A method and system for identifying telecom fraud based on pseudo labels and a storage medium

Abstract

This invention discloses a method, system, and storage medium for identifying telecommunications fraud based on pseudo-labels. Based on extracted sample features of suspected fraudulent numbers, the invention divides positive sample clusters through clustering, assigns reliable positive sample labels to these samples, and calculates the distances of unlabeled sample features from each cluster, thus labeling them with corresponding pseudo-labels. Anomaly detection is performed on the sample features of unlabeled numbers, and anomalous sample features are marked as potential anomalies. This process assigns more credible pseudo-labels to sample features while expanding the positive sample and balancing the ratio of positive to negative samples. Finally, the pseudo-labeled sample features and calculated sample weights are used as model input to build a binary classification model for fraudulent number identification, which more accurately and efficiently detects potential fraudulent numbers and can be widely applied in the field of telecommunications data processing technology.

Description

Technical Field

[0001] This invention relates to the field of telecommunications data processing technology, and in particular to a method, system, and storage medium for identifying telecommunications fraud based on fake tags. Background Technology

[0002] With the continuous development of science and technology, communication and information technology have become increasingly advanced, enabling convenient communication even in remote mountainous areas. However, at the same time, the techniques used in telecommunications fraud are also constantly evolving and improving. To better identify fraudulent numbers and increase the cost of fraud for scammers, thereby reducing the number of victims, more and more manufacturers are beginning to apply machine learning technology to telecommunications fraud prevention.

[0003] Modern fraud gangs open, collect, buy, and hoard SIM cards in large quantities, either developing or purchasing specialized tools to carry out their scams. While current mainstream methods for detecting telecom fraud still rely primarily on user-generated tagging, police or telecom operators marking identified fraudulent numbers or devices, or manufacturers having experienced experts analyze numbers to develop rules for detecting fraudulent numbers, fraudsters are becoming increasingly sophisticated. They analyze which behaviors easily fool experts analyzing historical number characteristics, thus circumventing some simple expert rule models. Therefore, it is necessary to utilize machine learning technology to analyze the more complex commonalities and characteristics of fraudsters, and more accurately identify fraudulent numbers.

[0004] While the police have accumulated a growing number of fraudulent phone numbers, fraudsters are constantly evolving their techniques. Therefore, analyzing older, potentially fraudulent numbers often proves outdated and doesn't reflect the behavioral patterns of current fraudsters, making timely detection difficult. Analyzing recent fraudulent numbers is often more effective. However, recent fraudulent numbers are generally fewer in number. In today's big data environment, a smaller sample size means fewer features that machine learning algorithms can learn, hindering the integration of machine learning technologies. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide an efficient and accurate method, system, and storage medium for identifying telecommunications fraud based on fake tags.

[0006] On one hand, embodiments of the present invention provide a method for identifying telecommunications fraud based on fake tags, including:

[0007] Obtain sample numbers and extract sample features from the sample numbers based on time granularity; wherein, the sample features include positive samples, negative samples, and unlabeled samples;

[0008] Anomaly detection and clustering are performed on the sample features to determine the total anomaly score for each unlabeled sample.

[0009] Based on the total anomaly detection score, pseudo-labeled samples are filtered from the unlabeled samples, and the sample weights of the pseudo-labeled samples are calculated; wherein, the pseudo-labeled samples include potential positive samples and reliable negative samples;

[0010] Based on the pseudo-labeled samples and the sample weights, the anomaly probability of the unlabeled samples after screening is determined by a supervised learning classification model, and the pseudo-labeled samples are supplemented and updated according to the anomaly probability.

[0011] The sample features of the filtered pseudo-labeled samples are iteratively processed to determine the target pseudo-labeled sample and the target sample weight;

[0012] Based on the target pseudo-label samples and the target sample weights, a supervised binary classification model is constructed. The supervised binary classification model is then optimized, and the optimized supervised binary classification model is used to identify fraudulent numbers.

[0013] Optionally, the step of performing anomaly detection and clustering processing on the sample features to determine the total anomaly discrimination score for each of the unlabeled samples includes:

[0014] Anomaly detection processing is performed on the unlabeled samples to obtain the anomaly degree of each unlabeled sample;

[0015] Clustering is performed on the positive samples and the negative samples respectively, and anomaly similarity scores are calculated for each of the unlabeled samples based on the results of the clustering.

[0016] Based on the anomaly degree and the anomaly similarity score, the total anomaly discrimination score for each of the unlabeled samples is determined.

[0017] Optionally, the anomaly detection processing of the unlabeled samples to obtain the anomaly degree of each unlabeled sample includes:

[0018] The KPCA anomaly detection algorithm based on reconstruction error calculates the reconstruction error of each unlabeled sample by training an unsupervised anomaly detection model using unlabeled samples.

[0019] Based on the reconstruction error, the anomaly degree of each unlabeled sample is calculated using the anomaly degree formula;

[0020] The anomaly calculation formula is as follows:

[0021]

[0022] In the formula, x iLet x′ represent the i-th unlabeled sample. i Let (x) represent the i-th reconstructed unlabeled sample. i -x′ i ) 2 This represents the reconstruction error of the i-th sample. IS(x) represents the maximum reconstruction error among all unlabeled samples. i ) represents the anomaly degree of the i-th sample.

[0023] Optionally, the step of filtering pseudo-labeled samples from the unlabeled samples based on the total anomaly detection score and calculating the sample weights of the pseudo-labeled samples includes:

[0024] Based on the total anomaly detection score, a pseudo-label threshold is set; wherein, the pseudo-label threshold includes a first threshold and a second threshold;

[0025] Unlabeled samples whose total anomaly detection score is greater than the first threshold are selected as potential positive samples;

[0026] Unlabeled samples whose total anomaly detection score is less than the second threshold are selected as reliable positive samples;

[0027] Based on the total anomaly detection score, the sample weight of the pseudo-labeled sample is calculated.

[0028] Optionally, setting a pseudo-label threshold based on the total anomaly score includes:

[0029] Based on the total anomaly detection score, a pseudo-label threshold is set using the pseudo-label threshold setting formula.

[0030] The formula for setting the pseudo-label threshold is as follows:

[0031]

[0032]

[0033] In the formula, α represents the first threshold, β represents the second threshold, n represents the total number of unlabeled samples, and TS(x) i ) represents the total anomaly detection score of the i-th unlabeled sample, and quantile represents the quantile of the total anomaly detection score of the unlabeled sample.

[0034] Optionally, calculating the sample weights of the pseudo-labeled samples based on the total anomaly detection score includes:

[0035] Based on the total anomaly detection score, the sample weight of the pseudo-label sample is calculated using the sample weight formula;

[0036] The sample weight formula is as follows:

[0037]

[0038] In the formula, potential anomaly represents a potential anomalous sample, reliable normal represents a reliable normal sample, observed sample represents a labeled positive or negative sample, w(x) represents the sample weight, σ represents the hyperparameter for adjusting the sample weight of pseudo-labels, and τ represents the cluster weight of positive and negative samples.

[0039] Optionally, the step of determining the anomaly probability of each of the unlabeled samples using a supervised learning classification model based on the pseudo-labeled samples and the sample weights, and supplementing and updating the pseudo-labeled samples according to the anomaly probabilities, includes:

[0040] Construct a supervised learning classification model, and train the supervised learning classification model based on the pseudo-label samples and the sample weights;

[0041] The abnormal probability of the remaining unlabeled samples after filtering out the pseudo-labeled samples is predicted by the trained supervised learning classification model.

[0042] The potential positive samples are supplemented and updated by filtering out unlabeled samples whose anomaly probability is greater than a first preset probability;

[0043] The reliable positive samples are supplemented and updated by selecting unlabeled samples whose anomaly probability is less than the second preset probability.

[0044] Optionally, the iterative processing of the sample features of the filtered pseudo-labeled samples to determine the target pseudo-labeled sample and the target sample weight includes:

[0045] The sample features of the filtered pseudo-labeled samples are iteratively processed to determine the average total anomaly discrimination score of each of the unlabeled samples;

[0046] Based on the average of the total score for anomaly detection, the target pseudo-label sample and the target sample weight are determined.

[0047] On the other hand, embodiments of the present invention provide a system for identifying telecommunications fraud based on fake tags, comprising:

[0048] The first module is used to obtain sample numbers and extract sample features of the sample numbers based on time granularity; wherein, the sample features include positive samples, negative samples and unlabeled samples;

[0049] The second module is used to perform anomaly detection and clustering on the sample features to determine the total anomaly discrimination score for each of the unlabeled samples.

[0050] The third module is used to filter pseudo-labeled samples from the unlabeled samples based on the total anomaly discrimination score, and to calculate the sample weight of the pseudo-labeled samples; wherein, the pseudo-labeled samples include potential positive samples and reliable negative samples;

[0051] The fourth module is used to determine the anomaly probability of the filtered unlabeled samples based on the pseudo-labeled samples and the sample weights through a supervised learning classification model, and to supplement and update the pseudo-labeled samples according to the anomaly probability.

[0052] The fifth module is used to iteratively process the sample features of the filtered pseudo-labeled samples to determine the target pseudo-labeled sample and the target sample weight.

[0053] The sixth module is used to construct a supervised binary classification model based on the target pseudo-label sample and the target sample weight, optimize the supervised binary classification model, and use the optimized supervised binary classification model to identify fraudulent numbers.

[0054] On the other hand, embodiments of the present invention provide an electronic device, including a processor and a memory;

[0055] The memory is used to store programs;

[0056] The processor executes the program to implement the method described above.

[0057] On the other hand, embodiments of the present invention provide a computer-readable storage medium storing a program that is executed by a processor to implement the methods described above.

[0058] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0059] The embodiments of the present invention first obtain sample numbers and extract sample features of the sample numbers based on time granularity; wherein, the sample features include positive samples, negative samples, and unlabeled samples; anomaly detection processing and clustering processing are performed on the sample features to determine the total anomaly discrimination score of each of the unlabeled samples; based on the total anomaly discrimination score, pseudo-labeled samples are screened from the unlabeled samples, and the sample weights of the pseudo-labeled samples are calculated; wherein, the pseudo-labeled samples include potential positive samples and reliable negative samples; based on the pseudo-labeled samples and the sample weights, the anomaly probability of the screened unlabeled samples is determined by a supervised learning classification model, and the pseudo-labeled samples are updated according to the anomaly probability; the sample features of the screened pseudo-labeled samples are iteratively processed to determine the target pseudo-labeled samples and target sample weights; based on the target pseudo-labeled samples and the target sample weights, a supervised binary classification model is constructed, the supervised binary classification model is optimized, and the optimized supervised binary classification model is used to identify fraudulent numbers. This invention, under the premise of knowing a small number of fraudulent numbers and having unclear fraudulent samples, combines clustering algorithms and anomaly detection algorithms, utilizes the idea of ​​pseudo-labels, and combines the purpose of machine learning to combat fraud, to assign pseudo-labels and relevant sample weights to the features of a large number of unlabeled samples, and applies them to the algorithm model to improve the model accuracy and identify fraudulent numbers more efficiently and accurately. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a flowchart illustrating the steps of a method for identifying telecommunications fraud based on fake tags, provided in an embodiment of the present invention.

[0062] Figure 2 This is a schematic diagram of the semi-supervised model for pseudo-label marking provided in an embodiment of the present invention;

[0063] Figure 3 A schematic diagram illustrating some sample features provided in an embodiment of the present invention;

[0064] Figure 4 This is a schematic diagram illustrating the principle of feature clustering provided in an embodiment of the present invention. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0066] First, it should be noted that existing telecommunications anti-fraud technologies include:

[0067] 1. Traditional anti-fraud methods for telecommunications mainly involve user, operator, and police labeling, and then using the relevant information of the labeled numbers to detect fraudulent numbers, or having experts analyze the general characteristics of these numbers and then develop simple expert rule models to detect fraudulent numbers.

[0068] 2. The paper "A Machine Learning-Based Method for Telecommunications Anti-Fraud" describes a common basic process of machine learning modeling and applies it to telecommunications anti-fraud. The basic process includes: extracting certain information data from the B and O domains of the phone number; constructing a series of features; extracting and calculating the features; cleaning the feature data; using the SMOTE algorithm to handle cases with few positive samples; training the LightGBM algorithm model; and optimizing parameters using cross-validation and grid search.

[0069] 3. The paper "Anomaly Detection with Partially Observed Anomalies" proposes a two-step semi-supervised learning algorithm based on pseudo-labels, dividing semi-supervised learning into unsupervised and supervised learning stages. The method mainly consists of: First, clustering the labeled anomaly samples to obtain clusters, then calculating the Euclidean distance from other unlabeled samples to these clusters to obtain similarity, while simultaneously performing anomaly detection on the unlabeled samples, calculating the anomaly degree between each unlabeled sample, and applying a certain threshold to both the similarity and anomaly degree. Samples meeting the threshold are labeled with a specified label, and the weighted sum of the anomaly degree and similarity is used as the sample weight. Second, inputting the labeled sample labels, sample weights, and sample features from the first step into the supervised algorithm model, training the model, and tuning its parameters.

[0070] However, existing technologies have the following problems:

[0071] 1. Expert rule models require experts with extensive anti-fraud experience to analyze numerous phone numbers. While these models are generally accurate, they are also relatively simple, making them vulnerable to fraud analysis that can uncover their core patterns and allow fraudsters to circumvent them. This renders the expert rule models outdated and unable to identify fraudulent phone numbers. Furthermore, expert rule models often require extensive analysis by experts, resulting in significant analysis costs.

[0072] 2. Using the SMOTE algorithm to construct positive samples is not very practical when samples have many class features. SMOTE constructs samples by taking the linear median value of each feature between two samples, but class features cannot be calculated. More importantly, the SMOTE algorithm cannot overcome the data distribution problem of imbalanced datasets, which easily leads to the problem of marginalization. When most positive samples are at the edge of the sample distribution, using the SMOTE algorithm to construct positive samples will blur the sample edges, making it more difficult to distinguish between positive and negative samples. Although constructing positive samples improves the sample distribution problem, it also increases the difficulty of classification for machine learning, and the accuracy will decrease to some extent.

[0073] 3. Most existing machine learning models are based on a set of relatively clearly labeled positive and negative samples. However, in telecommunications anti-fraud services, to improve the timeliness of the model, numbers are often identified frequently. In actual industry, our models will encounter the same number multiple times, and the characteristics of the number are inconsistent. To ensure good model recognition, the training samples and validation samples are often required to have a similar distribution. Therefore, in the training samples, the same number will also have multiple sample features. However, these sample features are not all fraudulent samples (some fraudulent numbers also have normal calling behavior). Therefore, in telecommunications anti-fraud services, positive samples are not very clearly defined, and directly labeling them often leads to a high false positive rate.

[0074] In view of this, and addressing the problems existing in the prior art, this invention aims to, under the premise of knowing a small number of fraudulent phone numbers and having unclear fraudulent samples, combine clustering algorithms and anomaly detection algorithms, utilize the idea of ​​pseudo-labeling, and combine with the purpose of machine learning for anti-fraud, to assign pseudo-labels and relevant sample weights to the features of a large number of unlabeled samples, and apply them to the algorithm model to improve the model's accuracy and identify fraudulent phone numbers more efficiently and accurately. On one hand, embodiments of this invention provide a method for telecommunications anti-fraud identification based on pseudo-labels, such as... Figure 1 As shown, the method includes the following steps:

[0075] S100. Obtain the sample number and extract the sample features of the sample number based on the time granularity;

[0076] Specifically, fraudulent numbers, whitelisted numbers, and general numbers are obtained. Fraudulent numbers are recorded as positive sample numbers, whitelisted numbers as negative sample numbers, and general numbers as unlabeled numbers. The signaling data in the O domain and the personal data of user registration in the B domain are extracted. The sample features of the numbers at different times are calculated according to the time granularity, and derived features are constructed.

[0077] The statistical characteristics extracted from the numbers include 124 statistical characteristics and 32 categorical characteristics, such as the number of calls made in the first half hour, the number of calls made in the last 24 hours, the average call intensity, the number of hours the number makes calls, the dispersion of calls made to other numbers, the dispersion of call segments, the city of origin, the province of origin, the percentage of outgoing calls made in the last 24 hours, the connection rate, and the average call duration. The data types of some of the number characteristics are shown in Table 1.

[0078] Table 1

[0079]

[0080] In industrial applications, to ensure the timeliness of models, a fraudulent number identification model may perform multiple identifications on the same day, each time targeting a large batch of numbers rather than tracking and identifying a single number. Therefore, considering resource consumption in practical applications, the extraction and calculation of number features are based on features within a specific time granularity. The process of calculating number features based on time granularity in this paper is as follows:

[0081] 1) Extract the outgoing and incoming call signaling of the number for the past week.

[0082] 2) Divide the outgoing and incoming call signaling of the number into time ranges, namely: signaling of the first half hour, signaling of the last 24 hours, signaling of yesterday, signaling of the day before yesterday, signaling of the day before yesterday, signaling of the day before yesterday, signaling of the last three days, and signaling of the last ten days, for a total of 7 time periods.

[0083] 3) Calculate the statistical characteristics of each time period (e.g., number of calling signals, number of called numbers, etc.).

[0084] 4) The different features extracted from the 7 time periods are concatenated to form the current sample features of the number.

[0085] The sample features calculated by time granularity for each number are divided into positive samples, negative samples, and unlabeled samples according to the label of the number itself.

[0086] It should be noted that in some embodiments, the sample features are also preprocessed, including imputation, deletion and modification of missing values ​​and outliers, and the statistical features are standardized, and the category features are digitized and standardized in a targeted manner.

[0087] Furthermore, referring to Figure 2 Based on these labeled numbers and number sample features, a semi-supervised learning model is established to filter labeled sample features, label unlabeled sample features, and calculate sample weights for these sample features, corresponding to the following steps S200 to S500:

[0088] S200. Perform anomaly detection and clustering on the sample features to determine the total anomaly score for each unlabeled sample.

[0089] It should be noted that anomaly detection processing is performed on unlabeled samples to obtain the anomaly degree of each unlabeled sample; cluster processing is performed on positive samples and negative samples respectively, and the anomaly similarity score of each unlabeled sample is calculated based on the results of the cluster processing; the total anomaly discrimination score of each unlabeled sample is determined according to the anomaly degree and the anomaly similarity score.

[0090] Specifically, an unsupervised anomaly detection model is trained using the KPCA anomaly detection algorithm based on reconstruction error and unlabeled samples. The model is then used to calculate the reconstruction error of each unlabeled sample feature to determine the anomaly score for each feature. For example, the anomaly score for unlabeled samples can be calculated using the following formula:

[0091]

[0092] Where, x i Let x′ represent the i-th unlabeled sample. i Let (x) represent the i-th reconstructed unlabeled sample. i -x i ′) 2 This represents the reconstruction error of the i-th sample. IS(x) represents the maximum reconstruction error among all unlabeled samples. i ) represents the anomaly degree of the i-th sample.

[0093] Using the density-based DBSCAN algorithm and positive and negative samples respectively, positive sample clustering and negative sample clustering models are established, and the cluster center (or centroid) of each cluster is calculated. Clusters with more sample features or more positive sample numbers in the positive sample clusters are marked as reliable positive sample clusters, and the remaining clusters are discarded. Similarly, clusters with more sample features or more positive sample numbers in the negative sample clusters are marked as reliable negative sample clusters, and the remaining clusters are discarded. Positive and negative sample clusters are merged, and the Euclidean distance between the cluster centers of each cluster is calculated. For cluster centers of multiple closely spaced samples from different categories, a weight τ is assigned to the cluster center based on the proportion of sample features contained within its cluster. The weight of the remaining cluster centers is τ = 1.

[0094] Calculate the distance from each unlabeled sample to these cluster centers to obtain the similarity score for each unlabeled sample. For example, the abnormal similarity score for unlabeled samples can be calculated using the following formula:

[0095]

[0096]

[0097] Where, μ j Let λ be the j-th cluster center in the negative sample clustering. k AS(x) is the k-th cluster center in the positive sample clustering. i ) represents the positive class similarity of the i-th unlabeled sample, NS(x) i ) represents the negative class similarity of the i-th unlabeled sample, ε is the threshold, and SS(x) i ) represents the abnormal similarity score of the i-th unlabeled sample, and τ represents the weight of the cluster centroid.

[0098] To identify potential positive samples and reliable negative samples from unlabeled samples, the total anomaly discrimination score of the samples will be calculated using the following formula, which combines the sample anomaly score and the sample anomaly similarity score:

[0099] TS(x i )=θ*SS(x i )+(1-θ)*IS(x i )

[0100] Wherein TS(x) i ) represents the total anomaly discrimination score of the i-th unlabeled sample, and θ is a hyperparameter used to adjust the weights of sample anomaly degree and sample anomaly similarity score.

[0101] S300. Based on the total score of anomaly detection, filter out pseudo-labeled samples from the unlabeled samples and calculate the sample weight of the pseudo-labeled samples.

[0102] It should be noted that pseudo-labeled samples include potential positive samples and reliable negative samples. Specifically, a pseudo-label threshold is set based on the total anomaly detection score; the pseudo-label threshold includes a first threshold and a second threshold; unlabeled samples with anomaly detection scores greater than the first threshold are selected as potential positive samples; unlabeled samples with anomaly detection scores less than the second threshold are selected as reliable positive samples; and the sample weight of the pseudo-labeled samples is calculated based on the total anomaly detection score.

[0103] Specifically, based on the calculated total anomaly detection score, two more thresholds, α and β, can be set, where TS(x) i Unlabeled samples with TS(x) > α are considered potential positive samples, and unlabeled samples with TS(x) < β are considered reliable negative samples. Samples meeting these conditions are assigned corresponding labels and denoted as pseudo-labeled samples. The settings for α and β can be referenced as follows:

[0104]

[0105]

[0106] In the formula, α represents the first threshold, β represents the second threshold, n represents the total number of unlabeled samples, and TS(x)i ) represents the total anomaly discrimination score of the $i$-th unlabeled sample, and quantile represents the quantile of the total anomaly discrimination score of the unlabeled samples.

[0107] Calculate the sample weights for the positive and negative samples and the pseudo-labeled samples according to the calculated total anomaly discrimination scores. For example, the sample weights can be calculated according to the following formula:

[0108]

[0109] In the formula, potential anomaly represents potential abnormal samples, reliable normal represents reliable normal samples, observed sample represents the positive and negative samples with labels (i.e., samples with known classifications), $w(x)$ represents the sample weight, $\sigma$ represents the hyperparameter for adjusting the sample weight of the pseudo-labeled samples, and $\tau$ represents the weight of the positive and negative sample clusters.

[0110] S400. Based on the pseudo-labeled samples and the sample weights, determine the anomaly probabilities of the screened unlabeled samples through a supervised learning classification model, and supplement and update the pseudo-labeled samples according to the anomaly probabilities;

[0111] It should be noted that a supervised learning classification model is constructed, and the supervised learning classification model is trained according to the pseudo-labeled samples and the sample weights; the anomaly probabilities of the unlabeled samples remaining after screening the pseudo-labeled samples are predicted through the trained supervised learning classification model; the unlabeled samples with anomaly probabilities greater than the first preset probability are screened to supplement and update the potential positive samples; the unlabeled samples with anomaly probabilities less than the second preset probability are screened to supplement and update the reliable positive samples.

[0112] Specifically, a supervised learning classification model is established, and the established supervised learning model is trained using the positive and negative samples, the pseudo-labeled samples obtained in step S300, and the sample weights, and all unlabeled samples (excluding pseudo-labeled samples) are used as prediction samples for prediction to obtain the anomaly probability $p$ of each unlabeled sample.

[0113] Set $p1$ and $p2$, and the samples with anomaly probabilities satisfying $p > p1$ and $p < p2$ are respectively combined with the positive and negative samples as potential positive samples and reliable negative samples.

[0114] S500. Perform iterative processing on the sample features of the screened pseudo-labeled samples to determine the target pseudo-labeled samples and the target sample weights;

[0115] It should be noted that iterative processing is performed on the sample features of the screened pseudo-labeled samples to determine the average value of the total anomaly discrimination scores of each unlabeled sample; according to the average value of the total anomaly discrimination scores, the target pseudo-labeled samples and the target sample weights are determined.

[0116] Specifically, the samples labeled with pseudo-labels in step S400 are iterated multiple times through steps S200 to S300. The anomaly discrimination total score TS(x) of the unlabeled samples obtained from the multiple iterations is then calculated. i The average is then performed, and step S300 is executed again to obtain the final potential positive samples and reliable negative samples and their sample weights.

[0117] S600. Based on the target pseudo-label samples and target sample weights, construct a supervised binary classification model, optimize the supervised binary classification model, and use the optimized supervised binary classification model to identify fraudulent numbers.

[0118] Specifically, based on the pseudo-labels and sample weights of the sample features calculated earlier, these are used as inputs to construct a supervised binary classification model and train a baseline model. The structure of this binary classification model is different from the supervised model mentioned above.

[0119] Based on the hyperparameters of the model, a Bayesian parameter optimization model is established, the model parameters are adjusted, the parameters of the optimal model are calculated, and the optimal parameters are used as the model parameters to train the optimal model.

[0120] Extract sample features from new phone numbers, preprocess them, and then input them into the optimal model. Numbers with a predicted fraud probability greater than a threshold are output as suspected fraud numbers.

[0121] The implementation principle of the present invention based on pseudo-tag anti-fraud identification is described in detail below with reference to specific embodiments. This description is only for explanation of the present invention and should not be regarded as a limitation of the present invention:

[0122] (1) Obtain numbers suspected of being involved in fraud, general numbers, whitelisted numbers, and numbers that have been shut down by the signaling anti-fraud system for a long time without being restored. Extract the relevant B and O domain data, preprocess the data, and extract the constructed derived features to obtain sample data. Examples of sample features are as follows: Figure 3 As shown (only some features are displayed).

[0123] The fraudulent numbers mentioned here mainly include numbers reported by 12321 and confirmed as fraudulent numbers after verification, as well as fraudulent numbers confirmed by the public security investigation. Whitelist numbers mainly refer to numbers added through the signaling anti-fraud system. Numbers that have been shut down by the signaling anti-fraud system for a long time and have not been restored mainly refer to numbers that have been shut down by the signaling anti-fraud system for a month and have not been restored.

[0124] The B-domain and O-domain data related to the number mentioned here include B-domain data, which includes user-registered personal data and business data, such as user consumption habits, terminal information, ARPU grouping, business content, and target audience; O-domain data includes network data, such as signaling, alarms, faults, and network resources, with the main focus on extracting signaling data.

[0125] The preprocessing of number data and extraction of derived features to obtain training data mentioned here can specifically be as follows:

[0126] The numbers mentioned above are classified, and feature labels are applied to the classified numbers. Then, numbers suspected of fraud and numbers that have been shut down by the signaling anti-fraud system and have not been restored are divided into one category (positive sample), whitelist numbers are divided into another category (negative sample), and general numbers are divided into another category (unlabeled sample), and feature labels are applied again.

[0127] The data used in this example mainly consists of signaling data from the O domain and a portion of data from the B domain. The signaling data in the O domain primarily comprises call records for calling numbers, including fields such as calling and called numbers, number location, call time, and call duration. A series of categorical and statistical features, including calling location and average call duration, are extracted from the signaling data. Missing and outlier values ​​are imputed, and data is deleted or modified. The statistical features are standardized, and the categorical features are digitized and standardized accordingly.

[0128] (2) Establish a semi-supervised learning model and train the semi-supervised model using training samples to obtain the pseudo-labels and confidence scores (i.e. weights) of general numbers.

[0129] (2.1) An unsupervised anomaly detection model is trained using the KPCA anomaly detection algorithm based on reconstruction error and unlabeled samples. The reconstruction error of each unlabeled sample is calculated by the model, and the maximum reconstruction error of the training set is normalized to the reconstruction error of each sample feature to obtain the anomaly degree of the unlabeled sample.

[0130] (2.2) Establish positive sample clustering and negative sample clustering models using the density-based DBSCAN algorithm and positive and negative samples respectively, and calculate the cluster center (or centroid) of each cluster. Clusters with more sample features or more positive sample numbers in the positive sample clusters are marked as reliable positive sample clusters, and the remaining clusters are discarded. Clusters with more sample features or more positive sample numbers in the negative sample clusters are marked as reliable negative sample clusters, and the remaining clusters are discarded. Merge the positive and negative sample clusters, and calculate the Euclidean distance between the cluster centers of each cluster. For multiple cluster centers that are close to each other, assign a corresponding weight ∈ based on the proportion of sample features contained in their cluster. The weight of the remaining cluster centers is ∈ = 1.

[0131] Referring to Figure 4 , in the embodiment of the present invention, all features will be used for clustering. Figure 4 This is a simple two-dimensional example. It is a basic example of two-dimensional clustering after standardizing two features, namely the call recipient number dispersion and the cumulative call volume. It is a partial example for clustering positive and negative samples and dividing the weights of the clustering clusters.

[0132] (2.3) Calculate the Euclidean distance from each unlabeled sample to these clustering centers, so as to obtain the similarity between each unlabeled sample and the positive and negative samples, and uniformly convert it into the anomaly similarity of the unlabeled sample.

[0133] (2.4) Calculate the total anomaly discrimination score of the sample by combining the sample anomaly degree and the sample anomaly similarity score, where the weight coefficient θ is set to 0.7.

[0134] (2.5) Set two thresholds according to the total anomaly discrimination score calculated above and where the unlabeled sample with TS(x i ) > α is labeled as a potential positive sample, and the unlabeled sample with TS(x i ) < β is labeled as a reliable negative sample. Corresponding labels are given to the samples that meet the conditions and are recorded as pseudo-labeled samples.

[0135] (2.6) Calculate the sample weights for the positive and negative samples and the pseudo-labeled samples according to the total anomaly discrimination score calculated above and the sample weight formula, where the hyperparameter σ is set to 0.7.

[0136] (2.7) Establish a binary classification model based on CatBoost, and use the positive and negative samples, the pseudo-labeled samples in step (2.5), and the corresponding sample weights in step (2.6) to train the established Catboost model, and use all unlabeled samples (excluding pseudo-labeled samples) as prediction samples for prediction to obtain the anomaly probability p of each unlabeled sample.

[0137] (2.8) Set p1 = 0.8 and p2 = 0.3, and combine the samples with anomaly probabilities satisfying p > p1 and p < p2 with the positive and negative samples respectively as potential positive samples and reliable negative samples.

[0138] (2.9) Repeat steps (2.2) to (2.8) for the potential positive samples and reliable negative samples labeled with pseudo-labels in step (2.8) for multiple iterations (5 iterations are performed in this embodiment), and average the TS t (x i ) of the unlabeled samples obtained from multiple iterations, and then execute steps (2.5) to (2.6) again to obtain the final potential positive samples, reliable negative samples and their sample weights.

[0139] (3.1) Construct the LightGBM model and train it using the positive samples, potential positive samples, negative samples, and reliable negative samples mentioned above. First, train a baseline model. Initially, some relevant parameters need to be set:

[0140] 1) learning_rate: learning rate, initially set to 0.1

[0141] 2) n_estimators: Maximum number of trees, initially set to 800

[0142] 3) early_stop_round: Stop early, set to 100

[0143] 4) max_depth: The maximum depth of the tree, initially set to 5.

[0144] 5) loss_function: Loss function, set to 'Logloss'

[0145] 6) subsample: Sample sampling rate, initially set to 0.8

[0146] 7) feature_fraction: Feature selection ratio, initially set to 0.8

[0147] 8) num_leaves: Minimum number of samples in the subtree, initially set to 100

[0148] 9) reg_alpha: Regularization coefficient, initially set to 2

[0149] 10) reg_lambda: Regularization coefficient, initially set to 2

[0150] 11) max_bin: Maximum number of bins, initially set to 127

[0151] (3.2) Set common upper and lower bounds for the above parameters respectively, and use the Bayesian optimizer to tune the parameters. Save the best model with the best performance and effect and its parameters.

[0152] (4) Output the results. Obtain the number to be judged, extract its relevant signaling for data preprocessing, extract the signaling features of the number, load the best_model saved in step (3.2), input the features of the number to be judged, use best_model for classification prediction, output the fraud probability of the number, and output the numbers with a fraud probability greater than 0.9 as suspected fraud numbers.

[0153] On the other hand, embodiments of the present invention provide a system for identifying telecommunications fraud based on fake tags, comprising:

[0154] The first module is used to obtain sample numbers and extract sample features of the sample numbers based on time granularity; wherein, the sample features include positive samples, negative samples and unlabeled samples;

[0155] The second module is used to perform anomaly detection and clustering on the sample features to determine the total anomaly discrimination score for each of the unlabeled samples.

[0156] The third module is used to filter pseudo-labeled samples from the unlabeled samples based on the total anomaly discrimination score, and to calculate the sample weight of the pseudo-labeled samples; wherein, the pseudo-labeled samples include potential positive samples and reliable negative samples;

[0157] The fourth module is used to determine the anomaly probability of the filtered unlabeled samples based on the pseudo-labeled samples and the sample weights through a supervised learning classification model, and to supplement and update the pseudo-labeled samples according to the anomaly probability.

[0158] The fifth module is used to iteratively process the sample features of the filtered pseudo-labeled samples to determine the target pseudo-labeled sample and the target sample weight.

[0159] The sixth module is used to construct a supervised binary classification model based on the target pseudo-label sample and the target sample weight, optimize the supervised binary classification model, and use the optimized supervised binary classification model to identify fraudulent numbers.

[0160] The content of the method embodiments of the present invention is applicable to the system embodiments. The specific functions implemented in the system embodiments are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0161] Another aspect of the present invention provides an electronic device, including a processor and a memory;

[0162] Memory is used to store programs;

[0163] The processor executes the program as described above.

[0164] The content of the method embodiments of the present invention is applicable to the embodiments of the present electronic device. The specific functions implemented by the embodiments of the present electronic device are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0165] Another aspect of this invention provides a computer-readable storage medium storing a program that is executed by a processor to implement the methods described above.

[0166] The content of the method embodiments of the present invention is applicable to the computer-readable storage medium embodiments. The specific functions implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0167] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0168] In summary, this invention provides a method, system, and storage medium for identifying telecommunications fraud based on pseudo-labels. This invention extracts sample features from suspected fraudulent numbers, divides them into positive sample clusters through clustering, assigns reliable positive sample labels to these samples, and calculates the distances of unlabeled sample features from each cluster to label the corresponding pseudo-labels. Anomaly detection is performed on the sample features of unlabeled numbers, and abnormal sample features are marked as potential anomalies. This process assigns more reliable pseudo-labels to sample features, expands the positive sample pool, and balances the ratio of positive to negative samples. Using the pseudo-labeled sample features and calculated sample weights as model inputs, a binary classification model for fraudulent number identification is built, enabling more accurate and efficient detection of potential fraudulent numbers. The beneficial effects of this invention include:

[0169] 1. Before the pseudo-labeling, a clustering algorithm was used to screen the sample features of the suspected fraudulent numbers, instead of directly defining all sample features of the suspected fraudulent numbers as positive samples. This is more in line with the principles of machine learning and the fundamental purpose of anti-fraud business, that is, to enable the model to identify the common features of most suspected fraudulent numbers, rather than all features of the suspected fraudulent numbers, because suspected fraudulent numbers also have normal behavior (manifested as a certain sample feature of the suspected fraudulent number being similar to the sample features of most normal numbers), which is more conducive to subsequent machine learning modeling.

[0170] 2. Some abnormal samples were extracted from the features of unlabeled samples, and the features of positive samples were expanded, so that some potential fraud features that do not exist in the current fraudulent numbers can also be learned by the machine learning model.

[0171] 3. The semi-supervised labeling of sample features and sample weights was iterated multiple times. The self-consistent regularization of the model was used to make the pseudo-labels and sample weights labeled in this step more reliable.

[0172] 4. The semi-supervised learning part uses the CatBoost algorithm based on forgetting decision trees, while the supervised learning part uses the LightGBM algorithm based on general decision trees. The two algorithms have different structures, which can reduce the similarity of results, reduce the risk of information leakage, and make the model more generalizable.

[0173] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.

[0174] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0175] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0176] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0177] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0178] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0179] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0180] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0181] The above is a detailed description of the preferred embodiments of the present invention, but the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A method for identifying telecommunications fraud based on pseudo-tags, characterized in that, include: Obtain sample numbers and extract sample features from the sample numbers based on time granularity; wherein, the sample features include positive samples, negative samples, and unlabeled samples; Anomaly detection and clustering are performed on the sample features to determine the total anomaly score for each unlabeled sample. Based on the total anomaly detection score, pseudo-labeled samples are filtered from the unlabeled samples, and the sample weights of the pseudo-labeled samples are calculated; wherein, the pseudo-labeled samples include potential positive samples and reliable negative samples; Based on the pseudo-labeled samples and the sample weights, the anomaly probability of the unlabeled samples after screening is determined by a supervised learning classification model, and the pseudo-labeled samples are supplemented and updated according to the anomaly probability. The sample features of the filtered pseudo-labeled samples are iteratively processed to determine the target pseudo-labeled sample and the target sample weight; Based on the target pseudo-label samples and the target sample weights, a supervised binary classification model is constructed, the supervised binary classification model is optimized, and the optimized supervised binary classification model is used to identify fraudulent numbers. The step of performing anomaly detection and clustering processing on the sample features to determine the total anomaly score for each unlabeled sample includes: Anomaly detection processing is performed on the unlabeled samples to obtain the anomaly score of each unlabeled sample; specifically, this includes: using a KPCA anomaly detection algorithm based on reconstruction error, training an unsupervised anomaly detection model with the unlabeled samples to calculate the reconstruction error of each unlabeled sample; and calculating the anomaly score of each unlabeled sample based on the reconstruction error using an anomaly score formula; wherein, the anomaly score calculation formula is: In the formula, Indicates the first One unlabeled sample, Indicates the first A reconstructed unlabeled sample, Indicates the first Reconstruction error of each sample This represents the maximum reconstruction error among all unlabeled samples. Indicates the first The anomaly of each sample; Clustering is performed on the positive and negative samples respectively, and anomaly similarity scores are calculated for each unlabeled sample based on the clustering results. Specifically, this includes: establishing positive and negative sample clustering models using the density-based DBSCAN algorithm and the positive and negative samples respectively; calculating the cluster center of each cluster; labeling reliable positive and negative sample clusters; merging the clusters; calculating the Euclidean distance between the cluster centers of each cluster; and assigning corresponding weights to cluster centers of multiple closely spaced samples of different categories based on the proportion of sample features contained within their clusters. The weights of the remaining cluster centers are Calculate the distance from each unlabeled sample to these cluster centers to obtain the abnormal similarity score for each unlabeled sample; the expression for the abnormal similarity score is: in, In the negative sample clustering, the first Cluster centers, The first positive sample in the cluster Cluster centers, For the first Positive class similarity of unlabeled samples, For the first Negative class similarity of unlabeled samples For the threshold, For the first The abnormal similarity score of unlabeled samples, The weights of the cluster centroids; Based on the anomaly degree and the anomaly similarity score, the total anomaly discrimination score for each of the unlabeled samples is determined; wherein, the expression for the total anomaly discrimination score is: in, For the first Total score for anomaly detection of unlabeled samples This is a hyperparameter used to adjust the weights of sample anomaly degree and sample anomaly similarity score.

2. The method for identifying telecommunications fraud based on fake tags according to claim 1, characterized in that, The step of filtering pseudo-labeled samples from the unlabeled samples based on the total anomaly discrimination score and calculating the sample weight of the pseudo-labeled samples includes: Based on the total anomaly detection score, a pseudo-label threshold is set; wherein, the pseudo-label threshold includes a first threshold and a second threshold; Unlabeled samples whose total anomaly detection score is greater than the first threshold are selected as potential positive samples; Unlabeled samples whose total anomaly detection score is less than the second threshold are selected as reliable positive samples; Based on the total anomaly detection score, the sample weight of the pseudo-labeled sample is calculated.

3. The method for identifying telecommunications fraud based on fake tags according to claim 2, characterized in that, The step of setting a pseudo-label threshold based on the total score for anomaly discrimination includes: Based on the total anomaly detection score, a pseudo-label threshold is set using the pseudo-label threshold setting formula. The formula for setting the pseudo-label threshold is as follows: In the formula, Indicates the first threshold. This represents the second threshold. This represents the total number of unlabeled samples. Indicates the first The total anomaly detection score for each unlabeled sample. This represents the quantile of the total anomaly detection score for unlabeled samples.

4. The method for identifying telecommunications fraud based on fake tags according to claim 2, characterized in that, The step of calculating the sample weight of the pseudo-labeled sample based on the total anomaly detection score includes: Based on the total anomaly detection score, the sample weight of the pseudo-label sample is calculated using the sample weight formula; The sample weight formula is as follows: In the formula, Indicates potentially anomalous samples. This indicates a reliable and normal sample. This represents labeled positive and negative samples. Indicates sample weights, The hyperparameter representing the adjustment of sample weights for pseudo-labels. This represents the cluster weights of positive and negative samples.

5. The method for identifying telecommunications fraud based on fake tags according to claim 1, characterized in that, The step of determining the anomaly probability of each unlabeled sample using a supervised learning classification model based on the pseudo-labeled samples and the sample weights, and then updating the pseudo-labeled samples according to the anomaly probabilities, includes: Construct a supervised learning classification model, and train the supervised learning classification model based on the pseudo-label samples and the sample weights; The abnormal probability of the remaining unlabeled samples after filtering out the pseudo-labeled samples is predicted by the trained supervised learning classification model. The potential positive samples are supplemented and updated by filtering out unlabeled samples whose anomaly probability is greater than a first preset probability; The reliable positive samples are supplemented and updated by selecting unlabeled samples whose anomaly probability is less than the second preset probability.

6. The method for identifying telecommunications fraud based on fake tags according to claim 1, characterized in that, The iterative processing of the sample features of the filtered pseudo-labeled samples to determine the target pseudo-labeled sample and the target sample weight includes: The sample features of the filtered pseudo-labeled samples are iteratively processed to determine the average total anomaly discrimination score of each of the unlabeled samples; Based on the average of the total score for anomaly detection, the target pseudo-label sample and the target sample weight are determined.

7. A system for identifying telecommunications fraud based on fake tags, characterized in that, include: The first module is used to obtain sample numbers and extract sample features of the sample numbers based on time granularity; wherein, the sample features include positive samples, negative samples and unlabeled samples; The second module is used to perform anomaly detection and clustering on the sample features to determine the total anomaly discrimination score for each of the unlabeled samples. The third module is used to filter pseudo-labeled samples from the unlabeled samples based on the total anomaly discrimination score, and to calculate the sample weight of the pseudo-labeled samples; wherein, the pseudo-labeled samples include potential positive samples and reliable negative samples; The fourth module is used to determine the anomaly probability of the filtered unlabeled samples based on the pseudo-labeled samples and the sample weights through a supervised learning classification model, and to supplement and update the pseudo-labeled samples according to the anomaly probability. The fifth module is used to iteratively process the sample features of the filtered pseudo-labeled samples to determine the target pseudo-labeled sample and the target sample weight. The sixth module is used to construct a supervised binary classification model based on the target pseudo-label sample and the target sample weight, optimize the supervised binary classification model, and use the optimized supervised binary classification model to identify fraudulent numbers. The step of performing anomaly detection and clustering processing on the sample features to determine the total anomaly score for each unlabeled sample includes: Anomaly detection processing is performed on the unlabeled samples to obtain the anomaly score of each unlabeled sample; specifically, this includes: using a KPCA anomaly detection algorithm based on reconstruction error, training an unsupervised anomaly detection model with the unlabeled samples to calculate the reconstruction error of each unlabeled sample; and calculating the anomaly score of each unlabeled sample based on the reconstruction error using an anomaly score formula; wherein, the anomaly score calculation formula is: In the formula, Indicates the first One unlabeled sample, Indicates the first A reconstructed unlabeled sample, Indicates the first Reconstruction error of each sample This represents the maximum reconstruction error among all unlabeled samples. Indicates the first The anomaly of each sample; Clustering is performed on the positive and negative samples respectively, and anomaly similarity scores are calculated for each unlabeled sample based on the clustering results. Specifically, this includes: establishing positive and negative sample clustering models using the density-based DBSCAN algorithm and the positive and negative samples respectively; calculating the cluster center of each cluster; labeling reliable positive and negative sample clusters; merging the clusters; calculating the Euclidean distance between the cluster centers of each cluster; and assigning corresponding weights to cluster centers of multiple closely spaced samples of different categories based on the proportion of sample features contained within their clusters. The weights of the remaining cluster centers are Calculate the distance from each unlabeled sample to these cluster centers to obtain the abnormal similarity score for each unlabeled sample; the expression for the abnormal similarity score is: in, In the negative sample clustering, the first Cluster centers, The first positive sample in the cluster Cluster centers, For the first Positive class similarity of unlabeled samples, For the first Negative class similarity of unlabeled samples For the threshold, For the first The abnormal similarity score of unlabeled samples, The weights of the cluster centroids; Based on the anomaly degree and the anomaly similarity score, the total anomaly discrimination score for each of the unlabeled samples is determined; wherein, the expression for the total anomaly discrimination score is: in, For the first Total score for anomaly detection of unlabeled samples This is a hyperparameter used to adjust the weights of sample anomaly degree and sample anomaly similarity score.

8. A computer-readable storage medium, characterized in that, The storage medium stores a program that is executed by a processor to implement the method as described in any one of claims 1 to 6.

Images