An abnormal number identification method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to an abnormal number identification method and device, electronic equipment and storage medium, comprising: obtaining feature data of a to-be-identified number; performing abnormality detection on the feature data to determine a candidate abnormal number; using a pre-trained weighted isolation forest model to classify the candidate abnormal number and determine an abnormal number from the candidate abnormal number. In this way, the problem of non-uniform interpretability of data abnormality and service abnormality is solved. The present disclosure uses strongly related features specified by service knowledge in feature generation, so that the algorithm-detected abnormality conforms to the real abnormality of the telecommunication fixed telephone abnormality, effectively reducing the model error.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, and in particular to a method, apparatus, electronic device, and storage medium for identifying abnormal numbers. Background Technology

[0002] With users immersed in mobile phone calls and mobile internet usage for extended periods, and mobile communication becoming the dominant mode of communication, the neglect of abnormal fixed-line telephone calls has led to irregular business activities based on fixed-line telephones disrupting people's normal work and life.

[0003] Currently, methods for identifying abnormal landline calls rely on supervised learning based on basic feature extraction. However, in real-world business scenarios, some landline calls share similar characteristics with abnormal calls, such as high caller ID and high dispersion, which can lead to significant deviations in the accuracy of abnormal call identification. Furthermore, supervised learning methods are not suitable for identifying abnormal landline calls using unlabeled data and are difficult to adapt to various business scenarios. Summary of the Invention

[0004] This disclosure provides an abnormal number identification system, method, apparatus, electronic device, and storage medium to at least solve the problems in related technologies where the accuracy of abnormal telephone number identification is significantly flawed, and it is not applicable to the identification of abnormal fixed-line telephones without tagged data, making it difficult to adapt to various business scenarios. The technical solution of this disclosure is as follows:

[0005] According to a first aspect of the present disclosure, an abnormal number identification method is provided, comprising:

[0006] Obtain the feature data of the number to be identified;

[0007] Anomaly detection is performed on the feature data to determine candidate abnormal numbers;

[0008] A pre-trained weighted isolated forest model is used to classify the candidate abnormal numbers and determine the abnormal numbers from the candidate abnormal numbers.

[0009] Optionally, before performing anomaly detection on the feature data and determining candidate anomaly numbers, the method further includes:

[0010] The feature data is standardized, and then subjected to data preprocessing, data completeness filling, deletion, and dimensionality reduction to obtain the feature dataset.

[0011] The step of performing anomaly detection on the feature data to determine candidate anomaly numbers includes:

[0012] Anomaly detection is performed on the feature dataset to determine candidate anomaly numbers.

[0013] Optionally, before classifying the candidate abnormal numbers using a pre-trained weighted isolated forest model and determining the abnormal numbers from the candidate abnormal numbers, the method further includes:

[0014] Based on feature sample datasets of abnormal and non-abnormal sample numbers, pre-defined weighted isolation forest models with different weights are trained respectively.

[0015] The fraud rate and recurrence rate of the preset weighted isolated forest model are calculated, and the preset weighted isolated forest model is optimized by grid search to obtain a weighted isolated forest model.

[0016] Optionally, the step of using a pre-trained weighted isolated forest model to classify the candidate anomaly numbers and determine the anomaly numbers from the candidate anomaly numbers includes:

[0017] Draw the decision tree for the weighted isolated forest model;

[0018] The leaf nodes of the decision tree are determined and the decision paths are extracted. The decision tree conditions are then converted into execution statements.

[0019] A weighted isolated forest is constructed based on the decision tree to identify the candidate abnormal numbers. The average of the predicted probability values ​​of all trees is output as the probability that the candidate abnormal number is an abnormal number.

[0020] According to a second aspect of the present disclosure, an abnormal number identification device is provided, comprising:

[0021] The acquisition module is used to acquire the feature data of the number to be identified;

[0022] The detection module is used to perform anomaly detection on the feature data and determine candidate abnormal numbers;

[0023] The classification module is used to classify the candidate abnormal numbers using a pre-trained weighted isolated forest model, and to determine the abnormal numbers from the candidate abnormal numbers.

[0024] Optionally, the acquisition module is used to:

[0025] The feature data is standardized, and then subjected to data preprocessing, data completeness filling, deletion, and dimensionality reduction to obtain the feature dataset.

[0026] The step of performing anomaly detection on the feature data to determine candidate anomaly numbers includes:

[0027] Anomaly detection is performed on the feature dataset to determine candidate anomaly numbers.

[0028] Optionally, the classification module is used for:

[0029] Based on feature sample datasets of abnormal and non-abnormal sample numbers, pre-defined weighted isolation forest models with different weights are trained respectively.

[0030] The fraud rate and recurrence rate of the preset weighted isolated forest model are calculated, and the preset weighted isolated forest model is optimized by grid search to obtain a weighted isolated forest model.

[0031] Optionally, the classification module is used for:

[0032] Draw the decision tree for the weighted isolated forest model;

[0033] The leaf nodes of the decision tree are determined and the decision paths are extracted. The decision tree conditions are then converted into execution statements.

[0034] A weighted isolated forest is constructed based on the decision tree to identify the candidate abnormal numbers. The average of the predicted probability values ​​of all trees is output as the probability that the candidate abnormal number is an abnormal number.

[0035] According to a third aspect of the present disclosure, an electronic device for identifying abnormal phone numbers is provided, comprising:

[0036] processor;

[0037] Memory used to store the processor's executable instructions;

[0038] The processor is configured to execute the instructions to implement the abnormal number identification method described in any one of the claims.

[0039] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein when instructions in the computer-readable storage medium are executed by a processor of an abnormal number identification electronic device, the abnormal number identification electronic device is enabled to perform the abnormal number identification method described in any one of the present invention.

[0040] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the abnormal number identification method described in any one of the present invention.

[0041] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects:

[0042] Obtain feature data of the number to be identified; perform anomaly detection on the feature data to determine candidate abnormal numbers; use a pre-trained weighted isolated forest model to classify the candidate abnormal numbers and determine the abnormal numbers from the candidate abnormal numbers.

[0043] This solves the interpretability problem caused by the inconsistency between data anomalies and business anomalies. The invention employs strongly correlated features specified by business knowledge in feature generation, ensuring that the anomalies detected by the algorithm match genuine anomalies in fixed-line telecommunications, effectively reducing model error.

[0044] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0045] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0046] Figure 1 This is a flowchart illustrating an abnormal number identification method according to an exemplary embodiment.

[0047] Figure 2 This is a flowchart of a method for identifying anomalies in fixed-line telephones based on multi-dimensional service characteristics, as described in an embodiment of the present invention.

[0048] Figure 3 This is a diagram illustrating the specific implementation steps of a method for identifying anomalies in fixed-line telephones based on multi-dimensional service characteristics, as described in this invention.

[0049] Figure 4 It is the optimal tree of an optimal weighted isolated forest generated by a method for identifying anomalies in fixed-line telephones based on multi-dimensional business characteristics.

[0050] Figure 5 This is a block diagram illustrating an abnormal number identification device according to an exemplary embodiment.

[0051] Figure 6 This is a block diagram illustrating an electronic device for identifying abnormal numbers according to an exemplary embodiment.

[0052] Figure 7 This is a block diagram illustrating an apparatus for identifying abnormal numbers according to an exemplary embodiment. Detailed Implementation

[0053] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0054] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0055] Figure 1 This is a flowchart illustrating an abnormal number identification method according to an exemplary embodiment, such as... Figure 1 As shown, the abnormal number identification method includes:

[0056] In step S11, the feature data of the number to be identified is obtained.

[0057] With users immersed in mobile phone calls and mobile internet usage for extended periods, and mobile communication becoming the dominant mode of communication, the neglect of abnormal fixed-line telephone calls has led to irregular business activities based on fixed-line telephones disrupting people's normal work and life.

[0058] Currently, methods for identifying abnormal landline calls rely on supervised learning based on basic feature extraction. However, in real-world business scenarios, some landline calls share similar characteristics with abnormal calls, such as high caller ID and high dispersion, which can lead to significant deviations in the accuracy of abnormal call identification. Furthermore, supervised learning methods are not suitable for identifying abnormal landline calls using unlabeled data and are difficult to adapt to various business scenarios.

[0059] For example, in real-world business scenarios, there are high caller ID and high dispersion characteristics similar to those of company landlines and abnormal landlines, such as after-sales calls, customer service calls, logistics calls, and sales calls. In the actual identification process, this can easily cause a large deviation in the accuracy of abnormal call identification, making it difficult to achieve completely accurate output using the same model.

[0060] In this application, the number to be identified can be either an abnormal number or a normal number. It is necessary to distinguish between the numbers to be identified in order to perform operations such as blocking abnormal numbers. The feature data of the number to be identified can include features from different dimensions such as operation and maintenance business dimensions, customer service business dimensions, and call service dimensions.

[0061] Furthermore, the characteristic data of the number to be identified can be encrypted and stored to obtain a multi-dimensional business characteristic table.

[0062] In step S12, anomaly detection is performed on the feature data to determine candidate anomaly numbers.

[0063] In this step, the Isolation Forest algorithm can be used for anomaly detection to determine candidate anomaly numbers, or other algorithms can be used; no specific limitation is made.

[0064] In one implementation, before performing anomaly detection on the feature data and determining candidate anomaly numbers, the method further includes: standardizing the feature data and obtaining a feature dataset through data preprocessing, data completeness filling, deletion, and dimensionality reduction.

[0065] Perform anomaly detection on feature data to determine candidate anomaly numbers, including: perform anomaly detection on feature datasets to determine candidate anomaly numbers.

[0066] In other words, the data is standardized to obtain a unified data representation. Then, through data preprocessing, data completeness imputation, and pruning, a complete dataset is formed to facilitate further analysis. The PCA algorithm is then used to reduce the dimensionality of the data and obtain key features. Finally, the data is processed into a DataFrame format that meets the requirements of the Isolation Forest algorithm.

[0067] Hypothesis verification:

[0068] Assumption 1. The proportion of abnormal samples is low.

[0069] Hypothesis 2. Abnormal samples have significant differences from normal samples.

[0070] To obtain correct anomaly detection results, the above assumptions must be met when using the Isolation Forest algorithm. The proposed assumptions have been verified on real data. For example, landline numbers that make more than 100 calls a day account for 1% of the total, and most numbers do not make any calls.

[0071] Initializing the Isolation Forest algorithm with the parameter `max_samples` will sample a portion of the data with or without replacement. Setting `max_features` will extract some features from these samples to construct a binary tree (iTree, or Isolation Tree). Multiple iTrees are created through repeated extraction of samples and features. Setting `n_estimators` will continue until the tree reaches a certain height / depth and cannot be further segmented.

[0072] The `fit_predict` function is called to fit and predict the dataset, ultimately obtaining the anomaly score for each landline phone number, arranged in reverse order, with lower scores indicating greater anomalies.

[0073] In step S13, a pre-trained weighted isolated forest model is used to classify candidate abnormal numbers and determine abnormal numbers from the candidate abnormal numbers.

[0074] In one implementation, a pre-trained weighted isolated forest model is used to classify candidate outlier numbers. Before determining outlier numbers from the candidate outlier numbers, the following steps are also included:

[0075] Based on feature sample datasets of abnormal and non-abnormal sample numbers, pre-defined weighted isolation forest models with different weights are trained respectively. The fraud rate and recurrence rate of the pre-defined weighted isolation forest models are calculated, and the pre-defined weighted isolation forest models are optimized by grid search to obtain the weighted isolation forest model.

[0076] In other words, a weighted isolated forest with different weights is trained based on the segmented feature sample datasets of company landline and personal landline phones. For a number t, its score in the isolated forest is denoted as Si, and its weight is denoted as W1. Based on the installation and maintenance business knowledge, i.e., whether the service activation time is delayed and whether the resource tree activation process is abnormal, a score is assigned and denoted as Zi, with a weight denoted as W2. The abnormality score Sc(t) is then: Sc(t) = W1*Si + W2*Zi.

[0077] Where W1+W2=1, it is a linear weighted sum.

[0078] We obtain weighted isolated forests of company landlines and personal landlines respectively, and then calculate relevant indicators such as fraud rate and call recurrence rate. We continue to adjust until the optimization indicators no longer increase to obtain the optimal weighted isolated forest.

[0079] The formula for the fraud rate is as follows:

[0080] Fraud = (Fn / N) x 100%

[0081] Formula for probability of recurrence:

[0082] Recover = (Rn / N) x 100%

[0083] Optionally, a pre-trained weighted isolation forest model is used to classify candidate anomaly numbers and determine anomaly numbers from the candidate anomaly numbers, including:

[0084] Draw the decision tree for the weighted isolated forest model;

[0085] Determine the leaf nodes of the decision tree and extract the decision paths, and transform the decision tree conditions into execution statements;

[0086] A weighted isolated forest is constructed based on the decision tree to identify candidate abnormal numbers. The average of the predicted probability values ​​of all trees is output as the probability that a candidate abnormal number is an abnormal number.

[0087] In other words, the decision subtrees of the weighted isolation forest are first drawn, the leaf nodes of the decision trees are found and the decision paths are extracted. Then, the CASE WHEN function is used to convert the decision tree conditions into HiveSQL statements. Following the diagram provided by the decision tree, the decisions are assigned step by step. Finally, the weighted isolation forest is constructed, the prediction set is identified, and the average predicted probability value of all trees is output.

[0088] This application provides an abnormal call identification system based on multi-source features, including a multi-dimensional business feature extraction module, an abnormal landline call processing module, a model index calculation module, a weighted isolated forest construction module, and a real-time abnormal landline call identification module.

[0089] Among them, the multi-dimensional business feature extraction module is used to construct business features including three dimensions: operation and maintenance business, customer service business, and call business;

[0090] The abnormal landline handling module is used to handle abnormal landline numbers. It determines whether to shut down an abnormal landline number by calling the called party to verify whether there is any abnormal content.

[0091] The model indicator calculation module is used to calculate the case involvement rate and re-activation rate of shut-down numbers, providing reference indicators for model optimization;

[0092] The weighted isolated forest construction module is used to linearly weightedly combine isolated forests and installation and maintenance business knowledge scoring to obtain a weighted isolated forest, which separates the identification scenarios of fraud involving company landlines and fraud involving personal landlines.

[0093] The real-time abnormal landline identification module is used to access hourly landline data, obtain landline abnormality scores through weighted isolated forest, and identify suspected abnormal landlines.

[0094] It is understandable that user call data typically used for analysis is large in scale, making data analysis difficult and ineffective. This application improves the performance of the model generation process and the resulting model itself by specifying features through business knowledge, compressing the data, removing a large number of weakly correlated and redundant features, and constructing a multi-dimensional business feature table.

[0095] Moreover, methods that address the issue of supervised learning-based mobile abnormal phone call identification not being applicable to unlabeled data, and methods applicable to unlabeled fixed-line phone call identification based on inter-class distance or density, such as KMeans and DBSCAN, suffer from slow computation speed and high system overhead. Furthermore, methods that are fast and have low system overhead but rely solely on business experience can lead to linear segmentation boundary problems in low-level identification logic, resulting in low identification success rates and an inability to guarantee 24 / 7 human monitoring.

[0096] This application combines existing call and business data from landline phones, employs the isolated forest algorithm to construct a weighted isolated forest model, extracts the decision subtrees of the isolated forest in the model, converts them into Hive SQL statements through corresponding functions, and deploys them in the data production system to automatically identify abnormal landline phones. This method is fast, has low system overhead, and high accuracy. The call re-call rate has been reduced from an average of 35% to 5%, and the case involvement rate has been increased by 10%. By monitoring landline calls for abnormality 24 / 7, it reduces potential economic losses for the public.

[0097] As can be seen from the above, the technical solution provided by the embodiments of this disclosure solves the interpretability problem of inconsistency between data anomalies and business anomalies. This invention employs strongly correlated features specified by business knowledge in feature generation, ensuring that the anomalies detected by the algorithm match the real anomalies of fixed-line telephone anomalies, effectively reducing model errors.

[0098] The method in this embodiment of the invention will be described below with reference to a specific example.

[0099] in, Figure 2 This is a flowchart of a method for identifying anomalies in fixed-line telecommunications telephones based on multi-dimensional service characteristics, as described in an embodiment of the present invention.

[0100] Figure 3 This is a diagram illustrating the specific implementation steps of a method for identifying anomalies in fixed-line telecommunications telephones based on multi-dimensional service characteristics, as described in an embodiment of the present invention.

[0101] Figure 4 It is the optimal tree of an optimal weighted isolated forest generated by a method for identifying anomalies in fixed-line telephones based on multi-dimensional business characteristics.

[0102] The present invention provides a method for identifying anomalies in fixed-line telephones based on multi-dimensional business characteristics, which includes acquiring raw fixed-line telephone data, extracting operation and maintenance business characteristics, customer service business characteristics and call service characteristics of fixed-line telephones, and constructing a multi-dimensional business characteristic table.

[0103] Based on a multidimensional business feature table, a weighted isolated forest algorithm is used for anomaly detection and shutdown of suspected abnormal numbers, calculating the fraud rate and recurrence rate of the model. Grid search optimization is employed to obtain the optimal weighted isolated forest. The weighted isolated forest is an improvement on the basic isolated forest algorithm, using different weights for individual and corporate fixed-line users to weight the isolated forest subtrees and detect suspected abnormal numbers. The subtrees of the optimal weighted isolated forest are expanded, and the subtree judgment logic is written using Hive SQL, coupling the model into the production system for anomaly identification of fixed-line telephones. This method possesses the advantages of high interpretability, high accuracy, and high scalability.

[0104] Specifically, the steps include the following:

[0105] Step 1: Obtain raw fixed-line telephone data, extend features using business knowledge, and encrypt and store it as a multi-dimensional business feature table. Obtain a batch of raw fixed-line telephone data with hourly time granularity, generate and encrypt features using specified business knowledge, and store this batch of data as a multi-dimensional business feature table for fixed-line telephones.

[0106] Step 2: Based on the multi-dimensional service feature table of fixed-line telephones, the isolated forest algorithm is used to detect suspected abnormal numbers.

[0107] Step 3: Shut down suspected abnormal numbers in this batch of numbers, and calculate the fraud rate and recovery rate of the model.

[0108] Manual outbound calls are made to suspected abnormal numbers to determine if the numbers exhibit any unusual behavior, in order to calculate the fraud rate of the abnormal numbers detected by the isolation forest model. For suspected numbers where the presence of unusual behavior cannot be determined, their call status is checked the following day to calculate the call resumption rate using the isolation forest model.

[0109] Step four: Train a weighted isolated forest with different weights based on the segmented feature sample datasets of company landline and personal landline phones. Adjust the subtree weights of the isolated forest model according to the installation and maintenance business knowledge to obtain the optimal weighted isolated forest.

[0110] Step 5: Use a grid search optimization model to adjust new hyperparameters in order to improve the fraud rate and reduce the recurrence rate.

[0111] Step six: Further expand the subtrees of the isolated forest model, and use Hive SQL to write and deploy the subtree convergence logic.

[0112] Step 7: Input the hourly time-granularity of fixed-line telephone data into the weighted isolation forest model to calculate the anomaly score of the fixed-line telephones, thereby realizing the identification of anomalies in fixed-line telephones every hour.

[0113] Furthermore, regarding step one, the original fixed-line telephone data is obtained, and its features are expanded through business knowledge, then encrypted and stored as a multi-dimensional business feature table. This multi-dimensional business feature table includes dimensions for operation and maintenance services, customer service services, and call services.

[0114] Operation and maintenance business characteristics include:

[0115] Is the actual IP address used by X1 consistent with the IP address used to send data?

[0116] Does the actual IP address used by X2 exhibit clustering?

[0117] Does the X3 caller's IP address actually originate within the corresponding time period?

[0118] The characteristics of passenger transport business include:

[0119] Is X4 a low-value package?

[0120] Does X5 have multiple units installed at the same address?

[0121] Is X6 a fixed age group?

[0122] Are X7 customers from other regions?

[0123] The features of call services include:

[0124] X8 Total number of mobile phone numbers dialed;

[0125] The number of unique mobile phone numbers dialed after X9;

[0126] X10: Total number of mobile phone numbers dialed from different regions;

[0127] X11 The number of unique mobile phone numbers after deduplication;

[0128] X12 Dispersion of the Number of Mobile Phone Numbers Dialnd;

[0129] X13 Regional dispersion of dialed mobile phone numbers;

[0130] X14 Total number of landline calls made;

[0131] X15 is the number of unique landline calls after deduplication.

[0132] X16 call types (long-distance / local);

[0133] Step two specifically includes:

[0134] 1. Standardize the data to obtain a unified data representation. Then, through data preprocessing, data completeness imputation, and deletion methods, form a complete dataset for further analysis. Next, use the PCA algorithm to reduce the dimensionality of the data and obtain key features. Finally, process the data into a DataFrame format that meets the requirements of the Isolation Forest algorithm.

[0135] 2. Hypothesis verification:

[0136] Assumption 1. The proportion of abnormal samples is low.

[0137] Hypothesis 2. Abnormal samples have significant differences from normal samples.

[0138] To obtain accurate anomaly detection results, the Isolation Forest algorithm requires the above assumptions to be met. These assumptions have been validated on real-world data; for example, landline numbers making more than 100 calls per day account for 1% of the total, and most numbers do not make any calls.

[0139] 3. Initialize the Isolation Forest algorithm's parameter `max_samples` to "auto", then `max_samples = min(256, n_samples)`. Since the sample size is greater than 256, 256 samples will be sampled with or without replacement. Set `contamination = 0.1`, indicating that outliers account for approximately 1% of the total. Set `max_features = 1.0`, then all features will be extracted to construct a binary tree (iTree, or Isolation Tree). By repeatedly extracting samples and features, multiple iTrees are created. Set `n_estimators = 100`, then the trees will reach a certain height / depth (log_2(n_estimators)) before they can be further segmented.

[0140] 4. Call the `fit_predict` function to fit and predict the dataset, ultimately obtaining the anomaly score for each landline phone number. The scores are sorted in reverse order, with lower scores indicating greater anomalies.

[0141] Step three specifically includes:

[0142] The model metrics were calculated after the first ten landline phones were shut down.

[0143] Model evaluation metrics:

[0144] Fraud rate formula: Fraud = (Fn / N) x 100%

[0145] The formula for recovery probability is: Recover = (Rn / N) x 100%.

[0146] Where N is the number of suspected abnormal numbers identified by the model, Fn is the total number of fixed telephone numbers determined to be involved in abnormal behaviors among them, and Rn is the total number of fixed telephone numbers that are restored within 24 hours among them.

[0147] Steps four to seven specifically include:

[0148] Use the weighted isolation forest obtained through grid search optimization and business weighting to identify fixed telephone abnormalities.

[0149] 1. Obtain the optimal parameters through grid search, and train weighted isolation forests with different weights based on the segmented feature sample datasets of company fixed telephone numbers and personal fixed telephone numbers.

[0150] For a number t, the score in the isolation forest is denoted as Si, and the weight is denoted as W1. According to the knowledge of installation and maintenance services, that is, whether the service opening time is delayed and whether there are abnormalities in the resource tree opening link, a score is recorded as Zi, and the weight is denoted as W2. The abnormal degree score Sc(t) of the number is:

[0151] Sc(t) = W1 * Si + W2 * Zi.

[0152] Use different combinations of weighted coefficients respectively. For the weighted isolation forest of company fixed telephone numbers, the weights are adjusted along the direction of W2 > W1, and the range of [w1, w2] is from [0.5, 0.5] to [0.1, 0.9], where W1 + W2 = 1. When the service opening time is delayed and there are abnormalities in the resource tree opening link, each is recorded as -0.5 points. For the weighted isolation forest of personal fixed telephone numbers, the weights are adjusted along the direction of W2 < W1, and the range of [w1, w2] is from [0.5, 0.5] to [0.9, 0.1], where W1 + W2 = 1. When the service opening time is delayed and there are abnormalities in the resource tree opening link, each is recorded as -1 point.

[0153] 3. Package the above parameter ranges into a dictionary {max_samples: [256, n_samples], max_features: [1, n_features], n_estimators: [1, 100], w1: [0.5, 0.9], w2: [0.5, 0.1]}, where n_samples represents the total number of samples and n_features represents the total number of features; grid it from [256, 1, 1, 0.5, 0.5] to [n_samples, n_features, 100, 0.9, 0.1], equally divide it into ten groups of parameters, output the results, calculate the fraud rate and restoration rate of the model, and adjust to use a new set of hyperparameters. Repeat the steps of weighting and tuning until the model performance no longer improves, and save the optimal weighted isolation forest.

[0154] 4: Connect fixed-line telephone data with hourly time granularity to the optimal weighted isolated forest model.

[0155] 5: Calculate the anomaly score of each landline number, sort them in reverse order, the lower the score, the more abnormal the number, and output the top 10 as suspected abnormal numbers.

[0156] 6: Make outbound calls to confirm whether the suspected abnormal numbers exhibit any unusual behavior.

[0157] Step six: Further expand the subtrees of the isolated forest model, and use Hive SQL to write and deploy the subtree convergence logic.

[0158] 1. First, draw the decision subtrees of the weighted isolated forest, which have a total of n_estimators.

[0159] 2. Find the leaf node of a decision subtree and extract the decision path.

[0160] 3. Next, use the CASE WHEN function to convert the decision tree conditions into HiveSQL statements.

[0161] 4. Then, based on the diagram provided by the decision subtree, allocate resources step by step.

[0162] 5. Repeat steps 2, 3, and 4 in each decision subtree to eventually build a weighted isolated forest.

[0163] 6. Finally, the prediction set is identified, and the average predicted probability value of all subtrees is output.

[0164] As can be seen from the above, the technical solution provided by the embodiments of this disclosure solves the interpretability problem of inconsistency between data anomalies and business anomalies. This invention employs strongly correlated features specified by business knowledge in feature generation, ensuring that the anomalies detected by the algorithm match the real anomalies of fixed-line telephone anomalies, effectively reducing model errors.

[0165] Figure 5 This is a block diagram of an abnormal number identification device according to an exemplary embodiment, comprising:

[0166] The acquisition module 201 is used to acquire the feature data of the number to be identified;

[0167] Detection module 202 is used to perform anomaly detection on the feature data and determine candidate abnormal numbers;

[0168] The classification module 203 is used to classify the candidate abnormal numbers using a pre-trained weighted isolated forest model, and to determine the abnormal numbers from the candidate abnormal numbers.

[0169] Optionally, the acquisition module 201 is configured to:

[0170] The feature data is standardized, and then subjected to data preprocessing, data completeness filling, deletion, and dimensionality reduction to obtain the feature dataset.

[0171] The step of performing anomaly detection on the feature data to determine candidate anomaly numbers includes:

[0172] Anomaly detection is performed on the feature dataset to determine candidate anomaly numbers.

[0173] Optionally, the classification module 203 is used for:

[0174] Based on feature sample datasets of abnormal and non-abnormal sample numbers, pre-defined weighted isolation forest models with different weights are trained respectively.

[0175] The fraud rate and recurrence rate of the preset weighted isolated forest model are calculated, and the preset weighted isolated forest model is optimized by grid search to obtain a weighted isolated forest model.

[0176] Optionally, the classification module 203 is used for:

[0177] Draw the decision tree for the weighted isolated forest model;

[0178] The leaf nodes of the decision tree are determined and the decision paths are extracted. The decision tree conditions are then converted into execution statements.

[0179] A weighted isolated forest is constructed based on the decision tree to identify the candidate abnormal numbers. The average of the predicted probability values ​​of all trees is output as the probability that the candidate abnormal number is an abnormal number.

[0180] As can be seen from the above, the technical solution provided by the embodiments of this disclosure solves the interpretability problem of inconsistency between data anomalies and business anomalies. This invention employs strongly correlated features specified by business knowledge in feature generation, ensuring that the anomalies detected by the algorithm match the real anomalies of fixed-line telephone anomalies, effectively reducing model errors.

[0181] Figure 6 This is a block diagram illustrating an electronic device for identifying abnormal numbers according to an exemplary embodiment.

[0182] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory including instructions that can be executed by a processor of an electronic device to perform the method. Optionally, the computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0183] In an exemplary embodiment, a computer program product is also provided that, when run on a computer, enables the computer to implement the method for identifying the abnormal number.

[0184] As can be seen from the above, the technical solution provided by the embodiments of this disclosure solves the interpretability problem of inconsistency between data anomalies and business anomalies. This invention employs strongly correlated features specified by business knowledge in feature generation, ensuring that the anomalies detected by the algorithm match the real anomalies of fixed-line telephone anomalies, effectively reducing model errors.

[0185] Figure 7 This is a block diagram illustrating an apparatus 800 for identifying abnormal numbers according to an exemplary embodiment.

[0186] For example, device 800 can be a mobile phone, computer, digital broadcasting electronic device, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0187] Reference Figure 7 The device 800 may include one or more of the following components: a processing component 802, a memory 804, a power component 806, a multimedia component 808, an audio component 810, an input / output (I / O) interface 812, a sensor component 814, and a communication component 816.

[0188] Processing component 802 typically controls the overall operation of device 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording operations. Processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the methods described.

[0189] Furthermore, the processing component 802 may include one or more modules to facilitate interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.

[0190] Memory 804 is configured to store various types of data to support the operation of device 800. Examples of this data include instructions for any application or method operating on device 800, contact data, phonebook data, messages, pictures, videos, etc. Memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0191] Power supply component 807 provides power to various components of device 800. Power supply component 807 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to device 800.

[0192] The multimedia component 808 includes a screen that provides an output interface between the device 800 and the account. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the account.

[0193] The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions, but also the duration and pressure associated with the touch or swipe operation.

[0194] In some embodiments, the multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera can receive external multimedia data. Each front-facing camera and rear-facing camera can be a fixed optical lens system or have focal length and optical zoom capabilities.

[0195] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone (MIC) configured to receive external audio signals when device 800 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 804 or transmitted via communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.

[0196] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, which may be a keyboard, click wheel, buttons, etc. These buttons may include, but are not limited to, a home button, volume buttons, a power button, and a lock button.

[0197] Sensor assembly 814 includes one or more sensors for providing status assessments of various aspects of device 800. For example, sensor assembly 814 can detect the on / off state of device 800, the relative positioning of components such as the display and keypad of device 800, changes in position of device 800 or a component of device 800, the presence or absence of contact between an account and device 800, orientation or acceleration / deceleration of device 800, and temperature changes of device 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications.

[0198] In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.

[0199] The communication component 816 is configured to facilitate wired or wireless communication between the device 800 and other devices. The device 800 can access wireless networks based on communication standards, such as WiFi, carrier networks (such as 2G, 3G, 4G, or 5G), or combinations thereof.

[0200] In one exemplary embodiment, the communication component 816 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In another exemplary embodiment, the communication component 816 further includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0201] In an exemplary embodiment, the apparatus 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described in the first and second aspects.

[0202] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions that can be executed by a processor 820 of the device 800 to perform the method.

[0203] Optionally, for example, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0204] In an exemplary embodiment, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform any of the abnormal number identification methods described in the embodiments.

[0205] As can be seen from the above, the technical solution provided by the embodiments of this disclosure solves the interpretability problem of inconsistency between data anomalies and business anomalies. This invention employs strongly correlated features specified by business knowledge in feature generation, ensuring that the anomalies detected by the algorithm match the real anomalies of fixed-line telephone anomalies, effectively reducing model errors.

[0206] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0207] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method of identifying an abnormal number, characterized by, The method comprises the following steps: obtaining feature data of a to-be-identified number; the feature data of the to-be-identified number comprises features of different dimensions of operation and maintenance business dimensions, customer service business dimensions and call business dimensions; wherein the operation and maintenance business dimensions comprise whether the actual call ip is consistent with the data delivery ip, whether the actual call ip is clustered, and whether the call number in the corresponding time period exists the actual call ip; performing anomaly detection on the feature data to determine a candidate abnormal number; using a pre-trained weighted isolation forest model to classify the candidate abnormal number and determine an abnormal number from the candidate abnormal number; before the step of using the pre-trained weighted isolation forest model to classify the candidate abnormal number and determine an abnormal number from the candidate abnormal number, the method further comprises the following steps: training different pre-set weighted isolation forest models with different weights based on feature sample data sets of sample abnormal numbers and sample non-abnormal numbers; wherein the weighted isolation forest weight of a company fixed telephone is adjusted along with the operation and maintenance business knowledge weight greater than the score in the isolation forest, and the weighted isolation forest weight of a personal fixed telephone is adjusted along with the operation and maintenance business knowledge weight less than the score in the isolation forest; wherein the operation and maintenance business knowledge comprises whether the service opening time is delayed and whether the resource tree opening link is abnormal; calculating the fraud rate and the re-computer probability of the pre-set weighted isolation forest model, and optimizing the pre-set weighted isolation forest model by using a grid search method to obtain a weighted isolation forest model.

2. The method of claim 1, wherein, before the step of performing anomaly detection on the feature data to determine a candidate abnormal number, the method further comprises the following steps: performing standardization processing on the feature data, and obtaining a feature data set through data preprocessing, data completeness filling, deletion and dimension reduction processing; the step of performing anomaly detection on the feature data to determine a candidate abnormal number comprises the following step: performing anomaly detection on the feature data set to determine a candidate abnormal number. 3.The abnormal number recognition method of claim 1, wherein, the step of using a pre-trained weighted isolation forest model to classify the candidate abnormal number and determine an abnormal number from the candidate abnormal number comprises the following steps: drawing a decision tree of the weighted isolation forest model; determining leaf nodes of the decision tree and extracting a decision path, and converting the decision tree condition into an execution statement; constructing a weighted isolation forest according to the decision tree, identifying the candidate abnormal number, and outputting the average value of the prediction probability value of all trees as the probability that the candidate abnormal number is an abnormal number.

4. An apparatus for identifying an abnormal number, characterized by comprising: The method comprises the following steps: an acquisition module is configured to obtain feature data of a to-be-identified number; the feature data of the to-be-identified number comprises features of different dimensions of operation and maintenance business dimensions, customer service business dimensions and call business dimensions; wherein the operation and maintenance business dimensions comprise whether the actual call ip is consistent with the data delivery ip, whether the actual call ip is clustered, and whether the call number in the corresponding time period exists the actual call ip; a detection module is configured to perform anomaly detection on the feature data to determine a candidate abnormal number; a classification module is configured to use a pre-trained weighted isolation forest model to classify the candidate abnormal number and determine an abnormal number from the candidate abnormal number; The classification module is used for: Training different preset weighted isolation forest models with different weights based on the feature sample data set of sample abnormal numbers and sample non-abnormal numbers; Wherein, the weighted isolation forest weight of company fixed telephone is greater than the score adjustment in the isolation forest along with the weight of installation and maintenance business knowledge, and the weighted isolation forest weight of personal fixed telephone is less than the score adjustment in the isolation forest along with the weight of installation and maintenance business knowledge; Wherein, the installation and maintenance business knowledge is whether the service opening time is delayed, and whether the resource tree opening link is abnormal; The fraud rate and the machine recovery rate of the preset weighted isolation forest model are calculated, and the preset weighted isolation forest model is optimized by using the grid search method to obtain the weighted isolation forest model.

5. The apparatus for identifying an abnormal number according to claim 4, wherein The acquisition module is used for: The feature data is standardized, and the feature data set is obtained through data preprocessing, data completeness filling, deletion and dimension reduction processing; The feature data is subjected to abnormality detection to determine the candidate abnormal number. The classification module is used for:

6. The apparatus for identifying an abnormal number according to claim 4, wherein Drawing the decision tree of the weighted isolation forest model; Determining the leaf node of the decision tree and extracting the decision path, and converting the decision tree condition into an execution statement; According to the decision tree, the weighted isolation forest is constructed, the candidate abnormal number is identified, and the average value of the prediction probability value of all trees is output as the probability of the candidate abnormal number being an abnormal number. It includes:

7. An electronic device, comprising: A processor; A memory for storing the processor executable instructions; Wherein, the processor is configured to execute the instructions to realize the abnormal number identification method in any one of claims 1 to 3. When the instructions in the computer readable storage medium are executed by the processor of the abnormal number identification electronic equipment, the abnormal number identification electronic equipment can execute the abnormal number identification method in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, The computer program is executed by the processor to realize the abnormal number identification method in any one of claims 1 to 3.

9. A computer program product comprising a computer program, characterized in that, ​

Images