Telecommunications anomaly event identification method and apparatus

Abstract

The application relates to the field of telecommunication technology and provides a telecommunication abnormal event identification method and device. The method comprises the following steps: inputting current first information of any user into a telecommunication abnormal event probability model to obtain a first probability that the any user will experience a telecommunication abnormal event in the future; determining a high-risk population of the telecommunication abnormal event according to the first probability; inputting current second information of any high-risk user in the high-risk population into a telecommunication abnormal communication probability model to obtain a second probability that the any high-risk user will experience the telecommunication abnormal event due to current target communication in the future; and determining whether the current target communication will trigger the telecommunication abnormal event in the future according to the second probability. The telecommunication abnormal event identification method and device provided in the application can protect and warn the high-risk users, and avoid the loss caused by the telecommunication abnormal event from the root.

Description

Technical Field

[0001] This application relates to the field of telecommunications technology, specifically to a method and apparatus for identifying telecommunications anomalies. Background Technology

[0002] Currently, the identification of telecommunications anomalies is mostly based on intelligent algorithms such as machine learning. These algorithms directly use historical data mining and rely on the intelligence of the algorithms.

[0003] However, most traditional methods for identifying telecommunications anomalies focus on identifying the triggering party. Since the actual victims of telecommunications anomalies are often the passive recipients of the event, identifying the triggering party cannot protect the actual victims or prevent losses caused by telecommunications anomalies from the root cause. Summary of the Invention

[0004] This application provides a method and apparatus for identifying telecommunications anomalies, which solves the technical problem that traditional telecommunications anomaly identification methods identify the triggering party but cannot protect the actual victims and prevent losses caused by telecommunications anomalies from the root.

[0005] In a first aspect, embodiments of this application provide a method for identifying telecommunications anomaly events, including:

[0006] Input the current first information of any user into the probability model of telecommunications abnormal events to obtain the first probability of the user experiencing telecommunications abnormal events in the future.

[0007] Based on the first probability, determine the high-risk group for the telecommunications anomaly;

[0008] Input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication.

[0009] Based on the second probability, determine whether the current target communication will trigger the telecommunications anomaly event in the future;

[0010] The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication.

[0011] In one embodiment, the probability model for telecommunications anomalies is constructed according to the following steps:

[0012] The users who need protection and the users who have experienced the aforementioned telecommunications anomaly are identified as target users;

[0013] The first outlier profile vector and the first communication structure vector of the first target user are determined as the first training samples; the first target user is a user among the target users who has experienced the telecommunications anomaly event, the first outlier profile vector is the outlier profile vector of the first target user before experiencing the telecommunications anomaly event, and the first communication structure vector is the communication structure vector of the first target user before experiencing the telecommunications anomaly event.

[0014] The second outlier profile vector and the second communication structure vector of the second target user are determined as the second training samples; the second target user is a user among the target users who has not experienced the telecommunications anomaly event, the second outlier profile vector is the outlier profile vector of the second target user when the first target user experiences the telecommunications anomaly event, and the second communication structure vector is the communication structure vector of the second target user when the first target user experiences the telecommunications anomaly event.

[0015] The first training sample and the second training sample are input into the first exponential model to train the first exponential model and obtain the probability model of the telecommunications anomaly event.

[0016] The first index model is an index model with outlier profile vector and communication structure vector as independent variables and the probability of experiencing telecommunications anomalies in the future as the dependent variable.

[0017] The dimensions of the outlier profile vector include the social strength between the target user and their friends, the number of different social circles of the target user, the social strength between the target user's friends and the target user's neighbors, the target user's level of fame among their neighbors, the transmission strength of the target user's social information, and the transmission strength of the target user's friends' social information.

[0018] The communication structure vector includes a call structure vector and an SMS structure vector. The dimensions of the call structure vector include the number of occurrences of the call companion structure, the number of occurrences of the call transmission structure, the number of occurrences of the call ring structure, the number of occurrences of the call superposition structure, the scale of occurrences of the call convergence structure, and the scale of occurrences of the call divergence structure. The dimensions of the SMS structure vector include the number of occurrences of the SMS companion structure, the number of occurrences of the SMS transmission structure, the number of occurrences of the SMS ring structure, the number of occurrences of the SMS superposition structure, the scale of occurrences of the SMS convergence structure, and the scale of occurrences of the SMS divergence structure.

[0019] The companion structure is a bidirectional communication structure between the target user and other users. The transmission structure is a structure in which the target user initiates communication with a friend, and the friend then initiates communication with their own friend. The ring structure is a triangular structure in which the target user communicates with two friends in pairs. The superposition structure is a structure in which a friend initiates communication with the target user, and the friend then initiates communication with their own friend. The convergence structure is a structure in which communication is initiated with the target user. The divergence structure is a structure in which the target user initiates communication with a friend.

[0020] In one embodiment, the telecommunications anomaly communication probability model is constructed according to the following steps:

[0021] The third outlier profile vector and the third communication structure vector of the first target user are determined as the third training samples; the third outlier profile vector is the outlier profile vector of the first target user when experiencing the telecommunications anomaly after the occurrence of historical target communication; the third communication structure vector is the communication structure vector of the first target user when experiencing the telecommunications anomaly after the occurrence of historical target call; the target communication includes target call and target SMS; the target call is the call duration of the first target user exceeding a preset duration; the target SMS is the SMS sent by the first target user with more than a preset number of characters.

[0022] The fourth outlier profile vector and the fourth communication structure vector of the first target user are determined as the fourth training sample; the fourth outlier profile vector is the outlier profile vector of the first target user after the occurrence of historical target communication without experiencing the telecommunications anomaly event, and the fourth communication structure vector is the communication structure vector of the first target user after the occurrence of historical target call without experiencing the telecommunications anomaly event.

[0023] The fifth outlier profile vector and the fifth communication structure vector of the first target user are determined as the fifth training sample; the fifth outlier profile vector is the change in the outlier profile vector before and after the first target user experiences the telecommunications anomaly after the occurrence of historical target communication; the fifth communication structure vector is the change in the communication structure vector before and after the first target user experiences the telecommunications anomaly after the occurrence of historical target communication.

[0024] The sixth outlier profile vector and the sixth communication structure vector of the first target user are determined as the sixth training sample; the sixth outlier profile vector is the change in the outlier profile vector of the first target user before and after the occurrence of the historical target communication without experiencing the telecommunications anomaly event; the sixth communication structure vector is the change in the communication structure vector of the first target user before and after the occurrence of the historical target communication without experiencing the telecommunications anomaly event.

[0025] The third training sample, the fourth training sample, the fifth training sample, and the sixth training sample are input into the second exponential model to train the second exponential model and obtain the telecommunications abnormal communication probability model.

[0026] The second exponential model is an exponential model with outlier profile vector, communication structure vector, change in outlier profile vector and change in communication structure vector as independent variables, and the probability of experiencing the telecommunications anomaly due to target communication as the dependent variable.

[0027] In one embodiment, determining the high-risk group for the telecommunications anomaly based on the first probability includes:

[0028] The first probabilities are arranged from largest to smallest, and the users corresponding to the first probabilities of the highest-ranked targets are identified as the high-risk group for the telecommunications anomaly.

[0029] In one embodiment, determining whether the current target communication will trigger the telecommunications anomaly event in the future based on the second probability includes:

[0030] If the second probability exceeds the probability threshold, it is determined that the current target communication will trigger the telecommunications anomaly event in the future;

[0031] If the second probability does not exceed the probability threshold, then it is determined that the current target communication will not trigger the telecommunications anomaly event in the future.

[0032] In one embodiment, determining whether the current target communication will trigger the telecommunications anomaly event in the future based on the second probability includes:

[0033] If it is determined that the current target communication will trigger the telecommunications anomaly event in the future, then risk control measures will be implemented for the current target communication.

[0034] If it is determined that the current target communication will not trigger the telecommunications anomaly event in the future, then monitoring of any of the high-risk users shall continue.

[0035] In one embodiment, risk control for the current target communication includes:

[0036] To issue an alert to any of the high-risk users and / or interrupt the current target's communications and / or report the incident to the police.

[0037] Secondly, embodiments of this application provide a telecommunications anomaly event identification device, comprising:

[0038] The first probability generation module is used to: input the current first information of any user into the telecommunications abnormal event probability model to obtain the first probability that the user will experience a telecommunications abnormal event in the future.

[0039] A high-risk group identification module is used to: identify high-risk groups for the telecommunications anomaly based on the first probability;

[0040] The second probability generation module is used to: input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication.

[0041] The telecommunications anomaly event identification module is used to: determine whether the current target communication will trigger the telecommunications anomaly event in the future based on the second probability;

[0042] The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication.

[0043] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the telecommunications anomaly event identification method described in the first aspect.

[0044] Fourthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the telecommunications anomaly event identification method described in the first aspect.

[0045] The telecommunications anomaly identification method and apparatus provided in this application inputs the current first information of any user into a telecommunications anomaly probability model to obtain the first probability that the user will experience a telecommunications anomaly in the future. Based on the first probability, a high-risk group for telecommunications anomalies is identified. The current second information of any high-risk user in the high-risk group is then input into a telecommunications anomaly communication probability model to obtain the second probability that the high-risk user will experience a telecommunications anomaly in the future due to the current target communication. Based on the second probability, it is determined whether the current target communication will trigger a telecommunications anomaly in the future. In this application, the user is a potential recipient of a telecommunications anomaly. Among the potential recipients, there are high-risk users who are likely to experience the telecommunications anomaly. High-risk users often have similar social and communication information. Therefore, high-risk users are first screened based on their social and communication information. Then, based on the changes in the social and communication information of high-risk users caused by the current target communication, it is determined whether the current target communication will trigger a telecommunications anomaly in the future, thus completing the process of identifying whether a telecommunications anomaly will occur from high-risk users. This identification method targets the passive recipients of telecommunications anomalies, i.e., high-risk users, and can protect and warn high-risk users, thus preventing losses caused by telecommunications anomalies at their source. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is one of the flowcharts illustrating the telecommunications anomaly event identification method provided in the embodiments of this application;

[0048] Figure 2 This is a second flowchart illustrating the telecommunications anomaly event identification method provided in the embodiments of this application;

[0049] Figure 3 This is the third flowchart of the telecommunications anomaly event identification method provided in the embodiments of this application;

[0050] Figure 4 This is a schematic diagram showing the change in the outlier profile vector of the telecommunications anomaly event identification method provided in this application embodiment;

[0051] Figure 5 This is a schematic diagram showing a change in the communication structure vector of the telecommunications anomaly event identification method provided in this application embodiment;

[0052] Figure 6This is a schematic diagram of the structure of the telecommunications anomaly event identification device provided in the embodiments of this application;

[0053] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0055] Figure 1 This is one of the flowcharts illustrating the telecommunications anomaly event identification method provided in the embodiments of this application. (Refer to...) Figure 1 This application provides a method for identifying telecommunications anomaly events, which may include:

[0056] 101. Input the current first information of any user into the probability model of telecommunications abnormal events to obtain the first probability of the user experiencing telecommunications abnormal events in the future;

[0057] 102. Identify high-risk groups for telecommunications anomalies based on the first probability.

[0058] 103. Input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that the high-risk user will experience a telecommunications abnormal event in the future due to the current target communication.

[0059] 104. Determine whether the current target communication will trigger a telecommunications anomaly event in the future based on the second probability.

[0060] The probability model for abnormal telecommunications events is constructed based on the user's historical social information and historical communication information. The probability model for abnormal telecommunications communication is constructed based on the user's historical social information, historical communication information, the changes in historical social information under the influence of historical target communication, and the changes in historical communication information under the influence of historical target communication.

[0061] In step 101, the current first information can be the user's current social information and current communication information.

[0062] In step 103, the current second information may be the high-risk user's current social information, current communication information, the amount of change of the current social information under the influence of the current target communication, and the amount of change of the current communication information under the influence of the current target communication.

[0063] It should be noted that a telecommunications anomaly event can be any adverse telecommunications event, and there is no limitation here. In this embodiment, the telecommunications anomaly event can be a telecommunications fraud event.

[0064] The telecommunications anomaly event identification method provided in this embodiment inputs the current first information of any user into a telecommunications anomaly event probability model to obtain the first probability that the user will experience a telecommunications anomaly event in the future. Based on the first probability, a high-risk group for telecommunications anomalies is identified. The current second information of any high-risk user in the high-risk group is then input into a telecommunications anomaly communication probability model to obtain the second probability that the high-risk user will experience a telecommunications anomaly event in the future due to the current target communication. Based on the second probability, it is determined whether the current target communication will trigger a telecommunications anomaly event in the future. In this embodiment, the user is a potential recipient of a telecommunications anomaly event. Among the potential recipients, there are high-risk users who are likely to experience the telecommunications anomaly event. High-risk users often have similar social and communication information. Therefore, high-risk users are first screened based on their social and communication information. Then, based on the changes in the social and communication information of high-risk users caused by the current target communication, it is determined whether the current target communication will trigger a telecommunications anomaly event in the future. This completes the process of identifying whether a telecommunications anomaly event will occur from high-risk users. This identification method in this embodiment targets the passive recipients of telecommunications anomalies, i.e., high-risk users, to identify telecommunications anomalies. It can protect and warn high-risk users and prevent losses caused by telecommunications anomalies from the root.

[0065] Furthermore, since this embodiment combines user social information and communication information, that is, combines the user's own characteristics and environmental characteristics to form a complete user profile, the method of this embodiment can be extended and transferred to other datasets and environments, and has good transferability and applicability.

[0066] Figure 2 This is the second flowchart illustrating the telecommunications anomaly event identification method provided in this application. (Refer to...) Figure 2 In one embodiment, the probability model for telecommunications anomalies can be constructed according to the following steps:

[0067] 201. Identify the users who need protection and those who have experienced abnormal telecommunications events as target users;

[0068] 202. The first outlier profile vector and the first communication structure vector of the first target user are determined as the first training sample;

[0069] The first target user is the user who has experienced a telecommunications anomaly among the target users; the first outlier profile vector is the outlier profile vector of the first target user before experiencing the telecommunications anomaly; the first communication structure vector is the communication structure vector of the first target user before experiencing the telecommunications anomaly.

[0070] 203. The second outlier profile vector and the second communication structure vector of the second target user are determined as the second training sample;

[0071] The second target user is the target user who has not experienced the telecommunications anomaly event. The second outlier profile vector is the outlier profile vector of the second target user when the first target user has experienced the telecommunications anomaly event. The second communication structure vector is the communication structure vector of the second target user when the first target user has experienced the telecommunications anomaly event.

[0072] 204. Input the first training sample and the second training sample into the first exponential model, train the first exponential model, and obtain the probability model of telecommunications abnormal events.

[0073] The first exponential model is an exponential model with outlier profile vectors and communication structure vectors as independent variables and the probability of experiencing telecommunications anomalies in the future as the dependent variable.

[0074] The dimensions of outlier profile vectors include the social strength between the target user and their friends, the number of different social circles of the target user, the social strength between the target user's friends and the target user's neighbors, the target user's fame among their neighbors, the transmission strength of the target user's social information, and the transmission strength of the target user's friends' social information.

[0075] Among them, the target user's friends can be defined as users who have had more than two historical communications with the target user, and suspected food delivery and courier personnel who have more than 60 daily call contacts need to be excluded.

[0076] The social strength between the target user and their friends, which is the average number of communications between the target user and all their friends;

[0077] The number of different social circles of the target user, that is, the number of non-overlapping triangular structures formed between the target user and two friends. Taking A as the target user, assuming that B, C, D and E are all friends of A, and form two non-overlapping triangular structures ABCA and ADEA with A respectively, then ABCA and ADEA represent A's two social circles.

[0078] The social strength between a target user's friends and their neighbors is the average number of communications between a target user's friends and all of their friends. Taking A as the target user, assuming B is A's friend, and C, D, and E are all B's friends, then C, D, and E are all A's neighbors. The average number of communications between these three users C, D, and E and B is the social strength between target user A's friend B and target user A's neighbors C, D, and E.

[0079] The target user's prominence among its neighbors is the proportion of the number of structures where the target user's friends' friends are friends with the target user, to the number of structures where the target user's friends' friends are friends with any other user. Taking A as the target user, assuming B is A's friend and C is B's friend, the proportion of structures like ABCA to structures like ABC-any other user is the target user's prominence among its neighbors. Here, any other user is someone who is different from either B or C.

[0080] The transmission intensity of social information of the target user is the average ratio of the number of communications between the target user and all friends to the total number of communications between the corresponding friends. Taking A as the target user, and assuming that B, C and D are A's friends, we calculate the ratio of the number of communications between A and B to the total number of communications between B and all users. Similarly, we calculate the ratio of the number of communications between A and C to the total number of communications between C and all users, and the ratio of the number of communications between A and D to the total number of communications between D and all users. The average of the three ratios is then taken as the transmission intensity of social information of the target user A.

[0081] The transmission intensity of social information between the target user's friends is the average ratio of the number of communications between the target user's friends and all their friends to the total number of communications between their respective friends. Taking A as the target user, assuming B is A's friend, and C and D are B's friends, we calculate the ratio of the number of communications between B and C to the total number of communications between C and all users. Similarly, we calculate the ratio of the number of communications between B and D to the total number of communications between D and all users. The average of the two ratios is then taken as the transmission intensity of social information between the target user's friend B.

[0082] The communication structure vector includes the call structure vector and the SMS structure vector. The dimensions of the call structure vector include the number of occurrences of the call companion structure, the number of occurrences of the call transmission structure, the number of occurrences of the call ring structure, the number of occurrences of the call superposition structure, the scale of occurrences of the call convergence structure, and the scale of occurrences of the call divergence structure. The dimensions of the SMS structure vector include the number of occurrences of the SMS companion structure, the number of occurrences of the SMS transmission structure, the number of occurrences of the SMS ring structure, the number of occurrences of the SMS superposition structure, the scale of occurrences of the SMS convergence structure, and the scale of occurrences of the SMS divergence structure.

[0083] The peer structure is a bidirectional communication structure between a target user and other users. Taking A as the target user and B as any other user, the structure A->B and B->A is the peer structure, where "->" represents the direction of communication initiation.

[0084] The transitive structure is a structure in which a target user initiates communication to a friend, and the friend then initiates communication to their friend. Taking A as the target user, and assuming B is A's friend and C is B's friend, then a structure like A->B, B->C is the transitive structure.

[0085] A ring structure is a triangular structure in which the target user communicates with two friends in pairs. Taking A as the target user, and assuming that B and C are both friends of A, then a structure like A->B->C->A is a ring structure.

[0086] The superposition structure is a structure in which a friend initiates communication to a target user, and the friend also initiates communication to their own friend. Taking A as the target user, and assuming B is A's friend and C is B's friend, then the structure B->A and B->C is the superposition structure.

[0087] A convergence structure is a structure that initiates communication to a target user. Taking A as the target user, if any users B, C, and D initiate communication to A, then a structure like B->A, C->A, and D->A is a convergence structure. The size of a convergence structure is equal to the number of B, C, and D, which is 3.

[0088] A divergent structure is a structure in which a target user initiates communication with a friend. Taking A as the target user, and assuming that B, C, and D are all friends of A, then structures like A->B, A->C, and A->D are divergent structures. The size of the divergent structure is the number of B, C, and D, which is 3.

[0089] In step 201, the users to be protected can be selected according to preset rules, which are not limited here. In this embodiment, users who have experienced telecommunications abnormal events can be users who have experienced telecommunications fraud events.

[0090] In step 204, the probability model for telecommunications anomalies can be expressed by the following formula:

[0091]

[0092] Where Y is the probability of experiencing a future telecommunications anomaly, and S t S is the call structure vector. r Z is the SMS structure vector, and Z is the outlier profile vector. The number of times the companion structure appears in the call. The number of times the transmission structure of the call occurs. The number of times the ring structure appears in the call. The number of times the superimposed structure of the call occurs. The scale of the convergence structure for voice communication The scale of the emergence of divergent structures in the call, The number of times the companion structure appears in the text message. The number of times the text message delivery structure appears. The number of times the ring structure appears in the text message. This represents the number of times the superimposed structure of the text message appears. The scale of the SMS aggregation structure Z1 represents the scale of the SMS dissemination structure, Z2 represents the social strength between the target user and their friends, Z3 represents the number of different social circles of the target user, Z4 represents the social strength between the target user's friends and their neighbors, Z5 represents the target user's level of fame among their neighbors, and Z6 represents the intensity of social information transmission from the target user and their friends. β1, β2, β3, β4, β5 and β6 are the corresponding correlation coefficients.

[0093] This embodiment uses the time nodes of the first target user's historical telecommunications anomaly events as a basis to obtain outlier profile vectors and communication structure vectors of users who have experienced telecommunications anomalies and those who have not experienced them at the corresponding time nodes before that time node as training samples. It can correct the model based on the model output and the actual historical telecommunications anomaly events, so that the trained telecommunications anomaly event probability model can more accurately predict the probability of users experiencing telecommunications anomalies in the future. In addition, since this embodiment quantifies the network structure model at the individual user level, it helps to identify small-scale and scattered telecommunications anomalies.

[0094] Figure 3 This is the third flowchart of the telecommunications anomaly event identification method provided in the embodiments of this application;

[0095] Figure 4 This is a schematic diagram showing the change in the outlier profile vector of the telecommunications anomaly event identification method provided in this application embodiment;

[0096] Figure 5 This is a schematic diagram showing a change in the communication structure vector of the telecommunications anomaly event identification method provided in this application embodiment;

[0097] Reference Figure 3 In one embodiment, the probability model for abnormal telecommunications communication can be constructed according to the following steps:

[0098] 301. The third outlier profile vector and the third communication structure vector of the first target user are determined as the third training sample;

[0099] The third outlier profile vector is the outlier profile vector of the first target user when experiencing a telecommunications anomaly after the occurrence of historical target communication. The third communication structure vector is the communication structure vector of the first target user when experiencing a telecommunications anomaly after the occurrence of historical target call. Target communication includes target call and target SMS. Target call is a call of the first target user whose call duration exceeds the preset duration. Target SMS is an SMS sent by the first target user whose number of characters exceeds the preset number of characters.

[0100] 302. The fourth outlier profile vector and the fourth communication structure vector of the first target user are determined as the fourth training sample;

[0101] The fourth outlier profile vector is the outlier profile vector of the first target user after the occurrence of historical target communication without experiencing any telecommunications anomalies. The fourth communication structure vector is the communication structure vector of the first target user after the occurrence of historical target call without experiencing any telecommunications anomalies.

[0102] 303. The fifth outlier profile vector and the fifth communication structure vector of the first target user are determined as the fifth training sample;

[0103] The fifth outlier profile vector is the change in the outlier profile vector before and after the first target user experiences a telecommunications anomaly after the historical target communication. The fifth communication structure vector is the change in the communication structure vector before and after the first target user experiences a telecommunications anomaly after the historical target communication.

[0104] 304. The sixth outlier profile vector and the sixth communication structure vector of the first target user are determined as the sixth training sample;

[0105] The sixth outlier profile vector is the change in the outlier profile vector of the first target user before and after the occurrence of historical target communication, without experiencing any telecommunications anomalies. The sixth communication structure vector is the change in the communication structure vector of the first target user before and after the occurrence of historical target communication, without experiencing any telecommunications anomalies.

[0106] 305. Input the third, fourth, fifth, and sixth training samples into the second exponential model to train the second exponential model and obtain the probability model of abnormal telecommunications communication.

[0107] The second exponential model is an exponential model with outlier profile vector, communication structure vector, change in outlier profile vector and change in communication structure vector as independent variables, and the probability of experiencing telecommunications anomalies due to target communication as the dependent variable.

[0108] In step 301, the preset duration and preset number of characters can be set according to actual needs, and are not limited here. In this embodiment, the preset duration can be set to 1 minute and the preset number of characters can be set to 10 characters.

[0109] In step 305, the probability model for abnormal telecommunications communication can be expressed by the following formula:

[0110]

[0111] Where Q is the probability of experiencing a telecommunications anomaly due to the target communication. This represents the change in the frequency of occurrences of the companion structure in the call before and after the target call. This represents the change in the number of occurrences of the call's transmission structure before and after the target call occurs. This represents the change in the number of occurrences of the ring structure in the call before and after the target call occurs. This represents the change in the number of occurrences of the call's overlay structure before and after the target call. The change in the size of the convergence structure of the call before and after the target call occurs. The change in the size of the divergent structure of the call before and after the target call occurs. This represents the change in the frequency of occurrences of the companion structure in the text message before and after the target text message is sent. This represents the change in the number of times the SMS delivery structure appears before and after the target SMS is sent. The change in the number of occurrences of the ring structure in the text message before and after the target text message is sent. This represents the change in the number of occurrences of the superimposed structure of the SMS message before and after the target SMS message is sent. This represents the change in the size of the SMS aggregation structure before and after the occurrence of the target SMS message. ΔZ1 represents the change in the scale of the divergent structure of the SMS message before and after the target SMS message occurs; ΔZ2 represents the change in the social strength between the target user and their friends before and after the target communication occurs; ΔZ3 represents the change in the social strength between the target user's friends and their neighbors before and after the target communication occurs; ΔZ4 represents the change in the target user's reputation among their neighbors before and after the target communication occurs; ΔZ5 represents the change in the intensity of the target user's social information transmission before and after the target communication occurs; and ΔZ6 represents the change in the intensity of the target user's friends' social information transmission before and after the target communication occurs. δ1, δ2, δ3, δ4, δ5 and δ6 are the corresponding correlation coefficients.

[0112] Reference Figure 4Before the target communication F occurs, target user A has two social circles, namely ABCA and ADEA. After the target communication F occurs, if Z2 increases, it means that the number of target user A's social circles has increased. That is, in the target communication F, the other end f of target user A is not in target user A's original social circle. It is a stranger to target user A and may trigger a telecommunications risk event.

[0113] Reference Figure 5 Before target communication F occurs, two users, users B and C, initiate communication with target user A. After target communication F occurs, if... or An increase in the number of users initiating communication with target user A indicates an increase in the number of users initiating communication with target user A. In other words, in target communication F, the peer f of target user A is not the user who originally initiated communication with target user A. To target user A, it is a stranger, which may trigger a telecommunications risk event.

[0114] This embodiment uses the historical outlier profile vector and historical communication structure vector of the first target user after experiencing and without experiencing telecommunications anomalies following the occurrence of historical target communication, as well as the changes in the historical outlier profile vector and historical communication structure vector after the occurrence of historical target communication, as training samples. It can correct the model based on the model output and the actual historical experience of telecommunications anomalies under the influence of historical target communication, so that the trained telecommunications anomaly communication probability model can more accurately predict the probability of users experiencing telecommunications anomalies in the future due to current target communication. In addition, since this embodiment quantifies the network structure model at the individual user level, it helps to identify small-scale, scattered telecommunications anomalies.

[0115] In one embodiment, determining a high-risk group for telecommunications anomalies based on a first probability may include:

[0116] The multiple first probabilities are arranged from largest to smallest, and the users corresponding to the first probabilities of the highest number of targets are identified as high-risk groups for telecommunications anomalies.

[0117] The target number can be set according to actual needs and is not limited here. In this embodiment, the target number can be set to 25%, that is, the users corresponding to the top 25% of the first probability are identified as the high-risk group for telecommunications abnormal events.

[0118] This embodiment uses a first probability ranking to screen high-risk groups, which can identify users with a high probability of experiencing abnormal telecommunications events in the future as high-risk groups, thus making the classification of high-risk groups highly accurate.

[0119] In one embodiment, determining whether the current target communication will trigger the telecommunications anomaly event in the future based on a second probability may include:

[0120] If the second probability exceeds the probability threshold, it is determined that the current target communication will trigger a telecommunications anomaly event in the future;

[0121] If the second probability does not exceed the probability threshold, then it is determined that the current target communication will not trigger telecommunications anomalies in the future.

[0122] This embodiment sets a threshold for the second probability, which can more accurately determine whether the current target communication will trigger a telecommunications anomaly event in the future.

[0123] In one embodiment, after determining whether the current target communication will trigger a telecommunications anomaly event in the future based on a second probability, the following may be included:

[0124] If it is determined that the current target communication will trigger a telecommunications anomaly in the future, risk control will be implemented for the current target communication. The specific risk control method can be set according to the actual situation and is not limited here. In this embodiment, an alarm can be triggered for high-risk users and / or the current target communication can be interrupted and / or a police report can be filed.

[0125] If it is determined that the current target communication will not trigger any abnormal telecommunications events in the future, then continue monitoring of the high-risk user.

[0126] It should be noted that monitoring high-risk users does not involve eavesdropping on their communications, but rather recording the other party communicating with the high-risk user, the duration of the call, and the number of characters in the text messages.

[0127] This embodiment performs risk control on the current target communication when it is determined that the current target communication will trigger a telecommunications anomaly in the future, and maintains monitoring of high-risk users when it is determined that the current target communication will not trigger a telecommunications anomaly in the future. This can maximize the protection and early warning of high-risk users and avoid losses caused by telecommunications anomalies at the source.

[0128] The telecommunications anomaly event identification device provided in the embodiments of this application is described below. The telecommunications anomaly event identification device described below can be referred to in correspondence with the telecommunications anomaly event identification method described above.

[0129] Figure 6 This is a schematic diagram of the telecommunications anomaly event identification device provided in an embodiment of this application. (Refer to...) Figure 6 This application provides a telecommunications anomaly event identification device, which may include:

[0130] The first probability generation module 601 is used to: input the current first information of any user into the telecommunications abnormal event probability model to obtain the first probability that the user will experience a telecommunications abnormal event in the future.

[0131] High-risk group identification module 602 is used to: identify high-risk groups for the telecommunications anomaly event based on the first probability;

[0132] The second probability generation module 603 is used to: input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication.

[0133] Telecommunications anomaly event identification module 604 is used to: determine whether the current target communication will trigger the telecommunications anomaly event in the future based on the second probability;

[0134] The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication.

[0135] The telecommunications anomaly event identification device provided in this embodiment inputs the current first information of any user into a telecommunications anomaly event probability model to obtain the first probability that the user will experience a telecommunications anomaly event in the future. Based on the first probability, high-risk groups for telecommunications anomalies are identified. The current second information of any high-risk user in the high-risk group is then input into a telecommunications anomaly communication probability model to obtain the second probability that the high-risk user will experience a telecommunications anomaly event in the future due to the current target communication. Based on the second probability, it is determined whether the current target communication will trigger a telecommunications anomaly event in the future. In this embodiment, the user is a potential recipient of a telecommunications anomaly event. Among the potential recipients, there are high-risk users who are likely to experience the telecommunications anomaly event. High-risk users often have similar social and communication information. Therefore, high-risk users are first screened based on their social and communication information. Then, based on the changes in the social and communication information of high-risk users caused by the current target communication, it is determined whether the current target communication will trigger a telecommunications anomaly event in the future. This completes the process of identifying whether a telecommunications anomaly event will occur from high-risk users. The identification method in this embodiment targets the passive recipients of telecommunications anomalies, i.e., high-risk users, to identify telecommunications anomalies. It can protect and warn high-risk users and prevent losses caused by telecommunications anomalies from the root.

[0136] Furthermore, since this embodiment combines user social information and communication information, that is, combines the user's own characteristics and environmental characteristics to form a complete user profile, the method of this embodiment can be extended and transferred to other datasets and environments, and has good transferability and applicability.

[0137] In one embodiment, a telecommunications anomaly event probability model building module (not shown in the figure) is also included, for:

[0138] The users who need protection and the users who have experienced the aforementioned telecommunications anomaly are identified as target users;

[0139] The first outlier profile vector and the first communication structure vector of the first target user are determined as the first training samples; the first target user is a user among the target users who has experienced the telecommunications anomaly event, the first outlier profile vector is the outlier profile vector of the first target user before experiencing the telecommunications anomaly event, and the first communication structure vector is the communication structure vector of the first target user before experiencing the telecommunications anomaly event.

[0140] The second outlier profile vector and the second communication structure vector of the second target user are determined as the second training samples; the second target user is a user among the target users who has not experienced the telecommunications anomaly event, the second outlier profile vector is the outlier profile vector of the second target user when the first target user experiences the telecommunications anomaly event, and the second communication structure vector is the communication structure vector of the second target user when the first target user experiences the telecommunications anomaly event.

[0141] The first training sample and the second training sample are input into the first exponential model to train the first exponential model and obtain the probability model of the telecommunications anomaly event.

[0142] The first index model is an index model with outlier profile vector and communication structure vector as independent variables and the probability of experiencing telecommunications anomalies in the future as the dependent variable.

[0143] The dimensions of the outlier profile vector include the social strength between the target user and their friends, the number of different social circles of the target user, the social strength between the target user's friends and the target user's neighbors, the target user's level of fame among their neighbors, the transmission strength of the target user's social information, and the transmission strength of the target user's friends' social information.

[0144] The communication structure vector includes a call structure vector and an SMS structure vector. The dimensions of the call structure vector include the number of occurrences of the call companion structure, the number of occurrences of the call transmission structure, the number of occurrences of the call ring structure, the number of occurrences of the call superposition structure, the scale of occurrences of the call convergence structure, and the scale of occurrences of the call divergence structure. The dimensions of the SMS structure vector include the number of occurrences of the SMS companion structure, the number of occurrences of the SMS transmission structure, the number of occurrences of the SMS ring structure, the number of occurrences of the SMS superposition structure, the scale of occurrences of the SMS convergence structure, and the scale of occurrences of the SMS divergence structure.

[0145] The companion structure is a bidirectional communication structure between the target user and other users. The transmission structure is a structure in which the target user initiates communication with a friend, and the friend then initiates communication with their own friend. The ring structure is a triangular structure in which the target user communicates with two friends in pairs. The superposition structure is a structure in which a friend initiates communication with the target user, and the friend then initiates communication with their own friend. The convergence structure is a structure in which communication is initiated with the target user. The divergence structure is a structure in which the target user initiates communication with a friend.

[0146] In one embodiment, a telecommunications anomaly communication probability model building module (not shown in the figure) is also included, for:

[0147] The third outlier profile vector and the third communication structure vector of the first target user are determined as the third training samples; the third outlier profile vector is the outlier profile vector of the first target user when experiencing the telecommunications anomaly after the occurrence of historical target communication; the third communication structure vector is the communication structure vector of the first target user when experiencing the telecommunications anomaly after the occurrence of historical target call; the target communication includes target call and target SMS; the target call is the call duration of the first target user exceeding a preset duration; the target SMS is the SMS sent by the first target user with more than a preset number of characters.

[0148] The fourth outlier profile vector and the fourth communication structure vector of the first target user are determined as the fourth training sample; the fourth outlier profile vector is the outlier profile vector of the first target user after the occurrence of historical target communication without experiencing the telecommunications anomaly event, and the fourth communication structure vector is the communication structure vector of the first target user after the occurrence of historical target call without experiencing the telecommunications anomaly event.

[0149] The fifth outlier profile vector and the fifth communication structure vector of the first target user are determined as the fifth training sample; the fifth outlier profile vector is the change in the outlier profile vector before and after the first target user experiences the telecommunications anomaly after the occurrence of historical target communication; the fifth communication structure vector is the change in the communication structure vector before and after the first target user experiences the telecommunications anomaly after the occurrence of historical target communication.

[0150] The sixth outlier profile vector and the sixth communication structure vector of the first target user are determined as the sixth training sample; the sixth outlier profile vector is the change in the outlier profile vector of the first target user before and after the occurrence of the historical target communication without experiencing the telecommunications anomaly event; the sixth communication structure vector is the change in the communication structure vector of the first target user before and after the occurrence of the historical target communication without experiencing the telecommunications anomaly event.

[0151] The third training sample, the fourth training sample, the fifth training sample, and the sixth training sample are input into the second exponential model to train the second exponential model and obtain the telecommunications abnormal communication probability model.

[0152] The second exponential model is an exponential model with outlier profile vector, communication structure vector, change in outlier profile vector and change in communication structure vector as independent variables, and the probability of experiencing the telecommunications anomaly due to target communication as the dependent variable.

[0153] In one embodiment, the high-risk population identification module 602 is specifically used for:

[0154] The first probabilities are arranged from largest to smallest, and the users corresponding to the first probabilities of the highest-ranked targets are identified as the high-risk group for the telecommunications anomaly.

[0155] In one embodiment, the telecommunications anomaly event identification module 604 is specifically used for:

[0156] If the second probability exceeds the probability threshold, it is determined that the current target communication will trigger the telecommunications anomaly event in the future;

[0157] If the second probability does not exceed the probability threshold, then it is determined that the current target communication will not trigger the telecommunications anomaly event in the future.

[0158] In one embodiment, a processing strategy module (not shown in the figure) is further included for:

[0159] If it is determined that the current target communication will trigger the telecommunications anomaly event in the future, then risk control measures will be implemented for the current target communication.

[0160] If it is determined that the current target communication will not trigger the telecommunications anomaly event in the future, then monitoring of any of the high-risk users shall continue.

[0161] In one embodiment, the processing strategy module is specifically used for:

[0162] To issue an alert to any of the high-risk users and / or interrupt the current target's communications and / or report the incident to the police.

[0163] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can call a computer program in the memory 730 to execute the steps of a telecommunications anomaly event identification method, such as including:

[0164] Input the current first information of any user into the probability model of telecommunications abnormal events to obtain the first probability of the user experiencing telecommunications abnormal events in the future.

[0165] Based on the first probability, determine the high-risk group for the telecommunications anomaly;

[0166] Input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication.

[0167] Based on the second probability, determine whether the current target communication will trigger the telecommunications anomaly event in the future;

[0168] The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication.

[0169] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0170] On the other hand, embodiments of this application also provide a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the telecommunications anomaly event identification method provided in the above embodiments, such as including:

[0171] Input the current first information of any user into the probability model of telecommunications abnormal events to obtain the first probability of the user experiencing telecommunications abnormal events in the future.

[0172] Based on the first probability, determine the high-risk group for the telecommunications anomaly;

[0173] Input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication.

[0174] Based on the second probability, determine whether the current target communication will trigger the telecommunications anomaly event in the future;

[0175] The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication.

[0176] On the other hand, embodiments of this application also provide a processor-readable storage medium storing a computer program for causing a processor to perform the steps of the methods provided in the above embodiments, such as including:

[0177] Input the current first information of any user into the probability model of telecommunications abnormal events to obtain the first probability of the user experiencing telecommunications abnormal events in the future.

[0178] Based on the first probability, determine the high-risk group for the telecommunications anomaly;

[0179] Input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication.

[0180] Based on the second probability, determine whether the current target communication will trigger the telecommunications anomaly event in the future;

[0181] The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication.

[0182] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0183] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for identifying telecommunications anomaly events, characterized in that, include: Input the current first information of any user into the probability model of telecommunications abnormal events to obtain the first probability of the user experiencing telecommunications abnormal events in the future. Based on the first probability, determine the high-risk group for the telecommunications anomaly; Input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication. Based on the second probability, determine whether the current target communication will trigger the telecommunications anomaly event in the future; The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication. The first information includes social information and communication information, and the second information includes social information, communication information, the amount of change of social information under the influence of target communication, and the amount of change of communication information under the influence of target communication. The social information is an outlier profile vector, and the communication information is a communication structure vector.

2. The telecommunications anomaly event identification method according to claim 1, characterized in that, The probability model for telecommunications anomalies is constructed based on the following steps: The users who need protection and the users who have experienced the aforementioned telecommunications anomaly are identified as target users; The first outlier profile vector and the first communication structure vector of the first target user are determined as the first training sample; The first target user is a user among the target users who has experienced the telecommunications anomaly event; the first outlier profile vector is the outlier profile vector of the first target user before experiencing the telecommunications anomaly event; and the first communication structure vector is the communication structure vector of the first target user before experiencing the telecommunications anomaly event. The second outlier profile vector and the second communication structure vector of the second target user are determined as the second training sample; The second target user is a user among the target users who has not experienced the telecommunications anomaly event; the second outlier profile vector is the outlier profile vector of the second target user when the first target user experiences the telecommunications anomaly event; and the second communication structure vector is the communication structure vector of the second target user when the first target user experiences the telecommunications anomaly event. The first training sample and the second training sample are input into the first exponential model to train the first exponential model and obtain the probability model of the telecommunications anomaly event. The first index model is an index model with outlier profile vector and communication structure vector as independent variables and the probability of experiencing telecommunications anomalies in the future as the dependent variable. The dimensions of the outlier profile vector include the social strength between the target user and their friends, the number of different social circles of the target user, the social strength between the target user's friends and the target user's neighbors, the target user's level of fame among their neighbors, the transmission strength of the target user's social information, and the transmission strength of the target user's friends' social information. The communication structure vector includes a call structure vector and an SMS structure vector. The dimensions of the call structure vector include the number of occurrences of the call companion structure, the number of occurrences of the call transmission structure, the number of occurrences of the call ring structure, the number of occurrences of the call superposition structure, the scale of occurrences of the call convergence structure, and the scale of occurrences of the call divergence structure. The dimensions of the SMS structure vector include the number of occurrences of the SMS companion structure, the number of occurrences of the SMS transmission structure, the number of occurrences of the SMS ring structure, the number of occurrences of the SMS superposition structure, the scale of occurrences of the SMS convergence structure, and the scale of occurrences of the SMS divergence structure. The companion structure is a bidirectional communication structure between the target user and other users. The transmission structure is a structure in which the target user initiates communication with a friend, and the friend then initiates communication with their own friend. The ring structure is a triangular structure in which the target user communicates with two friends in pairs. The superposition structure is a structure in which a friend initiates communication with the target user, and the friend then initiates communication with their own friend. The convergence structure is a structure in which communication is initiated with the target user. The divergence structure is a structure in which the target user initiates communication with a friend.

3. The telecommunications anomaly event identification method according to claim 2, characterized in that, The aforementioned abnormal telecommunications communication probability model is constructed based on the following steps: The third outlier profile vector and the third communication structure vector of the first target user are determined as the third training samples; the third outlier profile vector is the outlier profile vector of the first target user when experiencing the telecommunications anomaly after the occurrence of historical target communication; the third communication structure vector is the communication structure vector of the first target user when experiencing the telecommunications anomaly after the occurrence of historical target call; the target communication includes target call and target SMS; the target call is the call duration of the first target user exceeding a preset duration; the target SMS is the SMS sent by the first target user with more than a preset number of characters. The fourth outlier profile vector and the fourth communication structure vector of the first target user are determined as the fourth training sample; The fourth outlier profile vector is the outlier profile vector of the first target user when the first target user has not experienced the telecommunications anomaly after the historical target communication, and the fourth communication structure vector is the communication structure vector of the first target user when the first target user has not experienced the telecommunications anomaly after the historical target call. The fifth outlier profile vector and the fifth communication structure vector of the first target user are determined as the fifth training sample; The fifth outlier profile vector is the change in the outlier profile vector before and after the first target user experiences the telecommunications anomaly after the historical target communication. The fifth communication structure vector is the change in the communication structure vector before and after the first target user experiences the telecommunications anomaly after the historical target communication. The sixth outlier profile vector and the sixth communication structure vector of the first target user are determined as the sixth training sample; The sixth outlier profile vector is the change in the outlier profile vector of the first target user before and after the historical target communication without experiencing the telecommunications anomaly event. The sixth communication structure vector is the change in the communication structure vector of the first target user before and after the historical target communication without experiencing the telecommunications anomaly event. The third training sample, the fourth training sample, the fifth training sample, and the sixth training sample are input into the second exponential model to train the second exponential model and obtain the telecommunications abnormal communication probability model. The second exponential model is an exponential model with outlier profile vector, communication structure vector, change in outlier profile vector and change in communication structure vector as independent variables, and the probability of experiencing the telecommunications anomaly due to target communication as the dependent variable.

4. The telecommunications anomaly event identification method according to claim 1, characterized in that, The high-risk group for the telecommunications anomaly event determined based on the first probability includes: The first probabilities are arranged from largest to smallest, and the users corresponding to the first probabilities of the highest-ranked targets are identified as the high-risk group for the telecommunications anomaly.

5. The telecommunications anomaly event identification method according to claim 1, characterized in that, The step of determining whether the current target communication will trigger the telecommunications anomaly event in the future based on the second probability includes: If the second probability exceeds the probability threshold, it is determined that the current target communication will trigger the telecommunications anomaly event in the future; If the second probability does not exceed the probability threshold, then it is determined that the current target communication will not trigger the telecommunications anomaly event in the future.

6. The telecommunications anomaly event identification method according to claim 1, characterized in that, After determining whether the current target communication will trigger the telecommunications anomaly event in the future based on the second probability, the step includes: If it is determined that the current target communication will trigger the telecommunications anomaly event in the future, then risk control measures will be implemented for the current target communication. If it is determined that the current target communication will not trigger the telecommunications anomaly event in the future, then monitoring of any of the high-risk users shall continue.

7. The telecommunications anomaly event identification method according to claim 6, characterized in that, The risk control for the current target communication includes: To issue an alert to any of the high-risk users and / or interrupt the current target's communications and / or report the incident to the police.

8. A telecommunications anomaly event identification device, characterized in that, The method for performing the telecommunications anomaly event identification method according to claim 1 includes: The first probability generation module is used to: input the current first information of any user into the telecommunications abnormal event probability model to obtain the first probability that the user will experience a telecommunications abnormal event in the future. A high-risk group identification module is used to: identify high-risk groups for the telecommunications anomaly based on the first probability; The second probability generation module is used to: input the current second information of any high-risk user in the high-risk group into the telecommunications abnormal communication probability model to obtain the second probability that any high-risk user will experience the telecommunications abnormal event in the future due to the current target communication. The telecommunications anomaly event identification module is used to: determine whether the current target communication will trigger the telecommunications anomaly event in the future based on the second probability; The telecommunications anomaly event probability model is constructed based on the user's historical social information and historical communication information. The telecommunications anomaly communication probability model is constructed based on the user's historical social information, historical communication information, the change in historical social information under the influence of historical target communication, and the change in historical communication information under the influence of historical target communication.

9. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the telecommunications anomaly event identification method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the telecommunications anomaly event identification method according to any one of claims 1 to 7.

Images