Abnormal group identification method and device, computer device, and storage medium

Abstract

The application relates to an abnormal gang identification method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: updating a call relationship graph according to historical call record information of a known abnormal communication number; determining an initial abnormal communication number from a communication number associated with the known abnormal communication number in the updated call relationship graph; determining a candidate abnormal communication number from the initial abnormal communication number based on the updated call relationship graph; identifying the candidate abnormal communication number to obtain a corresponding identification result; and the identification result is used to indicate whether a user to which the candidate abnormal communication number belongs is an abnormal gang of a user to which the known abnormal communication number belongs. The method can improve the identification efficiency of a telecom fraud gang.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to an abnormal gang identification method and device, computer equipment, storage medium and computer program product. BACKGROUND

[0002] At present, most of the telecom fraud gangs are in the form of gangs to implement fraud; in order to prevent users from incurring economic losses, it is very important to effectively identify telecom fraud gangs.

[0003] The existing identification method of telecom fraud gangs mainly checks one by one through artificial communication numbers, such as point-to-point detection and judgment. However, the artificial checking method is very time-consuming and labor-intensive, resulting in low identification efficiency. SUMMARY

[0004] Therefore, it is necessary to provide an abnormal gang identification method, device, computer equipment, computer readable storage medium and computer program product capable of improving the identification efficiency of telecom fraud gangs.

[0005] In a first aspect, the present application provides an abnormal gang identification method. The method comprises:

[0006] updating the call relationship graph according to the historical call record information of the known abnormal communication number;

[0007] determining an initial abnormal communication number from the communication numbers associated with the known abnormal communication number in the updated call relationship graph;

[0008] determining a candidate abnormal communication number from the initial abnormal communication number based on the updated call relationship graph;

[0009] identifying the candidate abnormal communication number to obtain a corresponding identification result; the identification result is used to indicate whether the user to which the candidate abnormal communication number belongs is an abnormal gang of the user to which the known abnormal communication number belongs.

[0010] In one embodiment, the initial abnormal communication number is determined from the communication numbers associated with the known abnormal communication number in the updated call relationship graph, comprising:

[0011] determining the number of associated communication numbers of the communication numbers associated with the known abnormal communication number from the updated call relationship graph as the centrality score of the communication numbers;

[0012] sorting the communication numbers according to the centrality score to obtain sorted communication numbers;

[0013] From the sorted communication numbers, N communication numbers with the highest centrality scores are screened out as initial abnormal communication numbers, where N is a positive integer greater than or equal to 2.

[0014] In one of the embodiments, determining candidate abnormal communication numbers from the initial abnormal communication numbers based on the updated call relationship graph comprises:

[0015] According to the initial abnormal communication numbers and the known abnormal communication numbers, loop traversal is performed on the updated call relationship graph to obtain a loop traversal result, where the loop traversal result is used to indicate whether the initial abnormal communication numbers and the known abnormal communication numbers form a call relationship loop.

[0016] According to the loop traversal result, a communication number that forms a call relationship loop with the known abnormal communication numbers is screened out from the initial abnormal communication numbers.

[0017] The screened communication number is confirmed as the candidate abnormal communication number.

[0018] In one of the embodiments, updating the call relationship graph according to the historical call record information of the known abnormal communication numbers comprises:

[0019] From the historical call record information, an associated communication number of the known abnormal communication number and a call relationship between the known abnormal communication number and the associated communication number are extracted.

[0020] According to the call relationship between the known abnormal communication number and the associated communication number, the known abnormal communication number and the associated communication number are added to the call relationship graph to obtain the updated call relationship graph.

[0021] In one of the embodiments, before updating the call relationship graph according to the historical call record information of the known abnormal communication numbers, the method further comprises:

[0022] Obtaining historical call record information of a plurality of communication numbers.

[0023] Analyzing the historical call record information of each communication number to obtain associated communication numbers of the each communication number.

[0024] According to the each communication number and the associated communication numbers of the each communication number, the call relationship graph is constructed.

[0025] In one of the embodiments, identifying the candidate abnormal communication numbers to obtain corresponding identification results comprises:

[0026] extract feature information of the candidate abnormal communication number;

[0027] input the feature information into a pre-trained communication number identification model to obtain an abnormal probability of the candidate abnormal communication number;

[0028] in a case where the abnormal probability is greater than a preset probability, confirm a user to which the candidate abnormal communication number belongs as an abnormal gang to which a user to which the known abnormal communication number belongs.

[0029] In one of the embodiments, before the call relationship graph is updated according to the historical call record information of the known abnormal communication number, the method further comprises:

[0030] obtain communication data corresponding to the known abnormal communication number;

[0031] from the communication data, filter out call record information of the known abnormal communication number in a preset time period in the past as the historical call record information.

[0032] In a second aspect, the present application further provides an abnormal gang identification device. The device comprises:

[0033] a relationship graph updating module configured to update a call relationship graph according to historical call record information of a known abnormal communication number;

[0034] a first filtering module configured to determine an initial abnormal communication number from communication numbers associated with the known abnormal communication number in the updated call relationship graph;

[0035] a second filtering module configured to determine a candidate abnormal communication number from the initial abnormal communication number based on the updated call relationship graph;

[0036] a result determining module configured to identify the candidate abnormal communication number to obtain a corresponding identification result.

[0037] In a third aspect, the present application further provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0038] update a call relationship graph according to historical call record information of a known abnormal communication number;

[0039] determine an initial abnormal communication number from communication numbers associated with the known abnormal communication number in the updated call relationship graph;

[0040] determine a candidate abnormal communication number from the initial abnormal communication number based on the updated call relationship graph;

[0041] identify the candidate abnormal communication number, to obtain a corresponding identification result; the identification result is used to indicate whether a user to which the candidate abnormal communication number belongs is an abnormal group of users to which the known abnormal communication number belongs.

[0042] In a fourth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium has a computer program stored thereon, and the computer program is executed by a processor to implement the following steps:

[0043] updating a call relationship graph according to historical call record information of the known abnormal communication number;

[0044] determining an initial abnormal communication number from communication numbers associated with the known abnormal communication number in the updated call relationship graph;

[0045] determining a candidate abnormal communication number from the initial abnormal communication number based on the updated call relationship graph;

[0046] identifying the candidate abnormal communication number, to obtain a corresponding identification result; the identification result is used to indicate whether a user to which the candidate abnormal communication number belongs is an abnormal group of users to which the known abnormal communication number belongs.

[0047] In a fifth aspect, the present application further provides a computer program product. The computer program product comprises a computer program, and the computer program is executed by a processor to implement the following steps:

[0048] updating a call relationship graph according to historical call record information of the known abnormal communication number;

[0049] determining an initial abnormal communication number from communication numbers associated with the known abnormal communication number in the updated call relationship graph;

[0050] determining a candidate abnormal communication number from the initial abnormal communication number based on the updated call relationship graph;

[0051] identifying the candidate abnormal communication number, to obtain a corresponding identification result; the identification result is used to indicate whether a user to which the candidate abnormal communication number belongs is an abnormal group of users to which the known abnormal communication number belongs.

[0052] The above-mentioned abnormal group identification method, apparatus, computer device, storage medium and computer program product first updates the call relationship graph based on historical call record information; then determines the initial abnormal communication number from the communication numbers associated with the known abnormal communication number in the updated call relationship graph; then, based on the updated call relationship graph, determines candidate abnormal communication numbers from the initial abnormal communication numbers; finally, identifies the candidate abnormal communication numbers to obtain a corresponding identification result; the identification result is used to indicate whether the user to which the candidate abnormal communication number belongs is an abnormal group of the user to which the known abnormal communication number belongs. In this way, when identifying an abnormal group, the call relationship graph is first updated based on the historical call record information of the known abnormal communication number, and the communication numbers associated with the known abnormal communication number are obtained from the updated call relationship graph. Then, the communication numbers associated with the known abnormal communication number are screened twice, that is, the initial abnormal communication number is first screened from the communication numbers associated with the known abnormal communication number in the updated call relationship graph, and the candidate abnormal communication numbers are screened from the initial abnormal communication numbers based on the updated call relationship graph. The communication numbers obtained from the second screening are identified to obtain a corresponding identification result. This technology obtains the communication numbers associated with known abnormal communication numbers, and then uses the updated call relationship graph to conduct a secondary screening of them. This helps to automatically screen out the communication numbers of users who may belong to abnormal groups, so that only these screened communication numbers need to be identified in the future, and there is no need to manually check each communication number one by one, thereby reducing the scope of communication number screening, which helps to simplify the abnormal group identification process and thus improve the efficiency of abnormal group identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 1 is a flow chart of a method for identifying abnormal groups in one embodiment;

[0054] Figure 2 This is a schematic diagram of the structure of a call relationship diagram in one embodiment;

[0055] Figure 3 This is a schematic structural diagram of an updated call relationship diagram in one embodiment;

[0056] Figure 4 A flowchart illustrating the steps of determining an initial abnormal communication number in one embodiment;

[0057] Figure 5 A flowchart illustrating the steps of determining a candidate abnormal communication number in one embodiment;

[0058] Figure 6 A schematic flow chart of the steps for updating a call relationship graph in one embodiment;

[0059] Figure 7A flowchart of a procedure of a step of obtaining an identification result of a candidate abnormal communication number in an embodiment;

[0060] Figure 8 A flowchart of a procedure of a step of obtaining historical call record information of a known abnormal communication number in an embodiment;

[0061] Figure 9 A flowchart of an abnormal gang identification method in another embodiment;

[0062] Figure 10 A flowchart of a telecommunications gang fraud detection method based on a graph database technology in an embodiment;

[0063] Figure 11 A structural block diagram of an abnormal gang identification apparatus in an embodiment;

[0064] Figure 12 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0065] In order to make the purposes, technical solutions and advantages of the present application clearer, further detailed description will be given to the present application in combination with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0066] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0067] In an embodiment, as shown in Figure 1 An abnormal gang identification method is provided, and the present embodiment takes the method applied to a server as an example; it can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is realized through interaction between the terminal and the server. The terminal can be, but is not limited to, various smart phones and tablet computers; the server can be realized by an independent server or a server cluster composed of multiple servers. In the present embodiment, the method includes the following steps:

[0068] In step S101, the call relationship graph is updated according to the historical call record information of the known abnormal communication number.

[0069] Known abnormal communication numbers refer to phone numbers that have been identified as exhibiting abnormal communication behavior, such as those identified as suspicious by a server, verified as suspicious by a manual call, verified as suspicious on-site, or identified as suspicious by a fraud database. In real-world scenarios, known abnormal communication numbers refer to suspected fraudulent calls.

[0070] Historical call logs refer to the call logs of a known anomalous number over a period of time. Specifically, they include calls made to the known anomalous number over a period of time. In practice, historical call logs refer to the call logs of a suspected fraudulent call within a month.

[0071] The call relationship diagram is used to represent the call relationship between communication numbers.

[0072] The call relationship graph refers to a graph network composed of call record information of other communication numbers, specifically a graph network composed of related phone numbers of other phone numbers; for example, Figure 2 In the call relationship diagram shown, points B, C, D, E, and F represent other communication numbers, and the arrows between the points represent their call relationships. Figure 2 The call relationship diagram shown is only a part of the call relationship diagram.

[0073] Among them, the call relationship refers to the relationship between the terminal to which a communication number belongs and the terminal to which another communication number belongs, which establishes a communication behavior, including the head, relationship edge and tail. Figure 3 , there is a call relationship between communication number A and communication number B, then the head refers to communication number A, the tail refers to communication number B, and the relationship edge refers to the undirected edge between communication number A and communication number B.

[0074] Specifically, the server extracts the call relationship between the known abnormal communication number and the communication number associated with the known abnormal communication number from the historical call record information, records the call relationship into the call relationship graph, combines the original call relationship in the call relationship graph with the recorded call relationship, and obtains a new call relationship graph as the updated call relationship graph.

[0075] Further, before step S101, further comprising: the server acquiring historical call record information of the known abnormal communication number; specifically, the server receiving an abnormal gang identification request sent by the terminal, and parsing the abnormal gang identification request to obtain the known abnormal communication number; querying the call record database according to the known abnormal communication number to obtain the call record information of the known abnormal communication number; and screening the call record information of the known abnormal communication number in a period of time before the known abnormal communication number from the call record information of the known abnormal communication number, as the historical call record information of the known abnormal communication number.

[0076] Step S102, determining the initial abnormal communication number from the communication numbers associated with the known abnormal communication number in the updated call relationship graph.

[0077] The updated call relationship graph refers to the call relationship graph obtained by updating the call relationship graph using the historical call record information of the known abnormal communication number; as shown in Figure 3 The updated call relationship graph can also be used to represent the call relationship between communication numbers. For example, the graph database originally stores a call relationship graph (such as Figure 2 After importing the historical call record information of the known abnormal communication number into the graph database, the call relationship graph is updated accordingly, that is, the call relationship graph originally stored in the graph database is replaced by the updated call relationship graph (such as Figure 3 ).

[0078] The communication numbers associated with the known abnormal communication number refer to the communication numbers in the updated call relationship graph that have a call relationship with the known abnormal communication number, that is, the communication numbers that have a relationship edge with the abnormal communication number.

[0079] The initial abnormal communication number refers to the communication number whose centrality score meets the preset score condition, which is screened from the communication numbers associated with the known abnormal communication number in the updated call relationship graph.

[0080] The centrality score refers to the number of call relationships established by the communication number, that is, the number of connected communication numbers. In actual scenarios, the centrality score refers to the sum of the out-degree and the in-degree of the communication number. The out-degree of the communication number refers to the number of relationship edges starting from the communication number, and the in-degree of the communication number refers to the number of relationship edges ending at the communication number.

[0081] The preset score condition refers to a preset center degree score screening condition, such as being greater than a preset score threshold. If the center degree score of the communication number meets the preset score condition, such as being greater than the preset score, the communication number is identified as an initial abnormal communication number. If the center degree score of the communication number does not meet the preset score condition, such as being less than or equal to the preset score, the communication number is identified as a normal communication number.

[0082] The initial abnormal communication number refers to a communication number whose center degree score meets the preset score condition, such as a communication number whose center degree score is greater than the preset score.

[0083] Specifically, the server screens, from the communication numbers associated with the known abnormal communication numbers in the updated call relationship graph, a communication number whose center degree score meets the preset score condition as an initial abnormal communication number.

[0084] For example, the server queries the updated call relationship graph, obtains, from the updated call relationship graph, a communication number associated with a known abnormal communication number, confirms the center degree score of the communication number associated with the known abnormal communication number according to the sum of the out-degree and the in-degree of the communication number associated with the known abnormal communication number, such as directly taking the sum of the out-degree and the in-degree of the communication number associated with the known abnormal communication number as the center degree score of the communication number associated with the known abnormal communication number, or taking a score matched with the sum of the out-degree and the in-degree of the communication number associated with the known abnormal communication number as the center degree score of the communication number associated with the known abnormal communication number, and then determines whether the center degree score meets the preset score condition. If yes, the communication number is confirmed as an initial abnormal communication number. If no, the communication number is confirmed as a normal communication number.

[0085] In step S103, a candidate abnormal communication number is determined from the initial abnormal communication number based on the updated call relationship graph.

[0086] The candidate abnormal communication number refers to a communication number screened from the initial abnormal communication number, which forms a call relationship loop with the known abnormal communication number in the updated call relationship graph.

[0087] Further, the candidate abnormal communication number refers to a communication number whose call relationship with the known abnormal communication number can form a closed loop path in the initial abnormal communication number. In actual scenarios, the candidate abnormal communication number refers to a member of an abnormal group to which the user to which the known abnormal communication number belongs, specifically, a member of a fraud group to which the user to which the known abnormal communication number belongs.

[0088] The call relationship loop refers to a closed loop path formed by the call relationship among three or more communication numbers. It should be noted that the components of the call relationship loop according to the present application are the known abnormal communication number, the candidate abnormal communication number, and one or more other communication numbers. For example, in the updated call relationship graph, if there is a communication number in the initial abnormal communication number, which, together with the known abnormal communication number and other communication numbers, forms a closed loop call relationship loop, the communication number is a candidate abnormal communication number.

[0089] Specifically, the server screens, from the initial abnormal communication numbers, a communication number that, in the updated call relationship graph, forms a call relationship loop with the known abnormal communication number, as a candidate abnormal communication number associated with the known abnormal communication number.

[0090] Further, the server selects one communication number from the initial abnormal communication numbers each time, and obtains the positions of the selected communication number and the known abnormal communication number in the updated call relationship graph, taking the two positions as loop essential positions. Then, the server determines whether there is another position in the updated call relationship graph, which, together with the loop essential positions, forms a call relationship loop. If there is, the selected communication number is taken as a candidate abnormal communication number. In this way, the server can screen the candidate abnormal communication numbers from the initial abnormal communication numbers.

[0091] For example, referring to FIG. 1, Figure 3 The server takes the known abnormal communication number A and the initial abnormal communication number B as loop essential positions to determine that point C can form a call relationship loop with point A and point B, and thus determines that point B is a candidate abnormal communication number. Figure 3

[0092] In step S104, the candidate abnormal communication numbers are identified to obtain corresponding identification results. The identification results are used to indicate whether the user to which the candidate abnormal communication number belongs is an abnormal gang to which the user to which the known abnormal communication number belongs.

[0093] The abnormal gang refers to a fraud gang, such as a telecom fraud gang.

[0094] ​The user to whom the candidate abnormal communication number belongs is an abnormal gang of the user to whom the known abnormal communication number belongs, which means that the user to whom the candidate abnormal communication number belongs is a member of the abnormal gang to which the user to whom the known abnormal communication number belongs belongs. Specifically, the user to whom the candidate abnormal communication number belongs is a fraud gang member of the user to whom the known abnormal communication number belongs. In an actual scenario, the abnormal gang of the user to whom the known abnormal communication number belongs refers to a fraud gang member determined through artificial telephone verification or on-site verification for suspicious number marking, or compared with information of a current fraud database.

[0095] Specifically, the server obtains information of a candidate abnormal communication number, identifies the information of the candidate abnormal communication number, and obtains an identification result of the candidate abnormal communication number; and determines whether the user to whom the candidate abnormal communication number belongs is an abnormal gang of the user to whom the known abnormal communication number belongs according to the identification result of the candidate abnormal communication number. For example, the server compares the information of the candidate abnormal communication number (for example, B) in the known abnormal communication number with information of a current fraud database. If the comparison result is that the candidate abnormal communication number belongs to an abnormal gang, it is determined that the user to whom the candidate abnormal communication number belongs is an abnormal gang of the user to whom the known abnormal communication number belongs. Figure 3

[0096] The abnormal gang identification method described above first updates a call relationship graph according to historical call record information; then determines an initial abnormal communication number from communication numbers associated with the known abnormal communication number in the updated call relationship graph; then determines a candidate abnormal communication number from the initial abnormal communication number based on the updated call relationship graph; and finally identifies the candidate abnormal communication number to obtain a corresponding identification result. The identification result is used to indicate whether the user to whom the candidate abnormal communication number belongs is an abnormal gang of the user to whom the known abnormal communication number belongs. In this way, when identifying an abnormal gang, the historical call record information of the known abnormal communication number is used to update a call relationship graph, and communication numbers associated with the known abnormal communication number are obtained from the updated call relationship graph. The communication numbers associated with the known abnormal communication number are screened twice, that is, the initial abnormal communication number is screened from the communication numbers associated with the known abnormal communication number in the updated call relationship graph, the candidate abnormal communication number is screened from the initial abnormal communication number based on the updated call relationship graph, and the communication number obtained through the second screening is identified to obtain a corresponding identification result. Through the process of obtaining the communication numbers associated with the known abnormal communication number and screening them twice with the aid of the updated call relationship graph, the communication numbers of the users in the abnormal gang can be automatically screened out, so that only these screened communication numbers need to be identified in the subsequent process, and each communication number does not need to be checked one by one by artificial means, thereby reducing the range of communication number checking, simplifying the abnormal gang identification process, and improving the identification efficiency of the abnormal gang.​

[0097] In one embodiment, as shown in FIG. 1, the step S102 determines the initial abnormal communication number from the communication numbers associated with the known abnormal communication number in the updated call relationship graph, specifically including the following steps: Figure 4

[0098] Step S401 determines the number of associated communication numbers of the communication numbers associated with the known abnormal communication number in the updated call relationship graph as the centrality score of the communication number.

[0099] Step S402 sorts the communication numbers according to the centrality score to obtain the sorted communication numbers.

[0100] Step S403 filters the top N communication numbers in the centrality score from the sorted communication numbers as the initial abnormal communication number; N is a positive integer greater than or equal to 2.

[0101] The number of associated communication numbers of the communication numbers associated with the known abnormal communication number refers to the number of communication numbers connected to the communication numbers associated with the known abnormal communication number in the updated call relationship graph. In actual scenarios, the number of associated communication numbers refers to the sum of the out-degree and in-degree of the communication numbers associated with the known abnormal communication number.

[0102] Specifically, the server obtains the communication numbers connected to the known abnormal communication number from the updated call relationship graph as the communication numbers associated with the known abnormal communication number, obtains the number of communication numbers connected to the communication numbers associated with the known abnormal communication number from the updated call relationship graph as the number of associated communication numbers of the communication numbers associated with the known abnormal communication number, and confirms the number of associated communication numbers of the communication numbers as the centrality score of the communication number; for example, referring to Figure 3 The number of communication numbers connected to the communication number B is 5, indicating that the centrality score of the communication number B is 5. Then, the server sorts the communication numbers associated with the known abnormal communication number from high to low according to the centrality score to obtain the sorted communication numbers, and filters the communication numbers with high centrality scores according to the sorted communication numbers, and the filtered communication numbers are the initial abnormal communication numbers.

[0103] ​In this embodiment, the number of associated communication numbers of the communication numbers associated with the known abnormal communication numbers is determined from the updated call relationship graph as the centrality score of the communication numbers, the communication numbers are sorted according to the centrality score, and the sorted communication numbers are obtained. The communication numbers with high centrality scores are selected as the initial abnormal communication numbers. In this way, the number of associated communication numbers of the communication numbers associated with the known abnormal communication numbers is represented by the centrality score, and the communication numbers are sorted according to the centrality score. The higher the centrality score of the communication number, the higher the abnormal degree of the communication number. Therefore, the communication numbers associated with the known abnormal communication numbers can be preliminarily screened, so that the abnormal gangs determined based on the loop are more accurate, and the identification accuracy of the abnormal gangs is further improved.

[0104] In one embodiment, as shown in FIG. 5, Figure 5 Step S103, based on the updated call relationship graph, determines the candidate abnormal communication numbers from the initial abnormal communication numbers, specifically including the following steps:

[0105] Step S501, according to the initial abnormal communication numbers and the known abnormal communication numbers, performing loop traversal on the updated call relationship graph to obtain a loop traversal result; the loop traversal result is used to indicate whether the initial abnormal communication numbers and the known abnormal communication numbers form a call relationship loop.

[0106] Step S502, according to the loop traversal result, screening the communication numbers from the initial abnormal communication numbers which form a call relationship loop with the known abnormal communication numbers.

[0107] Step S503, confirming the screened communication numbers as candidate abnormal communication numbers.

[0108] Wherein, the loop traversal refers to selecting the initial abnormal communication numbers and the known abnormal communication numbers as necessary communication numbers, and performing call relationship loop judgment on each communication number in the other communication numbers in the updated call relationship graph to find whether there is a communication number which forms a call relationship loop with the necessary communication numbers.

[0109] Specifically, the server acquires the initial abnormal communication number and the known abnormal communication number, takes the initial abnormal communication number and the known abnormal communication number as loop necessary nodes, performs loop traversal on the updated call relationship graph according to the loop necessary nodes, judges whether there is a communication number that constitutes a call relationship loop together with the loop necessary nodes in the updated call relationship graph, and obtains a corresponding loop traversal result; according to the loop traversal result, it is judged that there is a communication number that constitutes a call relationship loop together with the loop necessary nodes in the updated call relationship graph, and the initial abnormal communication number is marked; finally, the marked initial abnormal communication number is screened out from the initial abnormal communication number as a candidate abnormal communication number.

[0110] In this embodiment, by performing loop traversal on the updated call relationship graph according to the initial abnormal communication number and the known abnormal communication number, and screening out the communication number that constitutes a call relationship loop with the known abnormal communication number from the initial abnormal communication number according to the loop traversal result, the screened communication number is confirmed as a candidate abnormal communication number. In this way, by taking the call relationship loop as a condition limitation, the communication number with a high centrality score but unable to constitute a call relationship loop with the known abnormal communication number can be avoided, so that the final screened candidate abnormal communication number is more accurate, and the screening accuracy can be effectively improved, so that the subsequent identification of abnormal gangs is more accurate.

[0111] In one embodiment, as shown in Figure 6 The step S101 updates the call relationship graph according to the historical call record information of the known abnormal communication number, specifically including the following steps:

[0112] Step S601 extracts the associated communication number of the known abnormal communication number and the call relationship between the known abnormal communication number and the associated communication number from the historical call record information.

[0113] Step S602 adds the known abnormal communication number and the associated communication number to the call relationship graph according to the call relationship between the known abnormal communication number and the associated communication number, and obtains an updated call relationship graph.

[0114] It should be noted that the associated communication number of the known abnormal communication number in step S601 is the same as the communication number associated with the known abnormal communication number in step S401.

[0115] For example, assuming that the known abnormal communication number is A, the server extracts A's associated communication numbers (such as B, C, D, E, F, G, H, I) and the call relationship between A and the associated communication numbers from A's historical call record information; according to the call relationship between A and the associated communication numbers, the known abnormal communication number A and the associated communication numbers (such as B, C, D, E, F, G, H, I) are added to the Figure 2 The corresponding position in the call relationship diagram shown is obtained as follows Figure 3 The call relationship diagram shown is used as the updated call relationship diagram.

[0116] In this embodiment, the associated communication numbers of a known abnormal communication number, as well as the call relationship between the known abnormal communication number and the associated communication numbers, are extracted from the historical call records of the known abnormal communication number. Based on the call relationship between the known abnormal communication number and the associated communication number, the known abnormal communication number and the associated communication number are added to a call relationship graph, resulting in an updated call relationship graph. This updated call relationship graph facilitates subsequent secondary screening of communication numbers using the updated call relationship graph, first automatically screening out initial abnormal communication numbers and then automatically screening out candidate abnormal communication numbers. This allows for rapid screening of communication numbers that may represent abnormal groups, further improving the efficiency of identifying abnormal groups.

[0117] In one embodiment, the above-mentioned step S101, before updating the call relationship graph based on the historical call record information of the known abnormal communication numbers, also includes the following contents: obtaining the historical call record information of multiple communication numbers; parsing the historical call record information of each communication number to obtain the associated communication number of each communication number; constructing a call relationship graph based on each communication number and the associated communication number of each communication number.

[0118] Among them, the historical call record information of the communication number records the communication number, the communication number that has a call with the communication number, and the call relationship between the two; the communication number that has a call with the communication number is called the associated communication number of the communication number.

[0119] Specifically, the server obtains historical call record information of a plurality of communication numbers (such as B, C, D, E, and F), parses the historical call record information of each communication number to obtain a parsing result, and obtains, from the parsing result, an associated communication number of each communication number. For example, the historical call record information of B is parsed to obtain the associated communication numbers C, D, E, and F of B. Then, the server constructs a node corresponding to each communication number and a node corresponding to the associated communication number of the communication number according to the call relationship between the associated communication number of each communication number and the communication number, and constructs a relationship edge between the two nodes, thereby obtaining a call relationship graph for representing the call relationship between the plurality of communication numbers. For example, the server first constructs the nodes B, C, D, E, and F, and then constructs the relationship edges between the node B and the node C, between the node B and the node D, between the node B and the node E, and between the node B and the node F, and finally obtains the call relationship graph as shown in FIG. 1. Figure 2

[0120] In this embodiment, the historical call record information of a plurality of communication numbers is obtained, the historical call record information of each communication number is parsed to obtain the associated communication number of each communication number, and a call relationship graph is constructed according to each communication number and the associated communication number of each communication number. In this way, by constructing a call relationship graph in advance, after obtaining the historical call record information of a known abnormal communication number, the call relationship graph only needs to be updated using the historical call record information of the known abnormal communication number, without the need to construct a new call relationship graph each time the abnormal gang is identified, thereby further simplifying the abnormal gang identification process and facilitating further improvement of the abnormal gang identification efficiency.

[0121] In one embodiment, as shown in FIG. 1, the step S104 of identifying the candidate abnormal communication number and obtaining the corresponding identification result includes the following steps. Figure 7

[0122] Step S701: Feature information of the candidate abnormal communication number is extracted.

[0123] Step S702: The feature information is input into a pre-trained communication number identification model to obtain an abnormal probability of the candidate abnormal communication number.

[0124] Step S703: In a case where the abnormal probability is greater than a preset probability, a user to which the candidate abnormal communication number belongs is confirmed as an abnormal gang to which a user to which the known abnormal communication number belongs.

[0125] The feature information of the candidate abnormal communication number refers to feature information related to the candidate abnormal communication number, such as length information and label information of the candidate abnormal communication number. ​​

[0126] The communication number identification model refers to a network model (such as a convolutional neural network model, a deep learning model, etc.) capable of identifying a communication number and determining whether the communication number is an abnormal gang, that is, capable of obtaining feature information of a candidate abnormal communication number, comparing the feature information of the candidate abnormal communication number with feature information of other abnormal communication numbers in a historical database, and determining whether the candidate abnormal communication number belongs to an abnormal gang based on the comparison result.

[0127] The abnormal probability of the candidate abnormal communication number refers to a probability that a user to which the candidate abnormal communication number belongs belongs to an abnormal gang. For example, if the similarity between the feature information of the candidate abnormal communication number and the feature information of other abnormal communication numbers in the historical database is high, the abnormal probability of the candidate abnormal communication number is also high.

[0128] Specifically, the server obtains related data of the candidate abnormal communication number, and performs feature extraction processing on the related data to obtain feature information of the candidate abnormal communication number. The feature information of the candidate abnormal communication number is input into a pre-trained communication number identification model, the feature information of the abnormal communication number is mapped by the communication number identification model to obtain a feature vector of the abnormal communication number, the feature vector is analyzed and processed to obtain an abnormal probability of the candidate abnormal communication number, the abnormal probability is compared with a preset probability to obtain a comparison result, the candidate abnormal communication number with an abnormal probability greater than the preset probability is screened out according to the comparison result, and a user to which the candidate abnormal communication number belongs is confirmed as an abnormal gang of a user to which a known abnormal communication number belongs, that is, the user to which the candidate abnormal communication number belongs is a fraud gang member of the user to which the known abnormal communication number belongs.

[0129] It should be noted that after obtaining the candidate abnormal communication number, suspicious number marking can be performed through artificial telephone verification, or on-site verification, or comparison with the existing recorded fraud database information to determine whether the user to which the candidate abnormal communication number belongs is a real fraud gang member.

[0130] In this embodiment, the feature information of the candidate abnormal communication number is extracted, the feature information is input into a pre-trained communication number identification model, an abnormal probability of the candidate abnormal communication number is obtained, and in the case where the abnormal probability is greater than a preset probability, a user to which the candidate abnormal communication number belongs is confirmed as an abnormal gang of a user to which a known abnormal communication number belongs. In this way, the pre-trained communication number identification model is used to automatically determine which candidate abnormal communication numbers are abnormal gangs of the user to which the known abnormal communication number belongs from the smaller range of candidate abnormal communication numbers after secondary screening, and the entire process does not need to be determined one by one by artificial judgment of the associated communication numbers of the known abnormal communication number, which is beneficial to further improving the abnormal gang identification efficiency.

[0131] In one embodiment, as shown in Figure 8 The step S101 further includes a step of obtaining historical call record information of the known abnormal communication number before updating the call relationship graph according to the historical call record information of the known abnormal communication number. Specifically, the step S101 includes the following steps: a step S801 of obtaining communication data corresponding to the known abnormal communication number.

[0132] A step S802 of screening call record information of the known abnormal communication number in a past preset time period from the communication data as the historical call record information.

[0133] The communication data refers to data information related to the known abnormal communication number, such as historical call record information of the communication number, state information of the communication number, etc.

[0134] The past preset time period refers to a pre-set historical time period. In actual scenarios, the past preset time period refers to the past one month.

[0135] Specifically, the server obtains the communication data corresponding to the known abnormal communication number from a database storing communication data corresponding to a plurality of communication numbers; divides the communication data corresponding to the abnormal communication number by time information to obtain a time information division result of the communication data; and screens call record information of the known abnormal communication number in a past preset time period as historical call record information of the known abnormal communication number according to the time information division result of the communication data.

[0136] In this embodiment, the communication data corresponding to the known abnormal communication number is obtained, and the call record information of the known abnormal communication number in the past preset time period is screened from the communication data as the historical call record information. In this way, since the historical call record information of the known abnormal communication number in the past preset time period is relevant data for abnormal gang identification, by only obtaining the historical call record information of the known abnormal communication number in the past preset time period, without obtaining the historical call record information of the known abnormal communication number in all past time periods, the amount of data to be processed for abnormal gang identification can be further reduced, thereby improving the efficiency of abnormal gang identification.

[0137] In one embodiment, as shown in Figure 9 Another abnormal gang identification method is provided. The method is applied to a server for illustration, and includes the following steps:

[0138] In step S901, historical call record information of a plurality of communication numbers is acquired; the historical call record information of each communication number is parsed to obtain an associated communication number of each communication number; and a call relationship graph is constructed according to each communication number and the associated communication number of each communication number.

[0139] In step S902, communication data corresponding to a known abnormal communication number is acquired; and call record information of the known abnormal communication number in a past preset time period is filtered out from the communication data as historical call record information.

[0140] In step S903, an associated communication number of the known abnormal communication number and a call relationship between the known abnormal communication number and the associated communication number are extracted from the historical call record information.

[0141] In step S904, the known abnormal communication number and the associated communication number are added to the call relationship graph according to the call relationship between the known abnormal communication number and the associated communication number, to obtain an updated call relationship graph.

[0142] In step S905, a number of associated communication numbers of a communication number associated with the known abnormal communication number is determined from the updated call relationship graph as a centrality score of the communication number.

[0143] In step S906, the communication numbers are sorted according to the centrality score to obtain sorted communication numbers; and N communication numbers with high centrality scores are filtered out from the sorted communication numbers as initial abnormal communication numbers; N is a positive integer greater than or equal to 2.

[0144] In step S907, the updated call relationship graph is looped and traversed according to the initial abnormal communication numbers and the known abnormal communication number to obtain a loop traversal result; and the loop traversal result is used to indicate whether the initial abnormal communication numbers and the known abnormal communication number form a call relationship loop.

[0145] In step S908, the initial abnormal communication numbers are filtered according to the loop traversal result to obtain communication numbers that form a call relationship loop with the known abnormal communication number; and the filtered communication numbers are confirmed as candidate abnormal communication numbers.

[0146] In step S909, feature information of the candidate abnormal communication numbers is extracted; and the feature information is input into a pre-trained communication number recognition model to obtain an abnormal probability of the candidate abnormal communication numbers.

[0147] In step S910, in a case where the abnormal probability is greater than a preset probability, a user to which the candidate abnormal communication number belongs is confirmed as an abnormal group of a user to which the known abnormal communication number belongs.

[0148] The abnormal group identification method comprises the following steps: obtaining historical call record information of a plurality of communication numbers, analyzing the historical call record information of each communication number to obtain associated communication numbers of each communication number, and constructing a call relationship graph according to each communication number and the associated communication numbers of each communication number; obtaining communication data corresponding to a known abnormal communication number, screening call record information of the known abnormal communication number in a preset time period in the past from the communication data as historical call record information; extracting associated communication numbers of the known abnormal communication number and a call relationship between the known abnormal communication number and the associated communication numbers from the historical call record information; adding the known abnormal communication number and the associated communication numbers to the call relationship graph according to the call relationship between the known abnormal communication number and the associated communication numbers to obtain an updated call relationship graph; determining a number of associated communication numbers of communication numbers associated with the known abnormal communication number from the updated call relationship graph as a centrality score of the communication numbers; sorting the communication numbers according to the centrality score to obtain sorted communication numbers, screening N communication numbers with higher centrality scores from the sorted communication numbers as initial abnormal communication numbers, wherein N is a positive integer greater than or equal to 2; performing loop traversal on the updated call relationship graph according to the initial abnormal communication numbers and the known abnormal communication number to obtain a loop traversal result; screening communication numbers constituting a call relationship loop with the known abnormal communication number from the initial abnormal communication numbers according to the loop traversal result, and confirming the screened communication numbers as candidate abnormal communication numbers associated with the known abnormal communication number; extracting feature information of the candidate abnormal communication numbers, inputting the feature information into a pre-trained communication number identification model to obtain an abnormal probability of the candidate abnormal communication number; and confirming a user to which the candidate abnormal communication number belongs as an abnormal group of a user to which the known abnormal communication number belongs when the abnormal probability is greater than a preset probability. In this way, when identifying an abnormal group, historical call record information of a known abnormal communication number is obtained first, and the historical call record information is used to update a call relationship graph, communication numbers associated with the known abnormal communication number are obtained from the updated call relationship graph, the communication numbers associated with the known abnormal communication number are screened twice, that is, communication numbers with a centrality score satisfying a preset score condition are screened from the communication numbers associated with the known abnormal communication number, and then communication numbers constituting a call relationship loop with the known abnormal communication number in the updated call relationship graph are screened again from the communication numbers obtained through the first screening, and the communication numbers obtained through the second screening are identified to obtain a corresponding identification result.The technology is beneficial to automatically screening out the communication numbers of the users of the abnormal gang by acquiring the communication numbers associated with the known abnormal communication numbers, and performing a secondary screening process of center degree scoring and loop judgment on the communication numbers by means of the updated call relationship graph, so that only the screened communication numbers need to be identified subsequently, without the need of checking each communication number by manpower, thereby reducing the checking range of the communication numbers, being beneficial to simplifying the abnormal gang identification process, and further improving the identification efficiency of the abnormal gang.

[0149] In one embodiment, in order to more clearly illustrate the abnormal gang identification method provided by the embodiments of the present application, the abnormal gang identification method is specifically described below by taking one specific embodiment. In one embodiment, as shown in Figure 10 The present application also provides a telecommunications gang fraud detection method based on a graph database technology. By means of high-performance graph database technology, and in cooperation with two graph calculation methods of out-degree centrality algorithm and loop self-graph discovery algorithm, the members of the telecommunications fraud gang can be accurately identified. Specifically, the method includes the following contents:

[0150] 1. The server receives a suspicious fraud telephone number, and defines the suspicious fraud telephone number as a node A.

[0151] 2. The server acquires the call record information of the node A, and constructs a call relationship triple-structured data according to the call record information of the node A.

[0152] 3. The server imports the triple-structured data into a graph database (such as Neo4J), and updates the call relationship graph in the original graph database.

[0153] 4. The server runs the out-degree centrality algorithm, acquires the remaining nodes having a call relationship with the node A from the updated call relationship graph in the graph database, determines the center degree scores of the remaining nodes according to the sum of the out-degree and the in-degree of the remaining nodes, and sorts the center degree scores of the remaining nodes from high to low. The nodes (such as the first 5 nodes) with high center degree scores obtained by sorting are high-throughput risk nodes, and the remaining nodes are normal and non-risk nodes.

[0154] 5. The server takes the node A as a loop necessary node, cyclically selects a high-throughput risk node as a second necessary node, for example, a node B. The server performs the loop self-graph discovery algorithm, and detects the loop form by performing full-graph traversal to identify whether the node A and the node B exist in a special connected loop network structure in the graph database.

[0155] 6. If nodes A and B form a loop, the server will confirm that node B is very likely to be a group that defrauds node A and needs to be quickly prioritized for verification. Otherwise, the verification level of node B will be lowered and it will not be prioritized for investigation.

[0156] In the above embodiment, the technology obtains the associated communication numbers of known abnormal communication numbers, and then uses graph database technology to perform a secondary screening process using the in-degree centrality algorithm and the loop self-graph discovery algorithm. This is conducive to automatically screening out the communication numbers of users who may be abnormal gangs, so that only these screened communication numbers need to be identified later, without the need to manually check each communication number one by one, thereby reducing the scope of communication number screening, which is conducive to simplifying the abnormal gang identification process and thus improving the efficiency of abnormal gang identification. At the same time, it can discover large-scale risks that are difficult to discover with traditional methods, and can effectively and clearly distinguish between normal and abnormal high-risk nodes, so as to quickly upgrade the verification efforts of high-risk nodes, thereby improving the efficiency of identifying telecommunications fraud gangs.

[0157] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0158] Based on the same inventive concept, the present application also provides an abnormal group identification device for implementing the abnormal group identification method described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more abnormal group identification device embodiments provided below can be found in the above-mentioned limitations of the abnormal group identification method and will not be repeated here.

[0159] In one embodiment, Figure 11 As shown, an abnormal group identification device is provided, including: a relationship graph updating module 1101, a first screening module 1102, a second screening module 1103 and a result determination module 1104, wherein:

[0160] The relationship graph updating module 1101 is used to update the call relationship graph according to the historical call record information of the known abnormal communication numbers.

[0161] The first screening module 1102 is configured to determine initial abnormal communication numbers from the communication numbers associated with the known abnormal communication numbers in the updated call relationship graph.

[0162] The second screening module 1103 is configured to determine candidate abnormal communication numbers from the initial abnormal communication numbers based on the updated call relationship graph.

[0163] The result determination module 1104 is configured to identify the candidate abnormal communication numbers to obtain corresponding identification results.

[0164] In an embodiment, the first screening module 1102 is further configured to determine, from the updated call relationship graph, a number of associated communication numbers of the communication numbers associated with the known abnormal communication numbers as a centrality score of the communication numbers, sort the communication numbers according to the centrality score to obtain sorted communication numbers, and screen the top N communication numbers in the centrality score from the sorted communication numbers as the initial abnormal communication numbers, where N is a positive integer greater than or equal to 2.

[0165] In an embodiment, the second screening module 1103 is further configured to perform loop traversal on the updated call relationship graph according to the initial abnormal communication numbers and the known abnormal communication numbers to obtain a loop traversal result, where the loop traversal result is used to indicate whether the initial abnormal communication numbers and the known abnormal communication numbers form a call relationship loop, screen the communication numbers that form the call relationship loop with the known abnormal communication numbers from the initial abnormal communication numbers according to the loop traversal result, and confirm the screened communication numbers as the candidate abnormal communication numbers.

[0166] In an embodiment, the relationship graph updating module 1101 is further configured to extract, from the historical call record information, the associated communication numbers of the known abnormal communication numbers and the call relationship between the known abnormal communication numbers and the associated communication numbers, and add the known abnormal communication numbers and the associated communication numbers to the call relationship graph according to the call relationship between the known abnormal communication numbers and the associated communication numbers to obtain the updated call relationship graph.

[0167] In an embodiment, the abnormal gang identification apparatus further includes a relationship graph construction module configured to obtain historical call record information of a plurality of communication numbers, parse the historical call record information of each communication number to obtain associated communication numbers of each communication number, and construct a call relationship graph according to each communication number and the associated communication numbers of each communication number.

[0168] In an embodiment, the result determination module 1104 is further configured to extract feature information of the candidate abnormal communication number; input the feature information into a pre-trained communication number identification model to obtain an abnormal probability of the candidate abnormal communication number; and in a case where the abnormal probability is greater than a preset probability, confirm a user to which the candidate abnormal communication number belongs as a user belonging to an abnormal gang of known abnormal communication numbers.

[0169] In an embodiment, the abnormal gang identification apparatus further includes an information screening module configured to acquire communication data corresponding to the known abnormal communication number; and screen, from the communication data, call record information of the known abnormal communication number in a past preset time period as historical call record information.

[0170] The modules in the abnormal gang identification apparatus described above can be implemented in whole or in part by software, hardware, and combinations thereof. The modules described above can be embedded in a processor in a computer device in hardware form or independent of the processor, or stored in a memory in the computer device in software form, so as to be called and executed by the processor to perform operations corresponding to the modules.

[0171] In an embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in FIG. 8. Figure 12 The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store call record information, a call relationship graph, identification results, and the like. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with terminals outside through a network connection. The computer program is executed by the processor to implement an abnormal gang identification method.

[0172] Those skilled in the art can understand that Figure 12 the structure shown in FIG. 8 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0173] In an embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above-mentioned method embodiments when executing the computer program.

[0174] In an embodiment, a computer readable storage medium is provided, storing a computer program, which, when executed by a processor, implements the steps in the above-mentioned method embodiments.

[0175] In an embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps in the above-mentioned method embodiments.

[0176] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium and can include the processes of the above-mentioned embodiments when executed. Any reference to a memory, database or other medium in the embodiments provided by the present application can include at least one of a non-volatile and volatile memory. The non-volatile memory can include a read-only memory (ROM), a magnetic tape, a floppy disk, a flash memory, an optical storage, a high-density embedded non-volatile memory, a resistive memory (ReRAM), a magnetoresistive random access memory (MRAM), a ferroelectric random access memory (FRAM), a phase change memory (PCM), a graphene memory, etc. The volatile memory can include a random access memory (RAM) or an external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as a static random access memory (SRAM) or a dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0177] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, as long as the combinations of technical features do not contradict each other, they shall be considered within the scope of the present disclosure.

[0178] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it shall not be understood as a limitation on the patent scope of the present application. It should be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these shall be within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. An abnormal group identification method, characterized by, The method comprises: updating a call relationship graph according to historical call record information of a known abnormal communication number; determining a number of associated communication numbers of a communication number associated with the known abnormal communication number from the updated call relationship graph as a centrality score of the communication number, sorting the communication number according to the centrality score to obtain a sorted communication number, and screening N communication numbers with a higher centrality score from the sorted communication number as initial abnormal communication numbers; N is a positive integer greater than or equal to 2; performing loop traversal on the updated call relationship graph according to the initial abnormal communication numbers and the known abnormal communication number to obtain a loop traversal result, wherein the loop traversal result is used to indicate whether the initial abnormal communication numbers and the known abnormal communication number form a call relationship loop, screening a communication number forming a call relationship loop with the known abnormal communication number from the initial abnormal communication numbers according to the loop traversal result, and confirming the screened communication number as a candidate abnormal communication number; identifying the candidate abnormal communication number to obtain a corresponding identification result, wherein the identification result is used to indicate whether a user to which the candidate abnormal communication number belongs is an abnormal group of a user to which the known abnormal communication number belongs.

2. The method of claim 1, wherein, The updating of the call relationship graph according to the historical call record information of the known abnormal communication number comprises: extracting associated communication numbers of the known abnormal communication number and a call relationship between the known abnormal communication number and the associated communication numbers from the historical call record information; adding the known abnormal communication number and the associated communication numbers to the call relationship graph according to the call relationship between the known abnormal communication number and the associated communication numbers to obtain the updated call relationship graph.

3. The method of claim 2, wherein, Before the updating of the call relationship graph according to the historical call record information of the known abnormal communication number, the method further comprises: obtaining historical call record information of a plurality of communication numbers; parsing the historical call record information of each communication number to obtain associated communication numbers of the each communication number; constructing the call relationship graph according to the each communication number and the associated communication numbers of the each communication number.

4. The method of claim 1, wherein, The identification of the candidate abnormal communication number to obtain a corresponding identification result comprises: extracting feature information of the candidate abnormal communication number; inputting the feature information into a pre-trained communication number identification model to obtain an abnormal probability of the candidate abnormal communication number; in a case where the abnormal probability is greater than a preset probability, confirming a user to which the candidate abnormal communication number belongs as an abnormal group of a user to which the known abnormal communication number belongs.

5. The method according to any one of claims 1 to 4, characterized in that, Before the updating of the call relationship graph according to the historical call record information of the known abnormal communication number, the method further comprises: obtaining communication data corresponding to the known abnormal communication number; screening call record information of the known abnormal communication number in a preset time period in the past from the communication data as the historical call record information.

6. An abnormal group identification device characterized by comprising: The device comprises: The relationship graph updating module is configured to update a call relationship graph according to historical call record information of the known abnormal communication number. The first screening module is configured to determine a number of associated communication numbers of the communication numbers associated with the known abnormal communication number from the updated call relationship graph as a centrality score of the communication numbers, sort the communication numbers according to the centrality score to obtain sorted communication numbers, and screen N communication numbers with the highest centrality scores from the sorted communication numbers as initial abnormal communication numbers, where N is a positive integer greater than or equal to 2. The second screening module is configured to perform loop traversal on the updated call relationship graph according to the initial abnormal communication numbers and the known abnormal communication number to obtain a loop traversal result, where the loop traversal result is used to indicate whether the initial abnormal communication numbers and the known abnormal communication number form a call relationship loop, screen communication numbers that form a call relationship loop with the known abnormal communication number from the initial abnormal communication numbers according to the loop traversal result, and confirm the screened communication numbers as candidate abnormal communication numbers. The result determining module is configured to identify the candidate abnormal communication numbers to obtain corresponding identification results.

7. The apparatus of claim 6, wherein, The relationship graph updating module is further configured to extract associated communication numbers of the known abnormal communication number and a call relationship between the known abnormal communication number and the associated communication numbers from the historical call record information, add the known abnormal communication number and the associated communication numbers to the call relationship graph according to the call relationship between the known abnormal communication number and the associated communication numbers, and obtain the updated call relationship graph.

8. The apparatus of claim 6, wherein, The result determining module is further configured to extract feature information of the candidate abnormal communication numbers, input the feature information into a pre-trained communication number identification model to obtain an abnormal probability of the candidate abnormal communication number, and confirm a user to which the candidate abnormal communication number belongs as an abnormal group of a user to which the known abnormal communication number belongs when the abnormal probability is greater than a preset probability. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 5.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5. The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images