A Fraudulent Call Recognition Method Based on Width Auto-Encoding with Attention Mechanism

Abstract

The present invention relates to a method for identifying fraudulent calls with a width autoencoder that integrates an attention mechanism, and belongs to the field of big data technology. S1: Based on the user service data of a telecom operator, extract and preprocess user basic information, voice communication data, SMS communication data, and mobile phone APP access data, perform feature processing on each form, and perform encrypted caller association integration according to external association rules; S2: Based on the preprocessed and associated data, construct a denoising autoencoder to compress the input into a low-dimensional space representation, and reconstruct the output through the representation; S3: Construct a width learning feature generation model, input the encoded data and the original data into the model to generate feature nodes, encoding feature nodes, enhancement nodes, and encoding enhancement nodes, and reconstruct the node distribution based on the user dimension; S4: Use the attention mechanism model to extract channel and space features; S5: Divide the data set, train the model and tune the parameters, obtain the trained model, and output the final prediction result of the fraud data.

Description

Technical Field

[0001] The present invention belongs to the field of big data technology and relates to a width autoencoding fraudulent phone call identification method integrating an attention mechanism. Background Art

[0002] Currently, fraud call identification solutions in the industry primarily rely on rule-based expert systems and traditional machine learning-based model systems. Rule-based expert systems require anti-fraud experts to manually analyze large amounts of positive and negative telecommunications data to accurately identify fraudsters' fraudulent behavior patterns and identify key features that effectively distinguish fraudulent activity. This is time-consuming and labor-intensive. Therefore, expert systems rely heavily on the expertise and business knowledge of anti-fraud experts. Failure to promptly detect increasingly complex fraud patterns can result in significant losses. Machine learning-based models typically perform feature engineering based on historical data, then utilize machine learning algorithms to train and evaluate the model on the dataset before applying it to fraud call identification. Both rule-based expert systems and machine learning-based model systems effectively identify individual fraud behavior patterns from historical data.

[0003] As telecom fraud techniques continue to advance, their methods become more complex and varied. The ability to ensure high-accuracy fraud call identification without relying on prior knowledge learned by humans or experts in feature engineering is crucial for the smooth progress of anti-fraud efforts by both the nation and the telecom industry. Therefore, in the context of high-dimensional, large-scale data, building an enhanced and optimized wide-feature generation model and leveraging attention mechanisms to mine users' latent feature expressions can effectively improve the model's fraud detection capabilities. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a wide-band autoencoding fraud call identification method that integrates an attention mechanism to achieve feature extraction and classification of fraud data.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A method for identifying fraudulent calls using a width autoencoder integrated with an attention mechanism, comprising the following steps:

[0007] S1: Based on the telecom operator's user service data, extract and pre-process basic user information, voice communication data, SMS communication data, and mobile app access data, add features to each form, and perform encrypted caller association integration according to external association rules;

[0008] S2: Based on the preprocessed and correlated data, a denoising autoencoder is constructed to compress the input into a low-dimensional spatial representation and reconstruct the output from this representation;

[0009] S3: Build a width learning feature generation model, input the encoded data and original data into the model to generate feature nodes, encoding feature nodes, enhancement nodes, and encoding enhancement nodes, and reconstruct the node distribution based on the user dimension;

[0010] S4: Use attention mechanism model to extract channel and spatial features;

[0011] S5: Divide the data set, train the model and tune the parameters to obtain the trained model, and output the final prediction results of the fraud data.

[0012] Furthermore, step S1 specifically includes: constructing a fraud call detection data set for different business data of users collected from telecom operators, and dividing the data into the following four categories according to different businesses: user basic information, voice communication data, SMS communication data, and mobile phone APP access data; performing data cleaning operations, including missing value and outlier processing and normalization processing; at the same time, marking the calls according to the reported information, with fraud calls marked as 1 and non-fraud calls marked as 0; adding feature processing to each form data, and then performing external association rule operations between forms according to the encrypted caller.

[0013] Furthermore, in step S1, for user information data, feature fields are added: the ratio of monthly consumption to the city's average consumption, the ratio of monthly consumption to the district and county's average consumption, and the number of primary card numbers divided into 0 and 1 with 4 as the limit; for voice communication data, feature fields are added: statistics on the number of calls and the number of calls, call type statistics, the maximum number of calls per day, the number of call recipients per day, the proportion of late-night calls, detailed statistics on total call duration, and the proportion of calls by city; for SMS communication data, feature fields are added: the total number of SMS messages sent, the number of SMS messages sent by a single device, the number of SMS senders, the number and proportion of late-night SMS messages sent, the maximum number of SMS messages sent per day, the total number of SMS messages received, the number and proportion of late-night SMS messages received, and the maximum number of SMS messages received per day; for mobile app access data, feature fields are added: total traffic statistics, the number of apps with no traffic in a single month, the number of traffic recipients in a single month, and monthly app traffic usage statistics. Then, an external association is performed on the feature-processed form data, with the associated field being the encrypted caller, and all user data is retained.

[0014] Furthermore, in step S2, the preprocessed and associated data is reconstructed through the constructed denoising autoencoder to add noise to the associated original fraud data, which is generated in the form of Gaussian white noise:

[0015]

[0016] Among them, X randomTo satisfy the random noise of normal distribution, μ is the mean of Gaussian distribution, σ is the square root of variance, m is a constant, and the generated noise data X is obtained. noise .

[0017] Passing the new variable with Gaussian noise through the denoising autoencoder will force the encoder to learn to extract the most important features and learn a more robust representation.

[0018] Specifically, we first set the value to 0 with a certain probability P, and then lose some features of the data:

[0019] X new =P(X+X noise )

[0020] Among them, P is the probability function and X is the associated data.

[0021] Through the X of lost information new Calculate y:

[0022] y=f θ (X new )=f(WX new +b)

[0023] Among them, W is the encoding matrix, b is its bias matrix, and f represents the encoding activation function.

[0024] Finally, the decoded y is used to generate the encoded reconstructed output:

[0025] X encoder =gθ′(y)=S(W′y+b′)

[0026] Among them, W′ is the decoding matrix, b′ is its bias matrix, S is the decoding activation function, X encoder Reconstruct output for encoding.

[0027] Furthermore, step S3 uses the width learning feature generation model to input the encoded data and the original data into the model generation feature node, the encoding feature node, the enhancement node and the encoding enhancement node, specifically including:

[0028] Feature nodes are generated by associating raw data:

[0029]

[0030] The encoded feature nodes are generated by encoding the reconstructed data:

[0031]

[0032] Among them, φ is the linear activation function, and is the Gaussian distribution matrix, β iis the bias matrix.

[0033] The enhancement nodes and coding enhancement nodes are derived from the nonlinear activation of feature nodes and coding feature nodes respectively:

[0034]

[0035]

[0036] Among them, ξ is a nonlinear activation function, commonly used Sigmoid, tanh and ReLU functions, etc. and is the orthogonal normalized matrix to reduce the redundancy of the enhanced features and make the expression stronger. j is the bias matrix.

[0037] The feature nodes, coded feature nodes, enhanced nodes, and coded enhanced nodes all contain data from all users on the same set of feature graphs. The node data distribution is reconstructed based on each user. The reconstructed feature graph elements are correlated, and the data corresponds to the labels one by one.

[0038] Further, step S4 specifically includes the following steps:

[0039] S41: Feature map Through the channel attention module, global average pooling and global maximum pooling are used to extract high-level features into Then, two fully connected layers and corresponding activation functions are used to model the correlation between channels, and the two outputs are combined to obtain the weight of the feature channel. The weight is then added to the original feature channel by channel using multiplication to complete the recalibration of the original feature in the channel dimension back to F. t H×W×C . Among them, the channel attention formula is:

[0040] M c (F) = σ(MLP(AvgPool(F o H×W×C ))+MLP(MaxPool(F o H×W×C )))

[0041] S42: The result F output by the channel attention module t H×W×C Perform average pooling and maximum pooling on the channel dimension respectively to obtain two feature maps and After the Concat operation, the two feature maps are concatenated to form Transformed into a 1-channel feature map F through 7*7 convolution c H×W×1, and then generate a spatial weight system through the activation function, multiply it with the input feature map to get the output, connect the fully connected layer, and finally get the prediction result. Among them, the spatial attention formula is:

[0042] M s (F)=σ(f 7×7 ([AvgPool(F t H×W×C );MaxPool(F t H×W×C )]))

[0043] Furthermore, in step S5, the dataset is first divided into training, test, and validation sets. During training, an appropriate batch size and number of epochs are set. Stochastic gradient descent is used to update network parameters, and cross-validation is used to optimize hyperparameters such as the learning rate. Finally, the training and validation sets are combined to train the model. The trained model outputs the final prediction results for the fraudulent data and calibrates them to 0 and 1.

[0044] The beneficial effects of the present invention are:

[0045] 1) This invention solves the problem of extracting features based on the interactive features of user call records and Internet data in the task of fraudulent call identification. It uses a wide learning system to perform feature engineering to collect and aggregate user information feature maps, and performs classification and prediction based on an attention mechanism model, providing a more effective data feature processing and extraction method for traditional fraudulent call identification tasks.

[0046] 2) This paper combines a denoising autoencoder with a width feature generation module to eliminate irrelevant and redundant features, retaining optimal user information while enhancing the representation of feature nodes. The introduction of channel and spatial attention mechanisms addresses the processing of high-dimensional features, learning inter-channel and spatial correlations, and calibrating the output weights, effectively enhancing feature extraction capabilities.

[0047] Other advantages, objects, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following description or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings, in which:

[0049] Figure 1 is a flow chart of the method of the present invention;

[0050] Figure 2 1 is a principle block diagram of the method of the present invention. DETAILED DESCRIPTION

[0051] The following describes the embodiments of the present invention by means of specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0052] Among them, the accompanying drawings are only for illustrative purposes and represent only schematic diagrams rather than actual pictures, and should not be understood as limiting the present invention. In order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, enlarged or reduced, and do not represent the dimensions of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions may be omitted in the accompanying drawings.

[0053] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "left", "right", "front", "back", etc. indicating directions or positional relationships, they are based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0054] This paper proposes a method for identifying fraudulent calls by integrating the width autoencoding of the attention mechanism. Figure 1 As shown, the specific steps include:

[0055] A fraud call identification dataset was constructed using user data from various business operations collected by telecom operators. The data was categorized into four different business categories: basic user information, voice communication data, SMS communication data, and mobile app access data. The data was cleaned, including missing value and outlier processing and normalization. Calls were also labeled based on reported information, with fraudulent calls marked as 1 and non-fraudulent calls as 0. Feature processing was performed on each form of data, and external association rules were then applied between forms based on the encrypted caller ID.

[0056] For user information data, additional feature fields were added: the ratio of monthly consumption to the city average, the ratio of monthly consumption to the district / county average, and the number of primary card numbers, divided into 0 and 1 using a limit of 4. For voice communication data, additional feature fields were added: the number of callers and call frequency, call type, maximum number of calls per day, number of call recipients per day, proportion of late-night calls, breakdown of total call duration, and proportion of calls by city. For SMS communication data, additional feature fields were added: total number of SMS messages sent, number of SMS messages sent by a single device, number of SMS senders, number and proportion of late-night SMS messages sent, maximum number of SMS messages sent per day, total number of SMS messages received, number and proportion of late-night SMS messages received, and maximum number of SMS messages received per day. For mobile app access data, additional feature fields were added: total traffic statistics, number of apps with no traffic usage in a single month, number of traffic recipients in a single month, and monthly app traffic usage statistics. Then, an external join was performed on the feature-processed form data, with the associated field being the encrypted calling number, retaining all user data.

[0057] Build an autoencoder. An autoencoder is a neural network that uses the backpropagation algorithm to make its output values as close as possible to the input values. First, it compresses the input into a latent space representation and then reconstructs the output from this representation. However, the autoencoder's learning only retains information about the original input data and cannot fully guarantee a useful set of feature representations. To avoid this and enable learning of better feature representations, constraining the data representation is necessary. Denoising autoencoders can address this problem by reconstructing noisy input data.

[0058] The preprocessed and correlated data is mixed with a new variable of Gaussian noise and passed through a denoising autoencoder, forcing the autoencoder to learn to remove the noise and obtain the true input without noise contamination. This forces the encoder to learn to extract the most important features, learning a more robust representation of the input data, and its generalization ability is stronger than that of a general encoder. The noise is generated in the form of Gaussian white noise:

[0059]

[0060] in, To satisfy the random noise of normal distribution, μ is the mean of Gaussian distribution, σ is the square root of variance, m is a constant, and the generated noise data X is obtained. noise .

[0061] The input is encoded by a denoising autoencoder, which plays the role of information filtering and denoising. In it, the value of X is set to 0 with a certain probability P, and some features of the data are lost:

[0062] X new =P(X+X noise )

[0063] Among them, P is the probability function and X is the associated data.

[0064] Through the X of lost information new Calculate y:

[0065] y=f θ (X new )=f(WX new +b)

[0066] Among them, W is the encoding matrix, b is its bias matrix, and f represents the encoding activation function.

[0067] Finally, the decoded y is used to generate the encoded reconstructed output:

[0068] X encoder =gθ′(y)=S(W′y+b′)

[0069] Among them, W′ is the decoding matrix, b′ is its bias matrix, S is the decoding activation function, X encoder Reconstruct output for encoding.

[0070] Furthermore, step S3 uses the width learning feature generation model to input the encoded data and the original data into the model generation feature node, the encoding feature node, the enhancement node and the encoding enhancement node, specifically including:

[0071] Feature nodes are generated by associating raw data:

[0072]

[0073] The encoded feature nodes are generated by encoding the reconstructed data:

[0074]

[0075] Among them, φ is the linear activation function, and is the Gaussian distribution matrix, β i is the bias matrix.

[0076] The enhancement nodes and coding enhancement nodes are derived from the nonlinear activation of feature nodes and coding feature nodes respectively:

[0077]

[0078]

[0079] Among them, ξ is a nonlinear activation function, commonly used Sigmoid, tanh and ReLU functions, etc., W o j and W e jis the orthogonal normalized matrix to reduce the redundancy of the enhanced features and make the expression stronger. j is the bias matrix.

[0080] The feature nodes, coded feature nodes, enhanced nodes, and coded enhanced nodes all contain data from all users on the same set of feature graphs. The node data distribution is reconstructed based on each user. The reconstructed feature graph elements are correlated, and the data corresponds to the labels one by one.

[0081] The feature map F o H×W×C Through the channel attention module, global average pooling and global maximum pooling are used to extract high-level features into Then, two fully connected layers and corresponding activation functions are used to model the correlation between channels, and the two outputs are combined to obtain the weight of the feature channel. The weight is then added to the original feature channel by channel using multiplication to complete the recalibration of the original feature in the channel dimension back to F. t H×W×C . Among them, the channel attention formula is:

[0082] M c (F) = σ(MLP(AvgPool(F o H×W×C ))+MLP(MaxPool(F o H×W×C )))

[0083] The output of the channel attention module F t H×W×C Perform average pooling and maximum pooling on the channel dimension respectively to obtain two feature maps and After the Concat operation, the two feature maps are concatenated to form Transformed into a 1-channel feature map F through 7*7 convolution c H×W×1 , and then generate a spatial weight system through the activation function, multiply it with the input feature map to get the output, connect the fully connected layer, and finally get the prediction result. Among them, the spatial attention formula is:

[0084] M s (F)=σ(f 7×7 ([AvgPool(F t H×W×C );MaxPool(F t H×W×C )]))

[0085] In the experiment, the dataset was first divided into a training set and a test set in a 4:1 ratio. A validation set was then divided within the training set, also in a 4:1 ratio. Training was performed with a batch size of 64 and 200 epochs. The network parameters were updated using a stochastic gradient descent optimizer, with a learning rate of 0.001 and a momentum of 0.9. Parameter optimization was performed using 5-fold cross-validation. Finally, the training and validation sets were combined to train the model. The trained model output the final prediction results for the fraudulent data, calibrated to 0 and 1.

[0086] The embodiment of the present invention can implement a width autoencoding fraudulent call identification method that integrates an attention mechanism by selecting different types and different numbers of data sets in different processes to detect and identify fraudulent numbers.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for identifying fraudulent calls using a wide autoencoder with an attention mechanism, characterized by: The method comprises the following steps: S1: Based on the telecom operator's user service data, extract and pre-process basic user information, voice communication data, SMS communication data, and mobile app access data, add features to each form, and perform encrypted caller association integration according to external association rules; S2: Based on the preprocessed and correlated data, a denoising autoencoder is constructed to compress the input into a low-dimensional spatial representation and reconstruct the output from this representation; S3: Build a width learning feature generation model, input the encoded data and original data into the model generation feature node, encoding feature node, enhancement node, and encoding enhancement node, and reconstruct the node distribution based on the user dimension, specifically including: Feature nodes are generated by associating raw data: The encoded feature nodes are generated by encoding the reconstructed data: Among them, φ is the linear activation function, and is the Gaussian distribution matrix, β i is the bias matrix; The enhancement nodes and coding enhancement nodes are derived from the nonlinear activation of feature nodes and coding feature nodes respectively: Among them, ξ is a nonlinear activation function, commonly used Sigmoid, tanh and ReLU functions, and is the orthogonal normalized matrix to reduce the redundancy of the enhanced features and make the expression stronger; β j is the bias matrix; The feature nodes, coded feature nodes, enhanced nodes, and coded enhanced nodes all contain data from all users on the same set of feature graphs. The node data distribution is reconstructed based on each user. The reconstructed feature graph elements are correlated, and the data corresponds to the label one-to-one. S4: Use attention mechanism model to extract channel and spatial features; S5: Divide the data set, train the model and tune the parameters to obtain the trained model, and output the final prediction results of the fraud data.

2. The method for identifying fraudulent phone calls using a wide autoencoder integrated with an attention mechanism according to claim 1, characterized in that: The S1 specifically includes: constructing a fraud call detection data set based on different business data of users collected from telecom operators, and dividing the data into the following four categories according to different businesses: user basic information, voice communication data, SMS communication data, and mobile phone APP access data; performing data cleaning operations, including missing value and outlier processing and normalization processing; at the same time, marking calls according to reported information, with fraud calls marked as 1 and non-fraud calls marked as 0; adding features to the data of each form, and then performing external association rule operations between forms according to the encrypted caller.

3. The method for identifying fraudulent calls using a wide autoencoder integrated with an attention mechanism according to claim 2, characterized in that: In S1, for user information data, feature fields are added: the ratio of monthly consumption to the average consumption in the city, the ratio of monthly consumption to the average consumption in the district or county, and the number of main card numbers divided into 0 and 1 with 4 as the limit; for voice communication data, feature fields are added: statistics on the number of calls and the number of calls, statistics on call types, the maximum number of calls on the day, the number of call recipients on the day, the proportion of late-night calls, detailed statistics on the total call duration, and the ratio of calls by city; for SMS communication data, feature fields are added: the total number of SMS messages sent, the number of SMS messages sent by a single device, the number of people sending SMS messages, the number and ratio of SMS messages sent late at night, the maximum number of SMS messages sent on the day, the total number of SMS messages received, the number and ratio of SMS messages received late at night, and the maximum number of SMS messages received on the day; For mobile APP access data, add feature fields: total traffic statistics, number of APPs with no traffic in a single month, number of traffic objects in a single month, and APP monthly traffic usage statistics; then, perform external association on the form data after feature processing, and the association field is encrypted caller, retaining all user data.

4. The method for identifying fraudulent calls using a wide autoencoder integrated with an attention mechanism according to claim 1, characterized in that: In S2, the preprocessed and associated data is reconstructed through the constructed denoising autoencoder to reconstruct the output, and noise is added to the associated original fraud data, which is generated in the form of Gaussian white noise: in, To satisfy the random noise of normal distribution, μ is the mean of Gaussian distribution, σ is the square root of variance, m is a constant, and the generated noise data X is obtained. noise ; Passing the new variable with Gaussian noise through the denoising autoencoder will force the encoder to learn to extract the most important features and learn a more robust representation; Specifically, we first set the X value to 0 with a certain probability P, and then lose some features of the data: X new =P(X+X noise ) Where P is the probability function and X is the associated data; Through the X of lost information new Calculate y: y=f θ (X new )=f(WX new +b) Among them, W is the encoding matrix, b is its bias matrix, and f represents the encoding activation function; Finally, the decoded y is used to generate the encoded reconstructed output: X encoder =gθ′(y)=S(W′y+b′) Among them, W′ is the decoding matrix, b′ is its bias matrix, S is the decoding activation function, X encoder Reconstruct output for encoding.

5. The method for identifying fraudulent phone calls using a wide autoencoder integrated with an attention mechanism according to claim 1, characterized in that: The S4 specifically includes the following steps: S41: Feature map Through the channel attention module, global average pooling and global maximum pooling are used to extract high-level features into Then, two fully connected layers and corresponding activation functions are used to model the correlation between channels, and the two outputs are combined to obtain the weight of the feature channel. The weight is then added to the original feature channel by channel using multiplication to complete the recalibration of the original feature in the channel dimension. Among them, the channel attention formula is: S42: Output of the channel attention module Perform average pooling and maximum pooling on the channel dimension respectively to obtain two feature maps and After the cascade Concat operation, the two feature maps are concatenated to form Transformed into a 1-channel feature map through 7*7 convolution Then, the spatial weight system is generated through the activation function, multiplied by the input feature map to obtain the output, connected to the fully connected layer, and finally the prediction result is obtained; the spatial attention formula is:

6. The method for identifying fraudulent phone calls using a wide autoencoder integrated with an attention mechanism according to claim 1, characterized in that: In S5, the dataset is first divided into a training set, a test set, and a validation set; during training, an appropriate batch size and epoch are set, a stochastic gradient descent optimizer is used to update the network parameters, and cross-validation is used to optimize the hyperparameters of the learning rate; finally, the training set and the validation set are combined to train the model together to obtain the trained model, and the final prediction results of the fraudulent data are output and calibrated as 0 and 1.

Images