Adverse telephonic posture awareness method and apparatus

Abstract

A method and apparatus for detecting malicious phone calls are disclosed. The method includes: filtering multiple phone numbers from those activated within a predetermined time period; generating a feature matrix for the multiple phone numbers, the feature matrix containing a feature vector with multiple dimensions generated for each of the multiple phone numbers; performing clustering processing on each dimension of the generated feature matrix based on the generated feature matrix, and classifying multiple phone numbers clustered into the same cluster on each of a first preset number of dimensions into the same set, thereby obtaining multiple sets, wherein the first preset number is greater than or equal to half the total number of dimensions in the feature matrix; if the number of phone numbers in one of the multiple sets is greater than a second preset number, then that set is determined as a potential set of malicious phone numbers.

Description

Technical Field

[0001] This disclosure relates to methods and apparatus for detecting malicious phone calls. Background Technology

[0002] Recently, malicious phone calls have shown a growing trend. Currently, the main approach is to locate each phone number after the call ends and compile statistics to determine the high-incidence areas of these calls. More specifically, firstly, the person receiving the malicious call needs to report it to the relevant authorities to identify the phone number. Secondly, the relevant authorities will provide the phone number to the corresponding mobile operators. Then, the operators will manually trace the phone number back to determine the origin of the malicious call. Finally, statistics will be compiled to identify the high-incidence areas of these calls over a certain period. Summary of the Invention

[0003] According to a first aspect of this disclosure, a method for detecting malicious phone calls is provided. The method includes the following steps: filtering multiple phone numbers from those activated within a predetermined time period, wherein the multiple phone numbers use prepaid plans with a prepaid amount lower than a preset value and belong to personal SIM cards; generating a feature matrix for the multiple phone numbers, the feature matrix containing a feature vector with multiple dimensions generated for each of the multiple phone numbers, the feature vector including at least the following dimensions: real-name authentication data, agent channel data, card production batch data, roaming area data, business-related data, and terminal-related data; based on the generated feature matrix, performing clustering processing on each dimension of the feature matrix, and classifying multiple phone numbers clustered into the same cluster on each of a first preset number of dimensions into the same set, thereby obtaining multiple sets, wherein the first preset number is greater than or equal to half the total number of dimensions in the feature matrix; if the number of phone numbers in a certain set of the multiple sets is greater than a second preset number, then that set is determined as a potential set of malicious phone numbers.

[0004] According to a second aspect of this disclosure, a malicious call situational awareness device is provided, the device comprising: components for performing a malicious call situational awareness method according to the first aspect.

[0005] According to a third aspect of this disclosure, a non-transient computer-readable storage medium is provided that stores instructions which, when executed by a processor, cause the execution of the adverse telephone situation awareness method according to the first aspect.

[0006] According to a fourth aspect of this disclosure, a computer program product is provided that stores instructions that, when executed by a processor, cause the execution of the adverse telephone situational awareness method according to the first aspect. Attached Figure Description

[0007] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the present disclosure and, together with the specification, serve to explain the principles of the disclosure without limitation. In the figures, similar reference numerals are used to denote similar items.

[0008] Figure 1 This is a block diagram of an exemplary malicious call situational awareness device according to some embodiments of the present disclosure.

[0009] Figure 2 This is a flowchart illustrating an exemplary method for detecting malicious phone calls according to some embodiments of the present disclosure.

[0010] Figure 3 The illustration shows a general hardware environment in which the present disclosure can be applied according to some embodiments of the present disclosure. Detailed Implementation

[0011] In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the exemplary embodiments described. However, it will be apparent to those skilled in the art that the described embodiments can be practiced without some or all of these specific details. In the exemplary embodiments described, well-known structures or processing steps are not described in detail to avoid unnecessarily obscuring the concepts of this disclosure.

[0012] The blocks within each of the block diagrams shown below can be implemented using hardware, software, firmware, or any combination thereof to achieve the principles of this disclosure. Those skilled in the art will understand that the blocks described in each block diagram can be combined or divided into sub-blocks to achieve the principles of this disclosure.

[0013] The steps of the method presented in this disclosure are intended to be illustrative. In some embodiments, the method may be performed with one or more additional steps not described and / or without the one or more steps discussed.

[0014] Furthermore, in the description of this disclosure, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or order. Similarly, although operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring such operations to be performed in the specific order shown or in sequential order, or requiring the execution of all illustrated operations to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous.

[0015] Figure 1 This is a block diagram of an exemplary malicious call situational awareness device 100 according to some embodiments of the present disclosure.

[0016] like Figure 1As shown, the device 100 may include: a preliminary screening unit 110, configured to screen multiple phone numbers from phone numbers activated within a predetermined time period, wherein the multiple phone numbers use prepaid plans with a stored value lower than a preset value and belong to personal cards; a feature matrix generation unit 120, configured to generate a feature matrix for the multiple phone numbers, the feature matrix containing a multi-dimensional feature vector generated for each of the multiple phone numbers, the feature vector including at least the following dimensions: real-name authentication data, agent channel data, card batch data, roaming area data, business-related data, and terminal-related data; and a feature matrix analysis unit 130, configured to perform clustering processing on each dimension of the generated feature matrix, and to perform clustering on each of the first preset number of dimensions. Multiple phone numbers clustered into the same cluster are classified into the same set, thus obtaining multiple sets, wherein the first preset number is greater than or equal to half the total number of dimensions in the feature matrix; the potential bad number set determination component 140 is configured to determine the set as a potential bad number set if the number of phone numbers in a certain set of the multiple sets is greater than a second preset number; the potential bad number display component 150 is configured to visually display the trend and quantity of potential bad number activities on an electronic map based on the agent channel data, real-name authentication data, and roaming area data of potential bad number numbers in the potential bad number set, by using arrows pointing from the place of purchase represented by the agent channel data or the real-name location represented by the real-name authentication data to the roaming location represented by the roaming area data.

[0017] The following text will describe in further detail how... Figure 1 The operation of each component shown.

[0018] Method 200 begins with step S210, where the preliminary screening component 110 filters out multiple phone numbers from those that were registered within a predetermined time period. These multiple phone numbers use packages with stored value amounts lower than a preset value and belong to personal cards.

[0019] The initial screening component 110 can access Customer Relationship Management (CRM) data to filter phone numbers that were registered within a predetermined time period and are using low-value prepaid plans and are personal cards. The predetermined time period can be the last 15 days, the last 3 months, the last 9 months, or the last year. It should be understood that by filtering out potentially problematic phone numbers that were recently registered, it is possible to predict recent problematic call patterns. CRM data can include the phone card's registration date (i.e., account opening date), the phone card's plan, and whether the phone card is a personal card. Here, a personal card is defined as a card used in contrast to a corporate user card. A low prepaid amount can be, for example, a prepaid amount of 20 yuan or less.

[0020] By referencing the phone card's activation date (i.e., account opening date), the phone card's plan, and whether the phone card is a personal or corporate card in the CRM data, the initial screening component 110 can filter out multiple phone numbers from recently activated phone numbers that use low-value plans and belong to personal cards.

[0021] In some embodiments, at step S210, the preliminary screening unit 110 may also randomly select a second plurality of phone numbers from the first plurality of screened phone numbers for subsequent processing.

[0022] It should be understood that for operators, the number of recently activated personal SIM cards with low-value prepaid plans may be enormous. To facilitate subsequent processing, the initial screening component 110 can further randomly select a predetermined number of SIM cards from these recently activated cards for further processing. This predetermined number can be determined based on actual needs; for example, it could be ten thousand phone numbers.

[0023] It should be understood that the telephone numbers screened by the preliminary screening unit 110 can be either landline or mobile telephone numbers. Since landline telephone numbers are less likely to be defective, the telephone numbers screened by the preliminary screening unit 110 may also include only mobile telephone numbers.

[0024] Next, method 200 proceeds to step S220, where the feature matrix generation component 120 generates a feature matrix for the plurality of phone numbers. The feature matrix contains a feature vector with multiple dimensions generated for each of the plurality of phone numbers. The feature vector includes at least the following dimensions: real-name authentication data, agent channel data, card batch data, roaming area data, business-related data, and terminal-related data.

[0025] The feature matrix generation unit 120 receives a first or second set of phone numbers from the preliminary screening unit 110. The feature matrix generation unit 120 generates a feature matrix for the received phone numbers by referencing B-domain (business domain) data and O-domain (operation domain) data. For each phone number, the feature matrix generation unit 120 generates a multi-dimensional feature vector, which may include the following dimensions: real-name authentication data, agent channel data, card batch data, roaming area data, business-related data, and terminal-related data. A feature matrix can be generated by including a multi-dimensional feature vector in each row. In this case, each column of the feature matrix corresponds to one dimension.

[0026] Real-name authentication data, agent channel data, and card production batch data can be obtained from the B domain. Roaming area data, business-related data, and terminal-related data can be obtained from the O domain. It should be understood that more data can be obtained from either the B or O domain to generate the feature matrix.

[0027] It should be understood that the dimension of the feature matrix is ​​not limited to this, but can include more dimensions.

[0028] Real-name authentication data can be data related to real-name authentication, such as the time of real-name authentication, the address of real-name authentication (i.e., the real-name location), etc. Real-name authentication can be completed offline at a business hall or online. If completed offline at a business hall, the real-name location refers to the address of the business hall. If completed online, the real-name location refers to the address determined by the online IP address. Agent channel data refers to the channel through which the phone card was obtained, including online and offline channels. Agent channel data can include data indicating the place of purchase. Card production batch data refers to the date or batch in which the phone card was produced. Roaming area data refers to the roaming area name of the mobile phone number corresponding to the phone card. Service-related data can include data related to the phone card's services. Service-related data can include at least one of call intensity, internet access frequency, and the type of application used. Terminal-related data refers to information such as the model of the terminal (e.g., mobile phone) using the phone card.

[0029] More specifically, online channels include obtaining phone cards via the internet, while offline channels include obtaining phone cards through physical stores; call strength indicates the call intensity of a phone number, including call frequency and duration; internet access frequency indicates how often a phone number accesses the internet, where "frequency" in both refers to both frequency and number of times; the type of application used can be a financial application such as "YiPay" or "Alipay". Terminal-related data can reflect the terminal's grade and price through information such as the model of the terminal using the phone card.

[0030] In some embodiments, each of the roaming area data, service-related data, and terminal-related data includes corresponding data falling within a second predetermined time period, such as roaming area data, service-related data, and terminal-related data within the last 7 days. It should be understood that, for example, the amount of service-related data for a single phone number can be enormous; considering only service-related data within a certain time window is beneficial for subsequent data analysis and processing. It should also be understood that the second predetermined time period can be set or adjusted according to actual needs.

[0031] For example, O-domain data can include: call signaling data, data service call detail records (CDRs), deep packet inspection (DPI) data, roaming data, and terminal registration data. More specifically, call strength can be obtained from service-related data in call signaling data, which indicates the caller and callee, call start and end times, call duration, call frequency, and active call periods. Internet access frequency can be obtained from service-related data in data service CDRs. The type of application used in service-related data can be obtained from DPI data. Roaming area data can be obtained from roaming data. And terminal-related data, such as terminal model, can be obtained from terminal registration data.

[0032] Consider the following specific misconduct by a criminal gang. This gang might initially purchase hundreds or thousands of SIM cards at once. They might use the identity cards of multiple people in a particular region to buy these cards, typically through online channels. They might then register these SIM cards under real names, for example in Guangzhou, before transporting them to various locations (roaming areas such as Yunnan and Hunan) for illicit activities. During these activities, the outbound call intensity and / or internet usage frequency of these phone numbers would be high, and the applications used would mostly be financial (such as YiPay). Furthermore, the devices used with these phone numbers would typically be inexpensive mobile phones. Based on this scenario, it's understandable that the multiple dimensions listed above make it possible to identify potential malicious phone numbers.

[0033] It should be understood that in this disclosure, the real-name location and roaming location can be specified down to the province, city, district / county, or street. This disclosure does not impose any restrictions on this.

[0034] Next, method 200 proceeds to step S230, where the feature matrix analysis unit 130 performs clustering processing on each dimension of the generated feature matrix, and classifies multiple phone numbers that are clustered into the same cluster on each of the first preset number of dimensions into the same set, thereby obtaining multiple sets, wherein the first preset number is greater than or equal to half of the total number of dimensions in the feature matrix.

[0035] First, the feature matrix analysis component 130 performs clustering processing on each dimension (or each column) of the generated feature matrix using a clustering algorithm. This clustering algorithm includes K-means clustering, BIRCH (Balanced Iterative Reduction and Clustering) using hierarchical methods, or DBSCAN (Density-Based Noise Applied Spatial Clustering). By performing clustering, multiple clusters are obtained for each dimension. For example, during clustering, phone numbers with the same real-name authentication data (more specifically, real-name authentication) can be clustered into the same cluster. Similarly, phone numbers with the same agent channel data can be clustered into the same cluster. Also similarly, phone numbers with the same card production batch data can be clustered into the same cluster. Similarly, phone numbers with the same roaming area data (more specifically, roaming location) can be clustered into the same cluster. During clustering, phone numbers with similar business-related data (such as call intensity) can be clustered into the same cluster. Similarly, phone numbers with similar terminal-related data (such as terminal grade) can be clustered into the same cluster.

[0036] In some embodiments, when multiple clusters are obtained by clustering phone numbers for each dimension, only clusters with a number of phone numbers greater than a predetermined value are retained. For example, when clustering along a dimension such as call intensity, multiple clusters corresponding to different call intensities are obtained. In this case, only the three clusters with the number of phone numbers in the top three, for example, can be considered. Phone numbers outside these three clusters can be considered as not being clustered into any cluster. It should be understood that by considering only the larger clusters, a larger potential criminal gang can be identified. After performing clustering on each dimension, for each phone number, a "fingerprint" of that phone number can be obtained, such as (A1, B3, C2, ..., Z0). Here, A, B, and C represent dimensions, numbers represent cluster numbers, and 0 indicates that the phone number has not been clustered into any cluster. More specifically, a "fingerprint" (A1, B3, C2, ..., Z0) indicates that the phone number is clustered into the first cluster in dimension A, the third cluster in dimension B, the second cluster in dimension C, and not clustered into any cluster in dimension Z.

[0037] Next, the feature matrix analysis component 130 will classify multiple phone numbers that are clustered into the same cluster in each of the first preset number of dimensions into the same set, thereby obtaining multiple sets, wherein the first preset number is greater than or equal to half of the total number of dimensions in the feature matrix.

[0038] In other words, the feature matrix analysis component 130 classifies multiple phone numbers that are clustered into the same cluster in at least half of the dimensions into the same set. For example, the feature matrix analysis component 130 can classify phone numbers whose fingerprints all contain "A1, B3, C2" into the same set. This means that phone numbers that are clustered into the same cluster in each of dimensions A, B, and C are classified into the same set. As another example, the feature matrix analysis component 130 can classify phone numbers whose fingerprints all contain "A1, C2, E3, F2" into the same set. This means that phone numbers that are clustered into the same cluster in each of dimensions A, C, E, and F are classified into the same set. It should be understood that the number "0" in the fingerprint indicates that it has not been clustered into any cluster; therefore, the number "0" does not represent the same cluster.

[0039] Next, method 200 proceeds to step S240. In step S240, if the number of phone numbers in one of the plurality of sets is greater than a second preset number, then the potential problematic number set determination component 140 determines that set as a potential problematic number set. Here, the second preset number can be a value preset based on experience. The potential problematic number set determination component 140 can label the potential problematic number set; the label could be, for example, "Bad Gang 1," "Bad Gang 2," etc.

[0040] In some embodiments, for each of a plurality of potential bad number sets, the potential bad number set determination component 140 may further expand the set by adding one or more phone numbers from a preset number database to the set based on the feature vector (or fingerprint) of the phone numbers in the set.

[0041] Here, the preset number database can be the operator's full number database, which includes all telephone numbers issued by the operator. For example, the potential problematic number set determination component 140 can add telephone numbers from the full number database that have a "common fingerprint" of the target set (the "common fingerprint" of the target set refers to the fingerprint portion on which the target set is obtained, such as "A1,B3,C2" or "A1,C2,E3,F2") to the target set.

[0042] In some embodiments, if one of the expanded sets contains multiple phone numbers corresponding to the same identity information, then that set is identified as a high-risk set of problematic numbers.

[0043] Malicious groups may use the same identity information (such as the same ID card) to open multiple phone cards. In some extreme cases, they may use the same identity information to open more than one hundred phone cards. Legitimate individual users obviously would not use so many phone cards. Therefore, if multiple phone numbers corresponding to the same identity information are found within an expanded set, that set is identified as a high-risk set of malicious numbers.

[0044] Alternatively, if multiple phone numbers corresponding to the same identity information are found within an expanded set, and these multiple phone numbers are not used by the same user, then the set is identified as a high-risk set of problematic numbers.

[0045] Next, method 200 proceeds to step S250, where the potential malicious phone number display component 150, based on the agent channel data, real-name authentication data, and roaming area data of the potential malicious phone numbers within the potential malicious phone number set, visually displays the direction and quantity of the potential malicious phone number activity chain on an electronic map by using arrows pointing from the place of purchase (represented by agent channel data) or the place of real-name authentication (represented by real-name authentication data) to the place of roaming (represented by roaming area data).

[0046] By using arrows pointing from the purchase location (represented by agent channel data) or the real-name authentication location (represented by real-name authentication data) to the roaming location (represented by roaming area data) on an electronic map, the direction and scale of potential malicious phone activity chains can be visually displayed. This allows for an intuitive view of the malicious phone card industry chain, thereby helping to combat malicious activities at their source.

[0047] In some embodiments, the potential malicious phone number display component 150 may also display a situational warning table. The situational warning table may contain information about each potential malicious number set. For example, the situational warning table may contain the location (e.g., roaming area), agency channel, card production batch, number of phone numbers included, tags, etc., of each potential malicious number set.

[0048] By displaying the situation warning table, users of the methods and apparatus disclosed herein can easily understand and grasp the adverse telephone situation.

[0049] The following is a specific example of this disclosure.

[0050] Suppose we recently received a batch of new card issuance information from CRM, including the following: phone number, region, activation date, card plan, agent channel, and place of residence as indicated on ID card:

[0051] P1(133ABCD0001, L1, 2020-02-22, China Telecom daily rental card 5 yuan, electronic channel, L3 location)

[0052] P2(133ABCD0003, L1, 2020-02-23, China Telecom daily rental card 5 yuan, electronic channel, L3 location)

[0053] P3(133ABCD0004, L1, 2020-02-24, Standard Prepaid, XX Agent Point, L3 Location)

[0054] P4(181HIJK0100, L2, 2020-02-25, Postpaid Package, XX Business Hall, L2 Location).

[0055] As is known, the location refers to the fixed distribution area of ​​a telephone number, which is related to the issuing location of the phone card. For example, a phone card issued in Beijing has Beijing as its location.

[0056] 1. Initial screening

[0057] Initial screening is conducted based on low-value personal cards issued within the past 15 days, with 10,000 phone numbers randomly selected daily.

[0058] P1(133ABCD0001, L1, 2020-02-22, China Telecom daily rental card 5 yuan, electronic channel 1, L3 location)

[0059] P2(133ABCD0003, L1, 2020-02-23, China Telecom daily rental card 5 yuan, electronic channel 1, L3 location)

[0060] P3(133ABCD0004, L1, 2020-02-24, Standard Prepaid, XX Agent Point 1, L3 Location) ...

[0062] P10000(133ABCD0004, Ln, 2020-02-24, Ordinary Prepaid, XX Agent Point, Lm Location).

[0063] 2. Analysis of the behavioral characteristics of the sliding time window

[0064] 1) Based on O-domain data and B-domain data, the feature matrix of multi-dimensional data such as location, various business behaviors within 7 days, terminal registration, and roaming location is shown below:

[0065] P1(133ABCD0001, 133ABCD, L1, activated on 2020-02-27, 0 calls, 0 SMS messages, 0 internet accesses, balance 50 yuan, terminal Samsung B199, location (L4, L5))

[0066] P2(133ABCD0003, 133ABCD, L1, activated on 2020-02-27, 20 calls, 0 text messages, 0 internet access, balance 30 yuan, Samsung B1100, location (L5))

[0067] P3(133ABCD0004, 133ABCD, L1, activated on 2020-02-25, 2 calls, 0 SMS messages, 0 internet access, balance 100 yuan, terminal Apple iPhone 7, location (L6)) ......

[0069] P10000(...).

[0070] Here, both the number range "133ABCD" and "L1" indicate the location. As is known, the location of a phone number can be determined through the number range "133ABCD". Various business activities are considered here, including the date the phone number was activated, the number of calls made, the number of SMS messages sent, internet data usage, and the remaining balance.

[0071] 3. Adverse Situation Awareness Analysis

[0072] 1) Cluster sequentially according to each dimension of the feature matrix

[0073] K-means clustering algorithm can be used, which only needs to retain clusters with the number of phone numbers in the top n.

[0074] 2) Determine the record feature "fingerprint" of each phone number (e.g., (A1, B3, C2, ..., Z0), where AZ represents dimension, numbers are clusters, and those without clusters are 0);

[0075] 3) Phone numbers with the same "fingerprint" in at least 3 dimensions will be placed in the same set;

[0076] 4) If the number of phone numbers in the set is not less than 2, then it is marked as a valid set and labeled as: Bad Gang 1, Bad Gang 2, ...

[0077] P1(133ABCD0001, 133ABCD, L1, activated on 2020-02-27, 0 calls, 0 SMS messages, 0 internet accesses, balance 50 yuan, terminal Samsung B199, location (L4, L5), electronic channel 1, A1, B2, C3, D0, ... Z0, bad gang 1)

[0078] P2(133ABCD0003, 133ABCD, L1, Activated on 2020-02-27, 20 calls, 0 text messages, 0 internet access, balance 30 yuan, Samsung B1100, Location (L5), Electronic Channel 1, A1, B2, C3, D0, ...Z0, Bad Group 1)

[0079] P3(133ABCD0004, 133ABCD, L1, Activated on 2020-02-25, 2 calls, 0 SMS messages, 0 internet access, balance 100 yuan, terminal Apple iPhone 7, location (L6), agent point 1, A2, B1, C3, D1, ...Z2, bad gang 2).

[0080] 4. Situational awareness output

[0081] 1) In the full number database, based on the specific values ​​of the common characteristics of each set of tags, retrieve more numbers to add to the set;

[0082] P10001(133ABCD1001, 133ABCD, L1, activated 2020-02-27, 20 calls, 0 SMS messages, 0 internet access, balance 30 yuan, Samsung B1100, location (L5), electronic channels 1, A1, B2, C3, D0, ...Z0, bad actors 1)...

[0083] P10002(133ABCD0004, 133ABCD, L1, Activated on 2020-02-25, 2 calls, 0 SMS messages, 0 internet access, balance 100 yuan, terminal Apple iPhone 7, location (L6), agent point 1, A2, B1, C3, D1, ...Z2, bad gang 2)...

[0084] 2) If there are any cases of identity theft and abnormal SIM card activation, these are considered high-risk sets of numbers. These high-risk sets will be output to the situation warning table (location, agent channel, card production batch, number of phone numbers included, tags):

[0085] (L5 (location), electronic channel 1, 2020-02-27, 20, criminal gang 1)

[0086] (L6 (location), Agent 1, 2020-02-25, 10, Bad Group 2).

[0087] As mentioned earlier, the feature matrix can include more dimensions. Specifically, for example, the dimensions of the feature matrix can also include the location of the phone number, the remaining balance of the phone credit, etc. In addition, business-related data can also include, for example, the activation date of the phone number, the number of SMS messages sent, etc.

[0088] Reference above Figure 1 and Figure 2 This paper introduces a method and apparatus for detecting malicious telephone activity based on the present disclosure. The method for detecting malicious telephone activity disclosed herein enables early and proactive prediction of the situation. This makes it possible to prevent and combat malicious telephone activity in a timely manner.

[0089] Hardware implementation

[0090] Figure 3 An exemplary embodiment of the present disclosure is shown, in which a general hardware environment 300 in which the present disclosure may be applied is illustrated.

[0091] refer to Figure 3 The computing device 300 will now be described as an example of a hardware device applicable to various aspects of this disclosure. The computing device 300 can be any machine configured to perform processing and / or computation, and can be, but is not limited to, a workstation, server, desktop computer, laptop computer, tablet computer, personal digital assistant, smartphone, portable camera, or any combination thereof. The aforementioned apparatus 100 can be implemented wholly or at least partially by the computing device 300 or similar devices or systems.

[0092] The computing device 300 may include elements capable of connecting to or communicating with the bus 302 via one or more interfaces. For example, the computing device 300 may include the bus 302, one or more processors 304, one or more input devices 306, and one or more output devices 308. The one or more processors 304 may be any type of processor and may include, but are not limited to, one or more general-purpose processors and / or one or more dedicated processors (such as dedicated processing chips). The input devices 306 may be any type of device capable of inputting information to the computing device and may include, but are not limited to, a mouse, keyboard, touchscreen, microphone, and / or remote control. The output devices 308 may be any type of device capable of presenting information and may include, but are not limited to, a monitor, speakers, video / audio output terminals, and / or printers. The computing device 300 may also include or be connected to a non-transient storage device 310. The non-transient storage device 310 may be any non-transient storage device capable of implementing a data repository, and may include, but is not limited to, disk drives, optical storage devices, solid-state storage devices, floppy disks, flexible disks, hard disks, magnetic tapes or any other magnetic media, compact disks or any other optical media, ROM (read-only memory), RAM (random access memory), cache memory and / or any other memory chips or cassettes, and / or any other media from which a computer can read data, instructions, and / or code. The non-transient storage device 310 may be detachable from an interface. The non-transient storage device 310 may have data / instructions / code for implementing the methods and steps described above. The computing device 300 may also include a communication device 312. The communication device 312 may be any type of device or system capable of communicating with external devices and / or with a network, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication equipment, and / or devices such as Bluetooth. TMChipsets for devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication facilities, etc.

[0093] Bus 302 may include, but is not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0094] The computing device 300 may also include a working memory 314, which may be any type of working memory that can store instructions and / or data useful for the operation of the processor 304, and may include, but is not limited to, random access memory and / or read-only memory devices.

[0095] Software elements may reside in working memory 314, including but not limited to operating system 316, one or more application programs 318, drivers, and / or other data and code. Instructions for performing the above methods and steps may be included in one or more application programs 318, and components of the above-described apparatus 100 may be implemented by processor 304 by reading and executing the instructions of one or more application programs 318. More specifically, the preliminary screening component 110 may be implemented, for example, by processor 304 when executing application program 318 with instructions to execute step S210. The feature matrix generation component 120 may be implemented, for example, by processor 304 when executing application program 318 with instructions to execute step S220. The feature matrix analysis component 130 may be implemented, for example, by processor 304 when executing application program 318 with instructions to execute step S230. The potential bad number set determination component 140 may be implemented, for example, by processor 304 when executing application program 318 with instructions to execute step S240. The potential bad phone number display component 150 may be implemented, for example, by processor 304 when executing application program 318 with instructions to execute step S250. The executable code or source code of the software element's instructions can be stored in a non-transitory computer-readable storage medium (such as the storage device(s) 310 described above) and can be read into the working memory 314 if compilation and / or installation are possible. The executable code or source code of the software element's instructions can also be downloaded from a remote location.

[0096] From the above embodiments, those skilled in the art will clearly understand that this disclosure can be implemented by software and necessary hardware, or by hardware, firmware, etc. Based on this understanding, embodiments of this disclosure can be implemented in part in software form. The computer software can be stored in a computer-readable storage medium, such as a floppy disk, hard disk, optical disk, or flash memory. The computer software includes a series of instructions that cause a computer (e.g., a personal computer, service station, or network terminal) to perform methods or a portion thereof according to various embodiments of this disclosure.

[0097] This disclosure has been described in this way; it is clear that this disclosure can be varied in many ways. These variations are not considered to depart from the spirit and scope of this disclosure, but rather all such modifications that would be obvious to those skilled in the art are included within the scope of the following claims.

Claims

1. A method for bad phone situation awareness, comprising the steps of: selecting a plurality of phone numbers from phone numbers that are opened in a predetermined time period, the plurality of phone numbers using a package with a stored value amount lower than a preset value and belonging to personal cards; generating a feature matrix for the plurality of phone numbers, the feature matrix containing a feature vector with a plurality of dimensions generated for each phone number in the plurality of phone numbers, the feature vector including at least the following dimensions: real-name authentication data, agent channel data, card issuance batch data, roaming area data, service-related data, and terminal-related data, wherein the service-related data includes call-out intensity, online frequency, and types of used applications, and the terminal-related data includes a model of a terminal; based on the generated feature matrix, performing clustering processing for each dimension in the feature matrix to obtain a fingerprint of each phone number representing a cluster to which each dimension is clustered, and classifying a plurality of phone numbers that are clustered into the same cluster in each of a first preset number of dimensions into a same set, thereby obtaining a plurality of sets, the plurality of phone numbers in each set having a common fingerprint part on which the set is dependent, wherein the first preset number is greater than or equal to half of a total number of dimensions in the feature matrix; if a number of phone numbers in a set in the plurality of sets is greater than a second preset number, determining the set as a potential bad number set, and for each set in the plurality of potential bad number sets, adding one or more phone numbers in a preset number base having the common fingerprint part of the set to the set to expand the set. 2.The method of claim 1, wherein the step of selecting further comprises: after selecting the plurality of phone numbers, randomly sampling a second plurality of phone numbers from the selected plurality of phone numbers, wherein the feature matrix is to be generated for the second plurality of phone numbers.

3. The method of claim 1 or 2, the determining step further comprising: if a set in the plurality of sets after expansion contains a plurality of phone numbers corresponding to a same identity information, determining the set as a high-risk bad number set. 4.The method of claim 1, further comprising: based on the agent channel data, the real-name authentication data, and the roaming area data of a potential bad phone number in a potential bad number set, visually displaying a trend and extent of a potential bad phone activity chain on an electronic map by using arrows pointing from a card purchase location represented by the agent channel data or a real-name location represented by the real-name authentication data to a roaming location represented by the roaming area data.

5. The method of claim 1, wherein, The step of performing clustering processing for each dimension in the feature matrix based on the generated feature matrix comprises, for each dimension, clustering the selected plurality of phone numbers into a plurality of clusters and retaining only a plurality of clusters in which a number of phone numbers is greater than a predetermined value.

6. The method of claim 1, wherein, The predetermined time period refers to the last 15 days, the last 3 months, the last 9 months, or the last 1 year.

7. The method of claim 1, wherein, Each of the roaming area data, the service-related data, and the terminal-related data includes corresponding data falling within a second predetermined time period.

8. A bad phone cyber situational awareness apparatus, comprising: ​ A component for performing the method of any of claims 1-7.

9. A bad phone cyber threat intelligence system, comprising: comprising: at least one processor; and at least one storage device storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the method of any of claims 1-7.

10. A non-transitory computer-readable storage medium, comprising: A storage device storing instructions that, when executed by a processor, cause performance of the method of any of claims 1-7.

11. A computer program product, characterised in that, A storage device storing instructions that, when executed by a processor, cause performance of the method of any of claims 1-7.

Images