Anti-telecom network fraud dissuasion processing method based on big data

Abstract

The present invention relates to the field of telecommunication network security technology, and discloses an anti-telecommunication network fraud dissuasion processing method based on big data; the method comprises training a machine learning model for predicting an electric fraud state value based on historical training data, collecting behavioral characteristics of real-time telecommunication network communications, judging whether to enter an anti-telecommunication network fraud dissuasion mode, collecting real-time comprehensive electric fraud data, predicting a real-time electric fraud state value, judging whether to issue a dissuasion prompt, marking abnormal over-limit data, and generating and executing a dissuasion instruction; compared with the prior art, the method can accurately and quickly predict a real-time electric fraud state value based on comprehensive electric fraud data and a machine learning model, judge whether a user has suffered from telecommunication network fraud, and differentiate the degree of harm of telecommunication network fraud by level through behavioral characteristics, thereby formulating corresponding dissuasion instructions according to different degrees of harm, and ensuring that the user's property loss can be accurately avoided at the first time.

Description

Technical Field

[0001] The present invention relates to the field of telecommunication network security technology, and more specifically, to an anti-telecommunication network fraud dissuasion processing method based on big data. Background Art

[0002] Telecom network fraud usually achieves the purpose of deception by impersonating others and counterfeiting and forging various legal guises and forms. In order to effectively prevent and respond to telecom network fraud, it is necessary to establish a complete anti-telecom network fraud system to accurately and quickly identify potential telecom network fraud phenomena, and promptly dissuade telecom network fraud to avoid unnecessary property losses.

[0003] The patent application with reference publication number CN117455498A discloses an intelligent dissuasion system and method for anti-telecom fraud, which obtains the phone number of potential victims by analyzing and mining the warning data, and controls the calls according to the risk level; then adopts different disposal strategies according to different risk levels, such as sending warning text messages to potential victims with low risk levels, and reminding users of the types of fraud they may face and preventive measures through simple and clear text; such as initiating intelligent voice calls to potential victims with medium risk levels, and conducting interactive dialogues with users through natural language processing and voice recognition technology, and generating alerts according to preset dialogue templates. The system converts the corresponding conversation content into speech signals through speech synthesis technology and outputs them to users. It also converts their replies into text signals through speech recognition technology and inputs them into the system. It also performs natural language processing and sentiment analysis on the text signals to determine whether the user has been deceived or has a tendency to be deceived, and gives corresponding dissuasion and guidance. For example, it transfers the manual service call to potential victims with high risk levels, and professional police officers or staff of the anti-fraud center communicate and educate the users, and conduct more flexible and effective dialogues and guidance based on the actual situation and needs of the users. It then generates disposal results based on different disposal strategies and feeds them back to the National Anti-Fraud Center.

[0004] The prior art has the following deficiencies:

[0005] The existing anti-telecom network fraud dissuasion method analyzes and warns potential telecom network fraud victims through direct screening and mining of large databases, thereby achieving a dissuasion effect on telecom network fraud. However, due to the large number of users who are potentially victims of telecom network fraud, directly analyzing a large number of users for telecom network fraud will result in a large amount of data involved in the analysis, and it will be impossible to identify and eliminate obvious non-telecom network fraud data, thereby increasing the workload of telecom network fraud analysis and dissuasion processing, and failing to achieve an efficient anti-telecom network fraud dissuasion effect.

[0006] In view of this, the present invention proposes an anti-telecom network fraud dissuasion processing method based on big data to solve the above problems. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: an anti-telecom network fraud dissuasion processing method based on big data, applied to an anti-fraud server, comprising:

[0008] S1: Collect historical training data of telecommunication network communications, including comprehensive fraud data and fraud status values;

[0009] S2: Based on historical training data, train a machine learning model to predict the status value of online fraud;

[0010] S3: Collecting the behavioral characteristics of real-time telecommunication network communications and, based on the behavioral characteristics, determining whether to enter the anti-telecom network fraud dissuasion mode;

[0011] S4: Collect real-time comprehensive fraud data, predict the real-time fraud status value based on the trained machine learning model, and determine whether to issue a dissuasion prompt;

[0012] S5: Compare the comprehensive electronic fraud data with the corresponding safety value, mark the abnormal and excessive data, and count the number of abnormal and excessive data;

[0013] S6: Generate and execute a dissuasion instruction based on the amount of abnormal over-limit data.

[0014] Furthermore, the comprehensive fraud data includes the proportion of sensitive texts, communication anomalies, account fund flow, and call duration values;

[0015] Methods for obtaining the proportion of sensitive text include:

[0016] Identify the communication language in telecommunication network communication by natural language processing technology to obtain the text to be identified;

[0017] Compare the text to be identified with the sensitive words stored in the anti-fraud center database one by one;

[0018] When the text to be recognized is consistent with the pre-stored sensitive words, the text to be recognized is marked as sensitive text;

[0019] The first time when the sensitive text appears is recorded as the starting time. When the sensitive text no longer appears within the preset number of words to be compared, the last time when the sensitive text appears is recorded as the ending time.

[0020] Count the number of sensitive texts in the time period from the start time to the end time, and obtain i sensitive texts;

[0021] When i exceeds the preset number threshold, the number of words in the i sensitive texts is accumulated and compared with the total number of words in the text to be identified to obtain the proportion of sensitive words;

[0022] The expression of sensitive word proportion is:

[0023]

[0024] Where, MG bz is the proportion of sensitive words, WB zl is the total number of characters to be recognized, ZS mga is the number of words in the ath sensitive text.

[0025] Furthermore, the method for obtaining the communication abnormality degree includes:

[0026] Mark the number currently communicating with the user through the telecommunication network as the target number;

[0027] Obtain the communication records of the target number before the current time from the communication service database, record them as original communication records, and divide the original communication records into p communication units;

[0028] Query the communication status between the target number and different numbers in p communication units, and count the number of numbers whose communication status is not connected and the number of numbers whose communication status is connected, and obtain p first quantity values ​​and p second quantity values ​​respectively;

[0029] Assigning different weight factors to the p first quantity values ​​and the p second quantity values ​​respectively, adding them together, and comparing them with the duration corresponding to the preset communication cycle to obtain p sub-abnormality degrees;

[0030] The expression of sub-abnormality is:

[0031]

[0032] In the formula, YC zp is the pth sub-abnormality, ZQ ys The duration of the preset communication cycle, SL 1p is the pth first quantity value, SL 2p is the pth second quantity value, is the weight factor;

[0033] The sub-abnormality degree greater than the preset abnormality threshold is recorded as the effective abnormality degree, and m effective abnormality degrees are obtained. The m effective abnormality degrees are accumulated and averaged to obtain the communication abnormality degree;

[0034] The expression of communication abnormality is:

[0035]

[0036] In the formula, YCtx is the communication abnormality, YC zb is the bth effective abnormality degree.

[0037] Furthermore, the method for obtaining the liquidity of account funds includes:

[0038] Mark the third-party fund account appearing in the text to be identified as the target account;

[0039] Query all transaction data in the target account and identify the withdrawal address, transfer address and account opening address in the transaction data;

[0040] The transaction data whose fund withdrawal address and fund transfer address are inconsistent with the account opening address are recorded as abnormal data, and the number of abnormal data is counted;

[0041] The first time when abnormal data appears is recorded as the abnormal starting point, and the last time when abnormal data appears is recorded as the abnormal end point;

[0042] After comparing the difference between the abnormal end point and the abnormal start point, the abnormal duration is obtained;

[0043] The expression for the abnormal duration is:

[0044] SJ cx =YC zd -YC qd :

[0045] In the formula, SJ cx is the abnormal duration, YC zd For abnormal endpoints, YC qd is the abnormal starting point;

[0046] Compare the number of abnormal data with the duration of abnormality to obtain the liquidity of account funds;

[0047] The expression of account liquidity is:

[0048]

[0049] In the formula, ZJ ld is the liquidity of account funds, SL yc is the number of abnormal data.

[0050] Furthermore, the training method of the machine learning model for predicting the fraud status value includes:

[0051] The comprehensive electronic fraud data is converted into a corresponding set of feature vectors, the feature vectors are used as the input of the machine learning model, and the electronic fraud status value corresponding to each set of comprehensive electronic fraud data is used as the output of the machine learning model. The electronic fraud status value is used as the prediction target, and minimizing the sum of prediction errors of all training data is used as the training target. The machine learning model is trained until the sum of prediction errors converges and the training is stopped.

[0052] Furthermore, the behavioral features include the note status and word length;

[0053] The methods for judging whether to enter the anti-telecom fraud dissuasion mode include:

[0054] Mark the number that communicates with the target number through the telecommunications network as the user number, mark the device where the user number is located as the user device, and obtain the original address book stored in the user device;

[0055] Match the target number with the note tag in the original address book to obtain the note status;

[0056] Count the number of digits in the target number and obtain the word length;

[0057] When the remark status is no remark and the length of the word count is not 11, it is judged to enter the anti-telecom fraud dissuasion mode;

[0058] When the remark status is no remark and the length of the word is 11, it is determined not to enter the anti-telecom fraud dissuasion mode;

[0059] When the remark status is "With Remarks" and the length of the word count is not 11, it is determined that the anti-telecom fraud dissuasion mode will not be entered;

[0060] When the remark status is "With Remarks" and the word length is 11, it is determined that the anti-telecom fraud dissuasion mode will not be entered.

[0061] Furthermore, the electronic fraud status value includes normal communication and abnormal communication;

[0062] The methods for determining whether to issue a dissuasion prompt include:

[0063] When the real-time electronic fraud status value is normal communication, it is determined that no dissuasion prompt will be issued;

[0064] When the real-time electronic fraud status value is abnormal communication, a dissuasion prompt is issued.

[0065] Furthermore, the marking method of abnormal over-limit data includes:

[0066] Compare the sensitive text proportion with the preset proportion safety value. When the sensitive text proportion is greater than the preset proportion safety value, the sensitive text proportion is marked as abnormal over-limit data;

[0067] The communication abnormality is compared with a preset communication safety value, and when the communication abnormality is greater than the preset communication safety value, the communication abnormality is marked as abnormal over-limit data;

[0068] Compare the account fund liquidity with the preset liquidity safety value. When the account fund liquidity is greater than the preset liquidity safety value, the account fund liquidity is marked as abnormal excess data.

[0069] The call duration value is compared with a preset duration safety value. When the call duration value is greater than the preset duration safety value, the call duration value is marked as abnormal over-limit data.

[0070] Furthermore, the dissuasion instruction includes an emergency dissuasion instruction and a real-time dissuasion instruction;

[0071] The method for generating the emergency dissuasion instruction and the real-time dissuasion instruction includes:

[0072] When the number of abnormal over-limit data is 3 or 4, an emergency dissuasion instruction is generated;

[0073] When the number of abnormal over-limit data is 1 or 2, a real-time dissuasion instruction is generated.

[0074] Furthermore, the execution method of the emergency dissuasion instruction and the real-time dissuasion instruction includes:

[0075] When an emergency dissuasion instruction is generated, the anti-fraud server queries the number of the emergency contact associated with the user number through the communication service database, sends a dissuasion message to the user number, and makes a dissuasion call to the number of the emergency contact;

[0076] When a real-time dissuasion instruction is generated, the anti-fraud server sends a dissuasion message to the user number.

[0077] The technical effects and advantages of the anti-telecom network fraud dissuasion processing method based on big data of the present invention are as follows:

[0078] The present invention collects historical training data of telecommunication network communication, the historical training data includes comprehensive fraud data and fraud status value, trains a machine learning model for predicting fraud status value based on the historical training data, collects behavioral characteristics of real-time telecommunication network communication, and judges whether to enter the anti-telecommunication network fraud dissuasion mode based on the behavioral characteristics, collects real-time comprehensive fraud data, predicts the real-time fraud status value based on the trained machine learning model, and judges whether to issue a dissuasion prompt, compares the comprehensive fraud data with the corresponding safety value, marks abnormal over-limit data, and counts the number of abnormal over-limit data, and generates and executes a dissuasion instruction based on the number of abnormal over-limit data; compared with the existing The technology can accurately and quickly predict the real-time telecom fraud status value based on comprehensive telecom fraud data and machine learning models, determine whether the user has been defrauded by telecommunications network fraud, and conduct preliminary identification of telecom network fraud through behavioral characteristics, eliminate obvious non-telecom network fraud data, reduce the analysis workload of telecom network fraud, and differentiate the degree of harm of telecom network fraud based on the number of abnormal and excessive data, so as to formulate corresponding dissuasion instructions according to different degrees of harm, and send telecom network fraud dissuasion information to users at the same time, ensuring that the user's property loss can be accurately avoided in the first time, which is also conducive to the rapid development of a safe and healthy telecommunications network communication environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 A flowchart of an anti-telecom fraud dissuasion processing method based on big data provided in Example 1 of the present invention;

[0080] Figure 2 A schematic diagram of an anti-telecom fraud dissuasion processing system based on big data provided in Example 2 of the present invention;

[0081] Figure 3 A logical schematic diagram of the big data-based anti-telecom network fraud dissuasion processing method provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0083] Example 1: Please refer to Figure 1 and Figure 3 As shown, the anti-telecom network fraud dissuasion processing method based on big data described in this embodiment is applied to an anti-fraud server, including:

[0084] S1: Collect historical training data of telecommunication network communications, including comprehensive fraud data and fraud status values;

[0085] Comprehensive telecom fraud data refers to data that can indicate changes in telecom fraud when it occurs, thereby indicating some specific data in telecom fraud and identifying whether the subsequent data is telecom fraud;

[0086] Comprehensive fraud data includes the proportion of sensitive texts, communication anomalies, account fund flow, and call duration;

[0087] The sensitive text ratio refers to the ratio of the number of words in telecommunication network communications that are judged to be sensitive text to the total number of words in the text within a specific time span. The larger the sensitive text ratio, the more sensitive words appear in telecommunication network communications, the more sensitive text words there are, the more abnormal the telecommunication network communication status is, and the higher the probability of telecommunication network fraud occurs;

[0088] Methods for obtaining the proportion of sensitive text include:

[0089] Identify the communication language in telecommunication network communication by natural language processing technology to obtain the text to be identified;

[0090] Compare the text to be identified with the sensitive words stored in the anti-fraud center database one by one; the stored sensitive words are summarized based on the words that appear frequently in telecommunications network fraud in the past, including but not limited to bank cards, suspected crimes, winning prizes, transfers, and verification codes;

[0091] When the text to be recognized is consistent with the pre-stored sensitive words, the text to be recognized is marked as sensitive text;

[0092] The time when the sensitive text appears for the first time is recorded as the starting time. When the sensitive text no longer appears within the preset comparison number of words, the time when the sensitive text appears for the last time is recorded as the ending time. The preset comparison number of words refers to the maximum number of words between two adjacent sensitive texts. When the sensitive text no longer appears within the preset comparison number of words, it means that a statistical time of the sensitive text ends. The preset comparison number of words is obtained by collecting a large number of words between two adjacent sensitive texts in history and optimizing the coefficient.

[0093] Count the number of sensitive texts in the time period from the start time to the end time, and obtain i sensitive texts;

[0094] When i exceeds the preset quantity threshold, the number of characters in i sensitive texts is accumulated and compared with the total number of characters in the text to be identified to obtain the proportion of sensitive words; the preset quantity threshold is the basis for limiting the minimum value of the number of sensitive texts. When the number of sensitive texts is less than the preset quantity threshold, it means that the number of sensitive texts will not be determined as influencing data of telecommunications network fraud; the preset quantity threshold is obtained by collecting a large number of sensitive texts that have been determined as telecommunications network fraud in history and taking the average value;

[0095] The expression of sensitive word proportion is:

[0096]

[0097] Where, MG bz is the proportion of sensitive words, WB zl is the total number of characters to be recognized, ZS mga is the number of words in the ath sensitive text;

[0098] Communication anomaly refers to the frequency of broadcast communications by the other party's phone number in a specific time period during telecommunication network communications. The greater the communication anomaly, the more times the other party's phone number broadcasts communications within a specific time period. At this time, the more abnormal the telecommunication network communication status is, the higher the probability of telecommunication network fraud.

[0099] Methods for obtaining the communication abnormality degree include:

[0100] Mark the number currently communicating with the user through the telecommunication network as the target number;

[0101] Obtain the communication records of the target number before the current time from the communication service database, record them as original communication records, and divide the original communication records into p communication units;

[0102] Query the communication status of the target number and different numbers in p communication units, and count the number of unconnected communication states and the number of connected communication states, and obtain p first quantity values ​​and p second quantity values ​​respectively; by counting the number of unconnected calls and the number of connected calls, the number of dialed calls of the target number can be accurately obtained, thereby ensuring the calculation accuracy of the target number communication abnormality;

[0103] The p first quantity values ​​and the p second quantity values ​​are respectively assigned different weight factors and then added, and compared with the duration corresponding to the preset communication cycle to obtain p sub-abnormality degrees;

[0104] The expression of sub-abnormality is:

[0105]

[0106] In the formula, YC zpis the pth sub-abnormality, ZQ ys The duration of the preset communication cycle, SL 1p is the pth first quantity value, SL 2p is the pth second quantity value, is the weight factor;

[0107] in, For example, is 0.442, is 0.558; it should be noted that the size of the weight factor is a specific value obtained by quantifying each data, which is convenient for subsequent comparison. The size of the weight factor depends on the number of the first quantity value and the second quantity value and the preliminary setting of the corresponding weight factor for each group of the first quantity value and the second quantity value by those skilled in the art;

[0108] The sub-abnormality degree greater than the preset abnormality threshold is recorded as the effective abnormality degree, and m effective abnormalities are obtained. The m effective abnormalities are accumulated and averaged to obtain the communication abnormality degree; the preset abnormality threshold is the minimum value of the sub-abnormality degree to be judged as the effective abnormality degree, which can distinguish the size of the sub-abnormality degree, and at the same time improve the numerical basis of the effective abnormality degree, avoiding the burden of a large number of sub-abnormalities with small values ​​on subsequent calculations; the preset abnormality threshold is obtained by collecting a large number of historical effective abnormalities and calculating their average value;

[0109] The expression of communication abnormality is:

[0110]

[0111] In the formula, YC tx is the communication abnormality, YC zb is the bth effective abnormality degree;

[0112] Account fund liquidity refers to the frequency of abnormal changes in funds in third-party accounts during telecommunications network communications. The greater the account fund liquidity, the more frequent abnormal changes in funds in third-party accounts. At this time, the more abnormal the telecommunications network communication status is, the higher the probability of telecommunications network fraud.

[0113] Methods for obtaining account liquidity include:

[0114] Mark the third-party fund account appearing in the text to be identified as the target account;

[0115] Query all transaction data in the target account and identify the withdrawal address, transfer address and account opening address in the transaction data;

[0116] The transaction data whose fund withdrawal address and fund transfer address are inconsistent with the account opening address are recorded as abnormal data, and the number of abnormal data is counted;

[0117] The first time when abnormal data appears is recorded as the abnormal starting point, and the last time when abnormal data appears is recorded as the abnormal end point;

[0118] After comparing the difference between the abnormal end point and the abnormal start point, the abnormal duration is obtained;

[0119] The expression for the abnormal duration is:

[0120] SJ cx =YC zd -YC qd :

[0121] In the formula, SJ cx is the abnormal duration, YC zd For abnormal endpoints, YC qd is the abnormal starting point;

[0122] Compare the number of abnormal data with the duration of abnormality to obtain the liquidity of account funds;

[0123] The expression of account liquidity is:

[0124]

[0125] In the formula, ZJ ld is the liquidity of account funds, SL yc is the number of abnormal data;

[0126] The call duration value refers to the real-time call duration with an unfamiliar number in telecommunication network communications. When the call duration value is larger, the other party can input more fraudulent information through the telecommunication network and avoid the communication opportunities between the user and other people. At this time, the more abnormal the telecommunication network communication status is, the higher the probability of telecommunication network fraud occurs. The call duration value is obtained by querying the communication service database;

[0127] The electronic fraud status value is used to indicate whether the telecommunications network communication is in the type of telecommunications network fraud. Generally, the electronic fraud status value includes normal communication and abnormal communication. Normal communication indicates that the telecommunications network communication is normal communication and there is no fraud phenomenon. Abnormal communication indicates that the telecommunications network communication is not normal communication and there is fraud phenomenon. The electronic fraud status value is obtained by collecting comprehensive electronic fraud data when the electronic fraud status value is in normal communication state and abnormal communication state in an experimental environment.

[0128] S2: Based on historical training data, train a machine learning model to predict the status value of online fraud;

[0129] The training methods for the machine learning model that predicts the fraud status value include:

[0130] The comprehensive electronic fraud data is converted into a corresponding set of feature vectors, and the feature vectors are used as the input of the machine learning model. The electronic fraud status value corresponding to each set of comprehensive electronic fraud data is used as the output of the machine learning model. The electronic fraud status value is used as the prediction target, and the sum of the prediction errors of all training data is minimized as the training target. The machine learning model is trained until the sum of the prediction errors reaches convergence and the training is stopped.

[0131] Exemplarily, the machine learning model is any one of a CNN neural network model or AlexNet;

[0132] The calculation formula for the prediction error is:

[0133] zk=(ak-wk) 2 ;

[0134] Where zk is the prediction error, k is the group number of the feature vector; ak is the predicted state value corresponding to the kth group of feature vectors, and wk is the actual state value corresponding to the kth group of training data;

[0135] In the machine learning model, the feature vector is the comprehensive fraud data, the state value is the fraud state value, and other model parameters of the machine learning model, such as the target loss value, optimization algorithm, the ratio of the training set, the test set, and the validation set, as well as the optimization of the loss function, are all obtained through actual engineering implementation and continuous experimental tuning.

[0136] S3: collect the behavioral characteristics of real-time telecommunication network communications, and determine whether to enter the anti-telecom network fraud dissuasion mode based on the behavioral characteristics; if not, repeat S3; if entering the anti-telecom network fraud dissuasion mode, execute S4;

[0137] When a machine learning model is needed to predict the fraud status value of telecommunication network communication, it is necessary to collect the behavior characteristics of telecommunication network communication in advance, and determine whether it is necessary to predict the fraud status value of this telecommunication network communication based on the behavior characteristics;

[0138] Behavioral characteristics refer to specific behavioral parameters in real-time telecommunications network communications, which are used to make a preliminary judgment on the status of behavioral data, thereby providing an accurate basis for predicting whether to conduct subsequent fraud status values;

[0139] Behavioral features include note status and word length;

[0140] The remark status is used to indicate whether the target number in this telecommunication network communication has been labeled and commented in the local machine. Usually, the remark status includes with remark and without remark. When there is no remark, it means that the target number is an unfamiliar number without remark. The word length is used to indicate the digit length of the target number in this telecommunication network communication. Usually, the word length is 11. When the word length is not 11, it means that the target number is not a normal number.

[0141] The anti-telecom fraud dissuasion mode refers to the mode that needs to be entered to dissuade the current telecommunications network communication from being a telecommunications fraud. When it is necessary to dissuade telecommunications network fraud, it is necessary to do so in the anti-telecom fraud dissuasion mode to ensure the normal dissuasion behavior and dissuasion effect;

[0142] The methods for judging whether to enter the anti-telecom fraud dissuasion mode include:

[0143] Mark the number that communicates with the target number through the telecommunications network as the user number, mark the device where the user number is located as the user device, and obtain the original address book stored in the user device;

[0144] Match the target number with the note tag in the original address book to obtain the note status;

[0145] Count the number of digits in the target number and obtain the word length;

[0146] When the remark status is no remark and the length of the word is not 11, it means that the target number is not a number stored in the user's device, and the target number is not a number of regular length, then it is judged to enter the anti-telecom fraud dissuasion mode;

[0147] When the remark status is no remark and the length of the characters is 11, it means that the target number is not a number stored in the user's device, and the target number is a number of regular length, so it is determined not to enter the anti-telecom fraud dissuasion mode;

[0148] When the remark status is "With Remarks" and the length of the characters is not 11, it means that the target number is a number stored in the user's device and the target number is not a number of regular length, and it is determined not to enter the anti-telecom fraud dissuasion mode;

[0149] When the remark status is "With Remarks" and the length of the characters is 11, it means that the target number is a number stored in the user's device and the target number is a number of regular length, and it is determined not to enter the anti-telecom fraud dissuasion mode;

[0150] S4: Collect real-time comprehensive fraud data, predict the real-time fraud status value based on the trained machine learning model, and determine whether to issue a dissuasion prompt; if it is determined to issue a dissuasion prompt, execute S5; if it is determined not to issue a dissuasion prompt, execute S3; the fraud status value includes normal communication and abnormal communication;

[0151] Collect real-time comprehensive fraud data of telecommunications network communications, and output the fraud status value corresponding to the real-time comprehensive fraud data through the trained machine learning model;

[0152] When the output of the electronic fraud status value of the machine learning model is 1, it indicates that the state of the telecommunications network communication is normal, and the electronic fraud status value is normal communication; when the electronic fraud status value of the machine learning model is 0, it indicates that the state of the telecommunications network communication is abnormal, and the electronic fraud status value is abnormal communication;

[0153] Whether to issue a dissuasion prompt is used to issue a warning message to dissuade real-time telecommunications network communications after they are predicted to be telecommunications network fraud, thereby providing a dissuasion prompt for real-time telecommunications network communications to ensure that the warning dissuasion message can be issued in the first place and accurately;

[0154] The methods for determining whether to issue a dissuasion prompt include:

[0155] When the real-time telecom fraud status value is normal communication, it means that the real-time telecommunication network communication does not belong to telecommunication network fraud, and it is determined that no dissuasion prompt will be issued;

[0156] When the real-time telecom fraud status value is abnormal communication, it means that the real-time telecommunication network communication belongs to telecommunication network fraud, and a dissuasion prompt is issued;

[0157] S5: Compare the comprehensive electronic fraud data with the corresponding safety value, mark the abnormal and excessive data, and count the number of abnormal and excessive data;

[0158] Abnormal over-limit data refers to data that is judged to be abnormal after comparing the proportion of sensitive text, communication anomaly, account fund flow and call duration in the comprehensive telecom fraud data with the corresponding security values. It is used to accurately describe the abnormal situation of the comprehensive telecom fraud data and to express the degree of harm of telecom network fraud by counting the number of abnormal over-limit data;

[0159] The marking methods for abnormal and out-of-limit data include:

[0160] Compare the sensitive text proportion with the preset proportion safety value; the preset proportion safety value is used to limit the maximum value of the sensitive text proportion, that is, to distinguish the safe range and dangerous range of the sensitive text proportion; the preset proportion safety value is obtained by collecting a large number of electronic fraud status values ​​as the maximum value of the sensitive text proportion during normal communication;

[0161] When the proportion of sensitive text is greater than the preset safety value, it means that the proportion of sensitive text in telecommunications network communications exceeds the safety range. At this time, the proportion of sensitive text will become data for judging telecommunications network fraud, and the proportion of sensitive text will be marked as abnormal over-limit data;

[0162] The communication anomaly degree is compared with a preset communication safety value; the preset communication safety value is used to limit the maximum value of the communication anomaly degree, that is, to distinguish the communication anomaly degree from the safe range and the dangerous range; the preset communication safety value is obtained by collecting a large number of electronic fraud status values ​​as the maximum value of the communication anomaly degree during normal communication;

[0163] When the communication anomaly is greater than the preset communication safety value, it means that the communication anomaly in the telecommunications network communication exceeds the safety range. At this time, the communication anomaly will become data for judging telecommunications network fraud, and the communication anomaly will be marked as abnormal over-limit data;

[0164] Compare the account fund liquidity with the preset liquidity safety value; the preset liquidity safety value is used to limit the maximum value of the account fund liquidity, that is, to distinguish the account fund liquidity from the safe range and the dangerous range; the preset liquidity safety value is obtained by collecting a large number of electronic fraud status values ​​as the maximum value of the account fund liquidity during normal communication;

[0165] When the account fund liquidity is greater than the preset liquidity safety value, it means that the account fund liquidity in the telecommunications network communication exceeds the safety range. At this time, the account fund liquidity will become the data for judging telecommunications network fraud, and the account fund liquidity will be marked as abnormal over-limit data;

[0166] Compare the call duration value with the preset duration safety value; the preset duration safety value is used to limit the maximum value of the call duration value, that is, to distinguish the call duration value from the safe range and the dangerous range; the preset mobile safety value is obtained by collecting a large number of electronic fraud status values ​​for the maximum value of the call duration value during normal communication;

[0167] When the call duration value is greater than the preset duration safety value, it means that the call duration value in the telecommunications network communication exceeds the safety range. At this time, the call duration value will become data for judging telecommunications network fraud, and the call duration value will be marked as abnormal over-limit data;

[0168] After all abnormal over-limit data are marked, the number of marked abnormal over-limit data needs to be counted, so as to obtain the number of abnormal over-limit data in telecommunication network communication, and based on the number of abnormal over-limit data, subsequent dissuasion operations are implemented;

[0169] It should be noted that, since the comprehensive electronic fraud data contains at most 4 data, the maximum number of abnormal and excessive data is 4. Exemplarily, the number of abnormal and excessive data is 1, 2, 3 or 4;

[0170] S6: Generate and execute a dissuasion instruction based on the amount of abnormal over-limit data;

[0171] After the number of abnormal and excessive data is counted, it is necessary to evaluate the criticality of telecommunications network fraud according to the number of abnormal and excessive data, and generate a dissuasion model based on the criticality of telecommunications network fraud, so that the dissuasion model can distinguish telecommunications network frauds of different criticality levels and provide a basis for the formulation of subsequent dissuasion instructions;

[0172] Dissuasion instructions include emergency dissuasion instructions and real-time dissuasion instructions; emergency dissuasion instructions are dissuasion measures generated for telecommunications network fraud at a serious critical level, and are used to forcibly dissuade telecommunications network fraud at the first time; real-time dissuasion instructions are dissuasion measures generated for telecommunications network fraud at a general critical level, and are used to accurately and non-compulsorily dissuade telecommunications network fraud at the first time;

[0173] The method for generating the emergency dissuasion instruction and the real-time dissuasion instruction includes:

[0174] When the number of abnormal data exceeding the limit is 3 or 4, it means that the number of abnormal data in the comprehensive telecom fraud data is 3 or 4. At this time, telecom network fraud needs to be forcibly dissuaded as soon as possible, and an emergency dissuasion instruction is generated;

[0175] When the number of abnormal over-limit data is 1 or 2, it means that the number of abnormal data in the comprehensive telecom fraud data is 1 or 2. At this time, it is necessary to conduct non-compulsory dissuasion of telecommunications network fraud in the first time, and a real-time dissuasion instruction is generated;

[0176] After the emergency dissuasion instruction and the real-time dissuasion instruction are generated, the emergency dissuasion instruction and the real-time dissuasion instruction need to be executed accordingly to prevent the user from being defrauded by telecommunications network fraud and avoid the user's property from being lost;

[0177] The execution method of the emergency dissuasion instruction and the real-time dissuasion instruction includes:

[0178] When an emergency dissuasion instruction is generated, the anti-fraud server queries the number of the emergency contact associated with the user number through the communication service database, sends a dissuasion message to the user number, informs the user that the user is being defrauded by telecommunications network fraud, and makes a dissuasion call to the emergency contact number, prompting the emergency contact to forcibly dissuade the user;

[0179] When a real-time dissuasion instruction is generated, the anti-fraud server sends a dissuasion message to the user's number, informing the user that he or she is suspected of being a victim of telecommunications network fraud and providing non-compulsory dissuasion to the user.

[0180] In this embodiment, by collecting historical training data of telecommunication network communications, the historical training data includes comprehensive fraud data and fraud status values, training a machine learning model that predicts fraud status values ​​based on the historical training data, collecting behavioral characteristics of real-time telecommunication network communications, and judging whether to enter the anti-telecom network fraud dissuasion mode based on the behavioral characteristics, collecting real-time comprehensive fraud data, predicting the real-time fraud status value based on the trained machine learning model, and judging whether to issue a dissuasion prompt, comparing the comprehensive fraud data with the corresponding safety value, marking abnormal over-limit data, and counting the number of abnormal over-limit data, generating and executing a dissuasion instruction based on the number of abnormal over-limit data; compared with the existing There is technology that can accurately and quickly predict the real-time telecom fraud status value based on comprehensive telecom fraud data and machine learning models, determine whether the user has been defrauded by telecommunications network fraud, and conduct preliminary identification of telecommunications network fraud through behavioral characteristics, eliminate obvious non-telecom network fraud data, reduce the analysis workload of telecommunications network fraud, and differentiate the degree of harm of telecommunications network fraud based on the number of abnormal and excessive data, so as to formulate corresponding dissuasion instructions according to different degrees of harm, and send telecommunications network fraud dissuasion information to users at the same time, to ensure that the user's property loss can be accurately avoided in the first place, which is also conducive to the rapid development of a safe and healthy telecommunications network communication environment.

[0181] Example 2: Please refer to Figure 2 As shown, the part not described in detail in this embodiment is described in Example 1, and a big data-based anti-telecom network fraud dissuasion processing system is provided, which is applied to an anti-fraud server and is used to implement a big data-based anti-telecom network fraud dissuasion processing method, including a data acquisition module, a model training module, a pattern judgment module, a real-time prediction module, a data marking module and a dissuasion instruction module, wherein each module is connected via a wired or wireless network;

[0182] A data collection module is used to collect historical training data of telecommunication network communications, where the historical training data includes comprehensive fraud data and fraud status values;

[0183] Model training module, used to train a machine learning model to predict the status value of online fraud based on historical training data;

[0184] A mode judgment module is used to collect the behavioral characteristics of real-time telecommunication network communications and determine whether to enter the anti-telecom network fraud dissuasion mode based on the behavioral characteristics;

[0185] The real-time prediction module is used to collect real-time comprehensive fraud data, predict the real-time fraud status value based on the trained machine learning model, and determine whether to issue a dissuasion prompt;

[0186] The data marking module is used to compare the comprehensive fraud data with the corresponding safety value, mark the abnormal and excessive data, and count the number of abnormal and excessive data;

[0187] The dissuasion instruction module is used to generate and execute dissuasion instructions based on the number of abnormal over-limit data.

[0188] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. Anti-telecom fraud dissuasion processing method based on big data, applied to anti-fraud server, characterized in that: include: S1: Collect historical training data of telecommunication network communications, including comprehensive fraud data and fraud status values; Comprehensive fraud data includes the proportion of sensitive texts, communication anomalies, account fund flow, and call duration; Methods for obtaining the proportion of sensitive text include: Identify the communication language in telecommunication network communication by natural language processing technology to obtain the text to be identified; Compare the text to be identified with the sensitive words stored in the anti-fraud center database one by one; When the text to be recognized is consistent with the pre-stored sensitive words, the text to be recognized is marked as sensitive text; The first time when the sensitive text appears is recorded as the starting time. When the sensitive text no longer appears within the preset number of words to be compared, the last time when the sensitive text appears is recorded as the ending time. Count the number of sensitive texts in the time period from the start time to the end time, and obtain i sensitive texts; When i exceeds the preset number threshold, the number of words in the i sensitive texts is accumulated and compared with the total number of words in the text to be identified to obtain the proportion of sensitive words; The expression of sensitive word proportion is: Where, MG bz is the proportion of sensitive words, WB zl is the total number of characters to be recognized, ZS mga is the number of words in the ath sensitive text; Methods for obtaining the communication abnormality degree include: Mark the number currently communicating with the user through the telecommunication network as the target number; Obtain the communication records of the target number before the current time from the communication service database, record them as original communication records, and divide the original communication records into p communication units; Query the communication status between the target number and different numbers in p communication units, and count the number of numbers whose communication status is not connected and the number of numbers whose communication status is connected, and obtain p first quantity values ​​and p second quantity values ​​respectively; Assigning different weight factors to the p first quantity values ​​and the p second quantity values ​​respectively, adding them together, and comparing them with the duration corresponding to the preset communication cycle to obtain p sub-abnormality degrees; The expression of sub-abnormality is: In the formula, YC zp is the pth sub-abnormality, ZQ ys The duration of the preset communication cycle, SL 1p is the pth first quantity value, SL 2p is the pth second quantity value, is the weight factor; The sub-abnormality degree greater than the preset abnormality threshold is recorded as the effective abnormality degree, and m effective abnormality degrees are obtained. The m effective abnormality degrees are accumulated and averaged to obtain the communication abnormality degree; The expression of communication abnormality is: In the formula, YC tx is the communication abnormality, YC zb is the bth effective abnormality degree; Methods for obtaining account liquidity include: Mark the third-party fund account appearing in the text to be identified as the target account; Query all transaction data in the target account and identify the withdrawal address, transfer address and account opening address in the transaction data; The transaction data whose fund withdrawal address and fund transfer address are inconsistent with the account opening address are recorded as abnormal data, and the number of abnormal data is counted; The first time when abnormal data appears is recorded as the abnormal starting point, and the last time when abnormal data appears is recorded as the abnormal end point; After comparing the difference between the abnormal end point and the abnormal start point, the abnormal duration is obtained; The expression for the abnormal duration is: SJ cx =YC zd -YC qd ; In the formula, SJ cx is the abnormal duration, YC zd For abnormal endpoints, YC qd is the abnormal starting point; Compare the number of abnormal data with the duration of abnormality to obtain the liquidity of account funds; The expression of account liquidity is: In the formula, ZJ ld is the liquidity of account funds, SL yc is the number of abnormal data; S2: Based on historical training data, train a machine learning model to predict the status value of online fraud; S3: Collecting the behavioral characteristics of real-time telecommunication network communications and, based on the behavioral characteristics, determining whether to enter the anti-telecom network fraud dissuasion mode; S4: Collect real-time comprehensive fraud data, predict the real-time fraud status value based on the trained machine learning model, and determine whether to issue a dissuasion prompt; S5: Compare the comprehensive electronic fraud data with the corresponding safety value, mark the abnormal and excessive data, and count the number of abnormal and excessive data; S6: Generate and execute a dissuasion instruction based on the amount of abnormal over-limit data.

2. The method for preventing telecommunication network fraud based on big data according to claim 1 is characterized in that: The training method of the machine learning model for predicting the electronic fraud status value includes: The comprehensive electronic fraud data is converted into a corresponding set of feature vectors, the feature vectors are used as the input of the machine learning model, and the electronic fraud status value corresponding to each set of comprehensive electronic fraud data is used as the output of the machine learning model. The electronic fraud status value is used as the prediction target, and minimizing the sum of prediction errors of all training data is used as the training target. The machine learning model is trained until the sum of prediction errors converges and the training is stopped.

3. The method for preventing telecommunication network fraud based on big data according to claim 2 is characterized in that: The behavior characteristics include the note status and word length; The methods for judging whether to enter the anti-telecom fraud dissuasion mode include: Mark the number that communicates with the target number through the telecommunications network as the user number, mark the device where the user number is located as the user device, and obtain the original address book stored in the user device; Match the target number with the note tag in the original address book to obtain the note status; Count the number of digits in the target number and obtain the word length; When the remark status is no remark and the length of the word count is not 11, it is judged to enter the anti-telecom fraud dissuasion mode; When the remark status is no remark and the length of the word is 11, it is determined not to enter the anti-telecom fraud dissuasion mode; When the remark status is "With Remarks" and the length of the word count is not 11, it is determined that the anti-telecom fraud dissuasion mode will not be entered; When the remark status is "With Remarks" and the word length is 11, it is determined that the anti-telecom fraud dissuasion mode will not be entered.

4. The method for preventing telecommunication network fraud based on big data according to claim 3 is characterized in that: The electronic fraud status value includes normal communication and abnormal communication; The methods for determining whether to issue a dissuasion prompt include: When the real-time electronic fraud status value is normal communication, it is determined that no dissuasion prompt will be issued; When the real-time electronic fraud status value is abnormal communication, a dissuasion prompt is issued.

5. The method for preventing telecommunication network fraud based on big data according to claim 4 is characterized in that: The marking method of abnormal over-limit data includes: Compare the sensitive text proportion with the preset proportion safety value. When the sensitive text proportion is greater than the preset proportion safety value, the sensitive text proportion is marked as abnormal over-limit data; The communication abnormality is compared with a preset communication safety value, and when the communication abnormality is greater than the preset communication safety value, the communication abnormality is marked as abnormal over-limit data; Compare the account fund liquidity with the preset liquidity safety value. When the account fund liquidity is greater than the preset liquidity safety value, the account fund liquidity is marked as abnormal excess data. The call duration value is compared with a preset duration safety value. When the call duration value is greater than the preset duration safety value, the call duration value is marked as abnormal over-limit data.

6. The method for preventing telecommunication network fraud based on big data according to claim 5 is characterized in that: The dissuasion instruction includes an emergency dissuasion instruction and a real-time dissuasion instruction; The method for generating the emergency dissuasion instruction and the real-time dissuasion instruction includes: When the number of abnormal over-limit data is 3 or 4, an emergency dissuasion instruction is generated; When the number of abnormal over-limit data is 1 or 2, a real-time dissuasion instruction is generated.

7. The big data-based anti-telecom fraud dissuasion processing method according to claim 6 is characterized in that: The execution method of the emergency dissuasion instruction and the real-time dissuasion instruction includes: When an emergency dissuasion instruction is generated, the anti-fraud server queries the number of the emergency contact associated with the user number through the communication service database, sends a dissuasion message to the user number, and makes a dissuasion call to the number of the emergency contact; When a real-time dissuasion instruction is generated, the anti-fraud server sends a dissuasion message to the user number.

Images