Group fraud governance method and device and computer readable storage medium

Abstract

The application provides a group fraud governance method and device and a computer readable storage medium, relates to the technical field of network security, and is used for solving the problems of low identification accuracy and low coverage of the prior art on group fraud behavior, and the method comprises the following steps: acquiring seed data of group fraud according to group fraud threat intelligence; using a group fraud identification model to screen group fraud data from operator signaling data, and verifying the accuracy and coverage of the group fraud data using the seed data; and using the group fraud data with accuracy and coverage reaching preset conditions to identify group fraud identification application information. The application can improve the accuracy and coverage of group fraud behavior identification, timely discover group fraud behavior, and avoid losses caused by group fraud.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus and computer-readable storage medium for combating group fraud. Background Technology

[0002] Group fraud generally refers to fraudulent activities carried out online by fraud gangs with clear division of labor and plans, where each member performs their specific duties. It can be analyzed using methods such as relationship graphs. Currently, the governance of group fraud mainly relies on post-incident handling methods. For example, by collecting relevant online behavioral characteristic data of group fraud activities to create models, and then using the models to analyze whether subsequent online behaviors are group fraudulent activities.

[0003] The drawback of existing technologies is that the performance of the model depends on the comprehensiveness of the data collected in advance. Due to the possibility that new group fraud methods may not be detected in time, there is a limited number of identifiable group fraud behaviors, and new group fraud methods cannot be detected in time. This leads to problems such as low accuracy and low coverage in the identification of group fraud behaviors. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the prior art by providing a method, apparatus and computer-readable storage medium for combating group fraud, so as to solve the problems of low accuracy and low coverage in the identification of group fraud in the prior art.

[0005] In a first aspect, the present invention provides a method for combating group fraud, the method comprising:

[0006] Obtain seed data for group fraud based on group fraud threat intelligence;

[0007] A group fraud identification model was used to filter group fraud data from operator signaling data, and seed data was used to verify the accuracy and coverage of the group fraud data.

[0008] Using group fraud data that meets preset accuracy and coverage criteria, group fraud identification is performed on group fraud identification application information.

[0009] Optionally, seed data on group fraud can be obtained based on group fraud threat intelligence, specifically including:

[0010] Analyze group fraud threat intelligence to identify first-end information indicating group fraud activities;

[0011] Based on the information from the first terminal, query the first network behavior characteristic data of the corresponding group fraud behavior, and use the first network behavior characteristic data as seed data for group fraud.

[0012] Optionally, a group fraud identification model is used to filter group fraud data from operator signaling data, and seed data is used to verify the accuracy and coverage of the group fraud data, specifically including:

[0013] Set the maximum number of iterations and the initial iteration parameters, and execute the following iterative operation starting from the initial number of iterations:

[0014] The group fraud identification model is used to filter the second network behavior feature data from the operator signaling data, and the second network behavior feature data is used as the group fraud data for this round of iterative calculation.

[0015] Calculate the first matching distance between each seed data and each group fraud data in this round of iteration, and evaluate whether the accuracy and coverage of the group fraud data in this round of iteration meet the preset conditions based on the first matching distance;

[0016] If the accuracy and coverage of this round of iteration do not meet the preset conditions, the group fraud identification model will be adjusted through supervised learning, and the next round of iteration will be executed.

[0017] If the accuracy and coverage of this round of iterations reach the preset conditions, the group fraud data from this round of iterations will be added to the group fraud black market database and the iteration will end, or the iteration will end when the maximum number of iterations is reached.

[0018] Optionally, the group fraud identification model is specifically a group fraud mimicry identification model.

[0019] Optionally, seed data, group fraud data, and group fraud identification application information are each stored in a sparse matrix, where i, j, and t are the three dimensions of the sparse matrix, and m, n, and p are the upper limits of the values ​​of i, j, and t.

[0020] Optionally, calculate the first matching distance between each seed data and each group fraud data in this round of iteration, specifically including:

[0021] Use equation (1) to calculate the first matching distance d between the x-th seed data and the y-th group fraud data in this round of iteration. xy :

[0022]

[0023] Where x = 1, 2, 3, ..., l1, y = 1, 2, 3, ..., l2, l1 is the number of seed data, and l2 is the number of group fraud data in this round of iteration. for transpose, for The transpose of , where λ is the first adjustment factor. For the first online time feature data of the x-th seed data, The second online time feature data for the y-th group fraud data. The first bandwidth feature data of the x-th seed data. The second bandwidth feature data is for the y-th group fraud data.

[0024] Optionally, the accuracy and coverage of the group fraud data in this round of iteration are evaluated based on the first matching distance to determine whether they meet preset conditions, specifically including:

[0025] According to d xy The accuracy of obtaining the group fraud data in this round of iterative calculations and coverage Where k is the number of iterations in this round of iteration;

[0026] Evaluate whether the accuracy and coverage of the group fraud data in this round of iterations satisfy equation (2). If so, the accuracy and coverage of this round of iterations have reached the preset conditions.

[0027]

[0028] Where P represents the probability meaning of the mathematical symbol, indicating that the result of the expression in the parentheses is a probability value.

[0029] Optionally, if the accuracy and coverage of the current iteration do not meet the preset conditions, the group fraud detection model is adjusted through supervised learning before the next iteration is executed, specifically including:

[0030] If the accuracy and coverage of the group fraud data in this round of iteration do not satisfy equation (2), adjust the group fraud identification model according to the conditions of equations (3)-(5):

[0031]

[0032]

[0033]

[0034] Where κ is the second adjustment coefficient. Let C be the recursive supervised learning factor for the k-th iteration. Gmax A Gmax These represent the maximum coverage and accuracy in the first k iterations, respectively.

[0035] Set k = k + 1 and execute the next round of iteration.

[0036] Optionally, using group fraud data that meets preset accuracy and coverage criteria, group fraud identification is performed on the group fraud identification application information, specifically including:

[0037] Receive group fraud identification application information, which includes second terminal information and corresponding third network behavior characteristic data;

[0038] Calculate the second matching distance between the third network behavior feature data and the group fraud data in the group fraud black market database;

[0039] If there is a second matching distance less than a preset threshold, it is determined that the second terminal corresponding to the second terminal information is involved in group fraud.

[0040] Secondly, the present invention provides a group fraud control device, the device comprising:

[0041] The acquisition module is used to acquire seed data for group fraud based on group fraud threat intelligence.

[0042] The screening and verification module, connected to the acquisition module, is used to screen group fraud data from operator signaling data using a group fraud identification model, and to verify the accuracy and coverage of the group fraud data using seed data.

[0043] The identification module, connected to the screening and verification module, is used to identify group fraud applications by utilizing group fraud data that meet preset accuracy and coverage conditions.

[0044] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when run by a processor, implements the group fraud control method described above.

[0045] This invention provides a method, apparatus, and computer-readable storage medium for combating group fraud. It employs a group fraud identification model to filter group fraud data from operator signaling data. The accuracy and coverage of the group fraud data are tested using seed data already identified as exhibiting group fraud behavior, ensuring that the accuracy and coverage of the filtered group fraud data meet preset conditions. Using this group fraud data with the preset accuracy and coverage conditions to identify group fraud behavior improves the accuracy and coverage of group fraud identification, enabling timely detection of group fraud and preventing losses caused by group fraud. Attached Figure Description

[0046] Figure 1 This is a flowchart of a group fraud control method according to an embodiment of the present invention;

[0047] Figure 2This is a schematic diagram of a scenario for a group fraud control method according to an embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of a sparse matrix data storage structure according to an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the structure of a group fraud control device according to an embodiment of the present invention. Detailed Implementation

[0050] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0051] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0052] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0053] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0054] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0055] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0056] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of the invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0057] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0058] Example 1:

[0059] like Figure 1As shown, the present invention provides a method for combating group fraud, the method comprising:

[0060] S01. Obtain seed data for group fraud based on group fraud threat intelligence;

[0061] S02. Use a group fraud identification model to filter group fraud data from operator signaling data, and use seed data to verify the accuracy and coverage of group fraud data;

[0062] S03. Using group fraud data that meets preset accuracy and coverage conditions, identify group fraud in the group fraud identification application information.

[0063] Specifically, in this embodiment, one application scenario of the method is as follows: Figure 2 As shown, existing group fraud identification models can be pre-collected in the group fraud identification device. These models are then used to filter group fraud data from operator signaling data. Seed data is obtained from threat intelligence already identified as exhibiting group fraud behavior. The accuracy and coverage of the group fraud data are then tested using the seed data to ensure the accuracy and coverage of the filtered group fraud data meet preset conditions. Finally, group fraud identification applications are processed using the group fraud data that meets these preset conditions. Seed data refers to network behavior characteristic data of the same nature as the filtered group fraud data, such as traffic volume, IP address, online / offline time, and bandwidth. The group fraud identification application information also contains corresponding network behavior characteristic data. This embodiment overcomes the problem of existing technologies relying on group fraud identification models to directly identify group fraud behavior, which may lead to incomplete or inaccurate identification due to incomplete pre-collected data. Using this embodiment, the accuracy and coverage of group fraud behavior identification can be improved, enabling timely detection of group fraud and preventing losses caused by group fraud.

[0064] Optionally, seed data on group fraud can be obtained based on group fraud threat intelligence, specifically including:

[0065] Analyze group fraud threat intelligence to identify first-end information indicating group fraud activities;

[0066] Based on the information from the first terminal, query the first network behavior characteristic data of the corresponding group fraud behavior, and use the first network behavior characteristic data as seed data for group fraud.

[0067] Specifically, in this embodiment... Figure 1 Step S01 corresponds to Figure 2Step ① specifically involves first analyzing the information of the first terminal involved in group fraud from threat intelligence, such as mobile phone numbers, and then using this information to trace back the original underlying data of the first terminal, i.e., the first network behavior characteristic data of the first terminal participating in network fraud. This data may include its traffic volume, IP address, online / offline time, and bandwidth associated with the IP address. This application selects online / offline time (first online time characteristic data) and bandwidth associated with the IP address (first bandwidth characteristic data) as the objects of subsequent analysis and calculation, and therefore uses them as seed data.

[0068] Optionally, a group fraud identification model is used to filter group fraud data from operator signaling data, and seed data is used to verify the accuracy and coverage of the group fraud data, specifically including:

[0069] Set the maximum number of iterations and the initial iteration parameters, and execute the following iterative operation starting from the initial number of iterations:

[0070] The group fraud identification model is used to filter the second network behavior feature data from the operator signaling data, and the second network behavior feature data is used as the group fraud data for this round of iterative calculation.

[0071] Calculate the first matching distance between each seed data and each group fraud data in this round of iteration, and evaluate whether the accuracy and coverage of the group fraud data in this round of iteration meet the preset conditions based on the first matching distance;

[0072] If the accuracy and coverage of this round of iteration do not meet the preset conditions, the group fraud identification model will be adjusted through supervised learning, and the next round of iteration will be executed.

[0073] If the accuracy and coverage of this round of iterations reach the preset conditions, the group fraud data from this round of iterations will be added to the group fraud black market database and the iteration will end, or the iteration will end when the maximum number of iterations is reached.

[0074] Specifically, in this embodiment... Figure 1 The purpose of step S02 is to use seed data to verify the identification effect of the existing group fraud identification model, so as to further improve the accuracy A and coverage C of the group fraud identification model, specifically corresponding to... Figure 2 Steps I and ② are performed first. Step I continuously filters group fraud data from operator signaling data. Group fraud data is the second network behavior feature data selected from the same dimension as the seed data. After verifying the accuracy A and coverage C of the filtered group fraud data using the seed data through the group fraud identification device, step ② is performed to add the group fraud data with accuracy A and coverage C that meet the preset conditions to the group fraud black market database.

[0075] Optionally, the group fraud identification model is specifically a group fraud mimicry identification model.

[0076] Specifically, in this embodiment, the group fraud identification model used is a group fraud mimicry identification model. "Mimetic computing" is a domain-oriented high-performance / high-efficiency hardware and software collaborative variable structure computing. It adopts a proactive cognitive multi-dimensional dynamic reconstruction function architecture. This embodiment of group fraud governance based on mimicry identification can improve the computational performance of the group fraud identification model through the dynamic heterogeneous redundancy architecture of mimicry computing, thereby improving the timeliness and accuracy of group fraud identification.

[0077] Optionally, seed data, group fraud data, and group fraud identification application information are each stored in a sparse matrix, where i, j, and t are the three dimensions of the sparse matrix, and m, n, and p are the upper limits of the values ​​of i, j, and t.

[0078] Specifically, in this embodiment, the seed data, group fraud data, and group fraud identification application information each adopt the following methods: Figure 3 The sparse matrix shown has three dimensions: i, j, and t, where m, n, and p are the upper limits of the values ​​of i, j, and t, respectively. Sparse matrices have the advantages of small storage space and fast search speed. Figure 2 The group fraud data in the group fraud black market database shown is ultimately stored in a sparse matrix.

[0079] Optionally, calculate the first matching distance between each seed data and each group fraud data in this round of iteration, specifically including:

[0080] Use equation (1) to calculate the first matching distance d between the x-th seed data and the y-th group fraud data in this round of iteration. xy :

[0081]

[0082] Where x = 1, 2, 3, ..., l1, y = 1, 2, 3, ..., l2, l1 is the number of seed data, and l2 is the number of group fraud data in this round of iteration. for transpose, for The transpose of , where λ is the first adjustment factor. For the first online time feature data of the x-th seed data, The second online time feature data for the y-th group fraud data. The first bandwidth feature data of the x-th seed data. The second bandwidth feature data is for the y-th group fraud data.

[0083] Optionally, the accuracy and coverage of the group fraud data in this round of iteration are evaluated based on the first matching distance to determine whether they meet preset conditions, specifically including:

[0084] According to d xu The accuracy of obtaining the group fraud data in this round of iterative calculations and coverage Where k is the number of iterations in this round of iteration;

[0085] Evaluate whether the accuracy and coverage of the group fraud data in this round of iterations satisfy equation (2). If so, the accuracy and coverage of this round of iterations have reached the preset conditions.

[0086]

[0087] Where P represents the probability meaning of the mathematical symbol, indicating that the result of the expression in the parentheses is a probability value.

[0088] Optionally, if the accuracy and coverage of the current iteration do not meet the preset conditions, the group fraud detection model is adjusted through supervised learning before the next iteration is executed, specifically including:

[0089] If the accuracy and coverage of the group fraud data in this round of iteration do not satisfy equation (2), adjust the group fraud identification model according to the conditions of equations (3)-(5):

[0090]

[0091]

[0092]

[0093] Where κ is the second adjustment coefficient. Let C be the recursive supervised learning factor for the k-th iteration. Gmax A Gmax These represent the maximum coverage and accuracy in the first k iterations, respectively.

[0094] Set k = k + 1 and execute the next round of iteration.

[0095] Specifically, in this embodiment, the first network behavior feature data includes the first online time feature data and the first bandwidth feature data. Correspondingly, the second network behavior feature data includes the second online time feature data and the second bandwidth feature data. The calculation formula for the iterative operation includes the formulas (1)-(5) as described above. An example of the specific calculation process of the iterative operation is as follows: First, set the initial iteration number to k=0 and the maximum iteration number to k=50. Select an existing group fraud mimicry identification model. Use the selected group fraud identification model to filter the group fraud data for this round of iterative operation from the operator signaling data. Use formula (1) to compare the seed data and the data for this round of iterative operation. The selected group fraud data is subjected to precise matching analysis to obtain the precise matching distance between the two. Furthermore, based on the precise matching distance, the accuracy and coverage of the selected group fraud identification model are obtained. Accuracy can be the proportion of correctly predicted data to the total number of data points, and coverage can be an evaluation of the completeness of the test during testing. For example, it can be determined whether any of the y precise matching distances for each seed data point is less than a preset threshold. If so, it indicates that the current round of group fraud data can identify the fraudulent behavior corresponding to that seed data. Therefore, based on all correctly identified seed data points (where d exists), the model can be used to identify the fraudulent behavior corresponding to that seed data. xy The accuracy of the group fraud data in this round of iterative calculation is obtained by measuring the distribution of the data in the three dimensions of i, j, and t (below a preset threshold). We can determine the extent to which the group fraud data covers each seed data point by identifying the number of exact match distances (y) that are less than a preset threshold. This number represents the degree of coverage of each seed data point by the group fraud data. Therefore, based on d... xy The distribution of group fraud data below a preset threshold across the three dimensions i, j, and t yields the coverage rate of group fraud data in this round of iterative calculation. Accuracy and coverage can also be defined and calculated using other methods, as long as they can express the computational effect of each iteration. The accuracy of the current iteration is then obtained. and coverage Then, it is determined whether the accuracy and coverage of this iteration meet the preset conditions of equation (2). If so, the group fraud data obtained in this iteration is used as the basis for subsequent group fraud application identification, and the iteration ends. Otherwise, the next iteration needs to be executed. The next iteration is monitored and controlled by equations (3)-(5) to gradually improve the accuracy of each iteration. and coverage Until accuracy and coverage If the requirements are not met even after the maximum number of iterations k=50, the iteration operation must also be terminated. This embodiment analyzes and improves the accuracy and coverage of the group fraud identification model through deep supervised learning and mimicry-based precise recognition. The obtained group fraud data has advantages such as high accuracy and high coverage.

[0096] Optionally, using group fraud data that meets preset accuracy and coverage criteria, group fraud identification is performed on the group fraud identification application information, specifically including:

[0097] Receive group fraud identification application information, which includes second terminal information and corresponding third network behavior characteristic data;

[0098] Calculate the second matching distance between the third network behavior feature data and the group fraud data in the group fraud black market database;

[0099] If there is a second matching distance less than a preset threshold, it is determined that the second terminal corresponding to the second terminal information is involved in group fraud.

[0100] Specifically, in this embodiment... Figure 1 Step S03 corresponds to Figure 2 Steps ③, ④, and ⑤ are as follows: Step ③ involves receiving the group fraud identification application information; Step ④ involves calling the group fraud data in the group fraud black market database and then calculating the second matching distance using the same formula as in equation (1). The difference is that the seed data is replaced by the third network behavior feature data in the group fraud identification application information, and the group fraud data in the group fraud black market database is replaced by the group fraud data in the iterative calculation process. The method for determining the existence of group fraud behavior is also based on the same preset threshold in the iterative calculation process. If the threshold is less than the preset threshold, it indicates that the network behavior feature data in the group fraud identification application information is similar to the network behavior of the group fraud data in the group fraud black market database. Therefore, it can be determined that there is group fraud behavior. Step ⑤ returns the group fraud identification result to the applicant. The method provided in this embodiment can be used to identify group fraud identification applications submitted by users, obtain identification results using a large amount of group fraud data stored in the group fraud black market database, and promptly and accurately inform users of group fraud information to avoid losses caused by fraud.

[0101] Example 2:

[0102] like Figure 4 As shown, Embodiment 2 of the present invention provides a group fraud control device, the device comprising:

[0103] Acquisition Module 01 is used to acquire seed data for group fraud based on group fraud threat intelligence;

[0104] The screening and verification module 02 is connected to the acquisition module 01 and is used to screen group fraud data from operator signaling data using a group fraud identification model, and to verify the accuracy and coverage of group fraud data using seed data.

[0105] The identification module 03, connected to the screening and verification module 02, is used to identify group fraud applications by utilizing group fraud data that meet preset accuracy and coverage conditions.

[0106] Optionally, module 01 is obtained, specifically including:

[0107] The analysis unit is used to analyze first-end information about group fraud activities from group fraud threat intelligence.

[0108] The query unit, connected to the analysis unit, is used to query the first network behavior feature data corresponding to the group fraud behavior based on the first terminal information, and to use the first network behavior feature data as seed data for group fraud.

[0109] Optionally, the screening and verification module 02 specifically includes:

[0110] The iteration start unit is used to set the maximum number of iterations and the initial iteration parameters. Starting from the initial number of iterations, the following iteration operations are performed:

[0111] The iterative filtering unit, connected to the iteration start unit, is used to filter second network behavior feature data from operator signaling data using the group fraud identification model, and uses the second network behavior feature data as the group fraud data for this round of iterative calculation.

[0112] The iterative verification unit, connected to the iterative filtering unit, is used to calculate the first matching distance between each seed data and each group fraud data in the current round of iterative operation, and to evaluate whether the accuracy and coverage of the group fraud data in the current round of iterative operation meet the preset conditions based on the first matching distance.

[0113] The iterative loop unit, connected to the iterative verification unit, is used to return to the iterative filtering unit to execute the next round of iterative calculation if the accuracy and coverage of the current round of iterative calculation do not meet the preset conditions, after adjusting the group fraud detection model through supervised learning.

[0114] The iteration termination unit, connected to the iteration verification unit, is used to add the group fraud data of the current iteration to the group fraud black market database and end the iteration if the accuracy and coverage of the current iteration reach the preset conditions, or to end the iteration when the maximum number of iterations is reached.

[0115] Optionally, the group fraud identification model is specifically a group fraud mimicry identification model.

[0116] Optionally, seed data, group fraud data, and group fraud identification application information are each stored in a sparse matrix, where i, j, and t are the three dimensions of the sparse matrix, and m, n, and p are the upper limits of the values ​​of i, j, and t.

[0117] Optionally, the iterative verification unit includes a distance calculation subunit, specifically used for:

[0118] Use equation (1) to calculate the first matching distance d between the x-th seed data and the y-th group fraud data in this round of iteration. xy :

[0119]

[0120] Where x = 1, 2, 3, ..., l1, y = 1, 2, 3, ..., l2, l1 is the number of seed data, and l2 is the number of group fraud data in this round of iteration. for transpose, for The transpose of , where λ is the first adjustment factor. For the first online time feature data of the x-th seed data, The second online time feature data for the y-th group fraud data. The first bandwidth feature data of the x-th seed data. The second bandwidth feature data is for the y-th group fraud data.

[0121] Optionally, the iterative verification unit may further include:

[0122] Obtain the sub-unit, connect it to the distance calculation sub-unit, and use it according to d xy The accuracy of obtaining the group fraud data in this round of iterative calculations and coverage Where k is the number of iterations in this round of iteration;

[0123] The evaluation sub-unit, connected to the acquisition sub-unit, is used to evaluate whether the accuracy and coverage of the group fraud data in this round of iterations satisfy equation (2). If so, the accuracy and coverage of this round of iterations meet the preset conditions.

[0124]

[0125] Where P represents the probability meaning of the mathematical symbol, indicating that the result of the expression in the parentheses is a probability value.

[0126] Optionally, the iterative loop unit specifically includes:

[0127] The adjustment sub-unit is used to adjust the group fraud identification model according to the conditions of equations (3)-(5) if the accuracy and coverage of the group fraud data in this round of iteration does not satisfy equation (2):

[0128]

[0129]

[0130]

[0131] Where κ is the second adjustment coefficient. Let C be the recursive supervised learning factor for the k-th iteration. Gmax A Gmax These represent the maximum coverage and accuracy in the first k iterations, respectively.

[0132] The loop subunit, connected to the adjustment subunit, is used to set k = k + 1 and execute the next round of iteration.

[0133] Optionally, the recognition module 03 specifically includes:

[0134] The receiving unit is used to receive group fraud identification application information, which includes second terminal information and corresponding third network behavior feature data.

[0135] The receiving unit is connected to the distance calculation subunit so that the distance calculation subunit is also used to calculate the second matching distance between the third network behavior feature data and the group fraud data in the group fraud black market database;

[0136] The determination unit, connected to the distance calculation subunit, is used to determine that the second terminal corresponding to the second terminal information has engaged in group fraud if there is a second matching distance less than a preset threshold.

[0137] Embodiment 2 of the present invention provides a group fraud control device, which corresponds to the group fraud control method of Embodiment 1. It can improve the accuracy and coverage of group fraud behavior identification, detect group fraud behavior in a timely manner, and avoid losses caused by group fraud.

[0138] Example 3:

[0139] Embodiment 3 of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is run by a processor, it implements the group fraud control method as described in Embodiment 1.

[0140] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0141] In addition, the present invention may also provide a computer device, the device including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the group fraud control method as described in Embodiment 1.

[0142] The memory is connected to the processor. The memory can be flash memory, read-only memory or other types of memory. The processor can be a central processing unit or a microcontroller.

[0143] Embodiments 1-3 of this invention provide a method, apparatus, and computer-readable storage medium for combating group fraud. These methods utilize a group fraud identification model to filter group fraud data from operator signaling data. The accuracy and coverage of the group fraud data are verified using seed data already identified as exhibiting group fraud behavior. This ensures that the accuracy and coverage of the filtered group fraud data meet preset conditions. By using group fraud data with the preset accuracy and coverage conditions to identify group fraud behavior, the accuracy and coverage of group fraud identification can be improved, enabling timely detection of group fraud and preventing losses caused by group fraud.

[0144] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for combating group fraud, characterized in that, The method includes: Obtain seed data for group fraud based on group fraud threat intelligence; Group fraud identification models are used to filter group fraud data from operator signaling data, and seed data is used to verify the accuracy and coverage of group fraud data. Specifically, this includes: Set the maximum number of iterations and the initial iteration parameters, and execute the following iterative operation starting from the initial number of iterations: The group fraud identification model is used to filter the second network behavior feature data from the operator signaling data, and the second network behavior feature data is used as the group fraud data for this round of iterative calculation. Calculate the first matching distance between each seed data and each group fraud data in this round of iteration, and evaluate whether the accuracy and coverage of the group fraud data in this round of iteration meet the preset conditions based on the first matching distance, specifically including: Calculate the first using formula (1) The seed data and the first iteration operation in this round First match distance of individual group fraud data : ， in, , The number of seed data, The number of group fraud data processed in this round of iterations. for transpose, for transpose, The first adjustment factor is... For the first The first online time feature data of each seed data, For the first The second online time characteristic data of group fraud data, For the first The first bandwidth feature data of each seed data, For the first Second bandwidth characteristic data of group fraud data; according to The accuracy of obtaining the group fraud data in this round of iterative calculations and coverage ,in, This represents the number of iterations in this round of iterations. Evaluate whether the accuracy and coverage of the group fraud data in this round of iterations satisfy equation (2). If so, the accuracy and coverage of this round of iterations have reached the preset conditions: ， in, The mathematical symbol represents the probability meaning, indicating that the result of the expression within the parentheses is a probability value; If the accuracy and coverage of the group fraud data in this round of iteration do not satisfy equation (2), adjust the group fraud identification model according to the conditions of equations (3)-(5): ， ， ， in, This is the second adjustment factor. , For the first The recursive supervised learning factor in the next iteration. , They are respectively the front The highest coverage and accuracy in each iteration. set up Then execute the next round of iterations. If the accuracy and coverage of this round of iteration reach the preset conditions, the group fraud data of this round of iteration will be added to the group fraud black market database and the iteration will end, or the iteration will end when the maximum number of iterations is reached. Using group fraud data that meets preset conditions in terms of accuracy and coverage, group fraud identification is performed on group fraud identification application information. The seed data, group fraud data, and group fraud identification application information are each stored in a sparse matrix, where i, j, and t are the three dimensions of the sparse matrix, and m, n, and p are the upper limits of the values ​​of i, j, and t.

2. The method according to claim 1, characterized in that, Seed data on group fraud is obtained based on group fraud threat intelligence, specifically including: Analyze group fraud threat intelligence to identify first-end information indicating group fraud activities; Based on the information from the first terminal, query the first network behavior characteristic data of the corresponding group fraud behavior, and use the first network behavior characteristic data as seed data for group fraud.

3. The method according to claim 2, characterized in that, The group fraud identification model is specifically a group fraud mimicry identification model.

4. The method according to any one of claims 1-3, characterized in that, Using group fraud data that meets preset accuracy and coverage criteria, group fraud identification is performed on group fraud identification application information, specifically including: Receive group fraud identification application information, which includes second terminal information and corresponding third network behavior characteristic data; Calculate the second matching distance between the third network behavior feature data and the group fraud data in the group fraud black market database; If there is a second matching distance less than a preset threshold, it is determined that the second terminal corresponding to the second terminal information is involved in group fraud.

5. A group fraud control device, characterized in that, The device includes: The acquisition module is used to acquire seed data for group fraud based on group fraud threat intelligence. A filtering and verification module, connected to the acquisition module, is used to filter group fraud data from operator signaling data using a group fraud identification model, and to verify the accuracy and coverage of the group fraud data using seed data. Specifically, it includes: Set the maximum number of iterations and the initial iteration parameters, and execute the following iterative operation starting from the initial number of iterations: The group fraud identification model is used to filter the second network behavior feature data from the operator signaling data, and the second network behavior feature data is used as the group fraud data for this round of iterative calculation. Calculate the first matching distance between each seed data and each group fraud data in this round of iteration, and evaluate whether the accuracy and coverage of the group fraud data in this round of iteration meet the preset conditions based on the first matching distance, specifically including: Calculate the first using formula (1) The seed data and the first iteration operation in this round First match distance of individual group fraud data : ， in, , The number of seed data, The number of group fraud data processed in this round of iterations. for transpose, for transpose, The first adjustment factor is... For the first The first online time feature data of each seed data, For the first The second online time characteristic data of group fraud data, For the first The first bandwidth feature data of each seed data, For the first Second bandwidth characteristic data of group fraud data; according to The accuracy of obtaining the group fraud data in this round of iterative calculations and coverage ,in, This represents the number of iterations in this round of iterations. Evaluate whether the accuracy and coverage of the group fraud data in this round of iterations satisfy equation (2). If so, the accuracy and coverage of this round of iterations have reached the preset conditions: ， in, The mathematical symbol represents the probability meaning, indicating that the result of the expression within the parentheses is a probability value; If the accuracy and coverage of the group fraud data in this round of iteration do not satisfy equation (2), adjust the group fraud identification model according to the conditions of equations (3)-(5): ， ， ， in, This is the second adjustment factor. , For the first The recursive supervised learning factor in the next iteration. , They are respectively the front The highest coverage and accuracy in each iteration. set up Then execute the next round of iterations. If the accuracy and coverage of this round of iteration reach the preset conditions, the group fraud data of this round of iteration will be added to the group fraud black market database and the iteration will end, or the iteration will end when the maximum number of iterations is reached. The identification module, connected to the screening and verification module, is used to identify group fraud in the group fraud identification application information by using group fraud data with accuracy and coverage that meet preset conditions. The seed data, group fraud data, and group fraud identification application information are each stored in a sparse matrix, where i, j, and t are the three dimensions of the sparse matrix, and m, n, and p are the upper limits of the values ​​of i, j, and t.

6. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the group fraud control method as described in any one of claims 1-4.

Images