Telecommunication fraud number identification method, system and electronic device based on feature fusion

Abstract

The present invention discloses a telecommunication fraud number recognition method, system and electronic device based on feature fusion, which relates to the cross-technical field of artificial intelligence and communication technology. The method includes: obtaining and processing multiple specified attribute fields in each telecommunication data in a telecommunication data set, obtaining a multidimensional feature vector corresponding to each one-dimensional feature vector, and further obtaining a telecommunication time series data set; generating simulated abnormal telecommunication time series data based on a Gaussian random noise simulation abnormal sequence generation algorithm and a telecommunication time series data set; constructing a telecommunication fraud number recognition model, and training the telecommunication fraud number recognition model based on a balanced telecommunication time series data set; and using the trained telecommunication fraud number recognition model to perform fraud recognition on new telephone numbers. The present invention can more accurately extract the common features of fraudulent calls and improve the accuracy and efficiency of telecommunication fraud detection.

Description

Technical Field

[0001] The present invention relates to the field of intersection of artificial intelligence and communication technology, and in particular to a method, system and electronic device for identifying telecommunication fraud numbers based on feature fusion. Background Art

[0002] With the booming development of the global digital economy, telecommunications technology has penetrated into every aspect of people's lives and work. However, the rapid development of this technology has also given rise to a serious social problem, telecommunications fraud. Telecommunications fraud not only causes economic losses to victims, but also poses a threat to social order and public safety, becoming a major problem that needs to be solved urgently. Telecommunications fraud methods can be mainly divided into three categories: telephone fraud, SMS fraud, and online false information fraud.

[0003] The problems of rampant telecommunication fraud and various fraud methods in telecommunication services have attracted the attention of academia and operators. Domestic and foreign scholars have conducted relevant research on telecommunication fraud number identification from multiple perspectives, focusing mainly on the analysis of user behavior characteristics and the optimization of related machine learning and deep learning algorithm models. There are few studies on the extraction of common features of telecommunication fraudsters when registering phone numbers, and the results of existing research are average. Summary of the invention

[0004] The technical problem to be solved by the present invention is to address the deficiencies of the prior art and specifically provide a method, system and electronic device for identifying telecommunication fraud numbers based on feature fusion, as follows:

[0005] 1) In the first aspect, the present invention provides a method for identifying telecommunication fraud numbers based on feature fusion, and the specific technical solution is as follows:

[0006] Acquire and convert multiple specified attribute fields in each telecommunication data in the telecommunication data set into features to obtain a one-dimensional feature vector corresponding to each telecommunication data, and convert each one-dimensional feature vector respectively through a feature fusion algorithm to obtain a multidimensional feature vector corresponding to each one-dimensional feature vector to form a multidimensional feature vector set;

[0007] Normalizing the multidimensional feature vector set, and then converting each normalized multidimensional feature vector into telecommunication time series data to obtain a telecommunication time series data set;

[0008] Generate simulated abnormal telecommunication time series data based on Gaussian random noise simulated abnormal sequence generation algorithm and telecommunication time series data set;

[0009] Constructing a telecommunications fraud number recognition model, and training the telecommunications fraud number recognition model based on a balanced telecommunications time series data set, where the balanced telecommunications time series data set includes telecommunications time series data in the telecommunications time series data set and generated simulated abnormal telecommunications time series data;

[0010] Use the trained telecommunications fraud number recognition model to identify fraudulent phone numbers for new phone numbers.

[0011] The beneficial effects of the telecommunication fraud number identification method based on feature fusion provided by the present invention are as follows:

[0012] Multidimensional feature vectors are generated through feature fusion algorithm. The generated multidimensional feature vectors optimize the expression of data without sacrificing the original information of the data, so that the interaction between multidimensional feature vectors is effectively reflected, rather than being treated independently. This can more accurately extract the common features of fraudulent calls, provide strong support for the training of telecommunications fraud number recognition models, and improve the accuracy and efficiency of telecommunications fraud detection.

[0013] Based on the above scheme, the telecommunication fraud number identification method based on feature fusion of the present invention can also be improved as follows.

[0014] Further, based on the Gaussian random noise simulated abnormal sequence generation algorithm and the telecommunication time series data set, simulated abnormal telecommunication time series data is generated, including:

[0015] Multiple iterations are performed on each telecommunication time series data marked as abnormal in the telecommunication time series data set. In each iteration, it is determined by probability whether to add Gaussian noise to the feature vector of the telecommunication time series data marked as abnormal. When it is determined to add Gaussian noise, the Gaussian noise is added to the non-zero feature vector at each moment, and the dimension of the added Gaussian noise is matched with the non-zero feature vector to generate simulated abnormal telecommunication time series data.

[0016] The beneficial effect of adopting the above further solution is: solving the imbalance problem of telecommunications time series data sets and being able to improve the recognition accuracy of the trained telecommunications fraud number recognition model.

[0017] Furthermore, a telecommunications fraud number recognition model is constructed, including:

[0018] Based on the characteristics of the telecommunications time series dataset, a Transformer-based deep learning model is constructed as a telecommunications fraud number recognition model.

[0019] Furthermore, the trained telecommunications fraud number recognition model is used to identify fraudulent phone numbers on new phone numbers, including:

[0020] Convert multiple specified attribute fields in the new phone number into features to obtain a one-dimensional feature vector corresponding to the new phone number, and convert the one-dimensional feature vector corresponding to the new phone number through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to the new phone number;

[0021] After normalizing the multidimensional feature vector corresponding to the new phone number, converting it, the telecommunication time series data corresponding to the new phone number is obtained;

[0022] Input the telecommunication time series data corresponding to the new telephone number into the trained telecommunication fraud number recognition model to obtain the output recognition result;

[0023] Determine whether the new phone number is a fraud number based on the output recognition result.

[0024] 2) In the second aspect, the present invention also provides a telecommunications fraud number identification system based on feature fusion, and the specific technical solution is as follows:

[0025] It includes a telecommunication data acquisition module, a telecommunication data processing module, a telecommunication time series data generation module, a simulated abnormal telecommunication time series data generation module, a model building training module and a telecommunication fraud number identification module;

[0026] The telecommunication data acquisition module is used to: acquire telecommunication data sets;

[0027] The telecommunication data processing module is used to: convert multiple specified attribute fields in each telecommunication data in the telecommunication data set into features, obtain a one-dimensional feature vector corresponding to each telecommunication data, and convert each one-dimensional feature vector respectively through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to each one-dimensional feature vector, thereby forming a multi-dimensional feature vector set;

[0028] The telecommunication time series data generation module is used to: normalize the multidimensional feature vector set, and then convert each normalized multidimensional feature vector into telecommunication time series data to obtain a telecommunication time series data set;

[0029] The simulated abnormal telecommunication time series data generation module is used to: generate simulated abnormal telecommunication time series data based on a simulated abnormal sequence generation algorithm of Gaussian random noise and a telecommunication time series data set;

[0030] The model building training module is used to: build a telecommunications fraud number recognition model, and train the telecommunications fraud number recognition model based on a balanced telecommunications time series data set, where the balanced telecommunications time series data set includes the telecommunications time series data in the telecommunications time series data set and the generated simulated abnormal telecommunications time series data;

[0031] The telecommunications fraud number identification module is used to: use the trained telecommunications fraud number identification model to identify fraudulent phone numbers on new phone numbers.

[0032] Based on the above scheme, the telecommunications fraud number identification system based on feature fusion of the present invention can also be improved as follows.

[0033] Furthermore, the simulated abnormal telecommunication time series data generation module is specifically used to: perform multiple iterations on each telecommunication time series data marked as abnormal in the telecommunication time series data set, and in each iteration, determine by probability whether to add Gaussian noise to the feature vector of the telecommunication time series data marked as abnormal, and when it is determined to add Gaussian noise, add Gaussian noise to the non-zero feature vector at each moment, and make the dimension of the added Gaussian noise match the non-zero feature vector to generate simulated abnormal telecommunication time series data.

[0034] Furthermore, the model building training module is also specifically used for:

[0035] Based on the characteristics of the telecommunications time series dataset, a Transformer-based deep learning model is constructed as a telecommunications fraud number recognition model.

[0036] Furthermore, the telecommunications fraud number identification module is specifically used for:

[0037] Calling a telecommunications data processing module to convert multiple specified attribute fields in the new phone number into features to obtain a one-dimensional feature vector corresponding to the new phone number, and converting the one-dimensional feature vector corresponding to the new phone number through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to the new phone number;

[0038] Calling a telecommunication time series data generation module to normalize the multidimensional feature vector corresponding to the new phone number, and then converting it to obtain the telecommunication time series data corresponding to the new phone number;

[0039] Input the telecommunication time series data corresponding to the new telephone number into the trained telecommunication fraud number recognition model to obtain the output recognition result;

[0040] Determine whether the new phone number is a fraud number based on the output recognition result

[0041] 3) In a third aspect, the present invention further provides an electronic device, comprising a processor, the processor being coupled to a memory, the memory storing at least one computer program, and the at least one computer program being loaded and executed by the processor, so that the electronic device can implement any of the above-mentioned telecommunications fraud number identification methods based on feature fusion.

[0042] 4) In a fourth aspect, the present invention further provides a computer-readable storage medium, in which at least one computer program is stored, and at least one computer program is loaded and executed by a processor so that the computer implements any of the above-mentioned telecommunications fraud number identification methods based on feature fusion.

[0043] It should be noted that the beneficial effects achieved by the technical solutions of the second to fourth aspects of the present invention and the corresponding possible implementation methods can be found in the above-mentioned technical effects of the first aspect and its corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0045] Figure 1 A schematic diagram of a method for identifying telecommunication fraud numbers based on feature fusion according to an embodiment of the present invention;

[0046] Figure 2 This is a structural diagram of a telecommunications fraud number identification system based on feature fusion according to an embodiment of the present invention;

[0047] Figure 3 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] The purpose of the present invention is to provide a telecommunications fraud number identification method, system and electronic device based on feature fusion, which can extract the common features of fraudulent calls and intercept fraud in advance.

[0050] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] like Figure 1 As shown, a method for identifying telecommunication fraud numbers based on feature fusion in an embodiment of the present invention includes the following steps:

[0052] S1. Acquire and convert multiple specified attribute fields in each telecommunication data in the telecommunication data set into features to obtain a one-dimensional feature vector corresponding to each telecommunication data, and convert each one-dimensional feature vector separately through a feature fusion algorithm to obtain a multidimensional feature vector corresponding to each one-dimensional feature vector to form a multidimensional feature vector set.

[0053] Among them, the telecommunications data set in the present invention refers to: a telecommunications data set that has been desensitized, and the telecommunications data set includes multiple telecommunications data, each telecommunications data contains relevant information about the telephone number registration, and may specifically include telephone number, ID number, province code, city code, district code, age, gender, number of numbers under the name, call package name, main card type, card activation date, card activation channel, card activation business hall and number change type, etc., all corresponding to different attribute fields.

[0054] Multiple specified attribute fields may include: attribute fields corresponding to telephone number, ID number, province code, city code, district code, age, gender, number of numbers under the name, call package name, main card type, card activation date, card activation channel, card activation business hall and number change type.

[0055] Among them, through the feature fusion algorithm, each one-dimensional feature vector is converted separately to obtain the multi-dimensional feature vector corresponding to each one-dimensional feature vector. The specific implementation process is as follows:

[0056] The feature fusion algorithm adopts a more refined data processing strategy, further converting the features in the telecommunications one-dimensional feature vector into one-dimensional features, and then combining multiple one-dimensional features into a multi-dimensional feature vector. Without sacrificing the original information of the data, the data expression form is optimized, so that the interaction between features is effectively reflected, rather than simply being treated independently. The feature fusion algorithm includes: for text-type telecommunications features, the similarity feature vector is formed after being processed by the Minhash algorithm; for date-type telecommunications features, time period coding is performed to form a periodic feature vector; for digital telecommunications features, highly correlated features are aggregated into feature vectors through in-depth correlation analysis. The data types of the converted features include digital, date, and text types. Specifically:

[0057] (1) The features corresponding to the telephone number, ID number, province code, city code, district code, card opening office, and call package name are considered text features. The specific conversion method is as follows:

[0058] After the Minhash algorithm is processed, a similarity feature vector is formed. For example, the Minhash algorithm is used to process the ID card number, which can ensure that the feature vectors generated by the numbers with only slight differences in a few digits remain close in space after processing, thereby retaining their similarity when inputting the model. The MinHash algorithm is one of the most commonly used hash function construction methods in the local sensitive hashing algorithm. It maps data in high-dimensional space to low-dimensional space by constructing a random hash function and maintains the similarity between data points. The implementation of the Minhash algorithm includes the following two steps:

[0059] 1) Construct a 3-shingle set:

[0060] Assume that the sliding window size is 3 and the sliding step is 1. The sliding window slides from the beginning to the end of the text data to generate a shingle set, which is converted into a numerical vector by calculating its CRC32 value.

[0061] 2) Map the 3-shingle set to a signature vector:

[0062] By selecting a random hash function to simulate random permutation, the hash values ​​of all elements in the shingle set are calculated and the minimum hash value is selected as the signature value. This implementation uses the division remainder method to construct m random hash functions, which are defined as follows:

[0063] h i (x)=(a i *x+b i )%mod

[0064] Among them, h i (x) represents the i-th random hash function, i∈[1,m], a i and b i is a random coefficient, mod is a prime number, and in this implementation, 3-shingle is mapped to [0,2 8 -1], then mod is greater than 2 8 The minimum prime number of -1 is 257. The random coefficient and mod value are the same when calculating the signature vector of each shingle set, so multiple signature vectors can be calculated in parallel, and % represents the modulus symbol.

[0065] The number of random hash functions m determines the length of the signature vector. The longer the signature, the more accurate the result of using the signature vector to evaluate the similarity between shingle sets, but the Minhash calculation amount will also increase. For example, when 2m random hash functions are selected to calculate the signature vector, the Minhash calculation amount doubles. In this embodiment, m=4 is specified, and a 4-dimensional feature vector is finally generated.

[0066] (2) The features corresponding to age, gender, number of numbers under one’s name, primary card type, card activation channel, and number change type are considered as digital features. Some non-numeric features (features corresponding to gender, primary card type, card activation channel, and number change type) are converted into digital features through numerical coding. For example, gender is converted to: 0 for male and 1 for female. Through in-depth correlation analysis, highly correlated features are clustered into feature vectors. For example, the user feature group includes features corresponding to age, gender, and number of numbers under one’s name, a total of 3 features. The number feature group includes features corresponding to primary card type, card activation channel, and number change type, a total of 3 features. A 4-dimensional feature vector is formed by forward filling with 0.

[0067] (3) Research shows that the peak period of telecommunications fraud is often related to special time periods such as holidays, and the annual statistics are periodic. Therefore, the date data, that is, the card opening date, is coded for time periods, and the time features of month, week, quarter, and day are extracted to form a periodic 4-dimensional feature vector.

[0068] After being processed by the feature fusion algorithm, the one-dimensional telecommunication feature data is converted into a multi-dimensional feature vector, namely a multi-dimensional feature vector, specifically 10×4 dimensions, and all the multi-dimensional feature vectors form a multi-dimensional feature vector set.

[0069] S2. Normalize the multidimensional feature vector set, and then convert each normalized multidimensional feature vector into telecommunication time series data to obtain a telecommunication time series data set. Specifically:

[0070] The max-min normalization method is used to normalize the multidimensional feature vector set to obtain the normalized (standardized) telecommunication multidimensional feature vector set, which is specifically described as follows:

[0071] Feature normalization is crucial to the prediction effect of the model. Max-Min transformation is a commonly used data normalization method. Its principle is to scale the value range of the original data to the target range through such linear transformation, thereby eliminating the dimensional differences between different features and making the data more suitable for the training and optimization of machine learning algorithms. The calculation formula is as follows:

[0072]

[0073] Where x is the original data, x′ is the converted data, min(X) and max(X) are the minimum and maximum values ​​of the original data, respectively, and min and max are the minimum and maximum values ​​of the specified target range, usually [0,1] or [-1,1].

[0074] Each normalized multi-dimensional feature vector is converted into telecommunication time series data. The specific implementation process is as follows:

[0075] Each normalized multidimensional feature vector is regarded as a feature matrix, each row is used as a feature vector at a certain moment, and the number of matrix rows is used as the time step. It is then converted into a telecommunications time series dataset, and the categories of the time series are marked one by one.

[0076] For example, the 10×4 dimensional multidimensional feature vector in the above text forms a 10×4 dimensional feature matrix, with each row as the feature vector at a certain moment and the number of matrix rows as the time step, which is then converted into telecommunication time series data. Similarly, all telecommunication time series data are obtained to form a telecommunication time series data set, and the categories of the telecommunication time series data are marked one by one.

[0077] S3, generating simulated abnormal telecommunication time series data based on a simulated abnormal sequence generation algorithm of Gaussian random noise and a telecommunication time series data set;

[0078] S4. Construct a telecommunication fraud number recognition model, and train the telecommunication fraud number recognition model based on a balanced telecommunication time series data set, where the balanced telecommunication time series data set includes the telecommunication time series data in the telecommunication time series data set and the generated simulated abnormal telecommunication time series data;

[0079] S5. Use the trained telecommunications fraud number recognition model to identify fraud on new phone numbers.

[0080] Optionally, in S3, generating simulated abnormal telecommunication time series data based on a simulated abnormal sequence generation algorithm of Gaussian random noise and a telecommunication time series data set includes:

[0081] S30, multiple iterations are performed on each telecommunication time series data marked as abnormal in the telecommunication time series data set. In each iteration, it is determined by probability whether to add Gaussian noise to the feature vector of the telecommunication time series data marked as abnormal. When it is determined to add Gaussian noise, the Gaussian noise is added to the non-zero feature vector at each moment, and the dimension of the added Gaussian noise is matched with the non-zero feature vector to generate simulated abnormal telecommunication time series data. This step is the implementation process of data expansion, specifically:

[0082] Data augmentation refers to the method of expanding the original data set by artificially creating new training data. In deep learning, data augmentation is a commonly used strategy that can effectively avoid model overfitting and improve the model's generalization ability for unknown data. Gaussian noise is a random noise that follows a normal distribution. In data augmentation, it is widely used in data types such as images, text, and audio to enhance the robustness and generalization ability of the model. The principle of using Gaussian noise for data augmentation is:

[0083] Increase the randomness of data: Adding Gaussian noise to the original data will cause random disturbances, thereby generating new data samples. These new data samples are similar to the original data, but there are certain differences, which can help the model learn more essential features in the data and avoid over-reliance on the specificity of the training data.

[0084] Simulating real data noise: In practical applications, data is often affected by various noises, such as sensor noise, environmental noise, etc. Adding Gaussian noise to training data can simulate these noises, making the model more robust and better able to handle real data with noise.

[0085] The probability density of Gaussian noise obeys Gaussian distribution (normal distribution), where there are two parameters, mean μ and variance σ, and the distribution is defined as follows:

[0086]

[0087] After obtaining the telecommunications time series data marked as abnormal, in order to simulate the data variability that may be encountered in actual applications, each telecommunications time series data marked as abnormal is iterated epochs times. In each iteration, it is decided whether to add Gaussian noise to the feature vector of the data based on probability. When it is decided to add Gaussian noise, Gaussian noise is added to each non-zero feature vector (each telecommunications time series data consists of multi-dimensional feature vectors, some of which are zero feature vectors, and zero feature vectors do not add noise), and the dimension of Gaussian noise is ensured to match the feature vector. The simulated abnormal data generated by iteration expands the abnormal telecommunications time series data set, and the balanced telecommunications time series data set is used for subsequent model training.

[0088] In this implementation, the probability threshold α is set to 0.4. Then, for a single abnormal telecommunication time series data X = (X1, X2,,…, X T ), where T represents the time step, X i Represents the feature vector of the i-th time step, and each iteration step is as follows:

[0089] 1) Generate a random number θ using a pseudo-random number generator (PRNG) based on a linear congruential generator (LCG).

[0090] 2) If θ ≥ α, the random sampling generated by the normal distribution with μ = 0 and σ = 1 is multiplied by a small coefficient ε = 0.0001 to form Gaussian noise, which is then superimposed on the non-zero eigenvector X in X. i A new abnormal telecommunication time series data X' is formed.

[0091] 3) If θ<α, then X'=X.

[0092] 4) Add X' to the abnormal telecommunication time series data set.

[0093] The size of the coefficient ε is set to ensure that the noise does not significantly interfere with the distribution characteristics of the original data.

[0094] Optionally, in S4, a telecommunications fraud number recognition model is constructed, including:

[0095] S40. Based on the characteristics of the telecommunications time series dataset, a Transformer-based deep learning model is constructed as a telecommunications fraud number recognition model.

[0096] The Transformer model consists of an encoder and a decoder, both of which are composed of multiple layers stacked together. Each layer contains the following two sub-layers:

[0097] 1) Self-Attention Mechanism: used to capture global dependencies in the input sequence;

[0098] 2) Feed Forward Network: used to perform nonlinear transformation on the representation of each position.

[0099] This implementation belongs to the classification task. The main goal is to understand the meaning of the input sequence and assign it to the relevant category. Therefore, the decoder is not necessary because the encoder itself can effectively process and classify the input data. The structure of the telecommunications fraud number recognition model constructed in this implementation includes: input layer, encoding layer and linear layer, as follows:

[0100] 1) Input layer: This layer is responsible for converting the dimension of the input sequence x. The 1D convolutional layer is used to convert the dimension m of the sequence x to 256 dimensions.

[0101] 2) Encoding layer: The main function of the encoder is to convert the input sequence into a semantic representation. The encoder consists of multiple identical layers, each of which mainly includes position encoding, self-attention mechanism, residual connection, and layer normalization. The main function of the decoder is to generate the target sequence based on the output of the encoder. Each layer mainly includes mask self-attention mechanism, encoder-decoder self-attention mechanism, residual connection, and layer normalization. The core mechanism in the encoding layer is the self-attention mechanism layer, and the calculation formula is as follows:

[0102]

[0103] Among them, Q, K, and V are three matrices of equal dimensions, representing the query vector, key vector, and value vector, respectively. kis the dimension of the key vector. The division operation helps prevent the inner product from being too large, causing the softmax function to enter the saturation region, thereby impairing the learning ability of the model.

[0104] 3) Output layer: This layer projects the vector output by the encoder to the final prediction value. It consists of 3 linear layers (256-128-64), and finally the judgment result is output by the sigmoid function.

[0105] The model is adjusted and trained using the balanced telecommunications time series dataset.

[0106] Optionally, in S5, the trained telecommunications fraud number recognition model is used to perform fraud recognition on the new telephone number, including:

[0107] S50, converting multiple specified attribute fields in the new phone number into features to obtain a one-dimensional feature vector corresponding to the new phone number, and converting the one-dimensional feature vector corresponding to the new phone number through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to the new phone number;

[0108] S51, normalizing the multidimensional feature vector corresponding to the new telephone number, and then converting it to obtain telecommunication time series data corresponding to the new telephone number;

[0109] S52, inputting the telecommunication time series data corresponding to the new telephone number into the trained telecommunication fraud number recognition model to obtain an output recognition result;

[0110] S53: Determine whether the new phone number is a fraud number based on the output recognition result.

[0111] In the present invention, a telecommunication data set is obtained, data preprocessing is performed on the telecommunication data set, the telecommunication data is converted into a one-dimensional feature vector, and the telecommunication one-dimensional feature vector is synthesized into a multi-dimensional feature vector through a feature fusion algorithm; the multi-dimensional feature vector data set is converted into a telecommunication time series data set; a simulated abnormal sequence generation algorithm based on Gaussian random noise is used to solve the imbalance problem of the telecommunication time series data set; according to the characteristics of the telecommunication time series data set, a telecommunication fraud number recognition model based on Transformer is constructed, and the model is adjusted and trained through the balanced telecommunication time series data set, and then the trained model is used to identify fraud for new phone numbers. The present invention realizes the extraction of common features of fraudulent calls and the advance warning and interception of fraud; at the same time, an in-depth study is conducted on the common features of telecommunication fraudsters when registering phone numbers, and an innovative feature fusion algorithm is proposed; the proposed simulated abnormal sequence generation algorithm based on Gaussian random noise can simulate and generate abnormal telecommunication time series data with fraud characteristics, thereby greatly improving the training ability of the model, so that it can still maintain high performance when facing an unbalanced telecommunication data set. A Transformer-based deep learning model was constructed, which has a high accuracy in detecting telecommunications fraud numbers and can promptly discover potential security threats. Compared with the prior art, the beneficial effects of the present invention are mainly reflected in the following aspects:

[0112] 1) The present invention conducts an in-depth study on the common features of fraudulent calls and proposes an innovative feature processing algorithm. Different from the loss of feature correlation caused by hash processing in traditional methods, the present invention processes text data with the Minhash algorithm to form a similarity feature vector; performs time period coding processing on date data to form a periodic feature vector; for digital data, highly correlated features are aggregated into feature vectors through in-depth correlation analysis. The formed multi-dimensional feature vector optimizes the expression of the data without sacrificing the original information of the data, so that the interaction between features is effectively reflected, rather than simply being treated independently. This innovative method can more accurately extract the common features of fraudulent calls and provide strong support for building an efficient telecommunications fraud number recognition model.

[0113] 2) The present invention realizes dynamic detection of fraudulent numbers and pre-emptive interception of fraud. By effectively processing the time series characteristics in the phone number registration data, the model can quickly identify numbers suspected of fraud and provide early warnings to prevent fraudulent number registration for business halls in specific areas. This not only improves the accuracy and efficiency of telecommunications fraud detection, but also significantly optimizes the practicality and response speed of the model, provides scientific decision-making support for operators, and effectively reduces the activation rate of fraudulent phone numbers.

[0114] 3) To address the data imbalance problem, the present invention proposes a simulated abnormal sequence generation algorithm based on Gaussian random noise. This algorithm can simulate and generate abnormal samples with fraud characteristics, thereby greatly improving the training ability of the model, enabling it to maintain high performance when facing an unbalanced data set. This innovative method effectively solves the difficulties faced by traditional models in processing unbalanced data, and further improves the accuracy and reliability of telecommunications fraud number recognition.

[0115] 4) The telephone service in the telecommunications service is selected for analysis and utilization, and a telecommunications fraud number identification method based on feature fusion is proposed to extract the common features of fraudulent calls and intercept fraud in advance. Combined with the experience accumulated by telecommunications operators, it is found that telecommunications users often have similar characteristics when committing telecommunications fraud. Members of the same fraud gang may choose to register batches of telephone numbers at the same location, special time period or the same channel, and have similar call packages. By learning and extracting the common features of fraudulent calls, a fraudulent number identification model is constructed and applied to business halls in specific areas, which can provide them with early warning information to prevent telecommunications fraud registration. Once the model identifies a batch of registered numbers with high-risk fraud suspicion, the system can immediately issue an early warning to the relevant business hall and recommend further review and verification measures. This strategy of preventing telecommunications fraud from the source can not only effectively reduce the activation rate of fraudulent phone numbers and reduce the occurrence of fraud incidents, but also improve the service security of telecommunications operators and the trust of users.

[0116] In the above embodiments, although the steps are numbered S1, S2, etc., these are only specific embodiments given by the present invention. Those skilled in the art may adjust the execution order of S1, S2, etc. according to actual conditions, which is also within the protection scope of the present invention. It can be understood that in some embodiments, some or all of the above embodiments may be included.

[0117] like Figure 2 As shown, a telecommunication fraud number identification system 200 based on feature fusion according to an embodiment of the present invention includes a telecommunication data acquisition module 201, a telecommunication data processing module 202, a telecommunication time series data generation module 203, a simulated abnormal telecommunication time series data generation module 204, a model building training module 205 and a telecommunication fraud number identification module 206;

[0118] The telecommunication data acquisition module 201 is used to: acquire a telecommunication data set;

[0119] The telecommunication data processing module 202 is used to: convert multiple specified attribute fields in each telecommunication data in the telecommunication data set into features, obtain a one-dimensional feature vector corresponding to each telecommunication data, and convert each one-dimensional feature vector respectively through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to each one-dimensional feature vector, thereby forming a multi-dimensional feature vector set;

[0120] The telecommunication time series data generation module 203 is used to: normalize the multidimensional feature vector set, and then convert each normalized multidimensional feature vector into telecommunication time series data to obtain a telecommunication time series data set;

[0121] The simulated abnormal telecommunication time series data generation module 204 is used to: generate simulated abnormal telecommunication time series data based on a simulated abnormal sequence generation algorithm of Gaussian random noise and a telecommunication time series data set;

[0122] The model building training module 205 is used to: build a telecommunications fraud number recognition model, and train the telecommunications fraud number recognition model based on a balanced telecommunications time series data set, where the balanced telecommunications time series data set includes the telecommunications time series data in the telecommunications time series data set and the generated simulated abnormal telecommunications time series data;

[0123] The telecommunications fraud number identification module 206 is used to use the trained telecommunications fraud number identification model to identify fraudulent phone numbers on new telephone numbers.

[0124] Optionally, in the above technical solution, the simulated abnormal telecommunication timing series data generation module 204 is specifically used to: perform multiple iterations on each telecommunication timing series data marked as abnormal in the telecommunication timing series data set, and in each iteration, determine by probability whether to add Gaussian noise to the feature vector of the telecommunication timing series data marked as abnormal; when it is determined to add Gaussian noise, add Gaussian noise to the non-zero feature vector at each moment, and make the dimension of the added Gaussian noise match the non-zero feature vector to generate simulated abnormal telecommunication timing series data.

[0125] Optionally, in the above technical solution, the model building training module 205 is further specifically used for:

[0126] Based on the characteristics of the telecommunications time series dataset, a Transformer-based deep learning model is constructed as a telecommunications fraud number recognition model.

[0127] Optionally, in the above technical solution, the telecommunications fraud number identification module 206 is specifically used for:

[0128] Calling the telecommunication data processing module 202 to convert multiple specified attribute fields in the new phone number into features to obtain a one-dimensional feature vector corresponding to the new phone number, and converting the one-dimensional feature vector corresponding to the new phone number through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to the new phone number;

[0129] Calling the telecommunication time series data generation module 203, normalizing the multi-dimensional feature vector corresponding to the new telephone number, and then converting it to obtain the telecommunication time series data corresponding to the new telephone number;

[0130] Input the telecommunication time series data corresponding to the new telephone number into the trained telecommunication fraud number recognition model to obtain the output recognition result;

[0131] Determine whether the new phone number is a fraud number based on the output recognition result.

[0132] It should be noted that the beneficial effects of the telecommunications fraud number identification system 200 based on feature fusion provided in the above embodiment are the same as the beneficial effects of the telecommunications fraud number identification method based on feature fusion, which will not be repeated here. In addition, when the system provided in the above embodiment realizes its functions, it only uses the division of the above-mentioned functional modules as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to actual conditions to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0133] like Figure 3 As shown, an electronic device 300 of an embodiment of the present invention includes a processor 320, the processor 320 is coupled to a memory 310, and the memory 310 stores at least one computer program 330, and the at least one computer program 330 is loaded and executed by the processor 320, so that the electronic device 300 implements any of the above-mentioned telecommunication fraud number identification methods based on feature fusion, specifically:

[0134] The electronic device 300 may have relatively large differences due to different configurations or performances, and may include one or more processors 320 (Central Processing Units, CPU) and one or more memories 310, wherein the one or more memories 310 store at least one computer program 330, and the at least one computer program 330 is loaded and executed by the one or more processors 320, so that the electronic device 300 implements any of the telecommunications fraud number identification methods based on feature fusion provided in the above embodiments. Of course, the electronic device 300 may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The electronic device 300 may also include other components for realizing device functions, which will not be repeated here. The electronic device may specifically be a computer, etc.

[0135] A computer-readable storage medium according to an embodiment of the present invention stores at least one computer program, and the at least one computer program is loaded and executed by a processor so that the computer implements any of the above-mentioned telecommunications fraud number identification methods based on feature fusion.

[0136] Optionally, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0137] In an exemplary embodiment, a computer program product or a computer program is also provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes any of the above-mentioned telecommunication fraud number identification methods based on feature fusion.

[0138] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0139] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0140] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules in the devices disclosed above may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0141] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0142] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or modules, which can be electrical, mechanical or other forms.

[0143] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0144] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0145] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for identifying telecommunication fraud numbers based on feature fusion, characterized in that: include: Acquire and convert multiple specified attribute fields in each telecommunication data in the telecommunication data set into features to obtain a one-dimensional feature vector corresponding to each telecommunication data, and convert each one-dimensional feature vector respectively through a feature fusion algorithm to obtain a multidimensional feature vector corresponding to each one-dimensional feature vector to form a multidimensional feature vector set; Normalizing the multidimensional feature vector set, and then converting each normalized multidimensional feature vector into telecommunication time series data to obtain a telecommunication time series data set; Generate simulated abnormal telecommunication time series data based on a simulated abnormal sequence generation algorithm of Gaussian random noise and the telecommunication time series data set; Constructing a telecommunications fraud number recognition model, and training the telecommunications fraud number recognition model based on a balanced telecommunications time series data set, wherein the balanced telecommunications time series data set includes telecommunications time series data in the telecommunications time series data set and generated simulated abnormal telecommunications time series data; Use the trained telecommunications fraud number recognition model to identify fraudulent phone numbers on new phone numbers; The method of generating simulated abnormal telecommunication time series data based on a Gaussian random noise simulated abnormal sequence generation algorithm and the telecommunication time series data set comprises: Multiple iterations are performed on each telecommunication time series data marked as abnormal in the telecommunication time series data set. In each iteration, it is determined by probability whether to add Gaussian noise to the feature vector of the telecommunication time series data marked as abnormal. When it is determined to add Gaussian noise, the Gaussian noise is added to the non-zero feature vector at each moment, and the dimension of the added Gaussian noise is matched with the non-zero feature vector to generate simulated abnormal telecommunication time series data.

2. According to the method for identifying telecommunication fraud numbers based on feature fusion according to claim 1, it is characterized in that: Construct a telecommunications fraud number recognition model, including: Based on the characteristics of the telecommunications time series data set, a Transformer-based deep learning model is constructed as the telecommunications fraud number recognition model.

3. A method for identifying telecommunication fraud numbers based on feature fusion according to any one of claims 1 to 2, characterized in that: Use the trained telecommunications fraud number recognition model to identify fraudulent phone numbers on new phone numbers, including: Convert multiple specified attribute fields in the new phone number into features to obtain a one-dimensional feature vector corresponding to the new phone number, and convert the one-dimensional feature vector corresponding to the new phone number through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to the new phone number; After normalizing the multidimensional feature vector corresponding to the new phone number, converting it, the telecommunication time series data corresponding to the new phone number is obtained; Input the telecommunication time series data corresponding to the new telephone number into the trained telecommunication fraud number recognition model to obtain the output recognition result; Determine whether the new telephone number is a fraudulent number based on the output recognition result.

4. A telecommunications fraud number recognition system based on feature fusion, characterized in that: It includes a telecommunication data acquisition module, a telecommunication data processing module, a telecommunication time series data generation module, a simulated abnormal telecommunication time series data generation module, a model building training module and a telecommunication fraud number identification module; The telecommunication data acquisition module is used to: acquire a telecommunication data set; The telecommunication data processing module is used to: convert multiple specified attribute fields in each telecommunication data in the telecommunication data set into features to obtain a one-dimensional feature vector corresponding to each telecommunication data, and convert each one-dimensional feature vector respectively through a feature fusion algorithm to obtain a multidimensional feature vector corresponding to each one-dimensional feature vector to form a multidimensional feature vector set; The telecommunication time series data generation module is used to: normalize the multidimensional feature vector set, and then convert each normalized multidimensional feature vector into telecommunication time series data to obtain a telecommunication time series data set; The simulated abnormal telecommunication time series data generation module is used to: generate simulated abnormal telecommunication time series data based on a simulated abnormal sequence generation algorithm of Gaussian random noise and the telecommunication time series data set; The model building training module is used to: build a telecommunications fraud number recognition model, and train the telecommunications fraud number recognition model based on a balanced telecommunications time series data set, wherein the balanced telecommunications time series data set includes telecommunications time series data in the telecommunications time series data set and generated simulated abnormal telecommunications time series data; The telecommunications fraud number identification module is used to: use the trained telecommunications fraud number identification model to identify fraudulent new phone numbers; The simulated abnormal telecommunication time series data generation module is specifically used to: perform multiple iterations on each telecommunication time series data marked as abnormal in the telecommunication time series data set, and in each iteration, determine by probability whether to add Gaussian noise to the feature vector of the telecommunication time series data marked as abnormal, and when it is determined to add Gaussian noise, add Gaussian noise to the non-zero feature vector at each moment, and make the dimension of the added Gaussian noise match the non-zero feature vector to generate simulated abnormal telecommunication time series data.

5. According to claim 4, a telecommunication fraud number identification system based on feature fusion is characterized in that: The model building training module is also specifically used for: Based on the characteristics of the telecommunications time series data set, a Transformer-based deep learning model is constructed as the telecommunications fraud number recognition model.

6. A telecommunication fraud number identification system based on feature fusion according to any one of claims 4 to 5, characterized in that: The telecommunications fraud number identification module is specifically used for: Calling the telecommunication data processing module to convert multiple specified attribute fields in the new phone number into features to obtain a one-dimensional feature vector corresponding to the new phone number, and converting the one-dimensional feature vector corresponding to the new phone number through a feature fusion algorithm to obtain a multi-dimensional feature vector corresponding to the new phone number; Calling the telecommunication time series data generation module to normalize the multidimensional feature vector corresponding to the new telephone number, and then converting it to obtain the telecommunication time series data corresponding to the new telephone number; Input the telecommunication time series data corresponding to the new telephone number into the trained telecommunication fraud number recognition model to obtain the output recognition result; Determine whether the new telephone number is a fraudulent number based on the output recognition result.

7. An electronic device, characterized in that: The electronic device includes a processor, the processor is coupled to a memory, at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor so that the electronic device can implement a telecommunications fraud number identification method based on feature fusion as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that: At least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by the processor so that the computer implements a telecommunications fraud number identification method based on feature fusion as described in any one of claims 1 to 3.

Images