Abnormal number re-opening risk level determination method and device, and electronic equipment

Abstract

The application discloses a method and device for determining the risk level of abnormal number reopening and electronic equipment. The method comprises the following steps: obtaining a shutdown data table and a reopening data table, wherein the shutdown data table comprises a shutdown number, a shutdown time, and a home of the shutdown number; the reopening data table comprises a reopening number, a reopening time, and a home of the reopening number; determining a first number of the reopening numbers of a target home in a target time period according to the reopening data table; determining a second number of the numbers that are reopened and then shut down in the target time period of the target home according to the shutdown data table and the reopening data table; and determining a reopening risk level corresponding to the target home according to the first number and the second number. The application solves the technical problem of low data analysis efficiency caused by the complicated process of manual analysis of fraud-related reopening machine data.

Description

Technical Field

[0001] This application relates to the fields of computer technology and software development technology, and more specifically, to a method, apparatus and electronic device for determining the risk level of abnormal number re-opening. Background Technology

[0002] With the development of modern technology, digital activities such as e-commerce and financial transactions are increasing, and data issues involving fraud and false invoicing are becoming increasingly complex. These fraudulent data vary in terms of data source, severity, and analysis rules, leading to complex and lengthy processing procedures. Currently, manual analysis of fraudulent data is cumbersome, resulting in low data analysis efficiency and poor analysis results.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a method, apparatus, and electronic device for determining the risk level of abnormal number re-opening, so as to at least solve the technical problem of low data analysis efficiency caused by the cumbersome process of manually analyzing fraudulent re-opening data.

[0005] According to one aspect of the embodiments of this application, a method for determining the risk level of abnormal number re-opening is provided, comprising: obtaining a shutdown data table and a re-opening data table, wherein the shutdown data table includes: a shutdown number, a shutdown time, and the location corresponding to the shutdown number, and the re-opening data table includes: a re-opening number, a re-opening time, and the location corresponding to the re-opening number; determining a first number of re-opening numbers in a target location within a target time period based on the re-opening data table; determining a second number of numbers in the target location that were reopened and then shut down again in the target time period based on the shutdown data table and the re-opening data table; and determining the re-opening risk level corresponding to the target location based on the first number and the second number, wherein the re-opening risk level is used to characterize the probability that a shutdown number in the target location will become abnormal again after being reopened.

[0006] Optionally, determining the reopening risk level corresponding to the target location based on the first quantity and the second quantity includes: determining the total number of closed numbers in the target location during the target time period based on the shutdown data table; determining the reopening rate based on the total number of closed numbers and the first quantity; and determining the reopening-shutdown rate based on the total number of closed numbers and the second quantity; and determining the reopening risk level based on the reopening rate and the reopening-shutdown rate.

[0007] Optionally, determining the reopening risk level based on the reopening rate and the reopening shutdown rate includes: determining a first risk level corresponding to the reopening rate based on the reopening rate and a preset reopening rate threshold, wherein the first risk level includes: low risk, medium risk, and high risk; determining a second risk level corresponding to the reopening shutdown rate based on the reopening shutdown rate and a preset reopening shutdown rate threshold, wherein the second risk level includes: low risk, medium risk, and high risk; and determining the reopening risk level based on the first risk level and the second risk level.

[0008] Optionally, obtaining the shutdown data table and the reopening data table includes: dividing the collected raw shutdown data according to the shutdown time to obtain a shutdown data table, wherein the shutdown time corresponding to the shutdown number in the same shutdown data table is within the same preset time dimension range; and dividing the collected raw reopening data according to the reopening time to obtain a reopening data table, wherein the reopening time corresponding to the reopening number in the same reopening data table is within the same preset time dimension range.

[0009] Optionally, determining the second number of numbers that were reopened and then closed again within the target time period for the target location includes: identifying target reopened numbers whose location in the reopened data table is the target location and whose reopening time is within the target time period; identifying target closed numbers in the closed data table that are the same as the target reopened numbers, and identifying the closure time corresponding to the target closed numbers; and counting the number of target reopened numbers whose closure time is after the reopening time to obtain the second number.

[0010] Optionally, the method includes: receiving a query instruction from a front-end interactive interface, wherein the query instruction includes a query time range and query conditions, and the query conditions include at least one of the following: source of number closure, location of number, and type of number closure; if the query time range is greater than a preset time dimension range, dividing the query time range into a first time range, a second time range, and a third time range, wherein the first time range extends from the start time of the query time range to the end time of the preset time dimension range corresponding to the start time, the second time range extends from the start time of the preset time dimension range corresponding to the end time of the query time range to the end time of the query time range, and the third time range is the remaining part of the query time range after removing the first and second time ranges; and performing multi-threaded query processing on the closure data table and / or reopening data table corresponding to the first time range, the second time range, and the third time range respectively, according to the query conditions, to obtain the query results.

[0011] Optionally, the method further includes: marking the first quantity and / or second quantity and / or reopening risk level corresponding to each target location onto the target map, and sending the marked target map to the front-end interactive interface for display, wherein the target map includes multiple target locations; and generating a line graph showing the change of the first quantity and / or second quantity corresponding to the target location over time, and sending the line graph to the front-end interactive interface for display.

[0012] According to another aspect of the embodiments of this application, a device for determining the risk level of abnormal number re-opening is also provided, comprising: a data acquisition and processing module for acquiring a shutdown data table and a re-opening data table, wherein the shutdown data table includes: a shutdown number, a shutdown time, and the location corresponding to the shutdown number, and the re-opening data table includes: a re-opening number, a re-opening time, and the location corresponding to the re-opening number; a first parameter determination module for determining a first number of re-opening numbers in a target location within a target time period based on the re-opening data table; a second parameter determination module for determining a second number of numbers in the target location that were reopened and then shut down again in the target time period based on the shutdown data table and the re-opening data table; and a risk level determination module for determining the re-opening risk level corresponding to the target location based on the first and second numbers, wherein the re-opening risk level is used to characterize the probability that a shutdown number in the target location will become abnormal again after being reopened.

[0013] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the program executes a method for determining the risk level of abnormal number re-opening during runtime.

[0014] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes a method for determining the risk level of abnormal number re-opening by running the computer program.

[0015] In this embodiment, a shutdown data table and a reopening data table are obtained. The shutdown data table includes: the shutdown number, the shutdown time, and the location corresponding to the shutdown number. The reopening data table includes: the reopened number, the reopening time, and the location corresponding to the reopened number. Based on the reopening data table, a first number of reopened numbers for the target location within a target time period is determined. Based on the shutdown and reopening data tables, a second number of numbers for the target location that were reopened and then shut down again within the target time period is determined. Based on the first and second numbers, a reopening risk level corresponding to the target location is determined, wherein the reopening risk level is used for... This method, which characterizes the probability of a suspended phone number reactivating after being shut down in a target location, leverages the advantages of distributed storage and computing. It stores the query and analysis results of suspended and reactivated data tables, and then matches the stored data with corresponding analysis rules based on different attributions such as data source, target location, and time. The queried data is then calculated and matched to determine its risk level, which is visualized to intuitively judge data characteristics. This achieves the goal of efficient and rapid data analysis, thereby solving the technical problem of low data analysis efficiency caused by the cumbersome process of manually analyzing fraudulent phone number reactivation data. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a hardware structure block diagram of a computer terminal (or electronic device) for determining the risk level of abnormal number re-opening according to an embodiment of this application;

[0018] Figure 2 This is a schematic diagram of a method for determining the risk level of abnormal number re-opening according to an embodiment of this application;

[0019] Figure 3 This is a schematic diagram of a data acquisition process according to an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of a data storage table creation process according to an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of a data analysis and statistical process provided according to an embodiment of this application;

[0022] Figure 6 This is a schematic diagram of another data analysis and statistical process provided according to an embodiment of this application;

[0023] Figure 7 This is a schematic diagram of a data query process provided according to an embodiment of this application;

[0024] Figure 8 This is a schematic diagram of a device for determining the risk level of abnormal number re-opening according to an embodiment of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] To facilitate a better understanding of the embodiments of this application by those skilled in the art, some technical terms or nouns involved in the embodiments of this application are explained as follows:

[0028] HBase is a distributed database based on Hadoop. It is an open-source, column-oriented, scalable, high-performance NoSQL database. HBase is designed to provide high reliability, high scalability, high performance, and scalability, making it suitable for storing large-scale datasets.

[0029] In related technologies, manual analysis of fraudulent call data is a cumbersome process with low data analysis efficiency and poor results. To address this issue, this application provides a solution, detailed below.

[0030] According to an embodiment of this application, a method for determining the risk level of abnormal number re-opening is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware block diagram of a computer terminal (or electronic device) for implementing a method to determine the risk level of re-opening abnormal phone numbers is shown. Figure 1 As shown, the computer terminal 10 (or electronic device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0032] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or electronic device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal number re-opening risk level determination method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned abnormal number re-opening risk level determination method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0035] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or electronic device).

[0036] Under the above operating environment, this application provides a method for determining the risk level of abnormal number re-opening. Figure 2 This is a schematic diagram of a method for determining the risk level of abnormal number re-opening according to an embodiment of this application, as shown below. Figure 2 As shown, the method includes the following steps:

[0037] Step S202: Obtain the shutdown data table and the reopening data table. The shutdown data table includes: shutdown number, shutdown time, and the location corresponding to the shutdown number. The reopening data table includes: reopening number, reopening time, and the location corresponding to the reopening number.

[0038] Step S204: Based on the re-opening data table, determine the first number of re-opened numbers in the target location within the target time period;

[0039] Step S206: Based on the shutdown data table and the reopening data table, determine the second number of numbers that were reopened and then shut down again in the target time period corresponding to the target location;

[0040] Step S208: Based on the first quantity and the second quantity, determine the reopening risk level corresponding to the target location, wherein the reopening risk level is used to characterize the probability that the closed number in the target location will become abnormal again after reopening.

[0041] Through the above steps, and based on multiple provinces, time points, and data sources, the reopening rate of phone numbers shut down for fraudulent purposes is analyzed. By analyzing and strictly controlling the reopening data according to its characteristics, the reopening status of fraudulent users can be more easily queried, enabling targeted and specific monitoring to protect users' interests. This solves the technical problem of low data analysis efficiency caused by the cumbersome process of manually analyzing data on phone numbers reopened for fraud.

[0042] The method for determining the risk level of abnormal number re-opening in steps S202 to S208 of this application embodiment will be further described below.

[0043] First, data related to fraud from multiple sources was collected. Figure 3 This is a schematic diagram of a data acquisition process according to an embodiment of this application, such as... Figure 3 As shown.

[0044] Specifically, data collection can be conducted by establishing a multi-departmental and multi-field fraud information collection mechanism. After collecting the raw data, the data obtained from different fields or sources can be integrated and processed to extract important data, such as abnormal numbers (e.g., fraudulent numbers), number shutdown time, number reopening time, and number source channels. Among them, fraudulent numbers are numbers related to abnormal behavior (e.g., fraudulent behavior). When users report abnormal behavior, relevant platforms or departments will verify the abnormal behavior and take measures such as shutdown and supervision of the relevant numbers corresponding to the abnormal behavior. In addition, after a certain period of time, the relevant numbers can be reopened. This operation is called reopening.

[0045] For example, the data collection channels mentioned above may include, but are not limited to: receiving emails, reading files, uploading from fraudulent apps, reporting by the public via telephone, uploading from websites, reporting through business halls, and reporting via fraudulent text messages, etc., to ensure data diversity and timely and accurate acquisition of the latest data.

[0046] In addition, to ensure the authenticity and reliability of the collected data, it can be sent to relevant professional institutions for verification to ensure the authenticity of the data information.

[0047] After obtaining the raw data, it can be divided into raw shutdown data and raw reopening data. Then, based on the raw shutdown data and the raw reopening data, a shutdown data table and a reopening data table can be built in the database. The specific steps are as follows.

[0048] In some embodiments of this application, obtaining the shutdown data table and the reopening data table includes the following steps: dividing the collected original shutdown data according to the shutdown time to obtain a shutdown data table, wherein the shutdown time corresponding to the shutdown number in the same shutdown data table is within the same preset time dimension range; and dividing the collected original reopening data according to the reopening time to obtain a reopening data table, wherein the reopening time corresponding to the reopening number in the same reopening data table is within the same preset time dimension range.

[0049] Specifically, Figure 4 This is a schematic diagram of a data storage and table creation process according to an embodiment of this application, such as... Figure 4 As shown, the collected raw shutdown data is stored in tables according to the shutdown time and a preset time dimension range (e.g., month dimension). That is, shutdown data tables are created and stored according to the month. Each shutdown data table contains multiple shutdown entries, and each shutdown entry includes at least: shutdown number, shutdown time, and the location corresponding to the shutdown number.

[0050] Similarly, the collected raw reopening data is divided into tables by month for storage. Each reopening data table contains multiple reopening entries, and each entry includes at least: the reopened number, the reopening time, and the location of the reopened number. By storing data in tables according to a preset time dimension, large batches of data can be processed in batches, reducing database pressure and facilitating subsequent time series analysis.

[0051] In this embodiment, the shutdown data table and the reopen data table can be stored in an HBase database. By storing them in an HBase database, it is convenient to add dynamic columns and save storage space; the data can be automatically split, allowing the data to be horizontally expanded, which is convenient for comparison of various data conditions; in addition, HBase supports high-concurrency read and write operations, which makes it more convenient and faster to access data for a certain period of time.

[0052] In addition, when adding new data entries to the shutdown data table and / or reopen data table, data deduplication will be performed first. If the number of the new entry is the same as the number of the data originally stored in the data table, the data with the latest reopening time or shutdown time will be stored in the data table.

[0053] After obtaining the shutdown data table and the reopening data table, data analysis can be performed based on the shutdown data table and the reopening data table. The following is a further explanation using the statistical process of reopening rate and restart shutdown rate as an example.

[0054] Figure 5 This is a schematic diagram of a data analysis and statistical process provided in an embodiment of this application, such as... Figure 5 As shown in this embodiment, data analysis and statistics can be performed according to different query dimensions (e.g., source, type, target location, shutdown code number, time).

[0055] Specifically, the first number of reactivated numbers in the target region within the target time period can be determined by matching the updated reactivated data table in HBase. For example, the reactivated numbers and reactivated times in a certain province (i.e., the target region) on the same day (i.e., the target time period mentioned above) can be determined, and the number of reactivated numbers 'a' can be counted, which is the first number mentioned above.

[0056] As an optional real-time method, the data tables stored in HBase can be matched based on the target location, reopening time, and shutdown source to determine the reopened numbers and reopening time of a certain source within a certain province (i.e., the target location) on the same day (i.e., the target time period mentioned above), and the number of reopened numbers b can be counted; or, the data tables stored in HBase can be matched based on the target location, reopening time, and shutdown type to determine the reopened numbers and reopening time of a certain type within a certain province (i.e., the target location) on the same day (i.e., the target time period mentioned above), and the number of reopened numbers c can be counted.

[0057] in addition, Figure 6 This is a schematic diagram of another data analysis and statistical process provided according to an embodiment of this application, such as... Figure 6 As shown, matching can also be performed based on the target location, reopening time, closing time, and reopening time. By comparing the reopening time and closing time, the second number d of the numbers that were reopened and then closed again in the target location during the target time period can be determined. For example, the number of numbers that were reopened and then closed again in a certain province (i.e., the target location) on the same day (i.e., the target time period mentioned above). The specific steps are as follows.

[0058] In some embodiments of this application, determining the second number of numbers that were reopened and then shut down again within a target time period for a target location includes the following steps: determining the location of the reopened number in the reopening data table as the target location, and the reopening time being within the target time period for the target reopened number; determining the target shut-down number in the shut-down data table that is the same as the target reopened number, and determining the shutdown time corresponding to the target shut-down number; counting the number of target reopened numbers whose shutdown time is after the reopening time to obtain the second number.

[0059] As an optional implementation, the number of reopened numbers and the percentage of reopened numbers can be counted separately after 3 days, 7 days, and 30 days following the shutdown. The data that is not empty after shutdown can be saved and entered into a newly created statistical analysis table of reopened fraudulent numbers.

[0060] After obtaining the second number d of numbers that were reopened and then closed again within a certain province (i.e., the target location) on the same day (i.e., the target time period mentioned above) and the first number a of numbers that were reopened within a certain province on the same day, the reopening rate and reopening / closing rate corresponding to the target location can be determined based on the first and second numbers. The specific steps are as follows.

[0061] In some embodiments of this application, determining the reopening risk level corresponding to the target location based on the first quantity and the second quantity includes the following steps: determining the total number of closed numbers in the target location within the target time period based on the shutdown data table; determining the reopening rate based on the total number of closed numbers and the first quantity; and determining the reopening shutdown rate based on the total number of closed numbers and the second quantity; and determining the reopening risk level based on the reopening rate and the reopening shutdown rate.

[0062] Specifically, firstly, by using the shutdown data table, determine the total number of shut-down numbers within a certain province (i.e., the target location mentioned above) on that day (i.e., the target time period mentioned above), which is the number of shutdowns within the province. Then, the reopening rate is equal to a / the number of shutdowns within the province, and the reopening / shutdown rate is equal to d / the number of shutdowns within the province.

[0063] After calculating the reopening rate and the reopening shutdown rate, the reopening risk level can be determined by comparing the reopening rate and the reopening shutdown rate with preset thresholds. The specific steps are as follows.

[0064] In some embodiments of this application, determining the reopening risk level based on the reopening rate and the reopening shutdown rate includes the following steps: determining a first risk level corresponding to the reopening rate based on the reopening rate and a preset reopening rate threshold, wherein the first risk level includes: low risk, medium risk, and high risk; determining a second risk level corresponding to the reopening shutdown rate based on the reopening shutdown rate and a preset reopening shutdown rate threshold, wherein the second risk level includes: low risk, medium risk, and high risk; and determining the reopening risk level based on the first risk level and the second risk level.

[0065] For example, the thresholds for the first risk level corresponding to the reopening rate include: low-risk threshold (α), medium-risk threshold (β), and high-risk threshold (γ). The thresholds for the second risk level corresponding to the reopening / shutdown rate include: low-risk threshold (δ), medium-risk threshold (ε), and high-risk threshold (θ). Then, by using the threshold ranges for the first risk level where the reopening rate falls, and the threshold ranges for the second risk level where the reopening / shutdown rate falls, the reopening risk level corresponding to the target location can be determined. For instance, if the reopening rate < α and the reopening / shutdown rate < δ, the reopening risk level corresponding to the target location is Level 1 risk; if α < reopening rate < β and the reopening / shutdown rate < δ, the reopening risk level corresponding to the target location is Level 2 risk; if α < reopening rate < β and δ < reopening / shutdown rate < ε, the reopening risk level corresponding to the target location is Level 3 risk. The risk level is categorized as follows: Level 4 risk if β < reopening rate < γ and reopening / shutdown rate < δ; Level 5 risk if β < reopening rate < γ and δ < reopening / shutdown rate < ε; Level 6 risk if β < reopening rate < γ and ε < reopening / shutdown rate < θ; Level 7 risk if γ < reopening rate and δ < reopening / shutdown rate < ε; Level 8 risk if γ < reopening rate and ε < reopening / shutdown rate < θ; and Level 10 risk if γ < reopening rate and θ < reopening / shutdown rate.

[0066] It should be noted that the risk level correspondence in this application is not limited to the examples above and can be adjusted according to actual needs.

[0067] In this embodiment, the target user can also perform a query by entering a query command on the front-end interactive interface. Figure 7 This is a schematic diagram of a data query process provided according to an embodiment of this application, such as... Figure 7 As shown, the specific steps are as follows.

[0068] In some embodiments of this application, the method includes the following steps: receiving a query instruction from a front-end interactive interface, wherein the query instruction includes a query time range and query conditions, and the query conditions include at least one of the following: source of number closure, location of number, and type of number closure; if the query time range is greater than a preset time dimension range, dividing the query time range into a first time range, a second time range, and a third time range, wherein the first time range starts from the start time of the query time range to the end time of the preset time dimension range corresponding to the start time, the second time range starts from the start time of the preset time dimension range corresponding to the end time of the query time range to the end time of the query time range, and the third time range is the remaining part of the query time range after removing the first and second time ranges; according to the query conditions, performing multi-threaded query processing on the closure data table and / or reopening data table corresponding to the first time range, the second time range, and the third time range respectively to obtain the query results.

[0069] Specifically, the query time range in the query command can be any dimension. After receiving the query command, the query time range set by the user will be analyzed to determine whether the query time range is greater than the preset time dimension range. For example, when the preset time dimension range is months, the query time range will be analyzed to determine whether it is a cross-month query, that is, whether the query time range exceeds one month. If it exceeds, the query time will be divided into three time periods: from the start time of the query to the end of the month (i.e., the first time range mentioned above), the data for the whole month in the middle (i.e., the third time range mentioned above), and from the beginning of the month to the end time of the query (i.e., the second time range mentioned above). Then, the above three time periods will be divided into multiple threads to process the query according to the query conditions, and the query results will be returned to the front-end interactive interface for display.

[0070] As an optional implementation, the method further includes the following steps: marking the first quantity and / or second quantity and / or reopening risk level corresponding to each target location on the target map, and sending the marked target map to the front-end interactive interface for display, wherein the target map includes multiple target locations; and generating a line graph showing the change of the first quantity and / or second quantity corresponding to the target location over time, and sending the line graph to the front-end interactive interface for display.

[0071] Specifically, the number of reopened businesses (first quantity), the number of businesses that reopened and then shut down (second quantity), and the risk level of reopening for each target location (e.g., province, city) can be marked on a map (e.g., different colors can be used to mark different risk levels) to more intuitively and clearly display the key points of the data analysis. In addition, a line chart can be created with time (date) as the horizontal axis and the vertical axis can be the number of fraud cases, the number of reopened businesses, the number of businesses that reopened and shut down, etc., to statistically analyze the data changes of different target locations in different target time periods. This makes it easier to monitor data growth and reopening situations, and thus conduct targeted management based on the data volume and time characteristics of reopening and then shutting down in the target location. Management can be implemented at the target location level, and targeted observation can be conducted on factors such as personnel, phone numbers, and time in this batch, so as to take corresponding preventive measures.

[0072] By creating visual graphics (maps, line graphs) to dynamically display data, it is possible to intuitively determine whether a target location has a high risk level, analyze data characteristics more specifically, and analyze data changes in that target location. This allows for a more intuitive and straightforward analysis of key data points, enabling targeted preventative measures and saving human resources.

[0073] This application's solution utilizes the base number of abnormal numbers, the number of re-opened numbers, and the number of numbers shut down after re-opening in each target location to calculate the re-opening risk level. It offers advantages such as automation, high accuracy, high efficiency, and saving human resources. It makes analyzing large volumes of data more convenient and faster, and has good scalability. It can be flexibly adjusted and optimized according to different data types and needs, thereby meeting the actual needs of diverse fields. It can be applied to multiple fields and various data analysis and statistics, and can be applied to multiple data types, greatly saving development costs. It also enables more efficient and faster analysis of data characteristics for targeted screening.

[0074] According to an embodiment of this application, an embodiment of a device for determining the risk level of abnormal number re-opening is also provided. Figure 8 This is a schematic diagram of a device for determining the risk level of abnormal number re-opening according to an embodiment of this application. Figure 8 As shown, the device includes:

[0075] The data collection and processing module 80 is used to obtain the shutdown data table and the reopening data table. The shutdown data table includes: shutdown number, shutdown time, and the location corresponding to the shutdown number. The reopening data table includes: reopening number, reopening time, and the location corresponding to the reopening number.

[0076] Optionally, obtaining the shutdown data table and the reopening data table includes: dividing the collected raw shutdown data according to the shutdown time to obtain a shutdown data table, wherein the shutdown time corresponding to the shutdown number in the same shutdown data table is within the same preset time dimension range; and dividing the collected raw reopening data according to the reopening time to obtain a reopening data table, wherein the reopening time corresponding to the reopening number in the same reopening data table is within the same preset time dimension range.

[0077] The first parameter determination module 82 is used to determine the first number of re-opened numbers in the target time period based on the re-opening data table;

[0078] The second parameter determination module 84 is used to determine the second number of numbers that were reopened and then closed again in the target time period corresponding to the target location, based on the shutdown data table and the reopening data table.

[0079] Optionally, determining the second number of numbers that were reopened and then closed again within the target time period for the target location includes: identifying target reopened numbers whose location in the reopened data table is the target location and whose reopening time is within the target time period; identifying target closed numbers in the closed data table that are the same as the target reopened numbers, and identifying the closure time corresponding to the target closed numbers; and counting the number of target reopened numbers whose closure time is after the reopening time to obtain the second number.

[0080] The risk level determination module 86 is used to determine the reopening risk level corresponding to the target location based on the first quantity and the second quantity. The reopening risk level is used to characterize the probability that the closed number in the target location will become abnormal again after reopening.

[0081] Optionally, determining the reopening risk level corresponding to the target location based on the first quantity and the second quantity includes: determining the total number of closed numbers in the target location during the target time period based on the shutdown data table; determining the reopening rate based on the total number of closed numbers and the first quantity; and determining the reopening-shutdown rate based on the total number of closed numbers and the second quantity; and determining the reopening risk level based on the reopening rate and the reopening-shutdown rate.

[0082] Optionally, determining the reopening risk level based on the reopening rate and the reopening shutdown rate includes: determining a first risk level corresponding to the reopening rate based on the reopening rate and a preset reopening rate threshold, wherein the first risk level includes: low risk, medium risk, and high risk; determining a second risk level corresponding to the reopening shutdown rate based on the reopening shutdown rate and a preset reopening shutdown rate threshold, wherein the second risk level includes: low risk, medium risk, and high risk; and determining the reopening risk level based on the first risk level and the second risk level.

[0083] Optionally, the device for determining the risk level of abnormal number reactivation is further configured to: receive a query instruction from a front-end interactive interface, wherein the query instruction includes a query time range and query conditions, and the query conditions include at least one of the following: source of number closure, location of number, and type of number closure; if the query time range is greater than a preset time dimension range, divide the query time range into a first time range, a second time range, and a third time range, wherein the first time range extends from the start time of the query time range to the end time of the preset time dimension range corresponding to the start time, the second time range extends from the start time of the preset time dimension range corresponding to the end time of the query time range to the end time of the query time range, and the third time range is the remaining part of the query time range after removing the first and second time ranges; and perform multi-threaded query processing on the closure data table and / or reactivation data table corresponding to the first time range, the second time range, and the third time range respectively, according to the query conditions, to obtain the query results.

[0084] Optionally, the device for determining the risk level of abnormal number re-opening is further configured to: mark the first quantity and / or second quantity and / or re-opening risk level corresponding to each target location on the target map, and send the marked target map to the front-end interactive interface for display, wherein the target map includes multiple target locations; and generate a line graph of the first quantity and / or second quantity corresponding to the target location changing over time, and send the line graph to the front-end interactive interface for display.

[0085] This application's solution can automatically filter and statistically analyze data based on different sources and analysis rules, thereby obtaining accurate analysis results and improving the efficiency and accuracy of data analysis. It avoids the complexity and lengthiness of processing caused by different data sources and analysis rules. Compared to traditional analytical methods, this technology has advantages such as high accuracy, high efficiency, and avoidance of subjectivity and misjudgment. It can conveniently, simply, and intuitively determine the characteristics of data within the time frame of fraud-related re-opening behavior. By creating visual graphs to present the data, it provides more targeted analysis of data characteristics and more intuitive and straightforward analysis of key data points for targeted preventative measures.

[0086] It should be noted that each module in the above-mentioned abnormal number re-opening risk level determination device can be a program module (for example, a set of program instructions to implement a certain specific function) or a hardware module. For the latter, it can be manifested in the following forms, but is not limited to them: each of the above modules is manifested as a processor, or the functions of each of the above modules are implemented by a processor.

[0087] It should be noted that the abnormal number re-opening risk level determination device provided in this embodiment can be used to perform... Figure 2The method for determining the risk level of abnormal number re-opening shown above is also applicable to the embodiments of this application, and will not be repeated here.

[0088] This application embodiment also provides a non-volatile storage medium, which includes a stored computer program. The device containing the non-volatile storage medium executes the following method for determining the risk level of abnormal number re-opening by running the computer program: obtaining a shutdown data table and a re-opening data table, wherein the shutdown data table includes: the shutdown number, the shutdown time, and the location corresponding to the shutdown number; the re-opening data table includes: the re-opening number, the re-opening time, and the location corresponding to the re-opening number; determining a first number of re-opened numbers for the target location within a target time period based on the re-opening data table; determining a second number of numbers for the target location that were reopened and then shut down again within the target time period based on the shutdown data table and the re-opening data table; and determining the re-opening risk level corresponding to the target location based on the first and second numbers, wherein the re-opening risk level characterizes the probability that a shut-down number in the target location will become abnormal again after being reopened.

[0089] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0090] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0091] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0092] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0093] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0094] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0095] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method of determining a risk level of a reorigination risk of an abnormal number, characterized by, include: Obtain the shutdown data table and the reopening data table, wherein the shutdown data table includes: shutdown number, shutdown time, and the location corresponding to the shutdown number; and the reopening data table includes: reopening number, reopening time, and the location corresponding to the reopening number. Based on the aforementioned reactivation data table, determine the first number of reactivated numbers for the target location within the target time period; Based on the shutdown data table and the reopening data table, determine the second number of numbers that were reopened and then shut down again in the target location during the target time period; Based on the first quantity and the second quantity, the reopening risk level corresponding to the target location is determined, wherein the reopening risk level is used to characterize the probability that the closed number in the target location will become abnormal again after reopening.

2. The anomalous number resolution risk level determination method of claim 1, wherein, Based on the first quantity and the second quantity, the reopening risk level corresponding to the target location is determined as follows: Based on the shutdown data table, determine the total number of shut-down phone numbers in the target location within the target time period; The reopening rate is determined based on the total number of the closed numbers and the first number; and the reopening-shutdown rate is determined based on the total number of the closed numbers and the second number. The reopening risk level is determined based on the reopening rate and the reopening shutdown rate.

3. The anomalous number resolution risk level determination method of claim 2, wherein, Based on the reopening rate and the reopening shutdown rate, the reopening risk level is determined as follows: Based on the reopening rate and the preset reopening rate threshold, a first risk level corresponding to the reopening rate is determined, wherein the first risk level includes: low risk, medium risk and high risk; Based on the reconnection and shutdown rate and the preset reconnection and shutdown rate threshold, a second risk level corresponding to the reconnection and shutdown rate is determined, wherein the second risk level includes: low risk, medium risk and high risk; The reopening risk level is determined based on the first risk level and the second risk level.

4. The anomalous number rekey risk level determination method of claim 1, wherein, Retrieving the shutdown and reopening data tables includes: Based on the shutdown time, the collected raw shutdown data is divided to obtain the shutdown data table, wherein the shutdown time corresponding to the shutdown number in the same shutdown data table is within the same preset time dimension range; and, Based on the reopening time, the collected original reopening data is divided to obtain the reopening data table, wherein the reopening time corresponding to the reopening number in the same reopening data table is within the same preset time dimension range.

5. The anomalous number rekey risk level determination method of claim 4, wherein, The second number of numbers whose target location was reopened and then closed again during the target time period includes: The location corresponding to the reactivated number in the reactivated data table is determined to be the target location, and the reactivated time is within the target time period for the target reactivated number; Identify the target shutdown number that is the same as the target reopening number in the shutdown data table, and determine the shutdown time corresponding to the target shutdown number; The second quantity is obtained by counting the number of target reopened numbers after the shutdown time and the reopening time.

6. The anomalous number resolution risk level determination method of claim 5, wherein, The method includes: Receive a query command from the front-end interactive interface, wherein the query command includes a query time range and query conditions, and the query conditions include at least one of the following: source of number shutdown, location of number, and type of number shutdown; If the query time range is greater than the preset time dimension range, the query time range is divided into a first time range, a second time range, and a third time range. The first time range starts from the start time of the query time range and ends at the end time of the preset time dimension range corresponding to the start time. The second time range starts from the start time of the preset time dimension range corresponding to the end time of the query time range and ends at the end time of the query time range. The third time range is the remaining part of the query time range after removing the first time range and the second time range. According to the query conditions, multi-threaded query processing is performed on the shutdown data table and / or reopen data table corresponding to the first time range, the second time range, and the third time range respectively to obtain the query results.

7. The anomalous number rekey risk level determination method of claim 1, wherein, The method further includes: The first quantity and / or the second quantity and / or the reopening risk level corresponding to each of the aforementioned target locations are marked on the target map, and the marked target map is sent to the front-end interactive interface for display, wherein the target map includes multiple target locations; and, Generate a line graph showing the change of the first quantity and / or the second quantity corresponding to the target location over time, and send the line graph to the front-end interactive interface for display.

8. An abnormal number reconnection risk level determination apparatus characterized by comprising: include: The data collection and processing module is used to obtain the shutdown data table and the reopening data table. The shutdown data table includes: shutdown number, shutdown time, and the location corresponding to the shutdown number. The reopening data table includes: reopening number, reopening time, and the location corresponding to the reopening number. The first parameter determination module is used to determine the first number of reactivated numbers in the target time period based on the reactivated data table; The second parameter determination module is used to determine, based on the shutdown data table and the reopening data table, the second number of numbers whose target location was reopened and then shut down again in the target time period; The risk level determination module is used to determine the reopening risk level corresponding to the target location based on the first quantity and the second quantity, wherein the reopening risk level is used to characterize the probability that the closed number in the target location will become abnormal again after reopening.

9. An electronic device, comprising: include: A memory and a processor, the processor being configured to run a program stored in the memory, wherein the program, when running, executes the method for determining the risk level of abnormal number re-opening as described in any one of claims 1 to 7.

10. A non-volatile storage medium, comprising: The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the method for determining the risk level of abnormal number re-opening as described in any one of claims 1 to 7 by running the computer program.

Images