Abnormal number identification method, device, equipment, storage medium and program product

Abstract

This application discloses a method, apparatus, device, storage medium, and program product for identifying abnormal numbers, wherein the method includes: obtaining a target number that establishes a communication connection with a local user; performing feature extraction processing on the target number's call record data using the relational graph convolutional network (R‑GCN) layer of a spatiotemporal neural network model to obtain a communication feature vector and a position feature vector in the target number; classifying the communication feature vector and the position feature vector using the temporal convolutional layer of the spatiotemporal neural network model to obtain a classification result for the target number; and the classification result is used to indicate whether the target number is an abnormal number. According to embodiments of the present application, the accuracy of identifying abnormal numbers can be improved.

Description

Technical Field

[0001] The present application belongs to the field of information technology, and in particular relates to a method, apparatus, device, storage medium and program product for identifying abnormal numbers. Background Art

[0002] In recent years, telephone harassment has become increasingly platform-based and professionalized, and traditional methods have made it impossible to identify behaviors that deliberately evade detection.

[0003] In the related art, manually formulated rules are generally used to determine whether a number is an abnormal number, or only the time structure of the user's calling behavior is considered when identifying abnormal numbers.

[0004] However, manually formulated rules have certain limitations, which makes the threshold for identifying abnormal numbers high; only considering the time structure of user call behavior makes the identification angle of abnormal numbers limited, which ultimately leads to inaccurate abnormal number identification results of existing technologies. Summary of the Invention

[0005] The embodiments of the present application provide a method, apparatus, device, storage medium, and program product for identifying abnormal numbers, which can improve the accuracy of identifying abnormal numbers.

[0006] In one aspect, an embodiment of the present application provides a method for identifying abnormal numbers, the method comprising:

[0007] Get the target number for establishing a communication connection with the local user;

[0008] Perform feature extraction processing on the call record data of the target number through the relational graph convolution network (R-GCN) layer of the spatiotemporal neural network model to obtain a communication feature vector and a position feature vector in the target number;

[0009] The communication feature vector and the position feature vector are classified by the time convolution layer of the spatiotemporal neural network model to obtain a classification result of the target number; the classification result is used to indicate whether the target number is an abnormal number.

[0010] In one possible implementation, before performing feature extraction processing on the call record data of the target number by the relational graph convolutional network (R-GCN) layer of the spatiotemporal neural network model to obtain the communication feature vector and the position feature vector of the target number, the method further includes:

[0011] Obtaining a communication training sample of the local user in a second time interval;

[0012] constructing a spatiotemporal graph based on the communication training samples;

[0013] The spatiotemporal subgraphs extracted from the spatiotemporal graph according to preset time intervals are used as inputs of the spatiotemporal neural network model to train the spatiotemporal neural network model.

[0014] In a possible implementation, obtaining a communication training sample of the local user in the second time interval includes:

[0015] Filter the numbers received by the local user in the second time interval according to a preset index to obtain a whitelist of the local user in the second time interval;

[0016] Merging the rejected numbers of the local user in the second time interval with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the second time interval; the received numbers and missed numbers are obtained from the call bill data of the local user;

[0017] The communication training sample is obtained according to the whitelist and the blacklist.

[0018] In a possible implementation, the communication training sample includes: a communication user representing communication, a communication vector representing a dialing direction, and a communication base station; and constructing a spatiotemporal graph based on the communication training sample includes:

[0019] The communication users are used as nodes of the communication graph, and the communication vectors are used as edges for constructing the nodes, thereby constructing the communication graph;

[0020] Using the user information of the communication user as a node attribute of the communication graph;

[0021] Using the communication details of the communication vector as edge attributes of the communication graph;

[0022] The location graph is constructed by taking the communication base station as a node of the location graph and taking the access information of the communication base station accessed by the communication user in the second time interval as an edge of the location graph;

[0023] The communication map and the location map are merged according to the communication users, communication base stations and communication time in each communication to obtain the space-time map.

[0024] In a possible implementation, before constructing the nodes of the communication graph based on the user information of the local user, the method further includes:

[0025] Cleaning the user information, the communication sample data, and the communication base station location to obtain cleaned information;

[0026] The node of the communication graph is constructed according to the user information of the local user, including:

[0027] According to the cleaning information, nodes of the communication graph are constructed.

[0028] In one possible implementation, the spatiotemporal neural network model is trained based on a spatiotemporal graph of the local user; the spatiotemporal graph is a graph structure constructed from call record data of the local user within a first time interval, and the nodes of the graph structure are communication objects and communication base stations; the time when the target number establishes a communication connection with the local user is a first moment; the first time interval is related to the first moment; and when the first time interval changes, the method further includes:

[0029] According to formulas (1) and (2), the weights of the edges of the spatiotemporal graph are determined:

[0030]

[0031] w e =w i，k *c i，r *w t (2)

[0032] Among them, w e represents the weight of edge e in the spatiotemporal graph at the tth moment in the first time interval, w t represents the weight of the edge associated with node i at time t, represents the set of neighbor nodes of node i in the relationship structure r, w i，k Represents edge e i，k The weight of the edge.

[0033] In a possible implementation, using the spatiotemporal subgraphs extracted from the spatiotemporal graph according to preset time intervals as inputs to a spatiotemporal neural network model to train the spatiotemporal neural network model includes:

[0034] Extracting the graph structure of the spatiotemporal subgraph through the R-GCN layer;

[0035] The label categories of the nodes in the graph structure are determined by the temporal convolution layer according to formula (3):

[0036]

[0037] in, is the vector of node u at time t, is the parameter matrix, is the label category of node u at time t;

[0038] According to formula (4), the cross entropy loss function of the spatiotemporal neural network model is determined:

[0039]

[0040] Among them, L is the cross entropy loss function, represents the true label category, is the label category of node u at time t, α is the weight hyperparameter used to balance the category distribution, t≤T, i≤N;

[0041] When the value of the cross entropy loss function satisfies the condition, the process returns to executing the method according to formula (3) to determine the label category of the node in the spatiotemporal subgraph until the value of the cross entropy loss function does not satisfy the condition.

[0042] In a possible implementation, after classifying the communication feature vector and the location feature vector by the temporal convolution layer of the spatiotemporal neural network model to obtain the classification result of the target number, the method further includes:

[0043] Evaluating the spatiotemporal neural network model according to the communication test sample to obtain an evaluation result;

[0044] In a case where the evaluation result is a first evaluation result indicating that the spatiotemporal neural network model is inaccurate, adjusting the parameters of the spatiotemporal neural network model according to the evaluation result, returning to execute the evaluation of the spatiotemporal neural network model according to the communication test sample to obtain an evaluation result, until the evaluation result is a second evaluation result indicating that the spatiotemporal neural network model is accurate;

[0045] After merging the rejected numbers of the local user in the first time interval with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the first time interval, the method further includes:

[0046] According to the whitelist and the blacklist, a communication test sample for testing the spatiotemporal neural network model is obtained.

[0047] On the other hand, an embodiment of the present application provides a device for identifying abnormal numbers, including:

[0048] An acquisition module is used to acquire a target number for establishing a communication connection with a local user;

[0049] An extraction module is used to perform feature extraction processing on the call record data of the target number through the relational graph convolution network (R-GCN) layer of the spatiotemporal neural network model to obtain a communication feature vector and a position feature vector in the target number;

[0050] The recognition module is used to classify the communication feature vector and the position feature vector through the time convolution layer of the spatiotemporal neural network model to obtain the classification result of the target number.

[0051] In another aspect, an embodiment of the present application provides a device for identifying abnormal numbers, the device comprising: a processor and a memory storing computer program instructions;

[0052] When the processor executes the computer program instructions, the method for identifying abnormal numbers as described in any one of the above items is implemented.

[0053] On the other hand, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method for identifying an abnormal number as described in any one of the above is implemented.

[0054] On the other hand, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the abnormal number identification method as described in any one of the above.

[0055] The abnormal number identification method, device, equipment, storage medium and program product of the embodiments of the present application use a spatiotemporal neural network model obtained by training based on the spatiotemporal graph of the local user to identify the target number, lower the identification threshold of abnormal numbers, consider the call feature vector and position feature vector in the target number during identification, increase the dimension of identifying abnormal numbers, and ultimately achieve improved accuracy in identifying abnormal numbers. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0057] Figure 1 1 is a flow chart of a method for identifying abnormal numbers provided in an embodiment of the present application;

[0058] Figure 2 is a schematic diagram of the spatiotemporal map provided in an embodiment of the present application;

[0059] Figure 3 Schematic diagram of a spatiotemporal neural network model provided in an embodiment of the present application;

[0060] Figure 4 Schematic diagram of the structure of the abnormal number identification device provided in the embodiment of the present application;

[0061] Figure 5 It is a structural diagram of the abnormal number identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0063] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of other identical elements in the process, method, article, or device comprising the elements.

[0064] Related technologies such as background technology, based on which the inventor provides a method, device, equipment, storage medium and program product for identifying abnormal numbers, using a spatiotemporal neural network model obtained by training based on the spatiotemporal graph of the local user to identify the target number, lowering the recognition threshold of abnormal numbers, considering the call feature vector and position feature vector in the target number during recognition, increasing the dimension of identifying abnormal numbers, and ultimately achieving improved accuracy in identifying abnormal numbers.

[0065] In order to solve the problems of the prior art, the embodiments of the present application provide a method, apparatus, device, storage medium and program product for identifying abnormal numbers. The following first introduces the abnormal number identification method provided by the embodiments of the present application.

[0066] Figure 1 FIG. 1 is a flow chart of the method for identifying abnormal numbers provided in the embodiment of the present application. Figure 1 As shown, the abnormal number identification method provided in the embodiment of the present application includes the following steps: S101 to S103.

[0067] S101, obtaining a target number for establishing a communication connection with a local user;

[0068] As an implementation of S101, when a user wants to establish a communication connection with a local user, a target number for establishing a communication connection with the local user is immediately obtained.

[0069] The target number is the number of the user who wants to establish a communication connection with the local user. In this application, the target number can be at least one of the local user's received number, missed number, and rejected number.

[0070] S102, performing feature extraction processing on the call record data of the target number through the relational graph convolutional network (R-GCN) layer of the spatiotemporal neural network model to obtain a communication feature vector and a position feature vector of the target number;

[0071] As an implementation of S102, the relational graph convolutional network (R-GCN) layer of the spatiotemporal neural network model learns the communication feature vector and the position feature vector representing the structure at the first moment.

[0072] The spatiotemporal neural network model is trained based on the local user's spatiotemporal graph. The spatiotemporal graph is a graph structure constructed from the local user's call log data within the first time interval, with the nodes of the graph representing communication objects and communication base stations. Figure 2 is a schematic diagram of the spatiotemporal map provided in the embodiment of the present application, such as Figure 2 As shown, u1 and u2 are communication objects, n1, n2, and n3 are communication base stations, and t1, t2, and t3 are the times of call record data.

[0073] Figure 3 is a schematic diagram of the spatiotemporal neural network model provided in the embodiment of the present application, such as Figure 3 As shown in the figure, the R-GCN layer also includes a long short-term memory network (LSTM). LSTM is a time recurrent neural network used to process and predict important events in time series with relatively long intervals and delays.

[0074] In the R-GCN layer, the node representation of node i in the l+1 layer can be obtained by aggregating the node representations of the lth layer of neighboring nodes with different relationship types.

[0075] This application leverages the extraction advantages of the R-GCN layer to learn the structural information of the spatiotemporal graph. By aggregating neighbor information through the defined spectral graph convolution, the concept of convolution is extended to the graph. Because the input spatiotemporal graph is a multi-layer network structure that includes user call relationships, user call time relationships, and base station location relationships, we assign different transformation matrices to different edge relationships.

[0076] Here, we first introduce a single-layer structure that includes information propagation and information aggregation. In the first-order propagation layer, the base station where a user is communicating represents the user's location preference, and the base stations through which users communicate represent the relationship between base stations. In the information aggregation layer, after the first layer of propagation, each node aggregates information from neighboring nodes to generate a new representation. This representation is as follows:

[0077]

[0078] in, is the representation of node i at the (l+1) layer, represents the set of neighbor nodes of node i in relation r, In Algorithm 1, we represent edge e i，j The weight of The transformation matrix representing the r relationship; the function δ is the activation function.

[0079] This application integrates user call times and base station location information into a spatiotemporal graph to construct a graph data structure with multiple edges. It creatively uses the R-GCN layer to process graph data structures with multiple relationships. This allows for more fine-grained learning based on user call times within a time unit t, shortening model training time and enabling the model to more accurately identify abnormal numbers.

[0080] S103, classifying the communication feature vector and the position feature vector through the temporal convolution layer of the spatiotemporal neural network model to obtain a classification result of the target number;

[0081] The classification result is used to indicate whether the target number is an abnormal number. An abnormal number can indicate any one or a combination of communication behaviors such as sales promotion and fraud.

[0082] The temporal convolution layer consists of a 1D fully connected convolution module and a causal convolution module. The 1D fully connected convolution operation ensures that the output layer has the same sequence length as the input layer, and the causal convolution operation ensures that the output of time period t is only obtained by convolution of the time period before it (including the current time period), thereby ensuring that the information of the current time period and historical information are used to model the prediction of the future time period.

[0083] Given an input sequence Xl∈RT×M of length T and M-dimensional features in the lth layer, and a filter f: {0, 1, ..., k–2}, for the element x of Xl, the convolution operation H is defined as follows:

[0084]

[0085] Where d is the dilation factor, k is the filter size, and xd·i represents the direction of history. We can increase the receptive field of the convolution by increasing the filter size k or increasing the dilation factor d.

[0086] The node embedding vector after the first spatial convolution layer of the spatiotemporal convolutional model aggregates neighboring information. After the temporal convolution layer, historical information about each node and its neighbors is obtained. Adding a spatial convolution layer to this layer, each node's vector representation aggregates information about it and its neighbors for both the current and historical time periods. Therefore, this model structure, which overlaps temporal and spatial convolutions, results in a node embedding vector with richer structural and historical information.

[0087] This application constructs a spatiotemporal graph by integrating location base stations, mining the local user's call and location preference information, and learning the user's call and spatial preference information characteristics. It uses a spatiotemporal neural network model to dynamically obtain the structure of the graph and combine it with historical information to predict abnormal numbers.

[0088] The above is a specific implementation of the method for identifying abnormal numbers provided in the embodiment of the present application. The method for identifying abnormal numbers in the embodiment of the present application uses a spatiotemporal neural network model obtained by training based on the spatiotemporal graph of the local user to identify the target number, lowers the recognition threshold of abnormal numbers, considers the call feature vector and position feature vector in the target number during recognition, increases the dimension of identifying abnormal numbers, and ultimately achieves improved accuracy in identifying abnormal numbers. The present application has broad market prospects and can be widely used in scenarios such as telecommunications fraud and financial risk control. Compared with previous machine learning algorithms, it has a low entry threshold and does not require manual attention to feature screening and parameter tuning. Feature screening and parameter tuning can be performed automatically, which is simple and convenient. Internally, it can provide telecommunications fraud solutions for provincial companies to identify abnormal numbers and reduce the risk of telecommunications fraud. Externally, it can provide financial risk control services and improve risk control capabilities.

[0089] In one possible implementation, before performing feature extraction processing on the call record data of the target number through the relational graph convolutional network (R-GCN) layer of the spatiotemporal neural network model to obtain the communication feature vector and the position feature vector of the target number, the method further includes:

[0090] Obtaining a communication training sample of the local user in a second time interval;

[0091] As a possible implementation manner, the communication training samples are extracted from the call record data of the local user in the second time interval.

[0092] Construct a spatiotemporal graph based on the communication training samples;

[0093] As a possible implementation method, a spatiotemporal graph is constructed based on the communication users, communication base stations and time each time a communication connection is established with the local user in the communication training samples.

[0094] The spatiotemporal subgraphs extracted from the spatiotemporal map according to preset time intervals are used as the input of the spatiotemporal neural network model to train the spatiotemporal neural network model.

[0095] As a possible implementation method, spatiotemporal subgraphs at different moments are extracted from the spatiotemporal graph according to preset time intervals and input into the spatiotemporal neural network model.

[0096] Therefore, a space-time graph is constructed through communication training samples to train the space-time neural network model and improve the recognition accuracy of abnormal numbers of the space-time neural network model.

[0097] In a possible implementation, obtaining a communication training sample of the local user in the second time interval includes:

[0098] Filter the numbers received by the local user in the second time interval according to the preset index to obtain a whitelist of the local user in the second time interval;

[0099] As a possible implementation manner, the preset indicator may be whether the call time is greater than a call time threshold, whether there is a callback, whether the number of calls in the first time interval is greater than a call number threshold, etc.

[0100] When filtering the numbers received by the local user during the second time interval, there may be only one preset criterion or multiple preset criteria. In the case of multiple preset criteria, the whitelist may include numbers that meet any one of the preset criteria or all of the preset criteria.

[0101] Merging the rejected numbers of the local user in the second time interval with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the second time interval;

[0102] As a possible implementation, received and missed call numbers are obtained from the local user's call record data. To improve the accuracy of the blacklist, before merging the local user's rejected numbers in the second time interval with the notification blacklist obtained from the preset blacklist library, the rejected numbers are screened and numbers already on the whitelist are removed.

[0103] According to the whitelist and blacklist, communication training samples are obtained.

[0104] As a possible implementation method, the whitelist and blacklist in the communication training sample can be obtained according to the ratio required by the user.

[0105] Thus, the whitelist and blacklist in the local user's call list data and the notification blacklist are used to obtain communication training samples.

[0106] In one possible implementation, constructing a spatiotemporal graph based on communication training samples includes:

[0107] The communication graph is constructed by taking the communication users as nodes of the communication graph and the communication vectors as edges of the nodes.

[0108] As a possible implementation manner, the communication training sample may include: a communication user representing a communication, a communication vector representing a dialing direction, and a communication base station.

[0109] Use the user information of the communication users as the node attributes of the communication graph;

[0110] As a possible implementation, the user information may include: name, gender, age and other information.

[0111] The communication details of the communication vector are used as edge attributes of the communication graph;

[0112] As a possible implementation, the communication detailed information may include: call duration, call start time, call end time, call number and other information.

[0113] Communication graph such as Figure 2 The upper part of the spectrum consists of u1 and u2.

[0114] The communication base station is used as a node of the location graph, and the access information of the communication base station accessed by the communication user in the second time interval is used as an edge of the location graph to construct the location graph;

[0115] As a possible implementation manner, the access information may include: access time, access times and other information.

[0116] Position map Figure 2 The lower part of the graph consists of n1, n2, and n3.

[0117] According to the communication users, communication base stations and communication time in each communication, the communication map and location map are merged to obtain a spatiotemporal map.

[0118] Therefore, by communicating the information in the training samples, the nodes and edges are determined, and then the spatiotemporal graph is constructed based on the nodes and edges.

[0119] In one possible implementation, before constructing the nodes of the communication graph based on the user information of the local user, the method further includes:

[0120] Cleaning user information, communication sample data, and communication base station locations to obtain cleaned information;

[0121] As a possible implementation method, data containing garbled characters, missing fields that cannot be completed, etc. in user information, communication sample data, and communication base station locations are cleaned to ensure that the established spatiotemporal map is more accurate.

[0122] Nodes for building a communication graph based on the local user's user information include:

[0123] Based on the cleaning information, the nodes of the communication graph are constructed.

[0124] Thus, by cleaning the data used to construct the communication map, the accuracy of the communication map is improved.

[0125] In one possible implementation, the spatiotemporal neural network model is trained based on a spatiotemporal graph of a local user; the spatiotemporal graph is a graph structure constructed from call record data of the local user within a first time interval, wherein the nodes of the graph structure are communication objects and communication base stations; the time when a communication connection is established between a target number and the local user is the first moment; the first time interval is related to the first moment; and when the first time interval changes, the method further includes:

[0126] According to formulas (1) and (2), the weights of the edges of the spatiotemporal graph are determined:

[0127]

[0128] w e =w i，k *c i，r *w t (2)

[0129] Among them, w e represents the weight of edge e in the spatiotemporal graph at time t in the first time interval, w t represents the weight of the edge associated with node i at time t, represents the set of neighbor nodes of node i in the relationship structure r, w i，k Represents edge e i，k The weight of the edge.

[0130] In other words, in order to save storage space, nodes and edges in the spatiotemporal graph will be inserted and deleted over time, and node attributes and edge attributes will also change over time. The spatiotemporal graph constructed in this application is a dynamically adjusted graph.

[0131] Therefore, when the call record data of the local user used to construct the spatiotemporal graph changes, the spatiotemporal graph is updated.

[0132] In one possible implementation, a spatiotemporal subgraph extracted from a spatiotemporal graph at preset time intervals is used as an input to a spatiotemporal neural network model, and the spatiotemporal neural network model is trained, including:

[0133] Extract the graph structure of spatiotemporal subgraphs through the R-GCN layer;

[0134] The label category of the node in the graph structure is determined by the temporal convolution layer according to formula (3):

[0135]

[0136] in, is the vector of node u at time t, is the parameter matrix, is the label category of node u at time t;

[0137] According to formula (4), the cross entropy loss function of the spatiotemporal neural network model is determined:

[0138]

[0139] Among them, L is the cross entropy loss function, represents the true label category, is the label category of node u at time t, α is the weight hyperparameter used to balance the category distribution, t≤T, i≤N;

[0140] When the value of the cross entropy loss function meets the conditions, the process returns to the method of determining the label categories of the nodes in the spatiotemporal subgraph according to formula (3) until the value of the cross entropy loss function does not meet the conditions.

[0141] Therefore, the spatiotemporal neural network model is trained by extracting spatiotemporal subgraphs from the spatiotemporal graph according to preset time intervals, thereby improving the accuracy of abnormal number recognition of the spatiotemporal neural network model.

[0142] In one possible implementation, after classifying the communication feature vector and the location feature vector using the temporal convolution layer of the spatiotemporal neural network model to obtain a classification result of the target number, the method further includes:

[0143] Evaluate the spatiotemporal neural network model based on the communication test samples and obtain evaluation results;

[0144] As a possible implementation method, the following data can be counted during the evaluation: the number of actual abnormal calls predicted as abnormal call numbers (TruePositive, TP), the number of actual non-abnormal calls predicted as non-abnormal call numbers (TrueNegative, TN), the number of actual non-abnormal calls predicted as abnormal call numbers (FalsePositive, FP), and the number of actual abnormal calls predicted as non-abnormal call numbers (FalseNegative, FN).

[0145] Based on the above data, further calculations are performed to obtain the following evaluation results for any one or any combination of the following:

[0146] Accuracy = correct predictions / all = (TP + TN) / (TP + FN + FP + TN)

[0147] Recall (i.e. coverage) = TP / (TP+FN)

[0148] F value (F-Measure)=2*accuracy*recall / (accuracy+recall)

[0149] Output blacklist accuracy = Number of communication test samples caught in the blacklist / Number of communication test samples output in the blacklist

[0150] Output blacklist ratio during prediction = number of communication training samples output blacklist / total number of communication training samples

[0151] Accuracy describes the proportion of correct model predictions and measures the predictive ability of the spatiotemporal neural network model.

[0152] Recall (i.e., coverage) is a measure of coverage, which measures how many actual abnormal call numbers are predicted as abnormal call numbers.

[0153] In the case where the evaluation result is a first evaluation result indicating that the spatiotemporal neural network model is inaccurate, adjusting the parameters of the spatiotemporal neural network model according to the evaluation result, returning to execute the evaluation of the spatiotemporal neural network model according to the communication test sample to obtain an evaluation result, until the evaluation result is a second evaluation result indicating that the spatiotemporal neural network model is accurate;

[0154] As a possible implementation method, algorithms such as grid search and random search can be used to determine parameters. However, as the number of parameters increases, the amount of computation increases exponentially. This method is not very effective in deep neural networks. In deep neural networks, random search methods are more efficient than grid search methods. Therefore, this application prefers random search methods.

[0155] Random search randomly selects points in the search range. If the sample is large enough, the global optimal value or approximate value can be found with a high probability through random sampling.

[0156] After merging the rejected numbers of the local user in the first time interval with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the first time interval, the method further includes:

[0157] According to the whitelist and blacklist, communication test samples for testing the spatiotemporal neural network model are obtained.

[0158] Therefore, the spatiotemporal neural network model is evaluated based on the communication test samples to determine whether the spatiotemporal neural network model is accurate and whether subsequent adjustments are required.

[0159] Based on the abnormal number identification method provided in the above embodiment, the present application also provides a specific implementation of the abnormal number identification device.

[0160] Figure 4 Schematic diagram of the structure of the abnormal number identification device provided in the embodiment of the present application. Figure 4 As shown, the abnormal number identification device 400 provided in the embodiment of the present application includes:

[0161] Acquisition module 401, used to acquire the target number for establishing a communication connection with the local user;

[0162] Extraction module 402, configured to perform feature extraction processing on the call record data of the target number through the relational graph convolutional network (R-GCN) layer of the spatiotemporal neural network model to obtain a communication feature vector and a position feature vector of the target number;

[0163] Identification module 403, configured to classify the communication feature vector and the position feature vector using the temporal convolution layer of the spatiotemporal neural network model to obtain a classification result of the target number; the classification result is used to indicate whether the target number is an abnormal number;

[0164] The above is a specific implementation method of the abnormal number identification device provided in the embodiment of the present application. The target number is identified by using the spatiotemporal neural network model obtained by training based on the spatiotemporal graph of the local user, which lowers the identification threshold of abnormal numbers. The call feature vector and position feature vector in the target number are considered during identification, and the dimension of identifying abnormal numbers is increased, thereby ultimately improving the accuracy of identifying abnormal numbers.

[0165] In one possible implementation, before performing feature extraction processing on the call record data of the target number using the relational graph convolutional network (R-GCN) layer of the spatiotemporal neural network model to obtain the communication feature vector and position feature vector of the target number, the abnormal number identification device 400 may further include:

[0166] A communication training sample module, used to obtain a communication training sample of the local user in a second time interval;

[0167] The spatiotemporal graph construction module is used to construct a spatiotemporal graph based on communication training samples;

[0168] The training module is used to use the spatiotemporal subgraphs extracted from the spatiotemporal graph according to preset time intervals as the input of the spatiotemporal neural network model to train the spatiotemporal neural network model.

[0169] Therefore, a space-time graph is constructed through communication training samples to train the space-time neural network model and improve the recognition accuracy of abnormal numbers of the space-time neural network model.

[0170] In one possible implementation, the communication training sample module may be used to:

[0171] Filter the numbers received by the local user in the second time interval according to the preset index to obtain a whitelist of the local user in the second time interval;

[0172] The rejected numbers of the local user in the second time interval are combined with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the second time interval; the received numbers and missed numbers are obtained from the local user's call record data;

[0173] According to the whitelist and blacklist, communication training samples are obtained.

[0174] Thus, the whitelist and blacklist in the local user's call list data and the notification blacklist are used to obtain communication training samples.

[0175] In one possible implementation, the communication training samples include: a communication user representing a communication, a communication vector representing a dialing direction, and a communication base station; and the spatiotemporal graph construction module can be used to:

[0176] The communication graph is constructed by taking the communication users as nodes of the communication graph and the communication vectors as edges of the nodes.

[0177] Use the user information of the communication users as the node attributes of the communication graph;

[0178] The communication details of the communication vector are used as edge attributes of the communication graph;

[0179] The communication base station is used as a node of the location graph, and the access information of the communication base station accessed by the communication user in the second time interval is used as an edge of the location graph to construct the location graph;

[0180] According to the communication users, communication base stations and communication time in each communication, the communication map and location map are merged to obtain a spatiotemporal map.

[0181] Therefore, by communicating the information in the training samples, the nodes and edges are determined, and then the spatiotemporal graph is constructed based on the nodes and edges.

[0182] In one possible implementation, before constructing the nodes of the communication graph based on the user information of the local user, the abnormal number identification device 400 may further include:

[0183] A cleaning module is used to clean user information, communication sample data and communication base station locations to obtain clean information;

[0184] Nodes for building a communication graph based on the local user's user information include:

[0185] Based on the cleaning information, the nodes of the communication graph are constructed.

[0186] Thus, by cleaning the data used to construct the communication map, the accuracy of the communication map is improved.

[0187] In one possible implementation, the spatiotemporal neural network model is trained based on a spatiotemporal graph of a local user; the spatiotemporal graph is a graph structure constructed from call record data of the local user within a first time interval, wherein the nodes of the graph structure are communication objects and communication base stations; the time when a communication connection is established between the target number and the local user is the first moment; the first time interval is associated with the first moment; and in the event that the first time interval changes, the abnormal number identification device 400 may further include:

[0188] The update module is used to determine the edge weights of the spatiotemporal graph according to formulas (1) and (2).

[0189] Therefore, when the call record data of the local user used to construct the spatiotemporal graph changes, the spatiotemporal graph is updated.

[0190] In one possible implementation, the training module may be used to:

[0191] Extract the graph structure of spatiotemporal subgraphs through the R-GCN layer;

[0192] Determine the label category of the node in the graph structure through the temporal convolution layer according to formula (3);

[0193] According to formula (4), the cross entropy loss function of the spatiotemporal neural network model is determined;

[0194] When the value of the cross entropy loss function meets the conditions, the process returns to the method of determining the label categories of the nodes in the spatiotemporal subgraph according to formula (3) until the value of the cross entropy loss function does not meet the conditions.

[0195] Therefore, the spatiotemporal neural network model is trained by extracting spatiotemporal subgraphs from the spatiotemporal graph according to preset time intervals, thereby improving the accuracy of abnormal number recognition of the spatiotemporal neural network model.

[0196] In one possible implementation, after classifying the communication feature vector and the position feature vector using the temporal convolution layer of the spatiotemporal neural network model to obtain a classification result of the target number, the abnormal number identification device 400 may further include:

[0197] An evaluation module is used to evaluate the spatiotemporal neural network model based on the communication test samples and obtain an evaluation result;

[0198] In the case where the evaluation result is a first evaluation result indicating that the spatiotemporal neural network model is inaccurate, adjusting the parameters of the spatiotemporal neural network model according to the evaluation result, returning to execute the evaluation of the spatiotemporal neural network model according to the communication test sample to obtain an evaluation result, until the evaluation result is a second evaluation result indicating that the spatiotemporal neural network model is accurate;

[0199] After merging the rejected numbers of the local user in the first time interval with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the first time interval, the method further includes:

[0200] According to the whitelist and blacklist, communication test samples for testing the spatiotemporal neural network model are obtained.

[0201] Therefore, the spatiotemporal neural network model is evaluated based on the communication test samples to determine whether the spatiotemporal neural network model is accurate and whether subsequent adjustments are required.

[0202] Based on the abnormal number identification method provided in the above embodiment, the present application also provides a specific implementation of the abnormal number identification device.

[0203] Figure 5 This is a schematic diagram of the structure of the abnormal number identification device provided in the embodiment of the present application. Figure 5 As shown, the abnormal number identification device may include a processor 501 and a memory 502 storing computer program instructions.

[0204] Specifically, the processor 501 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0205] The memory 502 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 502 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 502 may include removable or non-removable (or fixed) media. Where appropriate, the memory 502 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 502 is a non-volatile solid-state memory.

[0206] The memory 502 may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present application.

[0207] The processor 501 reads and executes computer program instructions stored in the memory 502 to implement any one of the abnormal number identification methods in the above embodiments.

[0208] In one example, the abnormal number identification device may further include a communication interface 503 and a bus 510. Figure 5 As shown, the processor 501, the memory 502, and the communication interface 503 are connected via a bus 510 and communicate with each other.

[0209] The communication interface 503 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0210] Bus 510 comprises hardware, software or both, and the parts of the identification device of abnormal number are coupled to each other.For example, and not limitation, bus can comprise accelerated graphics port (AGP) or other graphics buses, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations.In suitable cases, bus 510 can comprise one or more buses.Although the present application embodiment describes and shows specific bus, the application considers any suitable bus or interconnection.

[0211] The abnormal number identification device can execute the abnormal number identification method in the embodiment of the present application, thereby realizing the combination of Figure 1 and Figure 4 A method and apparatus for identifying abnormal numbers are described.

[0212] In addition, in conjunction with the abnormal number identification method in the above embodiment, the present application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any of the abnormal number identification methods in the above embodiment is implemented.

[0213] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0214] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0215] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps. In other words, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0216] The above reference is according to the flowchart and / or block diagram of the method, device and computer program product of the embodiment of the application, describes various aspects of the application.It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a kind of machine, so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more boxes of the flowchart and / or block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It is also understood that each box in the block diagram and / or flowchart and the combination of the boxes in the block diagram and / or flowchart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0217] The above description is only a specific embodiment of the present application. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the scope of protection of the present application.

Claims

1. A method for identifying abnormal numbers, characterized in that: include: Get the target number for establishing a communication connection with the local user; The call data of the target number is subjected to feature extraction processing by the relational graph convolution network R-GCN layer of the spatiotemporal neural network model to obtain the communication feature vector and the position feature vector in the target number, wherein the spatiotemporal neural network model is trained based on the spatiotemporal graph of the local user; the spatiotemporal graph is a graph structure constructed by the call data of the local user in the first time interval, and the nodes of the graph structure are the communication objects and the communication base stations; constructing the spatiotemporal graph includes: taking the communication users as nodes of the communication graph and the communication vectors as edges of the construction nodes to construct the communication graph; taking the communication base stations as nodes of the position graph and taking the access information of the communication base stations accessed by the communication users in the second time interval as edges of the position graph to construct the position graph; merging the communication graph and the position graph according to the communication users, communication base stations and communication time in each communication to obtain the spatiotemporal graph; The communication feature vector and the position feature vector are classified by the time convolution layer of the spatiotemporal neural network model to obtain a classification result of the target number; the classification result is used to indicate whether the target number is an abnormal number.

2. The method for identifying abnormal numbers according to claim 1, wherein: Before performing feature extraction processing on the call record data of the target number through the relational graph convolutional network (R-GCN) layer of the spatiotemporal neural network model to obtain the communication feature vector and the position feature vector in the target number, the method further includes: Obtaining a communication training sample of the local user in a second time interval; constructing a spatiotemporal graph based on the communication training samples; The spatiotemporal subgraphs extracted from the spatiotemporal graph according to preset time intervals are used as inputs of the spatiotemporal neural network model to train the spatiotemporal neural network model.

3. The method for identifying abnormal numbers according to claim 2, wherein: The acquiring of the communication training sample of the local user in the second time interval includes: Filter the numbers received by the local user in the second time interval according to a preset index to obtain a whitelist of the local user in the second time interval; Merging the rejected numbers of the local user in the second time interval with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the second time interval; the received numbers and missed numbers are obtained from the call bill data of the local user; The communication training sample is obtained according to the whitelist and the blacklist.

4. The method for identifying abnormal numbers according to claim 2, wherein: The communication training samples include: a communication user representing a communication, a communication vector representing a dialing direction, and a communication base station; and constructing a spatiotemporal graph based on the communication training samples includes: The communication users are used as nodes of the communication graph, and the communication vectors are used as edges for constructing the nodes, thereby constructing the communication graph; Using the user information of the communication user as a node attribute of the communication graph; Using the communication details of the communication vector as edge attributes of the communication graph; The location graph is constructed by taking the communication base station as a node of the location graph and taking the access information of the communication base station accessed by the communication user in the second time interval as an edge of the location graph; The communication map and the location map are merged according to the communication users, communication base stations and communication time in each communication to obtain the space-time map.

5. The method for identifying abnormal numbers according to claim 4, characterized in that: Before constructing the nodes of the communication graph based on the user information of the local user, the method further includes: Cleaning the user information, the communication sample data, and the communication base station location to obtain cleaned information; The node of the communication graph is constructed according to the user information of the local user, including: According to the cleaning information, nodes of the communication graph are constructed.

6. The method for identifying abnormal numbers according to claim 1, wherein: The time when the target number establishes a communication connection with the local user is a first moment; the first time interval is related to the first moment; In the case where the first time interval changes, the method further includes: According to formulas (1) and (2), the weights of the edges of the spatiotemporal graph are determined: w e =w i，k *c i，r *w t (2) Among them, w e represents the weight of edge e in the spatiotemporal graph at the tth moment in the first time interval, w t represents the weight of the edge associated with node i at time t, represents the set of neighbor nodes of node i in the relationship structure r, w i，k Represents edge e i，k The weight of the edge.

7. The method for identifying abnormal numbers according to claim 2, wherein: The method of extracting the spatiotemporal subgraphs from the spatiotemporal graph according to the preset time intervals as the input of the spatiotemporal neural network model and training the spatiotemporal neural network model includes: Extracting the graph structure of the spatiotemporal subgraph through the R-GCN layer; The label categories of the nodes in the graph structure are determined by the temporal convolution layer according to formula (3): in, is the vector of node u at time t, is the parameter matrix, is the label category of node u at time t; According to formula (4), the cross entropy loss function of the spatiotemporal neural network model is determined: Among them, L is the cross entropy loss function, represents the true label category, is the label category of node u at time t, α is the weight hyperparameter used to balance the category distribution, t≤T, i≤N; When the value of the cross entropy loss function satisfies the condition, the process returns to executing the method according to formula (3) to determine the label category of the node in the spatiotemporal subgraph until the value of the cross entropy loss function does not satisfy the condition.

8. The method for identifying abnormal numbers according to claim 3, wherein: After classifying the communication feature vector and the position feature vector by the temporal convolution layer of the spatiotemporal neural network model to obtain the classification result of the target number, the method further includes: Evaluating the spatiotemporal neural network model according to the communication test sample to obtain an evaluation result; In a case where the evaluation result is a first evaluation result indicating that the spatiotemporal neural network model is inaccurate, adjusting the parameters of the spatiotemporal neural network model according to the evaluation result, returning to execute the evaluation of the spatiotemporal neural network model according to the communication test sample to obtain an evaluation result, until the evaluation result is a second evaluation result indicating that the spatiotemporal neural network model is accurate; After merging the rejected numbers of the local user in the first time interval with the notification blacklist obtained from the preset blacklist library to obtain the blacklist of the local user in the first time interval, the method further includes: According to the whitelist and the blacklist, a communication test sample for testing the spatiotemporal neural network model is obtained.

9. A device for identifying abnormal numbers, characterized in that: The device comprises: An acquisition module is used to acquire a target number for establishing a communication connection with a local user; An extraction module is used to perform feature extraction processing on the call data of the target number through the relational graph convolution network R-GCN layer of the spatiotemporal neural network model to obtain the communication feature vector and position feature vector in the target number, wherein the spatiotemporal neural network model is trained based on the spatiotemporal graph of the local user; the spatiotemporal graph is a graph structure constructed by the call data of the local user in the first time interval, and the nodes of the graph structure are communication objects and communication base stations; constructing the spatiotemporal graph includes: taking the communication user as the node of the communication graph and the communication vector as the edge of the construction node to construct the communication graph; taking the communication base station as the node of the position graph and the access information of the communication base station accessed by the communication user in the second time interval as the edge of the position graph to construct the position graph; merging the communication graph and the position graph according to the communication user, communication base station and communication time in each communication to obtain the spatiotemporal graph; The recognition module is used to classify the communication feature vector and the position feature vector through the time convolution layer of the spatiotemporal neural network model to obtain the classification result of the target number.

10. An abnormal number identification device, characterized in that: The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method for identifying abnormal numbers according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the abnormal number identification method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the abnormal number identification method according to any one of claims 1 to 8.

Images