Fraud early warning method and device, electronic equipment and computer readable medium

Abstract

The application discloses a fraud early warning method and device, electronic equipment and a computer readable medium, and relates to the technical field of communication. The method comprises the following steps: in the case of determining that the current call is a fraud call, determining a first associated range object of the called party of the current call; determining a second associated range object of the called party from the first associated range object according to social interaction data between the called party and the first associated range object; and sending a warning reminder message to the called party and the second associated range object of the called party. In the case of determining that the current call is a fraud call, the second associated range object of the called party is identified in real time, and then a warning reminder message is sent to the called party and the second associated range object of the called party, so that the second associated range object of the called party can be timely warned against fraud, the awareness of fraud prevention of the weak group can be effectively protected, the risk of being cheated can be reduced, the effect of fraud prevention and warning can be maximized, and the fraud call discrimination ability of the called party and the second associated range object of the called party can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, and in particular to a fraud early warning method and device, an electronic device and a computer readable medium. BACKGROUND

[0002] Currently, there are various means of telecommunications fraud, such as impersonating acquaintances or logistics customer service, inducing false investment, etc. The current fraud prevention means in the field of telecommunications fraud mainly focuses on identifying fraudulent calls and sending reminders to the victims. However, for people with weak fraud prevention awareness, when fraud occurs, they often cannot distinguish it in time and suffer losses in person and property, or they cannot get effective reminders and suffer losses. If such groups of people can get timely reminders from others, the risk of being cheated will be significantly reduced. Therefore, when telecommunications fraud occurs, how to identify fraudulent calls in time and send reminders to the victims and their family members or friends with strong fraud prevention ability to prevent fraud is a problem that needs to be solved. SUMMARY

[0003] To solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present application provide a fraud early warning method, device, electronic device and computer readable medium.

[0004] In a first aspect, the embodiments of the present application provide a fraud early warning method, comprising: determining a first associated range object of a called party of a current call in the case of determining that the current call is a fraudulent call; determining a second associated range object of the called party from the first associated range object according to social interaction data of the called party and social interaction data of the first associated range object; and sending a warning reminder message to the called party and the second associated range object of the called party.

[0005] In an optional embodiment, determining a second associated range object of the called party from the first associated range object according to the social interaction data of the called party and the social interaction data of the first associated range object comprises: determining a social interaction feature between the called party and the first associated range object according to the social interaction data of the called party and the social interaction data of the first associated range object; and determining whether the first associated range object belongs to the second associated range object of the called party according to the social interaction feature and a pre-constructed first identification model.

[0006] In an optional embodiment, the method further comprises: obtaining fraud prevention portrait data of the first associated range object of the called party; and determining a fraud prevention portrait feature of the first associated range object of the called party according to the fraud prevention portrait data.

[0007] According to the social interaction feature and the pre-constructed first identification model, determining whether the first association range object belongs to the second association range object of the called party comprises: according to the social interaction feature, the anti-fraud portrait feature and the pre-constructed first identification model, determining whether the first association range object belongs to the second association range object of the called party and determining the anti-fraud ability level of the first association range object of the called party.

[0008] Sending a pre-warning reminder message to the called party and the second association range object of the called party comprises: determining the anti-fraud ability level of the second association range object of the called party; sorting the second association range object of the called party in descending order of the anti-fraud ability level; determining N second association range objects with higher anti-fraud ability levels according to the sorting; wherein N is an integer greater than or equal to 1; sending a pre-warning reminder message to the called party and the N second association range objects with higher anti-fraud ability levels.

[0009] In an optional embodiment, the social interaction feature between the called party and the first association range object comprises one or more of the following: call frequency, busy time base station coincidence degree, idle time base station coincidence degree, whether the same family package, main and secondary card relationship, call circle coincidence degree, longest residence time base station, idle time residence base station, average number of calls per unit time, average call duration per unit time, number of calls in a first preset time period, and call duration in a first preset time period.

[0010] The anti-fraud portrait feature comprises one or more of the following: occupation feature, education, age, number of received fraudulent information, number of times of being cheated, anti-fraud software installation and use, anti-fraud propaganda video and / or anti-fraud propaganda live broadcast watching, number of times of reporting bad information, and number of calls to fraudulent numbers.

[0011] In an optional embodiment, the first identification model comprises: a first attention component, an association relationship identification component, a second attention component, and an anti-fraud ability level determination component; wherein the first attention component is configured to determine a first score of the first association range object according to the social interaction feature; the association relationship identification component is configured to determine whether the first association range object belongs to the second association range object of the called party according to the social interaction feature, the anti-fraud portrait feature, and the first score determined by the first attention component; the second attention component is configured to determine a second score of the first association range object according to the anti-fraud portrait feature; and the anti-fraud ability level determination component is configured to determine the anti-fraud ability level of the first association range object according to the social interaction feature, the anti-fraud portrait feature, and the second score determined by the second attention component.

[0012] In an optional embodiment, determining the second association range object of the called party from the first association range object according to the social interaction data of the called party and the social interaction data of the first association range object comprises: determining whether the first association range object is the second association range object of the called party according to a preset first determination rule and the social interaction data between the called party and the first association range object.

[0013] In an optional embodiment, determining the first association range object of the called party of the current call comprises: obtaining social interaction data of the called party, the social interaction data comprising one or more of the following: call records, short message records, address books and friend data of multimedia social applications; and determining the first association range object of the called party according to the social interaction data of the called party.

[0014] In an optional embodiment, the method further comprises: obtaining user portrait data of the calling party of the current call; and identifying in real time whether the current call is a fraudulent call according to the user portrait data of the calling party.

[0015] In an optional embodiment, identifying in real time whether the current call is a fraudulent call according to the user portrait data of the calling party comprises: determining user portrait features of the calling party according to the user portrait data of the calling party; and identifying in real time whether the current call is a fraudulent call according to the user portrait features of the calling party and a pre-constructed second identification model.

[0016] In an optional embodiment, the user portrait features of the calling party comprise one or more of the following: call times, call hang-up times, call missed times, call received times, call reported times, different called party numbers, different calling party numbers, different called party area numbers, call duration times within a second preset time period, average call duration within a unit time, call duration standard deviation, call hang-up proportion and blacklist identification.

[0017] In an optional embodiment, identifying in real time whether the current call is a fraudulent call according to the user portrait data of the calling party comprises: identifying in real time whether the current call is a fraudulent call according to a preset second determination rule and the user portrait data of the calling party.

[0018] In an optional embodiment, the first association range object comprises members of a social circle of the called party, and the second association range object comprises members of a family circle of the called party.

[0019] In a second aspect, the embodiments of the present application also provide a fraud prevention and early warning device, comprising: a first determination module configured to determine a first associated range object of a called party of a current call when it is determined that the current call is a fraud call; a second determination module configured to determine a second associated range object of the called party from the first associated range object according to social interaction data of the called party and social interaction data of the first associated range object; and a warning module configured to send a warning reminder message to the called party and the second associated range object of the called party.

[0020] In optional embodiments, the second determination module is further configured to: determine a social interaction feature between the called party and the first associated range object according to the social interaction data of the called party and the social interaction data of the first associated range object; and determine whether the first associated range object belongs to the second associated range object of the called party according to the social interaction feature and a pre-constructed first identification model.

[0021] In optional embodiments, the second determination module is further configured to: obtain fraud prevention portrait data of the first associated range object of the called party; determine a fraud prevention portrait feature of the first associated range object of the called party according to the fraud prevention portrait data; determine whether the first associated range object belongs to the second associated range object of the called party and determine a fraud prevention ability level of the first associated range object of the called party according to the social interaction feature, the fraud prevention portrait feature and the pre-constructed first identification model; and the warning module is further configured to: determine a fraud prevention ability level of the second associated range object of the called party; sort the second associated range object of the called party in a descending order of the fraud prevention ability level; determine N second associated range objects with higher fraud prevention ability levels according to the sorting; wherein N is an integer greater than or equal to 1; and send a warning reminder message to the called party and the N second associated range objects with higher fraud prevention ability levels.

[0022] In optional embodiments, the second determination module is further configured to: determine whether the first associated range object is the second associated range object of the called party according to a pre-set first judgment rule and the social interaction data between the called party and the first associated range object.

[0023] In optional embodiments, the first determination module is further configured to: obtain social interaction data of the called party, the social interaction data including one or more of the following: call records, short message records, address books and friend data of multimedia social applications; and determine the first associated range object of the called party according to the social interaction data of the called party.

[0024] In an optional embodiment, the device further comprises a fraud identification module configured to acquire user portrait data of a calling party of a current call; and identify in real time whether the current call is a fraud call according to the user portrait data of the calling party.

[0025] In an optional embodiment, the fraud identification module is further configured to determine user portrait features of the calling party according to the user portrait data of the calling party; and identify in real time whether the current call is a fraud call according to the user portrait features of the calling party and a pre-constructed second identification model.

[0026] In an optional embodiment, the fraud identification module is further configured to identify in real time whether the current call is a fraud call according to a preset second judgment rule and the user portrait data of the calling party.

[0027] In a third aspect, an electronic device is provided, which comprises: one or more processors; and a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the fraud early warning method of the embodiments of the present application.

[0028] In a fourth aspect, a computer readable medium is provided, which stores a computer program, when the program is executed by a processor, the fraud early warning method of the embodiments of the present application is implemented.

[0029] An embodiment of the above application has the following advantages or beneficial effects:

[0030] In the case where it is determined that the current call is a fraud call, a second associated range object of the called party is identified in real time, which can include family circle members of the called party, such as family members and relatives of the called party, and can also include close friends, so that a warning reminder message is sent to the called party and the second associated range object of the called party, so that the second associated range object of the called party can be timely warned against fraud, the weak anti-fraud awareness population can be effectively protected, the risk of being cheated can be reduced, the anti-fraud reminding effect can be maximized, and the fraud call discrimination ability of the called party and the second associated range object of the called party can be improved. Furthermore, after the second associated range object of the called party is identified, the anti-fraud ability level of each second associated range object can be determined, and the warning reminder message can be sent to the members with high anti-fraud ability level first, so that the called party can be timely protected while resources are saved and costs are reduced. In addition, the user portrait data of the calling party of the current call can be used to identify in real time whether the current call is a fraud call, so that the timeliness of fraud early warning and the timeliness of the warning reminder message are ensured.

[0031] The further effects of the above-described non-conventional optional mode will be described in the following in conjunction with the specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0032] The accompanying drawings are included to provide a further understanding of the application, and are incorporated in and constitute a part of this specification, illustrate embodiments of the application, and together with the description serve to explain the principles of the application. In the drawings:

[0033] Figure 1 A schematic diagram illustrating a main flow of the fraud-preventing and early-warning method of an embodiment of the application is shown;

[0034] Figure 2 A flow chart illustrating the fraud-preventing and early-warning method of another embodiment of the application is shown;

[0035] Figure 3 A flow chart illustrating the fraud-preventing and early-warning method of an embodiment of the application is shown;

[0036] Figure 4 A structural schematic diagram of the first identification model in the fraud-preventing and early-warning method of an embodiment of the application is shown;

[0037] Figure 5 A flow chart illustrating the fraud-preventing and early-warning method of another embodiment of the application is shown;

[0038] Figure 6 A flow chart illustrating the fraud-preventing and early-warning method of an embodiment of the application is shown;

[0039] Figure 7 A schematic diagram illustrating the main modules of the fraud-preventing and early-warning device of an embodiment of the application is shown;

[0040] Figure 8 is an exemplary system architecture diagram in which embodiments of the application can be applied;

[0041] Figure 9 is a structural schematic diagram of a computer system of a terminal device or a server suitable for implementing embodiments of the application. DETAILED DESCRIPTION

[0042] Exemplary embodiments of the application are described herein below, with reference to the accompanying drawings, in which details of the application are illustrated to facilitate an understanding and are not intended to limit the scope of the application. It will be apparent to one of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the application. Also, for the sake of brevity and clarity, descriptions of well-known functions and constructions are omitted herein.

[0043] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than that illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of a kind and do not limit the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / " generally indicates that the objects before and after are in an "or" relationship.

[0044] Considering that when fraud occurs, if a person with weak fraud awareness can be reminded by a family member or a friend with strong fraud awareness in time, the risk of being cheated will be greatly reduced, therefore, in the case that the current call is identified as a fraud call, the fraud warning method of the embodiments of the present application identifies the second association range object of the called party (the second association range object includes the family circle members of the called party, which can be the family members, relatives of the called party, or close friends), and sends a warning reminder message to the second association range object of the called party, so that the second association range object can remind the called party to be careful of being cheated in time, can protect the weak fraud awareness group in time, prevent fraud behavior from occurring, effectively reduce the possibility of the called party being cheated, and can improve the fraud call identification ability of the cheated person and the second association range object together. Further, the fraud warning method of the embodiments of the present application not only can identify the second association range object of the called party, but also can identify the fraud awareness level of the second association range object, so as to send a warning reminder message to the second association range object with a higher fraud awareness level, which can reduce the resource usage amount and cost while reducing the risk of being cheated and improving the fraud awareness effect to the maximum extent. In addition, the embodiments of the present application can identify whether the current call is a fraud call in real time according to the user portrait features of the calling party of the current call, thereby ensuring the timeliness of fraud warning and the timeliness of the warning reminder message.

[0045] For the convenience of understanding, the fraud warning method of the embodiments of the present application is described below in combination with the accompanying drawings.

[0046] Figure 1 A schematic diagram of the main process of the fraud warning method of the embodiments of the present application is shown schematically as Figure 1 The method comprises:

[0047] Step S101: In the case that it is determined that the current call is a fraud call, determining the first association range object of the called party of the current call;

[0048] Step S102: determining a second association range object of the called party from the first association range object according to the social interaction data of the called party and the social interaction data of the first association range object;

[0049] Step S103: sending a pre-warning reminding message to the called party and the second association range object of the called party.

[0050] In the embodiment of the present application, the social interaction refers to the intersection and communication between people, and usually refers to the process of exchanging opinions, emotions and information through language and behavior between two or more people. The first association range object refers to the personnel who have social activities with the target (i.e. the called party). The first association range object can include the members of the social circle of the called party.

[0051] The called party and the calling party of the current call can be determined according to the real-time call data of the current call. The real-time call data includes the telephone number of the calling party of the current call, the telephone number of the called party and the call duration.

[0052] For example, the first association range object of the called party can be determined according to the following process:

[0053] Obtaining the social interaction data of the called party, the social interaction data including one or more of the following: call records, short message records, address book and friend data of multimedia social application;

[0054] Determining the first association range object of the called party according to the social interaction data.

[0055] In this embodiment, the telephone number, name, call time, call duration and base station location information of the party who calls the called party can be determined through the call records. The telephone number, name and short message receiving / sending time of the short message receiving party or sending party can be determined through the short message records. The information of the contacts recorded by the called party, such as name, telephone number, email, social account information and note information, etc. can be determined through the address book. The friend information of the called party, such as name, telephone number, email and note information, etc. can be determined through the friend data of the multimedia social application. Therefore, the contacts (i.e. telephone numbers) obtained through the call records, short message records, address book or friend data of the multimedia social application can be used as the first association range object of the called party.

[0056] After obtaining the social interaction data, the social interaction data can be written into a preset wide table, and fields of the wide table can include, but are not limited to, name, phone number, base station location information, call time, call duration, call times, note information, and social methods (such as short message, call, email, WeChat, etc.). Before or after writing the social interaction data into the wide table, the social interaction data can be subjected to data cleaning. Exemplarily, the data cleaning of the social interaction data can include, but is not limited to, deleting duplicate values.

[0057] For step S102, after determining the first associated range object of the called party, a second associated range object is determined from the first associated range object. Exemplarily, the second associated range object can include family circle members of the called party, i.e., members having a relationship of relatives in a family unit, such as family members, relatives, and close friends. The second associated range object can be determined in various ways, such as through a pre-trained neural network to analyze social interaction data between the called party and the first associated range object, or through a preset first judgment rule to determine whether the first associated range object is the second associated range object. The first judgment rule can be dynamically set. Exemplarily, the first judgment rule can be to determine the second associated range object according to contact information recorded in a contact list, such as contact persons with names of “father”, “mother”, “brother”, “sister” and the like in the contact list as the second associated range object. The first judgment rule can also be that the first associated range object with a monthly call times of more than a number of times (such as 30 times) is the second associated range object, or the first associated range object with a monthly call times of more than a number of times and a call duration of each call of more than a preset duration is the second associated range object.

[0058] For step S103, after determining the family circle friends of the called party, a warning reminder message can be sent to the called party and the family circle friends of the called party, so as to remind the called party through the warning reminder message and the second associated range object of the called party that the calling party of the current call is a fraud user, and to beware of fraud.

[0059] The fraud warning method of the embodiment of the present application can identify the second associated range object of the called party in real time in the case that the current call is a fraud call, and the second associated range object can be family members, relatives and close friends of the called party, so that a warning reminder message can be sent to the called party and the second associated range object of the called party, so that the second associated range object of the called party can timely remind the called party to beware of fraud, can effectively protect the population with weak anti-fraud consciousness, reduce the risk of being cheated, maximize the anti-fraud reminding effect, and at the same time can improve the fraud call discrimination ability of the called party and the second associated range object of the called party.

[0060] Figure 2 and Figure 3 A flowchart illustrating another embodiment of the fraud warning method of the present invention is shown, such as... Figure 2 and Figure 3 As shown, the method includes:

[0061] Step S201: If it is determined that the current call is a fraudulent call, determine the first associated scope of the called party in the current call;

[0062] Step S202: Determine the social interaction characteristics between the called party and the first associated scope object based on the social interaction data of the called party and the social interaction data of the first associated scope object;

[0063] Step S203: Obtain the anti-fraud profile data of the first associated scope object of the called party; determine the anti-fraud profile features of the first associated scope object of the called party based on the anti-fraud profile data;

[0064] Step S204: Based on the social interaction features, the anti-fraud profile features, and the pre-built first identification model, determine whether the first associated scope object belongs to the second associated scope object of the called party and determine the anti-fraud capability level of the first associated scope object of the called party;

[0065] Step S205: Determine the anti-fraud capability level of the second associated scope object of the called party;

[0066] Step S206: Sort the second associated range objects of the called party in descending order of the anti-fraud capability level;

[0067] Step S207: Based on the sorting, determine the N second associated range objects with higher anti-fraud capability levels; wherein, N is an integer greater than or equal to 1;

[0068] Step S208: Send a warning reminder message to the called party and the N second associated objects with higher anti-fraud capability levels.

[0069] The fraud warning method in this embodiment and Figure 1 The difference in the illustrated embodiment is that, in this embodiment, while determining the second associated scope object of the called party, the anti-fraud capability level of the first associated scope object is also determined, thereby determining the anti-fraud capability level of the second associated scope object. When sending the warning reminder message, it is only sent to the second associated scope object with a higher anti-fraud capability level, which saves resources and reduces costs while ensuring the warning and anti-fraud effect.

[0070] After determining the first association range object of the called party, the embodiment can further obtain anti-fraud portrait data of the first association range object. The anti-fraud portrait data can include but is not limited to identity data (such as age, occupation, education), service data (such as the type of communication package, cost, and included products), anti-fraud situation data (such as the number of views or viewing time of anti-fraud propaganda videos and / or anti-fraud propaganda live broadcasts), and the use of anti-fraud applications.

[0071] For example, the social interaction feature can include but is not limited to one or more of the following: call frequency (the call frequency can be determined according to the number of calls in a preset statistical period, such as 20 calls in 30 days, and the call frequency is 2 / 3), busy time base station coincidence degree, idle time base station coincidence degree, whether the same family package, main and secondary card relationship, call circle coincidence degree, longest residence time base station, idle time residence base station, average number of calls per unit time (such as monthly average call number, weekly average call number), average call duration per unit time (such as monthly average call duration, weekly average call number), number of calls in a first preset time period, and call duration in a first preset time period. The definitions of "busy time" and "idle time" in busy time base station coincidence degree and idle time base station coincidence degree can be flexibly set, for example, "busy time" is from 6 am to 11 pm every day, and "idle time" is from 11 pm to 6 am. Busy time base station coincidence degree is the base station coincidence degree from 6 am to 11 pm in a preset statistical period, and idle time base station coincidence degree is the base station coincidence degree from 11 pm to 6 am in a preset statistical period. The "first preset time period" in the number of calls in the first preset time period can be a late peak time period, such as from 5 pm to 9 pm.

[0072] The anti-fraud portrait feature can include but is not limited to one or more of the following: occupation characteristics, education, age, number of received fraud information (such as the number of received fraud phone calls and fraud SMS), number of times of being cheated, anti-fraud software installation and use (such as the name and number of installed anti-fraud software), anti-fraud propaganda video and / or anti-fraud propaganda live broadcast viewing (such as the number of views or viewing time of anti-fraud propaganda videos and / or anti-fraud propaganda live broadcasts), number of times of reporting bad information, and number of calls to received fraud numbers (i.e., number of times of connecting fraud number calls).

[0073] The first identification model of the embodiment can include a first attention component, a correlation relationship identification component, a second attention component, and a fraud prevention ability level determination component. The first attention component is configured to determine a first score of the first correlation range object based on the social interaction feature. The correlation relationship identification component is configured to determine whether the first correlation range object belongs to the second correlation range object of the called party based on the social interaction feature, the fraud prevention portrait feature, and the first score determined by the first attention component. The second attention component is configured to determine a second score of the first correlation range object based on the fraud prevention portrait feature. The fraud prevention ability level determination component is configured to determine the fraud prevention ability level (i.e., the fraud prevention probability, i.e., the probability of not being defrauded) of the first correlation range object based on the social interaction feature, the fraud prevention portrait feature, and the second score determined by the second attention component. The output result of the first identification model is shown in Table 1 as follows:

[0074] Table 1:

[0075]

[0076] As a specific example, the pre-constructed first identification model in the embodiment can be trained based on a deep neural network (DNN). As shown in Figure 4 , the deep neural network can be divided into three layers, namely an input layer, a hidden layer, and an output layer. The input layer is configured to receive input data, the hidden layer is configured to extract features, and the output layer is configured to output results. The parameters of the first identification model of the embodiment are shown as follows:

[0077] Activation function:

[0078] Loss function: L(y, a) = -∑ i y i log(a i );

[0079] Learning rate: η = 0.0001;

[0080] Initializer = uniform (initialization parameter).

[0081] After determining the fraud prevention ability level of the first correlation range object, the fraud prevention ability level of the second correlation range object is determined in combination with the identification result of the second correlation range object. Then, the second correlation range objects of the called party are sorted in descending order of the fraud prevention ability level. Based on the sorting, N second correlation range objects with higher fraud prevention ability levels are determined, where N is an integer greater than or equal to 1, for example, N = 5. A warning reminder message is sent to the called party and the N second correlation range objects with higher fraud prevention ability levels.

[0082] The fraud early warning method of the embodiment of the present application can determine the anti-fraud ability level of each second association range object after identifying the second association range object of the called party, thereby screening the second association range object with stronger anti-fraud ability, so as to improve the fraud telephone identification ability and reduce the risk of being cheated; the early warning reminder message can be sent to the member with high anti-fraud ability level in priority, so as to timely protect the weak anti-fraud consciousness group and prevent the fraud behavior, which can protect the called party in time and save resources and reduce the cost.

[0083] Figure 5 The flowchart of the fraud early warning method of another embodiment of the present application is schematically shown as Figure 5 The method comprises the following steps:

[0084] Step S501: acquiring the user portrait data of the calling party of the current call;

[0085] Step S502: identifying whether the current call belongs to a fraud telephone according to the user portrait data of the calling party;

[0086] Step S503: determining the first association range object of the called party of the current call in the case of determining that the current call belongs to a fraud telephone;

[0087] Step S504: determining the second association range object of the called party from the first association range object according to the social interaction data of the called party and the social interaction data of the first association range object;

[0088] Step S505: sending an early warning reminder message to the called party and the second association range object of the called party.

[0089] The steps S503-S505 are the same as the embodiment shown in Figure 1 , 2 The present application will not be described here.

[0090] In the embodiment of the present application, the scene of the telecom fraud can be analyzed in advance, and the key factors or key information affecting the fraud identification are summarized and sorted out, the key factors summarized and sorted out are determined as the user portrait data for identifying whether the current call belongs to a fraud telephone and whether the calling party is a fraud user, thereby completing the screening and definition of the user portrait data. In the optional embodiment, the user portrait data of the calling party and the social interaction data of the called party and the first association range object thereof can be acquired from the preset system or database. For example, Figure 6As shown, identity data, service data, fraud-related data, base station location data, and APP access data can be obtained from a mobile DPI database (DPI refers to Deep Packet Inspection), a CRM receiving database (CRM refers to Customer Relationship Management), a billing system database, a fraud prevention system database, and a base station system database. The identity data, service data, fraud-related data, base station location data, and APP access data are filtered and sorted to obtain user portrait data of the calling party and social interaction data of the called party and objects in the first associated range.

[0091] For step S502, after determining the user portrait data of the calling party, the user portrait features of the calling party are determined according to the user portrait data of the calling party; and whether the current call belongs to a fraud call is identified in real time according to the user portrait features of the calling party and a pre-constructed second identification model. The user portrait features of the calling party include one or more of the following: call times, call hang-up times, call missed times, call received times, call reported times, different called numbers, different calling numbers, different called area numbers, call duration times within a second preset time period (for example, call duration times within 30 seconds), average call duration within a unit time, call duration standard deviation, call hang-up proportion, and blacklist identification. The times or duration in the above features can be the number within a unit time (or a statistical period), or the average number of multiple unit times (or statistical periods). The unit time can be a month, a week, etc. For example, the call times can be the call times of the last month or the monthly average call times. The blacklist identification can indicate whether the calling party is marked as a blacklist user. For example, if the blacklist identification is 1, it indicates that the calling party is a blacklist user, and if the blacklist identification is 0, it indicates that the calling party is not a blacklist user.

[0092] The second identification model can be trained based on a random forest, an LSTM (Long Short-Term Memory), and a neural network model. Taking the construction of a fraud call real-time identification model based on a random forest as an example:

[0093] Parameter adjustment range:

[0094] The maximum depth of the tree max_depth is in the range of [8, 15);

[0095] The minimum sample number of the leaf node min_samples_leaf is in the range of [20, 65) with a value interval of 5;

[0096] The number of trees n_estimators is in the range of [50, 80) with a value interval of 5.

[0097] The parameters traverse the trained model with these values to recall rate (recall rate = predicted actual fraud phone / actual fraud phone), accuracy rate (accuracy rate = predicted actual fraud phone / predicted fraud phone), F1 value (F1 value = 2 * recall rate * accuracy rate / (recall rate + accuracy rate)) as the model evaluation standard, and finally select F1 as the evaluation index. The optimal parameters are as follows:

[0098] RandomForestClassifier(criterion = 'entropy', max_depth = 12, min_samples_leaf = 45, n_estimators = 55, class_weight = 'balanced', random_state = 25).

[0099] The output results of the second identification model are shown in Table 2:

[0100] Table 2:

[0101] Calling party Called party Output result (whether a fraud call) 189****6336 189****1701 No +1416-953-6315 189****1701 Yes

[0102] In optional embodiments, the current call can also be identified in real time as a fraud call according to a preset second judgment rule and user portrait data of the calling party. For example, the current call can be identified as a fraud call according to the number of calls, for example, if the average daily call volume of the calling party exceeds a preset threshold (for example, 90) or the average monthly call volume exceeds a threshold (for example, 500), it can be determined that the current call is a fraud call.

[0103] In optional embodiments, after sending a warning reminder message to the called party and its family circle friends, the application embodiments can also obtain the response results of the called party and its family circle friends to the warning reminder message, such as whether they have been cheated. Then, the relevant information of the identified successful fraud calls and the reminded called parties and their second associated range objects is counted as historical data to adjust the parameters of the first identification model and the second identification model, so as to iteratively optimize the first identification model and the second identification model, and maximize the fraud prevention and reminder effect. For example, the application embodiments can obtain relevant report information, complaint information or report information from a fraud reporting center (such as a national anti-fraud center or a public security system), match the report information, complaint information or report information with the calling parties and called parties identified as fraud calls in the present application, and determine whether the called parties have been cheated. If it is determined that the called parties have been cheated, the information of the cheated called parties and the calling parties is input into the model as sample data for iterative optimization. The application embodiments can also synchronize the information of the calling parties and called parties identified as fraud calls to the fraud reporting center (such as the national anti-fraud center, the public security system, etc.).

[0104] Figure 7 Fig. 7 is a schematic diagram showing main modules of a fraud warning device 700 according to an embodiment of the present application. Figure 7 As shown in the figure, the fraud warning device 700 comprises:

[0105] A first determining module 701 configured to determine a first associated range object of a called party of a current call in a case where it is determined that the current call is a fraud call.

[0106] A second determining module 702 configured to determine a second associated range object of the called party from the first associated range object according to social interaction data of the called party and social interaction data of the first associated range object.

[0107] A warning module 703 configured to send a warning reminder message to the called party and the second associated range object of the called party.

[0108] The fraud warning device according to the embodiment of the present application can identify the second associated range object of the called party in real time in a case where it is determined that the current call is a fraud call, and the second associated range object can be the family, relatives and close friends of the called party, so that the warning reminder message is sent to the called party and the second associated range object of the called party, so that the second associated range object of the called party can be timely warned against fraud, and the weak anti-fraud awareness population can be effectively protected, the risk of being cheated can be reduced, the anti-fraud reminding effect can be maximized, and the fraud call discrimination ability of the called party and the second associated range object of the called party can be improved.

[0109] In an optional embodiment, the second determining module is further configured to determine a social interaction feature between the called party and the first associated range object according to the social interaction data of the called party and the social interaction data of the first associated range object, and determine whether the first associated range object belongs to the second associated range object of the called party according to the social interaction feature and a pre-constructed first identification model.

[0110] In an optional embodiment, the second determining module is further configured to: acquire fraud prevention portrait data of the first associated range object of the called party; determine a fraud prevention portrait feature of the first associated range object of the called party according to the fraud prevention portrait data; determine whether the first associated range object belongs to the second associated range object of the called party and determine a fraud prevention ability level of the first associated range object of the called party according to the social interaction feature, the fraud prevention portrait feature and a pre-constructed first identification model; the early warning module is further configured to: determine a fraud prevention ability level of the second associated range object of the called party; sort the second associated range objects of the called party in a descending order of the fraud prevention ability level; determine N second associated range objects with higher fraud prevention ability according to the sorting; wherein N is an integer greater than or equal to 1; and send an early warning reminder message to the called party and the N second associated range objects with higher fraud prevention ability.

[0111] In an optional embodiment, the second determining module is further configured to: determine whether the first associated range object is the second associated range object of the called party according to a pre-set first judgment rule and social interaction data between the called party and the first associated range object.

[0112] In an optional embodiment, the first determining module is further configured to: acquire social interaction data of the called party, the social interaction data including one or more of the following: call records, short message records, address books and friend data of multimedia social applications; and determine the first associated range object of the called party according to the social interaction data of the called party.

[0113] In an optional embodiment, the device further comprises a fraud identification module configured to: acquire user portrait data of a calling party of a current call; and identify in real time whether the current call is a fraud call according to the user portrait data of the calling party.

[0114] In an optional embodiment, the fraud identification module is further configured to: determine a user portrait feature of the calling party according to the user portrait data of the calling party; and identify in real time whether the current call is a fraud call according to the user portrait feature of the calling party and a pre-constructed second identification model.

[0115] In an optional embodiment, the fraud identification module is further configured to: identify in real time whether the current call is a fraud call according to a pre-set second judgment rule and the user portrait data of the calling party.

[0116] The device described above can execute the method provided in the embodiments of the present application, and has the corresponding function modules and beneficial effects of executing the method. Technical details not described in the embodiments can be found in the method provided in the embodiments of the present application.

[0117] Figure 8 An exemplary system architecture 800 to which the fraud alerting method or fraud alerting apparatus of embodiments of the present application can be applied is shown.

[0118] As shown in Figure 8 , the system architecture 800 can include terminal devices 801, 802, 803, a network 804 and a server 805. The network 804 is a medium to provide communication links between the terminal devices 801, 802, 803 and the server 805. The network 804 can include various connection types, such as wired, wireless communication links or fiber optic cables, etc.

[0119] The users can use the terminal devices 801, 802, 803 to interact with the server 805 through the network 804 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 801, 802, 803, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0120] The terminal devices 801, 802, 803 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0121] The server 805 can be a server providing various services, such as a background management server providing support for shopping websites browsed by users using the terminal devices 801, 802, 803. The background management server can analyze and process received product information query requests and other data, and feed back the processing results (such as target push information, product information) to the terminal devices.

[0122] It should be noted that the fraud alerting method provided by embodiments of the present application is generally executed by the server 805, and accordingly, the fraud alerting apparatus is generally provided in the server 805.

[0123] It should be understood that the number of terminal devices, networks and servers in Figure 8 is merely illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0124] Reference is made to Figure 9 , which shows a structural schematic diagram of a computer system 900 of a terminal device suitable for implementing embodiments of the present application. Figure 9 The terminal device shown is merely an example and should not bring any limitation to the functions and use range of embodiments of the present application.

[0125] As shown in Figure 9As shown, the computer system 900 includes a central processing unit (CPU) 901 which can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 902 or loaded into a random access memory (RAM) 903 from a storage section 908. In the RAM 903, various programs and data required for the operation of the system 900 are also stored. The CPU 901, the ROM 902, and the RAM 903 are connected to each other through a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0126] Connected to the I / O interface 905 are an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a display device such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as necessary. A removable recording medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 910 as necessary, so that a computer program read therefrom is installed into the storage section 908 as necessary.

[0127] In particular, the processes described above with reference to the flow charts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flow charts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable recording medium 911. When the computer program is executed by the central processing unit (CPU) 901, the above-described functions defined in the system of the present disclosure are performed.

[0128] It should be noted that the computer-readable medium shown in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or component. In the present application, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or component. The program code contained on the computer-readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0129] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code containing one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order than that shown in the drawings. For example, two blocks that are shown in succession can actually be executed substantially in parallel, and sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams or flowcharts, and the combination of blocks in the block diagrams or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0130] The modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. The described modules can also be arranged in a processor, for example, a processor can be described as including a sending module, an obtaining module, a determining module and a first processing module. In some cases, the names of these modules do not constitute a limitation on the units themselves, for example, the sending module can also be described as "a module that sends a picture obtaining request to a connected server".

[0131] As another aspect, the present application also provides a computer readable medium, which can be included in the device described in the above embodiments, or can exist independently without being assembled into the device. The computer readable medium carries one or more programs, which, when executed by the device, cause the device to:

[0132] In a case where it is determined that the current call is a fraud call, determining a first association range object of a called party of the current call;

[0133] According to the social interaction data of the called party and the social interaction data of the first association range object, determining a second association range object of the called party from the first association range object;

[0134] Sending a warning reminder message to the called party and the second association range object of the called party.

[0135] The technical solution of the embodiments of the present application can identify the second association range object of the called party in real time in a case where it is determined that the current call is a fraud call. The second association range object can be the family, relatives and close friends of the called party, so that a warning reminder message can be sent to the called party and the second association range object of the called party, so that the second association range object of the called party can be timely warned against fraud, which can effectively protect the weak anti-fraud awareness group, reduce the risk of being cheated, maximize the anti-fraud reminding effect, and improve the fraud call discrimination ability of the called party and the second association range object of the called party.

[0136] The above specific embodiments do not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made depending on design requirements and other factors. Any modification, equivalent replacement and improvement made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A fraud alert method, characterized by, The method comprises the following steps: In a case where it is determined that the current call is a fraud call, determining a first associated range object of a called party of the current call; According to social interaction data of the called party and social interaction data of the first associated range object, determining a second associated range object of the called party from the first associated range object; Sending a pre-warning reminder message to the called party and the second associated range object of the called party; The method further comprises the following steps: According to the social interaction data of the called party and the social interaction data of the first associated range object, determining a social interaction feature between the called party and the first associated range object; According to the social interaction feature and a pre-constructed first identification model, determining whether the first associated range object belongs to the second associated range object of the called party; The method further comprises the following steps: According to the social interaction feature, the anti-fraud portrait feature and the pre-constructed first identification model, determining whether the first associated range object belongs to the second associated range object of the called party and determining an anti-fraud ability level of the first associated range object of the called party; The method further comprises the following steps: Determining an anti-fraud ability level of the second associated range object of the called party; According to the anti-fraud ability level from high to low, sorting the second associated range object of the called party; According to the sorting, determining N second associated range objects with high anti-fraud ability levels; wherein the N is an integer greater than or equal to 1; Sending a pre-warning reminder message to the called party and the N second associated range objects with high anti-fraud ability levels. The social interaction feature between the called party and the first associated range object comprises one or more of the following: call frequency, busy time base station coincidence degree, idle time base station coincidence degree, whether the same family package, main and secondary card relationship, call circle coincidence degree, longest residence time base station, idle time residence base station, average call number per unit time, average call duration per unit time, call number in a first preset time period and call duration in the first preset time period; 2. The method of claim 1, wherein, The anti-fraud portrait feature comprises one or more of the following: occupation feature, education, age, number of received fraud information, number of times of being defrauded, anti-fraud software installation and use, anti-fraud propaganda video and / or anti-fraud propaganda live broadcast watching, number of times of reporting bad information and number of times of receiving fraud calls. The first identification model comprises a first attention component, an association relationship identification component, a second attention component and an anti-fraud ability level determination component.

3. The method of claim 2, wherein, ​ The first attention component is configured to determine a first score of the first associated range object according to the social interaction feature. The association relationship identification component is configured to determine whether the first associated range object belongs to a second associated range object of the called party according to the social interaction feature, the fraud prevention portrait feature, and the first score determined by the first attention component. The second attention component is configured to determine a second score of the first associated range object according to the fraud prevention portrait feature. The fraud prevention ability level determination component is configured to determine a fraud prevention ability level of the first associated range object according to the social interaction feature, the fraud prevention portrait feature, and the second score determined by the second attention component.

4. The method of claim 1, wherein, The second associated range object of the called party is determined from the first associated range object according to social interaction data of the called party and social interaction data of the first associated range object, including: According to a preset first judgment rule and social interaction data between the called party and the first associated range object, it is judged whether the first associated range object is a second associated range object of the called party.

5. The method according to any one of claims 1 to 4, characterized in that, Determining the first associated range object of the called party of the current call includes: Obtaining social interaction data of the called party, the social interaction data including one or more of the following: call records, short message records, address books, and friend data of multimedia social applications; According to the social interaction data of the called party, the first associated range object of the called party is determined.

6. The method of claim 5, wherein, The method further includes: Obtaining user portrait data of the calling party of the current call; According to the user portrait data of the calling party, it is determined in real time whether the current call belongs to a fraudulent call.

7. The method of claim 6, wherein, According to the user portrait data of the calling party, it is determined in real time whether the current call belongs to a fraudulent call, including: According to the user portrait data of the calling party, a user portrait feature of the calling party is determined; According to the user portrait feature of the calling party and a pre-constructed second identification model, it is determined in real time whether the current call belongs to a fraudulent call.

8. The method of claim 7, wherein, The user portrait feature of the calling party includes one or more of the following: call times, call hang-up times, call failure times, call times, call report times, different called numbers, different calling numbers, different called area numbers, call duration times within a second preset time period, average call duration within a unit time, call duration standard deviation, call hang-up ratio, and blacklist identifier.

9. The method of claim 6, wherein, According to the user portrait data of the calling party, it is determined in real time whether the current call belongs to a fraudulent call, including: According to a preset second judgment rule and the user portrait data of the calling party, it is determined in real time whether the current call belongs to a fraudulent call.

10. The method of claim 1, wherein, The first associated range object includes social circle members of the called party, and the second associated range object includes family circle members of the called party.

11. A fraud prevention and early warning device, characterized in that, including: The first determination module is configured to determine a first associated range object of the called party of the current call when it is determined that the current call is a fraudulent call. determine, from the first association range object, a second association range object of the called party according to social interaction data of the called party and social interaction data of the first association range object; send a pre-warning reminding message to the called party and the second association range object of the called party; the second determination module is further configured to determine a social interaction feature between the called party and the first association range object according to the social interaction data of the called party and the social interaction data of the first association range object; determine whether the first association range object belongs to the second association range object of the called party according to the social interaction feature and a pre-constructed first identification model; the second determination module is further configured to obtain anti-fraud portrait data of the first association range object of the called party, and determine an anti-fraud portrait feature of the first association range object of the called party according to the anti-fraud portrait data; determine whether the first association range object belongs to the second association range object of the called party and determine an anti-fraud ability level of the first association range object of the called party according to the social interaction feature, the anti-fraud portrait feature and the pre-constructed first identification model; the pre-warning module is further configured to determine anti-fraud ability levels of the second association range objects of the called party, sort the second association range objects of the called party in a descending order of the anti-fraud ability levels, determine N second association range objects with high anti-fraud ability levels according to the sorting, and send a pre-warning reminding message to the called party and the N second association range objects with high anti-fraud ability levels, where N is an integer greater than or equal to 1.

12. An electronic device, comprising: comprise: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method in any one of claims 1-10.

13. A computer readable medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method in any one of claims 1-10.

Images