A data automatic updating method for telecommunication fraud identification model

Abstract

The present invention relates to the field of data model update technology, and specifically to a method for automatically updating data of a telecommunications fraud identification model. The method evaluates the degree of division of the initial telecommunications fraud identification model for each dimension of a newly added communication process based on the classification results of each decision tree. The communication data difference is adjusted according to the degree of division, and the number of decision trees to be added is determined. Further, when training the newly added decision tree, the candidate degree is used to evaluate the dimension, and a suitable number of newly added decision trees with good recognition effect are obtained. An updated telecommunications fraud identification model is obtained. The present invention updates the initial telecommunications fraud identification model, and can obtain a suitable number of newly added decision trees with good recognition effect. The communication process can be quickly and effectively identified by using the updated telecommunications fraud identification model.

Description

Technical Field

[0001] The present invention relates to the technical field of data model updating, and in particular to a method for automatically updating data of a telecommunications fraud identification model. Background Art

[0002] As a commonly used supervised learning method, the random forest algorithm is widely used in telecommunications fraud identification. It can improve the accuracy of communication process identification by building multiple decision trees for integrated learning.

[0003] The traditional random forest algorithm relies on the existing decision tree structure. In order to learn new telecommunications fraud communication patterns, the decision trees in the random forest need to be updated in a timely manner. When updating the data of the telecommunications fraud identification model, the existing technology simply increases the number of decision trees and uses the newly added communication process samples for training, which will lead to the complexity of the model. At the same time, too many newly added decision trees will also introduce noise, affecting the overall performance of the model. Summary of the invention

[0004] In order to solve the technical problem in the prior art that when updating the data of the telecommunications fraud identification model, the overall performance of the model is affected due to the unreasonable number of new decision trees, the purpose of the present invention is to provide a method for automatically updating the data of the telecommunications fraud identification model, and the technical solution adopted is as follows: The present invention proposes a method for automatically updating data of a telecommunications fraud identification model, the method comprising: Obtain multi-dimensional communication data under the communication process; the communication process includes a historical communication process and a newly added communication process; and train based on the historical communication process to obtain an initial telecommunications fraud identification model including several decision trees; Count the division results of the initial telecommunications fraud identification model for the newly added communication process and the historical communication process in each dimension, and obtain the degree of division of the communication data of each dimension of the newly added communication process by the initial telecommunications fraud identification model according to the data category distribution in the subnodes in the division results; Determine the number of new decision trees required in the initial telecommunications fraud identification model based on the degree of division under all dimensions of the new communication process; adjust the communication data difference between the new communication process and the historical communication process based on the degree of division to obtain communication differences; obtain the sampling probability of each historical communication process based on the communication data difference, sample the historical communication process using the sampling probability, and obtain training data for the new decision tree; obtain the candidate degree of each dimension in the training data based on the degree of division, train the new decision tree in the training data using the candidate degree, and obtain an updated telecommunications fraud identification model.

[0005] Furthermore, the method for obtaining the division degree includes: Take any dimension of the newly added communication samples as the target dimension, and for each decision tree in the initial telecommunications fraud identification model, send the communication process into the decision tree, and among the sub-nodes divided by the decision tree for the target dimension, the sub-node where the newly added communication sample is located is the target sub-node, and the others are non-target sub-nodes; take the proportion of the number of telecommunications fraud communication samples in the final division result corresponding to the target sub-node as the first proportion, and take the proportion of the number of normal communication samples in the final division result corresponding to the non-target sub-node as the second proportion; add the first proportion and the second proportion to obtain the initial division degree of each decision tree for the target dimension; According to the initial division degree of all decision trees for the target dimension, the division degree of the communication data of the newly added communication process under the target dimension by the initial telecommunications fraud identification model is obtained.

[0006] Furthermore, the obtaining of the degree of division of the communication data of the newly added communication process under the target dimension by the initial telecommunications fraud identification model includes: For the target dimension, the average value of the initial division degrees under all decision trees is used as the division degree of the communication data of the target dimension.

[0007] Furthermore, the method for obtaining the communication difference includes: Under each dimension, the division degree corresponding to the dimension is negatively correlated and normalized to obtain an adjustment weight, and the product of the adjustment weight and the communication data difference is used as the weighted communication data difference between the newly added communication process and the historical communication process; The weighted communication data differences under all dimensions are averaged to obtain the communication difference between the newly added communication process and the historical communication process.

[0008] Furthermore, the method for obtaining the number of decision trees to be added includes: The average values ​​of the degree of division of all dimensions are obtained, the average values ​​of the degree of division are negatively correlated and normalized to obtain the quantity weight, and the result of multiplying the quantity weight by the number of decision trees in the initial telecommunications fraud identification model is rounded to obtain the number of decision trees required to be added.

[0009] Furthermore, the method for obtaining the sampling probability includes: For all historical communication processes, the maximum communication difference between the newly added communication process is used as the reference communication difference; the difference between the communication difference corresponding to each historical communication process and the reference communication difference is normalized to obtain the sampling probability of each historical communication process; the sampling probabilities of all historical communication processes are accumulated to a positive integer 1.

[0010] Furthermore, the method for obtaining the candidate degree includes: The product of the adjustment weight and the Gini impurity of the corresponding dimension in the decision tree partitioning process is used as the candidate degree under the corresponding dimension.

[0011] Furthermore, the using the candidate degree to train the newly added decision tree in the training data includes: The dimensions are sorted in descending order according to the candidate degrees, a preset number of containments are selected as split features of a newly added decision tree, and the newly added decision tree is trained using the training data.

[0012] Furthermore, in the classification result, the electronic fraud communication data is marked as 1, and the normal communication data is marked as 0.

[0013] Furthermore, the communication data includes at least the IDs of the communicating parties, location IDs, call duration, call frequency, total roaming times, and total roaming time.

[0014] The present invention has the following beneficial effects: In order to determine the most appropriate number of newly added decision trees, the embodiment of the present invention first inputs the newly added communication process into the initial telecommunications fraud identification model, and evaluates the degree of division of the initial telecommunications fraud identification model for each dimension of the newly added communication process according to the classification results of each decision tree. By quantifying the degree of division, the degree of adaptation of the current newly added communication process under the initial telecommunications fraud identification model can be evaluated based on the degree of division, that is, the smaller the degree of division, the more targeted processing is required for the corresponding dimension when adding a new decision tree. Therefore, the communication data difference can be adjusted according to the degree of division, and the number of decision trees required to be added can be determined. By determining the accurate number of decision trees and determining the training data of the newly added decision trees, the classification effect of the newly added decision trees can be made more effective for the newly added communication process, reducing the overall noise of the model. Further, when training the newly added decision trees, the candidate degree is used to evaluate the dimensions, so that the classification effect of the newly added decision trees is more accurate, that is, by updating the initial telecommunications fraud identification model through the embodiment of the present invention, a suitable number of newly added decision trees with good recognition effect can be obtained, and the communication process can be quickly and effectively identified by using the updated telecommunications fraud identification model. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A flow chart of a method for automatically updating data of a telecommunications fraud identification model provided by one embodiment of the present invention; Figure 2 A flow chart of a method for obtaining a division degree provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the data automatic update method of a telecommunications fraud identification model proposed by the present invention, its specific implementation method, structure, features and effects, in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0018] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0019] The specific scheme of the data automatic updating method of the telecommunication fraud identification model provided by the present invention is described in detail below with reference to the accompanying drawings.

[0020] See also Figure 1 , which shows a flow chart of a method for automatically updating data of a telecommunications fraud identification model provided by an embodiment of the present invention, the method comprising: Step S1: obtaining multi-dimensional communication data under the communication process; the communication process includes historical communication processes and newly added communication processes; training based on the historical communication process to obtain an initial telecommunications fraud identification model containing several decision trees.

[0021] Step S2: Count the division results of the initial telecommunications fraud identification model for the new communication process and the historical communication process in each dimension, and obtain the degree of division of the communication data of each dimension of the new communication process by the initial telecommunications fraud identification model according to the data category distribution in the sub-nodes in the division results.

[0022] Step S3: Determine the number of new decision trees required in the initial telecommunications fraud identification model according to the degree of division of all dimensions of the newly added communication process; adjust the communication data difference between the newly added communication process and the historical communication process according to the degree of division to obtain communication differences; obtain the sampling probability of each historical communication process according to the communication data difference, and use the sampling probability to sample the historical communication process to obtain training data for the new decision tree; obtain the candidate degree of each dimension in the training data according to the degree of division, and use the candidate degree to train the new decision tree in the training data to obtain an updated telecommunications fraud identification model.

[0023] For step S1 of the embodiment of the present invention, it is necessary to obtain the corresponding multi-dimensional communication data under each communication process. The communication process will generate data under multiple dimensions such as the ID of the two communicating parties, the location ID, the call duration, etc. When classifying and identifying the communication process, it is necessary to analyze the data characteristics under each dimension separately, and then make a decision classification. Therefore, it is necessary to obtain the multi-dimensional communication data under the newly added communication process and the historical communication process in step S1, that is, the number of dimensions and the type of dimensions of the newly added communication process and the historical communication process are the same. The embodiment of the present invention aims to effectively update the data of the telecommunications fraud identification model built on the basis of random forests, that is, the telecommunications fraud identification model before the update is built based on the known historical communication process, that is, the initial telecommunications fraud identification model containing several decision trees is obtained by training based on the historical communication process in step S1. Because the initial telecommunications fraud identification model is trained based on the historical communication process, the category of the historical communication process is known, that is, whether the historical communication process is a telecommunications fraud communication process is known during the training process, so the initial telecommunications fraud identification model has a good classification ability for communication processes similar to the historical communication process. As for the newly added communication process, because it is a new telecommunications fraud model, the initial telecommunications fraud identification model has a weaker classification ability for it, and it will be identified as a normal communication process in the classification results. That is, the newly added communication process is a real new telecommunications fraud communication process, and it is identified as a normal communication process in the initial telecommunications fraud identification model.

[0024] The new telecom fraud model uses a different communication process from the known historical telecom fraud model, that is, the communication data of each dimension of the newly added communication process is quite different from that of the historical communication process. For example, if a new telecom fraud model communicates in a time period outside the known conventional telecom fraud model, it will cause a significant difference in the dimension of the call time period. Therefore, it is necessary to analyze the communication data of the newly added communication process based on each dimension. In order to determine the reference information that the initial telecom fraud identification model needs to update data, it is necessary to analyze the degree of division of the communication data of each dimension of the newly added communication process by the initial telecom fraud identification model, that is, the less obvious the degree of division, the more the dimension is concerned by the newly added decision tree, and the number of newly added decision trees should be larger. Therefore, in the embodiment of the present invention, step S2 is used to count the division results of the initial telecom fraud identification model for the newly added communication process and the historical communication process in each dimension. For a dimension, the more obvious the data category distribution in the subnodes in the division result under the dimension, the stronger the division ability of the initial telecom fraud identification model is for the dimension, and the greater the degree of division of the communication data of the newly added communication process by the initial telecom fraud identification model under the dimension. The greater the degree of division of the communication data of the newly added communication process in one dimension by the initial telecommunications fraud identification model, the stronger the recognition ability of the initial telecommunications fraud identification model for the newly added communication process in this dimension, and the less the need for more new decision trees to improve the overall performance of the model. Therefore, the degree of division can be used as reference data for determining the new decision trees of the model.

[0025] After obtaining the degree of division in step S2, the embodiment of the present invention analyzes the degree of division through step S3, because the degree of division can represent the recognition ability of the initial telecommunications fraud recognition model for the newly added communication process in a certain dimension, so the number of decision trees required to be added in the initial telecommunications fraud recognition model can be determined according to the degree of division in all dimensions of the newly added communication process. That is, if the degree of division in all dimensions reflects a smaller data feature, it means that the current initial telecommunications fraud recognition model needs more decision trees to enhance the recognition ability; anyway, it means that too many decision trees are not needed to avoid affecting the performance.

[0026] Step S3 of the embodiment of the present invention further considers that after determining the number of newly added decision trees, the newly added decision trees need to be trained. In order to improve the decision-making ability of the newly added decision trees, it is necessary to use more training data to train them. As a new type of electronic fraud mode, the number of corresponding samples of the newly added communication process is too small, and it is impossible to train the newly added decision trees only using the newly added communication process. Therefore, it is necessary to further select the training data of the newly added decision tree on the basis of the historical communication process. The selected training data should ensure that it has a strong similarity with the communication data of the newly added communication process, so it is necessary to analyze the communication data difference between the newly added communication process and the historical communication process. However, considering that the new electronic fraud mode and the traditional electronic fraud mode have different emphases on different dimensions, after determining the communication data difference, it is also necessary to adjust it in combination with the degree of division, that is, adjust the communication data difference between the newly added communication process and the historical communication process according to the degree of division, obtain the communication difference, and then obtain the sampling probability of each historical communication process according to the communication data difference. The historical communication process can be sampled using the sampling probability to determine the training data of the newly added decision tree.

[0027] Step S3 also takes into account that the newly added decision tree needs to construct corresponding division conditions according to different dimensions during the training process. In order to ensure that the newly added decision tree can effectively classify the communication samples of the newly added communication process type, it is necessary to focus on the more important dimensions in the decision tree. Therefore, step S3 of the embodiment of the present invention further uses the division degree to obtain the candidate degree of each dimension in the training data, and uses the candidate degree to train the newly added decision tree in the training data, thereby obtaining an updated telecommunications fraud model. That is, the newly added telecommunications fraud model avoids the overall impact of a large number of newly added decision trees on the model, and at the same time, the newly added decision tree is trained based on the characteristics of the newly added communication process, ensuring the overall recognition ability of the model.

[0028] It should be noted that when the telecommunications fraud identification model of the embodiment of the present invention analyzes the real-time communication process, if at least one decision tree determines that it is a telecommunications fraud communication process, a warning signal is fed back to the user. The warning signal can be a warning mark on the caller ID or a text message reminder sent after the call ends.

[0029] Preferably, in one embodiment of the present invention, the communication data includes at least six dimensions: the ID of the communicating parties, the location ID, the call duration, the call frequency, the total number of roaming times, and the total roaming time.

[0030] Preferably, see Figure 2 , Figure 2 A flow chart of a method for obtaining a division degree provided by an embodiment of the present invention is shown. The method for obtaining a division degree includes: Step S101: Take any dimension of the newly added communication sample as the target dimension. For each decision tree in the initial telecommunications fraud identification model, send the communication process into the decision tree. Among the sub-nodes divided by the decision tree from the target dimension, the sub-node where the newly added communication sample is located is the target sub-node, and the others are non-target sub-nodes.

[0031] In step S101, in order to analyze the ability of the initial telecommunications fraud identification model to divide the newly added communication process under the target dimension, it is necessary to analyze the category distribution in the division result, and more samples are needed for classification. Therefore, in this step, both the newly added communication process and the historical communication process are sent to the decision tree, and the decision tree divides the communication process. In order to facilitate accurate analysis of the category distribution in the sub-nodes divided under the target dimension, the sub-node where the newly added communication sample is located is used as the target sub-node, and the other sub-nodes are non-target sub-nodes. It should be noted that the decision tree may contain more than two sub-nodes in the process of dividing the target dimension. For example, the dimension of the communication time period can be divided into three sub-nodes based on the three division criteria of morning, noon, and evening.

[0032] Step S102: taking the proportion of the number of electronic fraud communication samples in the final division result corresponding to the target subnode as the first proportion, and taking the proportion of the number of normal communication samples in the final division result corresponding to the non-target subnode as the second proportion; adding the first proportion and the second proportion to obtain the initial division degree of each decision tree for the target dimension; Under a target dimension, because the newly added communication process is real electronic fraud communication, and the target sub-node contains the newly added communication process, in the target sub-node, the more the first proportion is, the stronger the decision tree's ability to divide the target dimension is; because the non-target sub-node does not contain the newly added communication process, for the non-target sub-node, it is necessary to analyze the proportion of the number of normal communications, that is, the second proportion, and further add the first proportion and the second proportion to obtain the initial division degree of each decision tree for the target dimension, that is, the larger the first proportion and the second proportion, the greater the initial division degree of the decision tree for the target dimension.

[0033] Step S103: According to the initial division degree of all decision trees for the target dimension, the division degree of the communication data of the newly added communication process under the target dimension by the initial telecommunications fraud identification model is obtained.

[0034] Because a decision tree has an initial division degree for the target dimension, and the initial telecommunications fraud identification model has multiple decision trees, it is necessary to further analyze the initial division degree of all decision trees for the target dimension, and then obtain the division degree of the initial telecommunications fraud identification model for the newly added communication process under the target dimension. Similarly, the division degree of the initial telecommunications fraud identification model for the newly added communication process under each dimension can be obtained.

[0035] Preferably, in one embodiment of the present invention, for the target dimension, the average value of the initial division degrees under all decision trees is used as the division degree of the communication data of the target dimension.

[0036] Preferably, in one embodiment of the present invention, in order to facilitate the analysis of the division results in the decision tree, the fraudulent communication data is marked as 1 and the normal communication data is marked as 0 in the division results. That is, the fraudulent communication data and the normal telecommunication data are distinguished by using different label values, thereby facilitating data statistics.

[0037] Preferably, in one embodiment of the present invention, the method for acquiring communication differences includes: Under each dimension, the division degree corresponding to the dimension is negatively correlated and normalized to obtain the adjustment weight. That is, the smaller the division degree, the more important the dimension is, and the more attention should be paid to the data difference under this dimension. Therefore, the product of the adjustment weight and the communication data difference is taken as the weighted communication data difference between the newly added communication process and the historical communication process. It should be noted that because the communication data of different dimensions have different forms of expression, for example, the location ID is usually text data, and the communication duration is usually numerical data. When calculating the communication data difference, it is necessary to perform targeted calculations according to different data forms. For example, for text data, it can be converted into a vector and then the cosine distance can be obtained. For numerical data, the difference between two numerical values ​​can be calculated and squared. The method for obtaining data differences of different data types is a technical means well known to those skilled in the art, and will not be repeated or limited here.

[0038] Because the communication data contains multiple dimensions, the weighted communication data differences under all dimensions are averaged to obtain the communication differences between the newly added communication process and the historical communication process.

[0039] In one embodiment of the present invention, the opposite number of the division degree is normalized by using range normalization to achieve negative correlation mapping and normalization of the division degree.

[0040] Preferably, in one embodiment of the present invention, because the smaller the degree of division, the worse the division ability of the initial telecommunications fraud identification model, and the more new decision trees are needed, and the communication process contains communication data of multiple dimensions, the average degree of division of all dimensions is first obtained, and the degree of division of all dimensions is integrated by averaging. The average value of the degree of division is negatively correlated and normalized to obtain the quantitative weight, that is, the smaller the average value of the degree of division, the weaker the overall recognition ability of the initial telecommunications fraud identification model for the newly added communication process, and the more new decision trees are needed to improve the recognition ability, the greater the quantitative weight. The result of multiplying the quantitative weight by the number of decision trees in the initial telecommunications fraud identification model is rounded to obtain the number of decision trees required to be added. In one embodiment of the present invention, the rounding method adopts rounding up.

[0041] Preferably, in one embodiment of the present invention, the method for obtaining the sampling probability includes: For all historical communication processes, the maximum communication difference between the newly added communication process is used as the reference communication difference; because the smaller the communication difference, the more similar the historical communication process is to the newly added communication process, so the difference between the communication difference corresponding to each historical communication process and the reference communication difference is normalized to obtain the sampling probability of each historical communication process. It should be noted that in order to ensure the accuracy of sampling, the sampling probabilities of all historical communication processes are accumulated to a positive integer 1. That is, the greater the difference between the communication difference and the reference communication difference, the smaller the communication difference of the corresponding historical communication process, the more similar the historical communication process is to the newly added communication process, and the greater the sampling probability. It should be noted that probability sampling is a technical means well known to those skilled in the art. The training data of the newly added decision tree can be obtained by probability sampling the historical communication process using the sampling probability.

[0042] As an example, the sampling probability in the embodiment of the present invention is expressed by the formula: ;in is the sampling probability of the vth historical communication process, For reference communication differences, is the communication difference of the vth historical communication process, is the number of historical communication processes.

[0043] Preferably, in an embodiment of the present invention, the method for obtaining the candidate degree includes: The product of the adjustment weight and the Gini impurity of the corresponding dimension in the decision tree division process is used as the candidate degree under the corresponding dimension. It should be noted that Gini impurity is a technical means well known to those skilled in the art, and the specific acquisition means will not be repeated. That is, for a dimension, the larger its adjustment weight and the larger its Gini impurity, the more important the dimension is relative to the new electronic fraud model, and the greater its candidate degree.

[0044] Preferably, after obtaining the candidate degree, the dimensions can be sorted in descending order according to the candidate degree, and the first preset number of blockades can be selected as the splitting features of the newly added decision tree, and the newly added decision tree can be trained using the training data. It should be noted that the preset number can be set based on the number of dimensions contained in each decision tree in the current initial telecommunications fraud identification model. The specific decision tree training method is a technical means well known to those skilled in the art and will not be elaborated here.

[0045] In summary, the embodiment of the present invention evaluates the degree of division of the initial telecommunications fraud identification model for each dimension of the newly added communication process based on the classification results of each decision tree. The communication data difference is adjusted according to the degree of division, and the number of decision trees to be added is determined. The candidate degree is further used to evaluate the dimension when training the newly added decision tree, and an appropriate number of new decision trees with good recognition effect are obtained. An updated telecommunications fraud identification model is obtained. The present invention updates the initial telecommunications fraud identification model, and can obtain an appropriate number of new decision trees with good recognition effect. The updated telecommunications fraud identification model can be used to quickly and effectively identify the communication process.

[0046] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0047] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A method for automatically updating data of a telecommunications fraud identification model. It is characterized in that The method comprises: Obtain multi-dimensional communication data under the communication process; the communication process includes a historical communication process and a newly added communication process; train based on the historical communication process to obtain an initial telecommunications fraud identification model including several decision trees; Count the division results of the initial telecommunications fraud identification model for the newly added communication process and the historical communication process in each dimension, and obtain the degree of division of the communication data of each dimension of the newly added communication process by the initial telecommunications fraud identification model according to the data category distribution in the subnodes in the division results; Determine the number of new decision trees required in the initial telecommunications fraud identification model based on the degree of division under all dimensions of the new communication process; adjust the communication data difference between the new communication process and the historical communication process based on the degree of division to obtain communication differences; obtain the sampling probability of each historical communication process based on the communication data difference, sample the historical communication process using the sampling probability, and obtain training data for the new decision tree; obtain the candidate degree of each dimension in the training data based on the degree of division, train the new decision tree in the training data using the candidate degree, and obtain an updated telecommunications fraud identification model.

2. According to claim 1, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that The method for obtaining the division degree includes: Take any dimension of the newly added communication samples as the target dimension, and for each decision tree in the initial telecommunications fraud identification model, send the communication process into the decision tree, and among the sub-nodes divided by the decision tree for the target dimension, the sub-node where the newly added communication sample is located is the target sub-node, and the others are non-target sub-nodes; take the proportion of the number of telecommunications fraud communication samples in the final division result corresponding to the target sub-node as the first proportion, and take the proportion of the number of normal communication samples in the final division result corresponding to the non-target sub-node as the second proportion; add the first proportion and the second proportion to obtain the initial division degree of each decision tree for the target dimension; According to the initial division degree of all decision trees for the target dimension, the division degree of the communication data of the newly added communication process under the target dimension by the initial telecommunications fraud identification model is obtained.

3. According to claim 2, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that The obtaining of the degree of division of the communication data of the newly added communication process under the target dimension by the initial telecommunications fraud identification model includes: For the target dimension, the average value of the initial division degrees under all decision trees is used as the division degree of the communication data of the target dimension.

4. According to claim 1, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that The method for acquiring the communication difference includes: Under each dimension, the division degree corresponding to the dimension is negatively correlated and normalized to obtain an adjustment weight, and the product of the adjustment weight and the communication data difference is used as the weighted communication data difference between the newly added communication process and the historical communication process; The weighted communication data differences under all dimensions are averaged to obtain the communication difference between the newly added communication process and the historical communication process.

5. According to claim 1, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that The method for obtaining the number of decision trees to be added includes: The average values ​​of the degree of division of all dimensions are obtained, the average values ​​of the degree of division are negatively correlated and normalized to obtain the quantity weight, and the result of multiplying the quantity weight by the number of decision trees in the initial telecommunications fraud identification model is rounded to obtain the number of decision trees required to be added.

6. According to claim 1, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that The method for obtaining the sampling probability includes: For all historical communication processes, the maximum communication difference between the newly added communication process is used as the reference communication difference; the difference between the communication difference corresponding to each historical communication process and the reference communication difference is normalized to obtain the sampling probability of each historical communication process; the sampling probabilities of all historical communication processes are accumulated to a positive integer 1.

7. According to claim 4, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that The method for obtaining the candidate degree includes: The product of the adjustment weight and the Gini impurity of the corresponding dimension in the decision tree partitioning process is used as the candidate degree under the corresponding dimension.

8. According to claim 7, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that The step of training the newly added decision tree in the training data using the candidate degree includes: The dimensions are sorted in descending order according to the candidate degrees, a preset number of containments are selected as split features of a newly added decision tree, and the newly added decision tree is trained using the training data.

9. According to claim 1, a method for automatically updating data of a telecommunications fraud identification model, It is characterized in that In the division result, the electronic fraud communication data is marked as 1, and the normal communication data is marked as 0.

10. The method for automatically updating data of a telecommunications fraud identification model according to claim 1, It is characterized in that The communication data at least includes the IDs of the communicating parties, location IDs, call duration, call frequency, total roaming times, and total roaming time.

Images