Telecommunication anomaly detection method based on graph mining

Abstract

The present invention discloses a telecommunications anomaly detection method based on graph mining. This method overcomes the problems of low detection efficiency and inaccuracy in existing telecommunications anomaly detection technologies. The detection method processes communication record data and organizes it into a graph. The graph is then divided into a series of subgraphs. Local and global learning of the graph representation is performed to obtain local representations at the node level and global representations at the subgraph level. An anomaly detection algorithm is used to obtain an anomaly score for each subgraph. The subgraphs with the highest anomaly scores are selected, and the anomaly detection algorithm is used to obtain an anomaly score for each node in these subgraphs. The nodes with the highest anomaly scores are then output as the final detection results. This detection method can efficiently and accurately detect telecommunications anomaly behavior in large-scale graphs.

Description

Technical Field

[0001] The present invention relates to the fields of data mining and machine learning, and in particular to a telecommunications anomaly detection method based on graph mining. Background Art

[0002] In recent years, telecom fraud cases have occurred frequently in my country, seriously threatening people's property safety and social stability. Telecom fraud is mixed in with normal communication activities and is highly concealed. In order to combat such illegal activities, it is necessary to accurately identify the source of the signal that implements telecom fraud.

[0003] Currently, the commonly used methods mainly include signaling data classification, call monitoring, and speech semantic recognition. These models, which target a single behavior of the fraud target, use a local modeling perspective, and the model's performance is severely limited. Chinese patent publication number CN111371749A, published on July 3, 2020, entitled "A method, system, device, and readable storage medium for telecommunications fraud detection," discloses a method for telecommunications fraud detection. The method uses training data obtained from processing telecommunications fraud case data to train a neural network to obtain a telecommunications fraud detection model, which is then used to detect telecommunications fraud. However, this patent is not efficient enough in processing data. When performing representation learning on large-scale communication data, the model's training efficiency and recognition effect are severely limited. Summary of the Invention

[0004] The present invention overcomes the problems of low detection efficiency and insufficient detection accuracy in the existing technology when performing telecommunications anomaly detection. It provides a telecommunications anomaly detection method based on graph mining. Through methods such as local learning at the node level, global learning at the subgraph level, and cascade anomaly detection, it can achieve efficient detection of telecommunications anomaly behavior in large-scale graphs.

[0005] In order to achieve the above object, the present invention adopts the following scheme:

[0006] The telecommunication anomaly detection method based on graph mining includes the following steps:

[0007] Step 1: Organize the call record data into a graph using numbers as nodes and call records as edges. Then, divide the graph into a series of subgraphs based on the closeness of the connections between nodes.

[0008] Step 2: Using the spatiotemporal aggregation features of the number and the static attributes of the call record as the feature information of the node, use GraphSage graph representation learning technology to perform local learning at the node level, obtain the node representation vector Z and split it into a local representation vector Zl and a global representation vector Zg; aggregate the global representation vector Zg of all nodes in a subgraph into a subgraph-level representation vector ZGi through a pooling operation; regard each subgraph as a supernode, use GraphSage graph representation learning technology to perform global learning at the subgraph level to obtain the representation vector ZGi', update the representation vector ZGi to the representation vector ZGi', and use the representation vector ZGi' to cover the global representation vector Zg of all nodes in the subgraph;

[0009] Step 3: Use the most recently updated node representation vector Z to replace the spatiotemporal aggregation features of the number and the static attributes of the call record as the node feature information. Iterate the local learning and global learning processes in step 2 until convergence, and finally obtain the global representation of the subgraph and the local representation of the node.

[0010] Step 4: Using the global representation of the subgraph as input, the anomaly detection algorithm is used to obtain the anomaly score of each subgraph. The subgraphs with the highest anomaly scores are selected, and the local representation of the nodes within the subgraph is used as input. The anomaly detection algorithm is used to obtain the anomaly score of each node, and the nodes with the largest anomaly scores are taken as the final detection result output.

[0011] Preferably, the static attributes in step 1 include call start time, call end time, call duration, calling location and called location.

[0012] Preferably, the spatiotemporal aggregation features in step one are calculated from the historical communication relationship and static attributes of the calling and called numbers, including the average monthly active days, the average daily number of calls, the call connection probability and the call dispersion.

[0013] Preferably, when dividing the subgraphs in step 1, the number of subgraphs is calculated according to the scale of the graph, and the division is performed using the Louvain graph clustering algorithm.

[0014] Preferably, the local learning of the graph representation in step 2 is performed in parallel in all subgraphs.

[0015] Preferably, the anomaly detection algorithm used in step 4 is an unsupervised anomaly detection algorithm OCSVM.

[0016] Preferably, the communication record data and graph information in step one, and the subgraph and node abnormality score data in step three are backed up and stored in a database.

[0017] This application also provides a telecommunications anomaly detection system, including:

[0018] The graph generation module is used to organize the input communication record data into a graph and divide the graph into a series of subgraphs based on the closeness of the connections between nodes;

[0019] A representation learning module is used to perform graph representation learning on subgraphs and nodes in the graph. The graph representation learning includes local learning and global learning. The local learning and global learning are iterated until convergence, and the representation vectors of the subgraphs and nodes are output;

[0020] The anomaly detection module performs anomaly detection by inputting the representation vectors of subgraphs and nodes, and outputs the anomaly scores of subgraphs and nodes.

[0021] This application also provides telecommunications anomaly detection equipment, including:

[0022] Memory for storing computer programs;

[0023] The processor is configured to implement the operation steps of the telecommunications anomaly detection method described above when loading and executing the computer program.

[0024] The present application also provides a computer-readable storage medium storing a computer program, which implements the operation steps of the telecommunications anomaly detection method described above when loaded and executed by a computer processor.

[0025] The present invention has at least the following beneficial effects: (1) representation learning is performed in parallel on each subgraph, the calculation speed is fast, the entire learning and detection process is more efficient, and data processing of ultra-large-scale graphs can be realized; (2) information is transmitted between local learning and global learning, and the representation information obtained by learning is more effective; (3) the static attributes and spatiotemporal aggregation features in the communication relationship are integrated, and the degree of abnormality of the number can be identified from the perspective of group and collaboration; (4) the cascade detection method is adopted, and only the nodes in the screened abnormal subgraphs need to be detected for abnormality, and the detection is comprehensive and efficient; (5) the iterative representation learning method is adopted to extract important information from the original features, reduce the original feature dimension, make the data more consistent with the low-dimensional applicability of the anomaly detection algorithm, and improve the detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 Schematic diagram of the telecommunications anomaly detection method provided in this application;

[0027] Figure 2 Flowchart of the telecommunications anomaly detection method provided in this application;

[0028] Figure 3 A structural diagram of the telecommunications anomaly detection system provided in this application;

[0029] Figure 4This is a structural diagram of the telecommunications anomaly detection device provided in this application. DETAILED DESCRIPTION

[0030] The present invention will be described in further detail below in conjunction with the accompanying drawings so that those skilled in the art can implement the invention with reference to the description.

[0031] like Figure 2 As shown, the telecommunication anomaly detection method based on graph mining provided by the embodiment of the present application includes the following steps:

[0032] Step 1: Preprocess the input communication record data. The communication record data is the key historical information record data of the number call, including the terminal feature information of the call, call establishment feature information, service quality information, call process behavior information, and call release related information. Preprocessing is to calculate and analyze the information contained in the communication record data to obtain the useful feature information required for subsequent operations; after preprocessing the communication record data to extract the static attributes of the call record, organize the communication record data into a graph with the number as the node and the call record as the edge. Each node in the graph is connected to multiple other nodes through undirected edges. Connections, undirected edges record the static attributes of call records between the node numbers at both ends, including static information such as the time and location of the calling and called numbers during the call. The number of subgraphs is set according to the scale of the graph. As an example, the number of subgraphs is set to 5000. Based on the closeness of the connections between nodes, the graph is divided into 5000 clusters, each cluster as a subgraph, forming a subgraph set consisting of 5000 subgraphs. Based on the historical communication relationship between the calling and called numbers, the spatiotemporal aggregation features of the numbers are calculated. The spatiotemporal aggregation features record dynamic information such as call quality and call frequency between the calling and called numbers.

[0033] Step 2: Use the spatiotemporal aggregation features of the number and the static attributes of the call records as the feature information of the node. Use GraphSage graph representation learning technology to perform local learning on the node within the subgraph. GraphSage graph representation learning technology uses the topological structure of the subgraph itself to map the feature information of the nodes in the subgraph into a low-dimensional vector space, and optimizes these mappings so that the learned representation vector can truly reflect the topological structure of the original subgraph. An N-dimensional representation vector is learned for each node. The learned representation vector can replace the original feature information of the node for subsequent operations. After local learning, the representation vector Z of the node is obtained. By changing the algorithm parameters of the GraphSage graph representation learning technology, the dimension of the obtained representation vector Z can be adjusted. As an example, the representation vector Z is adjusted to a 128-dimensional vector, and the node's The representation vector Z is split into a 64-dimensional local representation vector Zl and a 64-dimensional global representation vector Zg. The local representation vector Zl can participate in the local learning of the next iteration as part of the node feature and is output as part of the final representation information of the node when the iteration converges. The global representation vector Zg participates in the global learning at the subgraph level after processing; the global representation vector Zg of all nodes in a subgraph is aggregated into a 64-dimensional representation vector ZGi at the subgraph level through an average pooling operation; in the entire graph, each subgraph is regarded as a supernode, and GraphSage graph representation learning technology is used for global learning at the subgraph level. Each subgraph obtains a 64-dimensional representation vector ZGi', and the representation vector ZGi of the subgraph is updated to the representation vector ZGi', and the global representation vector Zg of all nodes in the subgraph is covered by the representation vector ZGi';

[0034] Step 3: Replace the spatiotemporal aggregation features of the number and the static attributes of the call record with the most recently updated node representation vector Z as the node feature information. Iterate the local learning and global learning process in step 2 until convergence. Finally, each subgraph obtains a 64-dimensional global representation of the subgraph, and each node obtains a 128-dimensional node representation. Each node representation consists of a 64-dimensional global representation and a 64-dimensional local representation.

[0035] Step 4: Using the global representation of the subgraph as input, obtain the anomaly score of each subgraph through the anomaly detection algorithm; select the subgraphs with the highest anomaly scores. As an example, select the subgraphs with the top 100 anomaly scores from high to low as the abnormal subgraphs; use the local representation of the nodes inside the abnormal subgraph as input, obtain the anomaly score of each node through the anomaly detection algorithm; select the nodes with the largest anomaly scores. As an example, select the top 50 nodes with the top anomaly scores from high to low in each abnormal subgraph as the final detection result output.

[0036] This telecommunications fraud detection method uses the divide-and-conquer idea, dividing the graph into multiple subgraphs, processing data at the subgraph level and node level respectively, and adopting the iterative representation learning method to extract important information from the original features, reduce the original feature dimension, make the data more consistent with the low-dimensional applicability of the anomaly detection algorithm, and improve detection accuracy; the iteration of local learning and global learning enables information transfer between different subgraphs, and the learned representation information is more effective; the learned representation vector integrates the static attributes and spatiotemporal aggregation features in the communication relationship, and can identify the degree of abnormality of the number from the perspective of group and collaboration; the cascade detection method is adopted, and only the nodes in the screened abnormal subgraphs need to be detected for anomaly, which is comprehensive and efficient.

[0037] In another technical solution, static attributes of call records include call start time, call end time, call duration, calling location, and called location. The spatiotemporal aggregated features of call numbers are calculated from the historical contact relationships between the calling and called numbers and their static attributes, including the average monthly active days, average daily number of calls, call connection probability, and call dispersion. The static attributes of call records and the spatiotemporal aggregated features of call numbers encompass both static and dynamic node information. The resulting node representation is accurate and complete, improving detection accuracy.

[0038] In another technical solution, Figure 1 As shown in the figure, when dividing a graph into subgraphs, the number of subgraphs is calculated based on the graph size, and the Louvain graph clustering algorithm is used for the division. Subgraphs divided by the Louvain graph clustering algorithm have dense internal connections and few connections between subgraphs. This allows for the aggregation of as many abnormal nodes as possible into abnormal subgraphs, making the detected abnormal subgraphs more representative in subsequent hierarchical anomaly detection.

[0039] In another technical solution, local learning of graph representations is performed in parallel across all subgraphs. This parallel representation learning across subgraphs results in faster computation, more efficient learning and detection, and enables data processing of very large graphs.

[0040] In another technical solution, the anomaly detection algorithm used in step 4 is the unsupervised anomaly detection algorithm OCSVM. As the current mainstream unsupervised anomaly detection algorithm, the OCSVM algorithm has high recognition efficiency, accuracy and reliability.

[0041] In another technical solution, the contact record data from step 1, the graph information, and the subgraph and node anomaly score data from step 3 are backed up and stored in a database. Storing this data in a database allows for easy access to the data needed for processing, facilitates the organization of anomaly detection results, and mitigates unexpected process interruptions.

[0042] like Figure 3As shown, the telecommunications anomaly detection system provided by the embodiment of the present application includes a graph generation module, a representation learning module, and an anomaly detection module. The specific working process is as follows:

[0043] The communication record data is input into the graph generation module, which organizes the communication record data into a graph and uses the graph clustering algorithm in the module to divide the graph from the entire graph into a series of subgraphs. The graph information processed by the graph generation module is input into the representation learning module, which calls the graph representation learning program to perform graph representation learning on the subgraphs and nodes in the connected graph. Graph representation learning includes local learning and global learning. Local learning and global learning are iterated until convergence. The representation vectors of the subgraphs and the representation vectors of the nodes are output to the anomaly detection module. The anomaly detection module performs hierarchical anomaly detection on the input subgraph and node representation vectors and outputs anomaly scores for the subgraphs and nodes. Obviously, this system can specifically implement the anomaly detection method presented in this embodiment.

[0044] like Figure 4 As shown, the telecommunications anomaly detection device provided in the embodiments of the present application includes at least the processor and memory shown in the figure, and may optionally be equipped with a power supply, input interface, output interface, and other accessories when in use. The memory uses the computer-readable storage medium provided in the embodiments of the present application, and the computer-readable storage medium stores a computer program. The stored computer program can be loaded and executed by the processor shown in the figure, and the execution can implement any operation in the embodiment of the telecommunications anomaly detection method provided in this embodiment.

[0045] It should be noted that although the steps are described above in a specific order, this does not necessarily mean that the steps must be performed in this specific order. In fact, some of these steps can be performed concurrently or even in a different order, as long as the required functions can be achieved. The number of devices and processing scales described here are intended to simplify the description of the present invention. Applications, modifications, and variations of the present invention will be apparent to those skilled in the art.

[0046] Although the embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the description and implementation methods. They can be fully applied to various fields suitable for the present invention. For those familiar with the art, additional modifications can be easily implemented. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to the specific details and illustrations shown and described herein.

Claims

1. A telecommunications anomaly detection method based on graph mining, comprising the following steps: Step 1: Organize the call record data into a graph using numbers as nodes and call records as edges. Then, divide the graph into a series of subgraphs based on the closeness of the connections between nodes. Step 2: Using the spatiotemporal aggregation features of the number and the static attributes of the call record as the feature information of the node, GraphSage graph representation learning technology is used to perform local learning at the node level to obtain the node representation vector Z and split it into a local representation vector Zl and a global representation vector Zg; Aggregate the global representation vectors Zg of all nodes in a subgraph into a subgraph-level representation vector ZGi through pooling operations; treat each subgraph as a supernode, use GraphSage graph representation learning technology to perform global learning at the subgraph level to obtain the representation vector ZGi', update the representation vector ZGi to the representation vector ZGi', and use the representation vector ZGi' to cover the global representation vector Zg of all nodes in the subgraph; Step 3: Use the most recently updated node representation vector Z to replace the spatiotemporal aggregation features of the number and the static attributes of the call record as the node feature information. Iterate the local learning and global learning processes in step 2 until convergence, and finally obtain the global representation of the subgraph and the local representation of the node. Step 4: Using the global representation of the subgraph as input, an anomaly detection algorithm is used to obtain the anomaly score of each subgraph. Select the subgraph with the highest anomaly score, use the local representation of the nodes within the subgraph as input, and use the anomaly detection algorithm to obtain the anomaly score of each node. Take the nodes with the largest anomaly score as the final detection result output; The static attributes include call start time, call end time, call duration, calling location and called location; The spatiotemporal aggregation features are calculated based on the historical communication relationship and static attributes of the calling and called numbers, including the average number of active days per month, the average number of calls per day, the probability of call connection, and call dispersion.

2. The telecommunication anomaly detection method according to claim 1, wherein: When dividing the subgraph in step 1, the number of subgraphs is calculated according to the scale of the graph, and the division is performed using the Louvain graph clustering algorithm.

3. The telecommunication anomaly detection method according to claim 1, wherein: The local learning of graph representation in step 2 is performed in parallel in all subgraphs.

4. The telecommunication anomaly detection method according to claim 1, wherein: The anomaly detection algorithm used in step 4 is the unsupervised anomaly detection algorithm OCSVM.

5. The telecommunication anomaly detection method according to claim 1, wherein: The communication record data and graph information in step 1, and the subgraph and node abnormality score data in step 3 are backed up and stored in a database.

6. Telecommunications anomaly detection equipment, characterized in that, include: Memory for storing computer programs; A processor, configured to implement the operation steps of the telecommunications anomaly detection method according to any one of claims 1 to 5 when loading and executing the computer program.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is loaded and executed by a computer processor, the operation steps of the telecommunications anomaly detection method according to any one of claims 1 to 5 are implemented.

Images