-type device, the number corresponding to the device identifier is determined as the target number. Obtain the communication characteristics of the target number; Based on the communication characteristics of the target number, it is determined whether the target number belongs to the first type of device; the first type of device is a device used for illegal activities. If the target number does not belong to the first type of device, determine whether the target number is a black or gray market number based on the communication characteristics of the target number; The communication characteristics used to determine whether the target number belongs to the first type of device include the behavioral characteristics of the target number during communication and the location characteristics when the behavior occurs; the communication characteristics used to determine whether the target number is a black and gray market number include at least one of the following: total call duration, number of times the phone is turned off, number of times the phone is turned on, average call duration, number of outgoing calls, average release duration, number of contacts, number of out-of-town contacts, outgoing call rate, number of SMS messages sent, number of SMS messages received, SMS sending frequency, monthly call charges, and monthly data charges.

2. The method according to claim 1, characterized in that, The communication characteristics of the target number obtained include: Obtain the communication data of the target number; Determine whether the communication data meets the set conditions; the set conditions are LTE Voice Bearer (Volte) signaling or Mobile Switching (MC) signaling. When the communication data meets the set conditions, the communication characteristics of the target number are obtained based on the communication data.

3. The method according to claim 1, characterized in that, The step of determining whether the target number belongs to the first type of device based on the communication characteristics of the target number includes: The communication characteristics of the target number are input into the first model to obtain the classification identifier output by the first model; the classification identifier is used to indicate whether the target number belongs to the first type of device; Based on the classification identifier, determine whether the target number belongs to the first type of device.

4. The method according to claim 1, characterized in that, The step of determining whether a target number is a black or gray market number based on its communication characteristics includes: The application scenario of the target number is determined using the second model; If the application scenario belongs to the set reference scenario, then the target number is determined to be a black and gray market number; If the application scenario does not belong to the set reference scenario, then the target number is determined not to be a black or gray market number.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the communication content of the target number; Determine whether the target number belongs to the black and gray market based on the communication content.

6. The method according to claim 5, characterized in that, The communication content includes: SMS content, and the step of determining whether the target number is a black market or gray market number based on the communication content includes: If the text message contains set keywords, then the target number is determined to be a black and gray market number.

7. The method according to claim 5, characterized in that, The communication content includes: telephone test results, which characterize the results generated by conducting telephone tests. The step of determining whether the target number is a black market or gray market number based on the communication content includes: Determine whether the telephone test result is the preset result; If the telephone test result is the set result, then the target number is determined to be the black and gray market number.

8. An information processing device, characterized in that, The device includes: An acquisition unit is configured to acquire the device identifier of a target device; determine that the target device is not a first-type device if the device identifier does not correspond to multiple numbers; determine the number corresponding to the device identifier as the target number; and acquire the communication characteristics of the target number. The determination unit is used to determine whether the target number belongs to a first type of device based on the communication characteristics of the target number; the first type of device is a device that is engaged in illegal activities. The determining unit is configured to determine whether the target number is a black or gray market number based on the communication characteristics of the target number when the target number does not belong to the first type of device. The communication characteristics used to determine whether the target number belongs to the first type of device include the behavioral characteristics of the target number during communication and the location characteristics when the behavior occurs; the communication characteristics used to determine whether the target number is a black and gray market number include at least one of the following: total call duration, number of times the phone is turned off, number of times the phone is turned on, average call duration, number of outgoing calls, average release duration, number of contacts, number of out-of-town contacts, outgoing call rate, number of SMS messages sent, number of SMS messages received, SMS sending frequency, monthly call charges, and monthly data charges.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the information processing method according to any one of claims 1 to 7.

10. A storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the information processing method according to any one of claims 1 to 7.

Images