A fraud identification method and system based on multi-source label fusion

Abstract

The present invention belongs to the field of anti-fraud technology, and provides a fraud identification method and system based on multi-source label fusion. The method includes: collecting number and label detail data corresponding to various data sources; comprehensively evaluating the accuracy, data volume and label distribution of labels from different sources, determining the weights, thresholds and reference items of various data sources to calculate the label scores corresponding to different data sources of each number, selecting a specified number of label scores for fusion to obtain a fusion label; determining the fusion label of the number to be processed, and performing anti-fraud processing according to the determined fusion label. The present invention can objectively and reasonably judge the label to which the number belongs through label fusion, which can further improve the accuracy of the number label.

Description

Technical Field

[0001] The present invention relates to the field of anti-fraud technology, and in particular to a fraud identification method and system based on multi-source label fusion. Background Art

[0002] In the existing telecommunications network anti-fraud and anti-harassment scenarios, the blacklist number library is usually used. When the calling number hits the number in the fraud and harassment library, it will trigger corresponding disposal measures such as voice and SMS reminders. The blacklist number library is usually composed of numbers detected by the model or numbers reported by users. However, for multi-source data, such as a variety of fraud / harassment number identification models, multiple types of user complaint / reported number sources, etc., most of them adopt a priority method, and request various types of blacklist numbers in reverse order of confidence. However, for multiple data sources with equivalent confidence levels, and the number labels in each data source are different or even contradictory, the existing methods cannot accurately identify user labels.

[0003] Regarding anti-fraud and anti-harassment in communication scenarios, the existing technologies mainly have the following problems: the existing detection of fraud and harassment numbers mostly uses one type of data source, such as the mobile phone manufacturer's incoming call number label reminder using a label provided by a supplier, or using a number detection model to remind users; labels mostly use a priority method, or use the intersection of the results of multiple model detections, which will reduce the accuracy of the number.

[0004] Therefore, it is necessary to provide a fraud identification method and system based on multi-source label fusion to solve the above problems. Summary of the invention

[0005] The present invention aims to provide a fraud identification method and system based on multi-source label fusion to solve the technical problems in the prior art that the fraud identification accuracy is low due to the single label and the fraud and disturbing numbers cannot be effectively identified. The technical problem to be solved by the present invention is achieved through the following technical solution.

[0006] The first aspect of the present invention proposes a fraud identification method based on multi-source label fusion, including: collecting numbers and label related data corresponding to various data sources; mapping and unifying labels according to a predefined standard label system, and correcting each label data based on a priori knowledge base, wherein the priori knowledge base includes a global whitelist, secondary numbers, and yellow pages numbers; comprehensively evaluating the accuracy, data volume, and label distribution of labels from different sources, and determining the weights, thresholds, and reference items of various data sources, wherein the reference items include the number of markings, the number of complaints, the reporting time, the number of model detections, and the model detection time; calculating the label scores corresponding to different data sources of each number according to the determined weights, thresholds, and reference items of various data sources, and selecting a specified number of label scores for fusion to obtain a fused label, specifically including correcting the confidence of the label score according to a decay function of the marking time and the detection time; receiving a number to be processed, and determining a fused label of the number to be processed, so as to perform anti-fraud processing according to the determined fused label.

[0007] The second aspect of the present invention provides a fraud identification system based on multi-source label fusion, which adopts the fraud identification method based on multi-source label fusion described in the first aspect of the present invention, and the fraud identification system includes: a data collection module, which is used to collect numbers and label related data corresponding to various data sources; a correction processing module, which maps and unifies labels according to a predefined standard label system, and corrects each label data based on a priori knowledge base, wherein the priori knowledge base includes a global white list, a secondary number, and a yellow page number; a first determination module, which is used to comprehensively evaluate the accuracy, data volume and label distribution of labels from different sources, and determine the weights, thresholds and reference items of various data sources, wherein the reference items include the number of markings, the number of complaints, the reporting time, the number of model detections, and the model detection time; a calculation module, which calculates the label scores corresponding to different data sources of each number according to the determined weights, thresholds and reference items of various data sources, selects a specified number of label scores for fusion to obtain a fusion label, and specifically includes correcting the confidence of the label score according to the attenuation function of the marking time and the detection time; a second determination module, which is used to receive a number to be processed, determine the fusion label of the number to be processed, and perform anti-fraud processing according to the determined fusion label.

[0008] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the fraud identification method based on multi-source label fusion described in the first aspect of the present invention.

[0009] A fourth aspect of the present invention provides a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the fraud identification method based on multi-source label fusion described in the first aspect of the present invention is implemented.

[0010] The embodiments of the present invention include the following advantages:

[0011] Compared with the prior art, the present invention integrates number label data from multiple sources, establishes weights, thresholds and reference items for multi-source label data sets, and comprehensively evaluates the labels corresponding to the numbers. In particular, for the case where the same number corresponds to different labels in different sources, the label fusion can be used to objectively and reasonably determine the label to which the number belongs, thereby further improving the accuracy of number labels.

[0012] In addition, calculating the initial adjustment factor according to statistical methods and optimizing the adjustment factor by calculating the standard deviation of confidence in different data sources can effectively measure the distribution of confidence in different data sources, effectively optimize the adjustment factor, and then effectively balance the impact of confidence from multiple data sources and the highest confidence from a single data source on the total confidence. It can effectively ensure that when the number of markings in a certain data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score will not affect the accuracy of the total confidence.

[0013] In addition, weights are assigned to different tags according to tag priorities, and weights can be set according to application scenarios. The weighted total confidence is obtained through the influencing factors of the application scenarios, and then a more accurate fusion tag, namely the application tag, can be obtained. Users can be intercepted and reminded based on application tags, and the parameters involved can be flexibly adjusted according to business conditions, which has strong applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flowchart of an example of a fraud identification method based on multi-source label fusion of the present invention;

[0015] Figure 2 It is a partial flow chart of an implementation method of a fraud identification method based on multi-source label fusion of the present invention;

[0016] Figure 3 It is a structural block diagram of a fraud identification system based on multi-source label fusion of the present invention;

[0017] Figure 4 is a schematic structural diagram of an electronic device embodiment according to the present invention;

[0018] Figure 5 It is a schematic diagram of the structure of a computer-readable medium embodiment according to the present invention. DETAILED DESCRIPTION

[0019] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0020] In view of the above problems, the present invention proposes a fraud identification method based on multi-source label fusion. The method establishes weights, thresholds and reference items for the multi-source label data sets, comprehensively evaluates the labels corresponding to the numbers, thereby improving the accuracy of the number labels. It can also flexibly adjust the parameters involved according to business conditions, and has strong applicability.

[0021] It should be noted that the present invention has a wide range of applications, and is particularly suitable for various business scenarios in security manager products, specifically providing users with anti-fraud processing, such as interception and reminder services for disturbing calls, and analyzing the types of disturbing calls.

[0022] Example 1

[0023] Refer to the following Figures 1 to 3 , the contents of the present invention will be described in detail.

[0024] Figure 1 It is a flowchart of an example of the fraud identification method based on multi-source label fusion of the present invention. Figure 2 It is a partial flow chart of an implementation of a fraud identification method based on multi-source label fusion of the present invention.

[0025] like Figure 1 As shown, in step S101, numbers and label-related data corresponding to various data sources are collected.

[0026] Specifically, the numbers and labels corresponding to various data sources and their related data are collected, for example, by using a data storage system for storage and query, and associating the mobile phone number with the label of the mobile phone number and other related data. When a mobile phone number is entered, the label and label-related data corresponding to the mobile phone number can be returned.

[0027] For the collection of various data sources, including internal and external data, such as Internet tag data, user complaint data, user report data, detection data of multiple models such as fraud-related models and disturbance-related models, intimacy model data, user address book data, business ordering data, yellow pages data, etc., after data transmission and data cleaning, the standard data is stored in the data storage system. The data storage system is, for example, a number library corresponding to different business types, such as Hive, Mysql, mongodb, etc. Through the mobile phone number, you can query the detailed information of the label and label-related data corresponding to the mobile phone number. The following Table 1 shows some data examples. The corresponding data sources of 1861***5678 are Internet tag data, disturbance-related models, and user report data. The data sources of 1851***5678 are only Internet tag data and disturbance-related models. The data source of 137123***78 is only fraud-related models:

[0028] Table 1

[0029]

[0030] Table 1 is an example of partial detailed information of the label corresponding to the mobile phone number and the label-related data.

[0031] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0032] Next, in step S102, the labels are mapped and unified according to a predefined standard label system, and each label data is corrected based on a priori knowledge base, wherein the priori knowledge base includes a global whitelist, secondary numbers, and yellow page numbers.

[0033] Specifically, the data stored in the data storage system is differentiated according to whether it has a label or not, the labels are mapped and unified according to a predefined standard label system, and the data is corrected based on a priori knowledge base, such as a global whitelist, secondary numbers, yellow pages numbers, etc.

[0034] First, a unified label system and mapping rules are set based on the business. For example, the 9 types of disturbing phone calls displayed to users are used as standard label types. For labels other than the 9 types or newly added labels, set their mapping rules to standard labels, such as mapping loan sales and food and drug sales to advertising sales, and mapping stocks and securities to insurance and financial management. For related models such as fraudulent number identification and disturbing number identification, when there is only a detected number but no specific label, when the model detection probability value exceeds the threshold, it is set as a fraudulent phone type or disturbing phone type. Data for other situations is not used. For example, for the fraudulent number identification model (sometimes also referred to as the fraudulent model), the model outputs the number, probability value, and model detection date. For example, the threshold is set to 0.6, and the label corresponding to the number with a probability value exceeding 0.6 is set as a suspected fraudulent label.

[0035] It should be noted that in this example, the global whitelist refers to a list of numbers whose mobile phone numbers do not involve risks such as fraud or harassment. A secondary number refers to a number that is no longer used by the user and is given to a new user for secondary use. If there is a corresponding label for the number and the number is used by a new user, the label should be deleted. A yellow page number refers to a certified number used to determine the accuracy of the corresponding label for the user's mobile phone number.

[0036] Next, the data in the data storage system is modified based on the prior knowledge base, which includes the global whitelist, secondary numbers, yellow page numbers, etc. When the global whitelist is used, for example, if the business rule is that the number hits the global whitelist, no reminder or interception will be applied. The numbers in the data storage system are traversed, and the data of the numbers that are also in the global whitelist are deleted or marked. For example, in step 101, 137123***78 belongs to the global whitelist, so the data is deleted or marked.

[0037] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0038] Next, in step S103, the accuracy, data volume and label distribution of labels from different sources are comprehensively evaluated to determine the weights, thresholds and reference items of various data sources. The reference items include the number of markings, the number of complaints, the reporting time, the number of model detections, and the model detection time.

[0039] Specifically, the accuracy, data volume and label distribution of different source labels (i.e. labels from different data sources) are comprehensively considered, and weights, thresholds and reference items are configured for each type of data source.

[0040] After the label processing in step 102, all data sources have been mapped to labeled types.

[0041] In a specific implementation, reference items are set for different data sources, such as the reference item for Internet marking data is the number of markings, the reference item for user reporting data is the number of reports, and the reference items for fraud models and harassment models are the fraud probability value or the harassment probability value.

[0042] For fraud-related models, user call records, basic user information (such as user ID, user device ID, owner information such as age and gender, etc.), Internet logs, etc. are used as model input data, and modeling is performed in combination with samples of labeled fraud-related numbers. Optionally, based on the above input data, the number of outgoing calls, call time, number of calls answered by the other end, etc. are used as model input features, and fraud-related calls are annotated to establish training data for training fraud models. A neural network model such as textcnn is used to build a fraud model. When applying a trained fraud model, for example, if a mobile phone number is input, the model outputs the probability of fraud and the type of fraud for whether it is a fraud-related call.

[0043] For the interference model, user call records, basic user information (such as user ID, user device ID, owner information such as age and gender, etc.), Internet logs, etc. are used as input data for the model, and modeling is performed in combination with samples of marked interference numbers. Optionally, based on the above input data, the number of outgoing calls, call time, number of calls answered by the other end, etc. are used as model input features, and the interference calls are labeled to establish training data for training the interference model. A neural network model such as textcnn is used to build the interference model. When applying the trained interference model, for example, if a mobile phone number is input, the model outputs the interference probability and interference type of whether it is a interference call.

[0044] Because different sources use different data, models, and strategies, each source has different focuses on the corresponding labels. For example, the fraud model is more accurate in identifying fraud phone labels, and the harassment model is more accurate in identifying harassment calls. The weights of different data sources can be determined by the following methods:

[0045] For the weight determination process, the weight of each data source can be allocated according to reliability and importance, and the weight is calculated by comprehensively considering the total data volume, number of labels, label distribution and accuracy of each source. If a source has a large amount of data, rich labels, reasonable label distribution and high accuracy, then the corresponding weight of this source is high. The specific calculation process is:

[0046] The accuracy can be measured or determined by the F1 value. A batch of real number label samples are prepared, and the accuracy and recall of the labels corresponding to each source are calculated, and then the F1 value of the labels corresponding to each source is obtained.

[0047] The total data volume, number of labels, variance of the number of labels, and F1 value of the corresponding labels from different sources are normalized in turn, that is, the data is scaled to the same dimension or specified dimension. The specific method can be determined according to the specific situation, such as selecting minimum and maximum value normalization, weight scaling, etc., according to the data source dimension, such as normalizing the total data volume of sources A, B, and C.

[0048] Specifically, the total amount of data, number of labels, variance of the number of labels, and F1 value from different sources after normalization are added together and normalized as the weights of the corresponding labels from different sources.

[0049] For the determination of the threshold, in order to ensure that the numbers and labels with too low accuracy will not participate in the subsequent calculation, the dynamic threshold method can be used to filter the numbers and labels with low accuracy. Specifically, the dynamic threshold is set according to the average value and standard deviation of the number of markings or probability values, and the number of markings or probability values ​​greater than a specific value (for example, The number and label of are involved in the calculation. Among them, It is verified by samples with real numbers and labels.

[0050] Specifically, reference items can be constructed according to the specific circumstances of the data source, and relevant reference items can be selected to participate in the calculation, as shown in Table 2 below for some reference items.

[0051] Table 2

[0052]

[0053] Table 2 is an example table of reference items from different data sources.

[0054] In an optional implementation, a random forest algorithm is used to establish a reference item prediction model.

[0055] Input a data source identifier and output at least two reference items that match the data source identifier.

[0056] Specifically, first collect as many reference items as possible corresponding to the data source, and use machine learning algorithms such as the random forest algorithm to evaluate the importance of features, such as training a reference item prediction model based on real label samples of reference items, calculating the feature importance score of each reference item, and automatically selecting the reference item with the highest score, that is, the most valuable. Select at least two reference items based on the score.

[0057] Specifically, the reference item prediction model is used to determine at least two of the following reference items that match the Internet data, complaint data, report data, and various model data respectively:

[0058] Number of markings, latest marking time, number of complaints, complaint time, complained number, credit rating of complained number, number of reports, reporting time, fraud probability value, number of fraud detections, latest detection time, disturbance probability value, number of disturbance detections.

[0059] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0060] Next, in step S104, based on the determined weights, thresholds and reference items of various data sources, the label scores corresponding to the different data sources of each number are calculated, and a specified number of label scores are selected for fusion to obtain a fused label, specifically including correcting the confidence of the label score according to the attenuation function of the marking time and the detection time.

[0061] The following expression is used to calculate the label scores corresponding to different data sources of each number to calculate the total confidence of the label j corresponding to the number number:

[0062] (1)

[0063] in, is the total confidence of the label j corresponding to number number, is the score of number number in the corresponding label j of the i-th data source, different data sources i is a positive integer, 1≤i≤n, W ij 、C ij They correspond to the weight and confidence of the i-th data source label j respectively; It is an adjustment factor used to balance the impact of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, to ensure that when the number of labeling in a certain data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence.

[0064] For the adjustment factor, in an optional implementation, if Figure 2 As shown, perform the following steps to optimize the adjustment factor:

[0065] Step S201: Calculate the standard deviation of confidence levels in different data sources.

[0066] Specifically, the standard deviation The distribution of confidence in different data sources can be measured and calculated using the following expression:

[0067] (2)

[0068] in, Indicates the calculation of confidence in different data sources The standard deviation of Confidence The average value among different data sources, Represents the confidence level corresponding to the i-th data source label j, where i is a positive integer, 1≤i≤n.

[0069] Step S202: Calculate an initial adjustment factor based on a statistical method, and optimize the initial adjustment factor according to the calculated standard deviation of confidence in different data sources.

[0070] The adjustment factor is calculated using the following expression: :

[0071] (3)

[0072] in, It is an adjustment factor used to balance the influence of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, so as to ensure that when the number of labeling in a data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence; Represents the initial adjustment factor. The initial value can be set to 1. The initial adjustment factor is adjusted by the standard deviation to obtain the adjustment factor. ; Indicates the calculation of confidence in different data sources The standard deviation of; when label j is evenly distributed in confidence, When the value is large and the confidence distribution of label j is inconsistent, The value is smaller.

[0073] In a preferred embodiment, after calculating the adjustment factor Then, the adjustment factor is adjusted by Bayesian method or AB test. Adjust and update to get the final adjustment factor .

[0074] Using Bayesian methods, specifically:

[0075] First select the prior distribution , for example, the prior distribution For a normal distribution (or Gaussian distribution), define the likelihood function , where D is the observed data of the total confidence of the corresponding label j of number number;

[0076] The following expression is used to calculate the posterior distribution, and the expected value is calculated based on the calculated posterior distribution as the final update value of the adjustment factor:

[0077]

[0078] in, The posterior distribution of the observed data representing the total confidence of the label j corresponding to the adjustment factor number; The likelihood function of the observed data and the adjustment factor representing the total confidence of the label j corresponding to number number; represents the prior distribution of the adjustment factor; P(D) represents the distribution of the observed data of the total confidence of the corresponding label j of number number.

[0079] It should be noted that, in this embodiment, the contents of the aforementioned steps are substantially the same as the contents of step S201 and step S202 in the above embodiment, and therefore, the description of the same parts is omitted.

[0080] Calculating the initial adjustment factor based on statistical methods and optimizing the adjustment factor by calculating the standard deviation of confidence in different data sources can effectively measure the distribution of confidence in different data sources, effectively optimize the adjustment factor, and then effectively balance the impact of confidence from multiple data sources and the highest confidence from a single data source on the total confidence. It can effectively ensure that when the number of markings in a certain data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score will not affect the accuracy of the total confidence.

[0081] Specifically, the label scores corresponding to the different data sources of each number are calculated. According to the selected reference items, the confidence of each label is calculated using the following expression:

[0082] (4)

[0083] in, Indicates the confidence level corresponding to the i-th data source and label j; is the amount of data corresponding to the i-th data source, and the impact of the data amount is adjusted using a logarithmic function, i is a positive integer, ; is the value of the reference item corresponding to the i-th data source label j, is the threshold corresponding to the i-th data source label j, Indicates that between 0 and ( ) select the maximum value, when Less than or equal to When , the tag score is 0, so that the tags below the set threshold are eliminated; is the maximum value corresponding to label j in the i-th data source, so that even if the distribution of labels in the same source is different, the reference item value of each source can be in the same scale range; represents the decay function of the latest marking time and detection time of the tag corresponding to tag j in the i-th data source, To adjust the time weight parameter, it is determined by optimizing the difference between the real sample and the calculated predicted sample; t ij Indicates the time difference between the latest marking time and the detection time.

[0084] According to the selected reference items, the confidence of each label is calculated using the following expression:

[0085] (5)

[0086] in, Indicates the confidence level corresponding to the i-th data source and label j; is the amount of data corresponding to the i-th data source, and the impact of the data amount is adjusted using a logarithmic function, where i is a positive integer; is the value of the reference item corresponding to the i-th data source label j, For the i The threshold corresponding to the data source label j, Indicates that between 0 and Select the maximum value among Less than or equal to ,but , the label score is 0, which aims to eliminate labels below the threshold. is the maximum value corresponding to label j in the i-th data source. The second part of the formula This is because the distribution of labels is different in the same source. For example, in the Internet labeled data, the labels of the harassing phone type are higher than the recruitment type, so they are normalized so that the reference item values ​​of all sources are in the same scale range.

[0087] In a preferred embodiment, a specified number of label scores are selected for fusion to obtain a fused label.

[0088] Specifically, a specified number of label scores are selected, such as selecting the top three or top five labels with the highest total confidence for secondary fusion, that is, weights are assigned to different labels according to label priorities. Weights can be set according to application scenarios, including: when the priority of a fraudulent call label is higher than that of a disturbing call label, a higher weight can be assigned to the fraudulent call label than to the disturbing call label; the following expression is specifically used to perform weighted processing on the initial total confidence obtained by the initial calculation, that is, the initial total confidence is multiplied by the label weight to obtain the weighted total confidence:

[0089] ;

[0090] in, Indicates that the initial confidence is multiplied by the label weight to obtain the weighted total confidence, K j represents the label weight of label j; is the total confidence of the label j corresponding to number number, that is, the initial total confidence.

[0091] Weights are assigned to different tags according to tag priorities. Weights can be set according to application scenarios. The weighted total confidence is obtained through the influencing factors of the application scenario, and a more accurate fusion tag, namely the application tag, can be obtained.

[0092] It should be noted that in other implementations, the top six labels can be selected, or other rules can be used to select, or all labels for calculating label scores can be merged twice. The above is only used as an optional example and cannot be understood as a limitation of the present invention.

[0093] Next, in step S105, the number to be processed is received, and a fusion tag of the number to be processed is determined, so as to perform anti-fraud processing according to the determined fusion tag.

[0094] Specifically, the label with the highest weighted total confidence is selected as the final application label of the number, that is, the fusion label is .

[0095] When receiving a number to be processed, obtain the label detail data corresponding to the number to be processed, calculate the label scores corresponding to different data sources of the number to be processed, and then calculate the weighted total confidence of the label scores corresponding to different data sources of the number to be processed, so as to perform phone interception and SMS reminder according to the grading range of the weighted total confidence.

[0096] The obtained fusion labels are used to update the classification thresholds of the fraud-related model and the disturbance-related model.

[0097] In a specific implementation, for example, based on the determined fusion features, anti-fraud processing is provided to users, for example, interception and reminder services for disturbing calls, and the types of disturbing calls are analyzed, including: fraudulent calls, disturbing calls, insurance and financial management, real estate agencies, advertising and promotion, education and training, recruitment types, one ring, and other types.

[0098] Specifically, when the user selects the type of incoming call that needs to be blocked or reminded on the front-end page, the incoming call of this type will be automatically blocked or a text message reminder will be sent to the user when the user receives the incoming call of this type.

[0099] For example, the top 3 labels ranked by total confidence are fused twice to obtain application labels. For example, if the user sets up to block fraudulent calls and to remind people of disturbing calls and real estate agents, and the caller numbers and application labels are: 10112***78, "disturbing calls", 10212***678, "fraudulent calls", 1031***5678, "recruitment type", then the call from 10212***678 will be blocked and the call from 10112***78 will be reminded.

[0100] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0101] In addition, the drawings are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the drawings do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0102] Compared with the prior art, the present invention integrates number label data from multiple sources, sets weights, thresholds and reference items for multi-source label data sets, and comprehensively evaluates the labels corresponding to the numbers. In particular, for the case where the same number corresponds to different labels in different sources, the present invention can objectively and reasonably evaluate the labels to which the number belongs, and perform label fusion to improve the accuracy of number labels.

[0103] In addition, calculating the initial adjustment factor according to statistical methods and optimizing the adjustment factor by calculating the standard deviation of confidence in different data sources can effectively measure the distribution of confidence in different data sources, effectively optimize the adjustment factor, and then effectively balance the impact of confidence from multiple data sources and the highest confidence from a single data source on the total confidence. It can effectively ensure that when the number of markings in a certain data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score will not affect the accuracy of the total confidence.

[0104] In addition, weights are assigned to different tags according to tag priorities, and weights can be set according to application scenarios. The weighted total confidence is obtained through the influencing factors of the application scenarios, and then a more accurate fusion tag, namely the application tag, can be obtained. Users can be intercepted and reminded based on application tags, and the parameters involved can be flexibly adjusted according to business conditions, which has strong applicability.

[0105] Example 2

[0106] The following is a system embodiment of the present invention, which can be used to implement the method embodiment of the present invention. For details not disclosed in the system embodiment of the present invention, please refer to the method embodiment of the present invention.

[0107] Figure 3 4 is a schematic structural diagram of an example of a fraud identification system based on multi-source label fusion according to the present invention.

[0108] Reference Figure 3 The second aspect of the present disclosure provides a fraud identification system 300 based on multi-source label fusion, which adopts the fraud identification method based on multi-source label fusion described in the first aspect of the present invention.

[0109] Specifically, the fraud identification system 300 includes a data collection module 310 , a correction processing module 320 , a first determination module 330 , a calculation module 340 and a second determination module 350 .

[0110] In a specific implementation, the data collection module 310 is used to collect the numbers and label-related data corresponding to various data sources; the correction processing module 320 maps and unifies the labels according to the predefined standard label system, and corrects the label data based on the prior knowledge base, which includes the global white list, secondary numbers, and yellow page numbers. The first determination module 330 is used to comprehensively evaluate the accuracy, data volume and label distribution of labels from different sources, and determine the weights, thresholds and reference items of various data sources, and the reference items include the number of markings, the number of complaints, the reporting time, the number of model detections, and the model detection time. The calculation module 340 calculates the label scores corresponding to the different data sources of each number according to the weights, thresholds and reference items of the determined various data sources, selects a specified number of label scores for fusion to obtain a fusion label, specifically including correcting the confidence of the label score according to the attenuation function of the marking time and the detection time. The second determination module 350 is used to receive the number to be processed, determine the fusion label of the number to be processed, and perform anti-fraud processing according to the determined fusion label.

[0111] The following expression is used to calculate the label scores corresponding to different data sources of each number to calculate the total confidence of the label j corresponding to the number number:

[0112] ;

[0113] in, is the total confidence of the label j corresponding to number number, is the score of number number in the corresponding label j of the i-th data source, different data sources i is a positive integer, 1≤i≤n, W ij 、C ij They correspond to the weight and confidence of the i-th data source label j respectively; It is an adjustment factor used to balance the impact of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, to ensure that when the number of labeling in a certain data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence.

[0114] According to an optional implementation manner, optimizing the adjustment factor comprises the following steps:

[0115] Step S201: Calculate the confidence level of different data sources Standard Deviation , which is calculated using the following expression:

[0116]

[0117] in, Indicates the calculation of confidence in different data sources The standard deviation of Confidence The average value among different data sources, Represents the confidence level corresponding to the i-th data source label j, where i is a positive integer, 1≤i≤n.

[0118] Step S202: Calculate the initial adjustment factor based on statistical methods , according to the confidence calculated from different data sources Standard Deviation Optimize the initial adjustment factor and use the following expression to calculate the adjustment factor :

[0119] ,

[0120] in, It is an adjustment factor used to balance the influence of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, so as to ensure that when the number of labeling in a data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence; It indicates the initial adjustment factor calculated by statistical method. The initial value can be set to 1. The initial adjustment factor is adjusted by standard deviation to obtain the adjustment factor. ; Indicates the calculation of confidence in different data sources The standard deviation of; when label j is evenly distributed in confidence, When the value is large and the confidence distribution of label j is inconsistent, The value is small; after getting the initial After the value is obtained, the adjustment factor can be adjusted and updated by Bayesian method, which includes:

[0121] First select the prior distribution , define the likelihood function , where D is the observed data of the total confidence of the corresponding label j of number number.

[0122] The following expression is used to calculate the posterior distribution, and the expected value is calculated based on the calculated posterior distribution as the final update value of the adjustment factor:

[0123]

[0124] in, The posterior distribution of the observed data representing the total confidence of the label j corresponding to the adjustment factor number; The likelihood function of the observed data and the adjustment factor representing the total confidence of the label j corresponding to number number; represents the prior distribution of the adjustment factor; P(D) represents the distribution of the observed data of the total confidence of the corresponding label j of number number.

[0125] According to an optional implementation manner, the calculation of the label scores corresponding to the different data sources of each number includes: according to the selected reference item, using the following expression to calculate the confidence of each label:

[0126] ;

[0127] in, Indicates the confidence level corresponding to the i-th data source and label j; is the amount of data corresponding to the i-th data source, and the impact of the data amount is adjusted using a logarithmic function, where i is a positive integer; is the value of the reference item corresponding to the i-th data source label j, is the threshold corresponding to the i-th data source label j, Indicates that between 0 and ( ) select the maximum value, when Less than or equal to When , the tag score is 0, so that the tags below the set threshold are eliminated; is the maximum value corresponding to label j in the i-th data source, so that even if the distribution of labels in the same source is different, the reference item value of each source can be in the same scale range; represents the decay function of the latest marking time and detection time of the tag corresponding to tag j in the i-th data source, To adjust the time weight parameter, it is determined by optimizing the difference between the real sample and the calculated predicted sample; t ij Indicates the time difference between the latest marking time and the detection time.

[0128] According to an optional implementation, the fusion to obtain a fusion label includes: selecting a specified number of label scores, performing secondary fusion, that is, assigning weights to different labels according to label priorities, and configuring weights according to application scenarios, specifically including: when the fraud-related phone label has a higher priority than the disturbance-related phone label, the fraud-related phone label can be assigned a higher weight than the disturbance-related phone label; specifically, the following expression is used to perform weighted processing on the initial total confidence obtained by the initial calculation, that is, the initial total confidence is multiplied by the label weight to obtain the weighted total confidence:

[0129] ;

[0130] in, Indicates that the initial confidence is multiplied by the label weight to obtain the weighted total confidence, K j represents the label weight of label j; is the total confidence of the label j corresponding to number number, that is, the initial total confidence.

[0131] According to an optional implementation manner, a random forest algorithm is used to establish a reference item prediction model; a data source identifier is input, and at least two reference items matching the data source identifier are output.

[0132] Utilize the reference item prediction model to determine at least two of the following reference items that match the Internet data, complaint data, reporting data, and various model data, respectively: number of markings, latest marking time, number of complaints, complaint time, complained number, credit rating of complained number, number of reports, reporting time, fraud probability value, number of fraud detections, latest detection time, disturbance probability value, number of disturbance detections.

[0133] According to an optional implementation, the label with the highest weighted total confidence is selected as the final application label of the number, that is, the fusion label is .

[0134] Receive the number to be processed, obtain the label detail data corresponding to the number to be processed, calculate the label scores corresponding to the different data sources of the number to be processed, and then calculate the weighted total confidence of the label scores corresponding to the different data sources of the number to be processed, so as to perform phone interception and SMS reminder according to the grading range of the weighted total confidence.

[0135] Compared with the prior art, the present invention integrates number label data from multiple sources, sets weights, thresholds and reference items for multi-source label data sets, and comprehensively evaluates the labels corresponding to the numbers. In particular, for the case where the same number corresponds to different labels in different sources, the present invention can objectively and reasonably evaluate the labels to which the number belongs, and perform label fusion to improve the accuracy of number labels.

[0136] In addition, weights are assigned to different tags according to tag priorities, and weights can be set according to application scenarios. The weighted total confidence is obtained through the influencing factors of the application scenarios, and then a more accurate fusion tag, namely the application tag, can be obtained. Users can be intercepted and reminded based on application tags, and the parameters involved can be flexibly adjusted according to business conditions, which has strong applicability. Figure 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

[0137] like Figure 4As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0138] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least some steps in the method.

[0139] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0140] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0141] It should be understood that Figure 4 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0142] Through the above description of the implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by combining software with necessary hardware. Figure 5 As shown, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of commands to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the embodiment of the present invention.

[0143] The software product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0144] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0145] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0146] The computer-readable medium carries one or more programs (eg, computer-executable programs). When the one or more programs are executed by a device, the computer-readable medium implements the method of the present disclosure.

[0147] Those skilled in the art will appreciate that the above modules can be distributed in the device according to the description of the embodiment, or can be changed accordingly and only used in one or more devices different from the embodiment. The modules of the above embodiments can be combined into one module, or further divided into multiple sub-modules.

[0148] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the exemplary embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several commands to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiment of the present invention.

[0149] The exemplary embodiments of the present invention are specifically shown and described above. It should be understood that the present invention is not limited to the detailed structure, configuration or implementation method described herein; on the contrary, the present invention is intended to cover various modifications and equivalent configurations included in the spirit and scope of the appended claims.

Claims

1. A fraud identification method based on multi-source label fusion, characterized in that: include: Collect numbers and tags related data corresponding to various data sources; Mapping and unifying labels according to a predefined standard label system, and correcting each label data based on a priori knowledge base, which includes a global whitelist, secondary numbers, and yellow pages numbers; Comprehensively evaluate the accuracy, data volume and label distribution of labels from different sources, and determine the weights, thresholds and reference items of various data sources. The reference items include the number of markings, the number of complaints, the reporting time, the number of model detections and the model detection time; According to the determined weights, thresholds and reference items of various data sources, the label scores corresponding to the different data sources of each number are calculated and fused to obtain a fused label, specifically including correcting the confidence of the label score according to the decay function of the marking time and the detection time; receiving a number to be processed, determining a fusion tag of the number to be processed, and performing anti-fraud processing according to the determined fusion tag; wherein, Use the following expression to calculate the label scores corresponding to different data sources of each number to calculate the corresponding label of number number The total confidence level is: ； in, The corresponding label for number number The total confidence level, is number number in Corresponding labels for data sources The score is Different data sources, is a positive integer, , , Corresponding to Data source tags The weight and confidence of It is an adjustment factor used to balance the impact of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, so as to ensure that when the number of labeling in a data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence; Optimizing the adjustment factor includes the following steps: Step S201: Calculate the confidence level of different data sources Standard Deviation , which is calculated using the following expression: ； in, Indicates the calculation of confidence in different data sources The standard deviation of Confidence The average value among different data sources, Indicates the corresponding Data source tags The confidence level, is a positive integer, ; Step S202: Calculate the initial adjustment factor based on statistical methods , according to the confidence calculated from different data sources Standard Deviation Optimize the initial adjustment factor and use the following expression to calculate the adjustment factor : ， in, It is an adjustment factor used to balance the influence of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, so as to ensure that when the number of labeling in a data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence; It indicates the initial adjustment factor calculated by statistical method. The initial value can be set to 1. The initial adjustment factor is adjusted by standard deviation to obtain the adjustment factor. ; Indicates the calculation of confidence in different data sources The standard deviation of When the confidence distribution is uniform, The value is large, and the label When the confidence distributions are inconsistent, The value is small; after getting the initial After the value is obtained, the adjustment factor can be adjusted and updated by Bayesian method, which includes: First select the prior distribution , define the likelihood function , where D is the corresponding label of number number The total confidence level of the observed data; The following expression is used to calculate the posterior distribution, and the expected value is calculated based on the calculated posterior distribution as the final update value of the adjustment factor: ； in, Indicates the corresponding label of the adjustment factor and number number The posterior distribution of the observed data with total confidence; Indicates the corresponding label of number number The likelihood function of the observed data and the adjustment factor with the total confidence level; represents the prior distribution of the adjustment factor; Indicates the corresponding label of number number The total confidence level of the observed data distribution.

2. The fraud identification method according to claim 1, characterized in that: The calculation of the label scores corresponding to the different data sources of each number includes: According to the selected reference items, the confidence of each label is calculated using the following expression: ； in, Indicates the corresponding Data sources, labels confidence level; For the The amount of data corresponding to each data source is adjusted using a logarithmic function. is a positive integer; For the Data source tags The value of the corresponding reference item, For the Data source tags The corresponding threshold value, Indicates that between 0 and ( ) select the maximum value, when Less than or equal to When , the tag score is 0, so that the tags below the set threshold are eliminated; For the Tags in data sources The corresponding maximum value makes it possible to put the reference item values ​​of each source in the same scale range even if the distribution of labels in the same source is different; Indicates Tags in data sources The decay function of the latest marking time and detection time of the corresponding tag, To adjust the parameters of the time weight, it is determined by optimizing the difference between the real sample and the calculated predicted sample; Indicates the time difference between the latest marking time and the detection time.

3. The fraud identification method according to claim 1, characterized in that: The step of fusing to obtain a fusion tag comprises: Select a specified number of label scores for secondary fusion, that is, assign weights to different labels according to label priorities. The weights can be set according to application scenarios, including: when the priority of the fraudulent phone label is higher than that of the disturbing phone label, the fraudulent phone label can be assigned a higher weight than the disturbing phone label; the following expression is used to weight the initial total confidence obtained by the initial calculation, that is, the initial total confidence is multiplied by the label weight to obtain the weighted total confidence: ； in, It means multiplying the initial confidence by the label weight to get the weighted total confidence. Representation Tags The label weight of The corresponding label for number number The total confidence of , that is, the initial total confidence.

4. The fraud identification method according to claim 1, characterized in that: include: The random forest algorithm is used to establish a reference item prediction model; Input a data source identifier and output at least two reference items that match the data source identifier.

5. The fraud identification method according to claim 4, characterized in that: include: Using the reference item prediction model, determine at least two of the following reference items that match the Internet data, complaint data, report data, and various model data respectively: Number of markings, latest marking time, number of complaints, complaint time, complained number, credit rating of complained number, number of reports, reporting time, fraud probability value, number of fraud detections, latest detection time, disturbance probability value, number of disturbance detections.

6. The fraud identification method according to claim 3, characterized in that: The label with the highest weighted total confidence is selected as the final application label of the number, that is, the fusion label is ; Receive the number to be processed, obtain the label detail data corresponding to the number to be processed, calculate the label scores corresponding to the different data sources of the number to be processed, and then calculate the weighted total confidence of the label scores corresponding to the different data sources of the number to be processed, so as to perform phone interception and SMS reminder according to the grading range of the weighted total confidence.

7. A fraud identification system based on multi-source label fusion, characterized in that: The fraud identification method based on multi-source label fusion according to claim 1 is adopted, and the fraud identification system comprises: Data collection module, used to collect numbers and label-related data corresponding to various data sources; A correction processing module maps and unifies labels according to a predefined standard label system, and corrects each label data based on a priori knowledge base, wherein the priori knowledge base includes a global whitelist, secondary numbers, and yellow pages numbers; The first determination module is used to comprehensively evaluate the accuracy, data volume and label distribution of labels from different sources, and determine the weights, thresholds and reference items of various data sources. The reference items include the number of markings, the number of complaints, the reporting time, the number of model detections and the model detection time; A calculation module, which calculates the label scores corresponding to different data sources of each number according to the determined weights, thresholds and reference items of various data sources, selects a specified number of label scores for fusion to obtain a fusion label, specifically including correcting the confidence of the label score according to the decay function of the marking time and the detection time; The second determination module is used to receive the number to be processed, determine the fusion tag of the number to be processed, and perform anti-fraud processing according to the determined fusion tag; wherein, Use the following expression to calculate the label scores corresponding to different data sources of each number to calculate the corresponding label of number number The total confidence level is: ； in, The corresponding label for number number The total confidence level, is number number in Corresponding labels for data sources The score is Different data sources, is a positive integer, , , Corresponding to Data source tags The weight and confidence of It is an adjustment factor used to balance the impact of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, so as to ensure that when the number of labeling in a data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence; Optimizing the adjustment factor includes the following steps: Step S201: Calculate the confidence level of different data sources Standard Deviation , which is calculated using the following expression: ； in, Indicates the calculation of confidence in different data sources The standard deviation of Confidence The average value among different data sources, Indicates the corresponding Data source tags The confidence level, is a positive integer, ; Step S202: Calculate the initial adjustment factor based on statistical methods , according to the confidence calculated from different data sources Standard Deviation Optimize the initial adjustment factor and use the following expression to calculate the adjustment factor : ， in, It is an adjustment factor used to balance the influence of the confidence of multiple data sources and the highest confidence of a single data source on the total confidence, so as to ensure that when the number of labeling in a data source is greater than the set value, even if some data sources do not have corresponding labels, the calculated label score does not affect the accuracy of the total confidence; It indicates the initial adjustment factor calculated by statistical method. The initial value can be set to 1. The initial adjustment factor is adjusted by standard deviation to obtain the adjustment factor. ; Indicates the calculation of confidence in different data sources The standard deviation of When the confidence distribution is uniform, The value is large, and the label When the confidence distributions are inconsistent, The value is small; after getting the initial After the value is obtained, the adjustment factor can be adjusted and updated by Bayesian method, which includes: First select the prior distribution , define the likelihood function , where D is the corresponding label of number number The total confidence level of the observed data; The following expression is used to calculate the posterior distribution, and the expected value is calculated based on the calculated posterior distribution as the final update value of the adjustment factor: ； in, Indicates the corresponding label of the adjustment factor and number number The posterior distribution of the observed data with total confidence; Indicates the corresponding label of number number The likelihood function of the observed data and the adjustment factor with the total confidence level; represents the prior distribution of the adjustment factor; Indicates the corresponding label of number number The total confidence level of the observed data distribution.

Images