A network anti-telecom fraud system and anti-fraud method thereof

Abstract

Multiple embodiments of the present specification relate to the field of information technology, and specifically to a network anti-telecom fraud system and its anti-fraud method. The system includes: a server and a user end, the user end includes a data collection module, a local comparison module, a feature extraction module and a network comparison module, the data collection module collects the usage data of the handheld device, the local comparison module compares the reference behavior with the reference behavior once, if the first comparison is consistent, the operation content is compared with the reference content for a second time, if the second comparison is consistent, a risk warning is issued and the preset first disposal measure is initiated, the feature extraction module extracts the data features of the operation content and uploads it to the server, if the first comparison is inconsistent, the server feeds back the fraud risk identification result to the user end, the user end compares the operation content with the reference library, if the comparison is consistent, a risk warning is issued and the preset second disposal measure is initiated.

Description

Technical Field

[0001] Multiple embodiments of this specification relate to the field of information technology, and specifically to a network anti-telecom fraud system and an anti-fraud method thereof. Background Art

[0002] Telecom fraud refers to the use of telephones, the Internet and other communication tools to implement deception, with the purpose of illegally possessing other people's property. Common telecommunications fraud methods include but are not limited to impersonating public security, procuratorial and judicial personnel, impersonating relatives and friends, false winning information, fake shopping websites, false investment opportunities, etc. Telecom fraud usually starts with a phone call. After the user is deceived, they are gradually guided to visit a pre-prepared fraud website, or install a designated APP, or other tools. Fraudulent rhetoric is usually repetitive and simple, and its purpose is to quickly screen out targets that are easily deceived. This is because certain specific rhetoric has been proven to be effective. They usually use these proven patterns repeatedly to lure victims. For example, "You have an uncollected package that needs to be paid for", or "There is a security risk in your bank account, please follow the prompts."

[0003] At present, fraud risk identification based on big data analysis is a modern technical means, which uses a large amount of data resources and advanced analysis algorithms to predict and identify potential fraud activities. This method can improve the accuracy of identification and help relevant institutions take timely measures to prevent and combat fraud. However, big data analysis needs to be based on more sample data, and lacks the ability to identify newly emerging fraudulent rhetoric or fraudulent means. As a result, the current fraud risk identification has the problem of incomplete coverage. To this end, it is necessary to study anti-fraud technology suitable for small sample fraud risk identification. Summary of the invention

[0004] Multiple embodiments of this specification describe a network anti-telecom fraud system and an anti-fraud method thereof.

[0005] In a first aspect, the embodiments of this specification provide a network anti-telecom fraud system, including a server and a user terminal, wherein the user terminal runs on a user's handheld device and is connected to the server.

[0006] The user terminal includes a data collection module, a local comparison module, a feature extraction module and a network comparison module.

[0007] The data collection module collects usage data of the handheld device, the usage data includes operation behavior and operation content, the local comparison module stores preset reference data, the reference data includes reference behavior and reference content, the local comparison module compares the reference behavior with the reference behavior once, if the first comparison is consistent, then the operation content is compared with the reference content twice, if the second comparison is consistent, a risk warning is issued and a preset first disposal measure is initiated,

[0008] If the comparison does not match once, the feature extraction module extracts the data features of the operation content and uploads the data features to the server. The server obtains the fraud risk identification results of the data features based on the data features uploaded by multiple user terminals. When the fraud risk identification result is that there is a risk, the fraud risk identification result and the reference library are fed back to the user terminal. The user terminal compares the operation content with the reference library. If the comparison matches, a risk warning is issued and the preset second disposal measure is initiated.

[0009] In a second aspect, the embodiments of this specification provide a network anti-telecom fraud method, characterized in that it includes the steps of:

[0010] Setting up a server, setting up a user terminal on a user's handheld device, and the user terminal is in communication connection with the server;

[0011] The user terminal collects usage data of the handheld device, wherein the usage data includes operation behavior and operation content;

[0012] The user terminal stores preset reference data, and the reference data includes reference behavior and reference content;

[0013] The user terminal compares the reference behavior with the reference behavior once, and if the first comparison is consistent, the operation content is compared with the reference content for a second time, and if the second comparison is consistent, the user terminal issues a risk warning and initiates a preset first disposal measure,

[0014] If the comparison does not match, the user terminal extracts the data features of the operation content and uploads the data features to the server;

[0015] The server obtains fraud risk identification results of data features according to the data features uploaded by multiple users;

[0016] When the fraud risk identification result indicates that there is a risk, the server feeds back the fraud risk identification result and the reference library to the user terminal;

[0017] The user terminal compares the operation content with the reference library, and if the comparison is consistent, a risk warning is issued and a preset second disposal measure is initiated.

[0018] In a third aspect, an embodiment of this specification provides an electronic device, including a processor and a memory;

[0019] The processor is connected to the memory;

[0020] The memory is used to store executable program code;

[0021] The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in any one of the above aspects.

[0022] In a fourth aspect, an embodiment of the present specification provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the above aspects.

[0023] In a fifth aspect, an embodiment of this specification provides a computer program product, including a computer program, which implements the method described in any of the above aspects when executed by a processor.

[0024] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0025] In multiple embodiments of this specification, the network anti-telecom fraud system and method provided by the invention can identify network fraud risks by triggering a secondary comparison after a match is found. This method has the advantage of occupying less resources on the user side and only uploads data features to the server, so that the user's call recordings and text content do not need to leave the local area, which can effectively protect the user's privacy and security. Through the analysis of data features by the server, it is possible to identify new fraudulent words with a higher probability, issue risk warnings more timely, and be more conducive to protecting the user's information and financial security.

[0026] Other features and advantages of the various embodiments of the present specification will be further disclosed in the following detailed description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1A schematic diagram of an application scenario of the network anti-telecom fraud system provided in the embodiments of this specification.

[0029] Figure 2 A schematic diagram of the network anti-telecom fraud system architecture provided in the embodiments of this specification.

[0030] Figure 3 A schematic diagram of the UI interface of the network anti-telecom fraud system server provided in the embodiments of this specification.

[0031] Figure 4 A schematic diagram of extracting data features provided in an embodiment of this specification.

[0032] Figure 5 A schematic diagram of fraud risk identification results obtained by a server provided in an embodiment of this specification.

[0033] Figure 6 A schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0034] The following is an explanation and description of the technical solutions of the embodiments of this specification in conjunction with the drawings of the embodiments of this specification, but the following embodiments are only preferred embodiments of this specification, not all. Based on the embodiments in the implementation mode, other embodiments obtained by those skilled in the art without creative work are all within the scope of protection of this specification.

[0035] The terms "first", "second", "third", etc. in the description and claims of this specification and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0036] In the following description, terms such as "inside", "outside", "up", "down", "left", "right", etc. that indicate directions or positional relationships are only used to facilitate the description of the embodiments and simplify the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation of this specification.

[0037] The data involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection of relevant data complies with the relevant laws, regulations and standards of relevant countries and regions.

[0038] Before describing the technical solution in this specification, the application scenarios and related technologies of the technical solution are introduced.

[0039] Internet fraud is a form of fraud that is carried out over the Internet with the goal of illegally obtaining another person's property or sensitive information. As Internet technology develops, the methods of Internet fraud are also evolving. Common methods of Internet fraud include sending emails or text messages containing malicious links or attachments to trick victims into clicking on them to install malware or provide personal information. Or using social media platforms to post false information, such as fake sweepstakes, coupons, etc., to attract users to click on them and steal personal information. Creating web pages that are very similar to legitimate websites to trick users into entering sensitive information such as bank account numbers and passwords. Selling non-existent goods or services on illegal websites, or attracting buyers at extremely low prices, but not shipping them after payment. Using fake investment opportunities, such as high-return digital currency investments, to trick people into investing money and then disappearing. Using stolen identity information to conduct financial transactions or other fraudulent activities. And using communication methods disguised as trusted entities to steal login credentials, credit card details or other personal identity information.

[0040] Telephone fraud refers to the act of a fraudster 10 using various excuses or means to deceive a victim 21 through telephone communication, so that the victim 21 voluntarily or unknowingly provides money, personal information or other valuable items. Telephone fraud often impersonates public security, judicial and legal personnel, bank customer service, etc. to intimidate or deceive. Telephone fraud can be tracked through information such as phone numbers, but it is relatively difficult to track because the fraudster 10 may use prepaid mobile phone cards or other methods to hide his true identity. In some cases, online fraud and telephone fraud are used in combination. For example, the fraudster 10 may first contact the victim 21 by phone, and then guide him to visit a website or send a text message containing a malicious link to gain the victim's 21 trust or sensitive information.

[0041] In telephone fraud, the fraudster 10 often creates an emergency situation to make the victim 21 make a decision in a short time and reduce the time for thinking. After the victim 21 is deceived, the fraudster 10 gradually guides the victim 21 to provide key information, visit a designated website, or transfer money to a designated account according to the predetermined script. The fraudster 10 often uses a fake identity and impersonates an authority or person to increase persuasiveness. Please refer to the attached Figure 1 , scammers 10 will repeatedly call the same phone number, or even make group calls to multiple numbers in a region.

[0042] The scammers’ language is usually very direct and easy to understand, which ensures that the target group can quickly understand the intention. This simple and direct approach also helps scammers quickly establish contact with potential victims21. Simple language and direct requests reduce communication costs, allowing scammers to reach more people in a short period of time. The language used by scammers10 is designed with strong screening functions, which can help scammers10 quickly identify those who are most vulnerable to scams. For example, if a person immediately believes the caller’s claim that they are a bank employee and is willing to follow the instructions, then this person is more likely to become a target of fraud. On the contrary, if the other party raises questions or requests more information, the scammer10 may abandon this person and move on to the next target.

[0043] By using these strategies, the scammer 10 can effectively screen out those who may lack vigilance, are not familiar with technology, or are in a difficult situation (such as urgently needing funds) as targets. The elderly, people with unstable economic conditions, or individuals who are unfamiliar with network technology are often the main targets of this type of fraud. Most users 20 will not be fooled, and can clearly distinguish whether the incoming call is a harassing call or a fraudulent call. However, most users 20 only hang up the phone quickly after determining that the call is a fraudulent call. For example, 3 seconds, 5 seconds, 10 seconds, etc. In the process, the user 20 will not make any response, but may mark the phone number as a harassing call or a fraudulent call after hanging up the phone. Only the deceived user 20, that is, the victim 21, will patiently communicate with the scammer 10 for a long time and perform some actions according to the requirements of the scammer 10, such as providing an account password, transferring money, visiting a designated website, etc.

[0044] The system and method provided in this application are applied to Figure 2 In the system architecture shown, Figure 2 is a schematic diagram of the system architecture in the embodiment of the present application, such as Figure 2 As shown, the system architecture includes a server and a handheld device 23, and the user end is deployed on the handheld device 23, wherein the user end runs on the handheld device 23 in the form of an independent application (application, APP), and can also be operated on the handheld device 23 in the form of a background service, etc. The specific presentation form of the user end is not limited here. The server involved in this application can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), as well as big data and artificial intelligence platforms and other basic cloud computing services. As shown in the attached Figure 3As shown, it is a schematic diagram of the UI interface of the network anti-telecom fraud system server disclosed in this specification. The UI interface displays the number of data features received, the number of risk warnings issued, and the corresponding disposal statistics. The handheld device 23 can be a smart phone, tablet computer, laptop, PDA, personal computer, smart speaker, smart TV, smart watch, vehicle-mounted device, wearable device, etc. with voice call function. The handheld device 23 and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application. The number of servers and handheld devices 23 is also not limited.

[0045] Since this application involves some professional terms, these professional terms will be introduced below.

[0046] Call number

[0047] The calling number is the phone number used to make the call, which can be a landline or mobile number.

[0048] Call Recording

[0049] Call recording is a technical means of recording the conversation between two parties during a call. Call recording can be used for personal purposes, such as recording important information and memos, and can also be used for internal corporate management, customer service quality monitoring, etc. In addition, it also has specific application scenarios in the fields of law and security.

[0050] Hash value

[0051] A hash value is a string output that is converted into a fixed length of data (such as a string, file, etc.) through a hash algorithm. This output is usually composed of numbers and letters, and has a fixed length (depending on the hash algorithm used). There are many types of hash algorithms, such as MD5, SHA-1, SHA-256, etc. If the hash values ​​of two texts or files are the same, it means that the contents of the two are the same.

[0052] This manual first provides a network anti-telecom fraud system. Please refer to the attached Figure 2 , including a server and a client, wherein the client runs on a handheld device 23 of a user 20 and is connected to the server.

[0053] The user terminal includes a data collection module, a local comparison module, a feature extraction module and a network comparison module. The data collection module collects the usage data of the handheld device 23, and the usage data includes operation behavior and operation content. The local comparison module stores preset reference data, and the reference data includes reference behavior and reference content. The local comparison module compares the reference behavior with the reference behavior once 31. If the first comparison 31 is consistent, the operation content is compared with the reference content twice. If the second comparison is consistent, a risk warning is issued and the preset first disposal measure is initiated. The first comparison 31 is used to identify more obvious fraud risks, which have been obtained from previous cases or data through machine learning. Exemplarily, the reference behavior includes a call duration interval, a caller number fraud mark, a no answer, and a simple answer. The local comparison module performs the following steps when comparing the reference behavior with the reference behavior once 31: when the call duration matches the call duration interval of the reference behavior, the comparison is determined to be consistent; when the call ends, if the user 20 operates the caller number fraud mark, the comparison is determined to be consistent.

[0054] For example, according to the analyzed data, when the call duration is within a certain range, such as less than 3 seconds, it is generally judged as a sales call or a harassment call, and when the call duration is around 10 seconds, it is judged to be a possible fraud call. In another example, when the call duration is between 5 seconds and 15 seconds, it is judged to be a possible fraud call. Therefore, a call duration interval is set, and when the call duration is within the call duration interval, a secondary comparison is triggered for further judgment and screening.

[0055] When the primary comparison 31 matches, a secondary comparison is triggered to further determine whether there is a risk of telecommunications fraud. During the call, if the user 20 does not answer, the comparison is determined to be consistent; during the call, when the user 20's answers are all within the preset simple answer set, the comparison is determined to be consistent.

[0056] Exemplarily, the secondary comparison includes that after the call is completed, it is found through analysis that the user 20 has not made any response, then it is determined that there is a risk of telecommunications fraud. In another exemplary case, fraud calls usually need to guide the user 20 to do subsequent operations, such as transferring money, visiting a designated website, etc. In this process, the fraudster 10 keeps explaining the instructions, and the victim 21 only needs to answer simple replies such as "OK". Therefore, the secondary comparison includes that when the user 20 just keeps repeating simple answers during the process, it is determined that there is a risk of telecommunications fraud. At this time, a risk warning is issued and the preset first disposal measure is initiated. Exemplarily, a pop-up window is used to remind the user 20 that he may be experiencing telecommunications fraud, and the pop-up window disappears after the user 20 clicks. Exemplarily, the first disposal measure includes a pop-up window to remind the user 20 of the risk of telecommunications fraud when the user 20 opens any financial-related APP, reminding the user 20 to handle it with caution, and the pop-up window disappears after the user 20 clicks the pop-up window.

[0057] The feature extraction module extracts the data feature 22 of the operation content and uploads the data feature 22 to the server. Regardless of whether the comparison 31 is consistent, the data feature 22 is extracted and uploaded to the server. When the feature extraction module extracts the data feature 22 of the operation content, please refer to the attached Figure 4 , perform the following steps:

[0058] Step S101) identifying topics and their order in the text content, and recording them as topic context;

[0059] Step S102) respectively identifying the emotions of the two parties in the call recording, and recording them as the local call emotion sequence and the other party call emotion sequence respectively;

[0060] Step S103 ) extracts the hash value of the call number, and uses the hash value, topic context, the local call emotion sequence and the other party call emotion sequence as data features 22 .

[0061] If a comparison 31 does not match, the server obtains a fraud risk identification result 32 of the data feature 22 based on the data features 22 uploaded by multiple user terminals. When the fraud risk identification result 32 indicates that there is a risk, the fraud risk identification result 32 and the reference library 33 are fed back to the user terminal. The user terminal compares the operation content with the reference library 33. If the comparison matches, a risk warning is issued and the preset second disposal measure is initiated.

[0062] On the other hand, the operation content includes the call number and the call recording. When the data collection module collects the call recording, the following steps are performed: collecting the call recording during the call, storing the call recording after the call ends, identifying the text content of the call recording and storing it. After the feature extraction module extracts the data features 22, the call recording and the text content are deleted to ensure the security of the call recording and the text content.

[0063] By extracting the data feature 22 and uploading the data feature 22 to the server, the server obtains the data. Meanwhile, the data feature 22 cannot reversely restore the call recording and text content, and has a confidentiality effect, which can ensure the privacy of the call of the user 20.

[0064] The hash value of the call number can compare whether two call numbers are the same without revealing the call number. Among them, when extracting the hash value of the call number, a salted hash value can be used. The topics involved in the text content can be extracted by a large language model. That is, the text content is input into the large language model, and the large language model is instructed to extract the topics involved in the text content. The order of topics is determined by the order in which the topics appear in the text content. The large language model can also be used to identify the emotions of the two callers in the call recording, and the corresponding natural language task can be constructed.

[0065] Exemplarily, the text corresponding to each speech of each party in the text content is input into the large language model, and the large language model is instructed to recognize emotions. The sequence of emotions of both parties constitutes the local call emotion sequence and the other party call emotion sequence. The local call emotion sequence represents the call emotion sequence of the user 20. The other party call emotion sequence represents the call emotion sequence of the other party of the call. In the telephone communication link in telephone fraud and network fraud, the fraudster 10 usually impersonates some identities and intentionally creates panic in the victim. Moreover, the fraudulent speech is often used repeatedly. Therefore, when the same fraud speech is used for fraud, the local call emotion sequence will show similar characteristics on multiple victims. Moreover, the discovery of this similarity does not require too many samples, only a small number of samples, such as 10 samples, which is enough to find abnormalities and issue fraud warnings. It is suitable for discovering new fraud speech, and for warning and handling new fraud speech.

[0066] The reference content is a reference template of the fraudulent speech that has been received, or the reference content is a pre-set keyword set for fraud identification. When the first comparison 31 matches, the call duration is generally short, but it is enough to extract the text content and compare it with the keyword set to complete the second comparison. Exemplarily, the keyword set is {act now, reply immediately, limited time offer, last chance, make money without effort, get rich quickly, high return without risk, guaranteed income, bonus, exclusive investment, inside information, stock tips, high profit project, will be arrested, legal proceedings, fines, service suspension, donations, charity events, emergency rescue}.

[0067] On the other hand, in another embodiment, when the server obtains the fraud risk identification result 32 of the data feature 22 according to the data features 22 uploaded by the multiple users, please refer to the attached Figure 5 , perform the following steps:

[0068] Step S201) Group the received data features 22 according to the hash value of the call number and record them as the first group;

[0069] Step S202) Calculating the similarity of the topic context between the data features 22 in the first group;

[0070] Step S203) If the similarity is greater than a preset first threshold, the fraud risk identification result 32 is determined to be risky;

[0071] Step S204) Grouping the received data features 22 according to the topic context, recorded as the second group;

[0072] Step S205) calculating the similarity of the local call emotion sequence and the other party call emotion sequence between the data features 22 in the second group, and obtaining the comprehensive similarity according to the similarity of the local call emotion sequence and the other party call emotion sequence;

[0073] Step S206) If the comprehensive similarity is greater than a preset second threshold, the fraud risk identification result 32 is determined to be risky.

[0074] The hash values ​​of the call numbers are the same, indicating that the call is made from the same phone number. When the fraudster 10 calls multiple users 20, they can be classified into the first group. According to step S202) to step S203), the data features 22 of the first group are analyzed to obtain whether the call number is suspected of conducting network fraud or telephone fraud. The topic context can reflect the dialogue. When the number of data features 22 included in the second group is large, it means that there are many calls with the same topic context. For example, if there are 10 data features 22 with high similarity in topic context, it means that the topic context in 10 calls is basically the same, and there is a greater risk of fraudulent speech. At this time, the server feeds back the fraud risk identification result 32 and the reference library 33 to the user end. The reference library 33 is the latest reference template of the fraud speech, or the latest keyword set for fraud identification. It is used for the user end to compare the text content with the reference library 33 locally, identify the risk of fraud through the latest keyword set for possible fraud identification, and ensure the information and financial security of the user 20. Exemplarily, the second handling measure includes prompting the user 20 through a pop-up window that the user 20 may be experiencing telecommunications fraud, which disappears after the user 20 clicks on it. It also includes prompting the user 20 through a pop-up window when the user 20 opens any finance-related APP, reminding the user 20 to handle it with caution, which disappears after the user 20 clicks on it. It also includes reporting fraud risks to relevant competent authorities and servers.

[0075] On the other hand, this specification provides a network anti-telecom fraud method, comprising the steps of:

[0076] Setting up a server, setting up a user terminal on the handheld device 23 of the user 20, and the user terminal is in communication connection with the server;

[0077] The user terminal collects usage data of the handheld device 23, wherein the usage data includes operation behavior and operation content;

[0078] The user terminal stores preset reference data, and the reference data includes reference behavior and reference content;

[0079] The user terminal compares the reference behavior with the reference behavior once 31. If the first comparison 31 is consistent, the operation content is compared with the reference content twice. If the second comparison is consistent, the user terminal issues a risk warning and initiates a preset first disposal measure.

[0080] The user terminal extracts data features 22 of the operation content and uploads the data features 22 to the server;

[0081] If the comparison 31 does not match, the server obtains a fraud risk identification result 32 of the data feature 22 according to the data features 22 received from the multiple users;

[0082] When the fraud risk identification result 32 indicates that there is a risk, the server feeds back the fraud risk identification result 32 and the reference library 33 to the user terminal;

[0083] The user terminal compares the operation content with the reference library 33, and if the comparison is consistent, a risk warning is issued and a preset second disposal measure is initiated.

[0084] On the other hand, in another embodiment, the method for the user terminal to collect usage data of the handheld device 23 includes:

[0085] Collecting call recordings during a call, storing the call recordings after the call ends, and identifying and storing text content of the call recordings;

[0086] The method for the user end to extract the data feature 22 of the operation content includes:

[0087] Identify the topics and the order of topics involved in the text content, and record them as topic context;

[0088] Respectively identifying the emotions of the two parties in the call recording, and recording them as the local call emotion sequence and the other party call emotion sequence respectively;

[0089] The hash value of the call number is extracted, and the hash value, topic context, the local call emotion sequence and the other party call emotion sequence are used as data features 22.

[0090] On the other hand, the reference behavior includes a call duration interval and a caller number fraud mark, and the local comparison module performs the following steps when comparing the reference behavior with the reference behavior:

[0091] When the call duration matches the call duration interval of the reference behavior, the comparison is determined to be consistent;

[0092] When the call is over, if the user 20 operates the fraud mark of the incoming call number, it is determined that the comparison is consistent.

[0093] On the other hand, when the server obtains the fraud risk identification result 32 of the data feature 22 according to the data features 22 uploaded by the multiple users, the server performs the following steps:

[0094] According to the hash value of the call number, the received data feature 22 is grouped and recorded as a first group;

[0095] Calculating the similarity of the topic context between the data features 22 in the first group;

[0096] If the similarity is greater than a preset first threshold, the fraud risk identification result 32 is determined to be risky;

[0097] The received data features 22 are grouped according to the topic context, and recorded as the second group;

[0098] Calculate the similarity of the local call emotion sequence and the other party call emotion sequence between the data features 22 in the second group, and obtain the comprehensive similarity according to the similarity of the local call emotion sequence and the other party call emotion sequence;

[0099] If the comprehensive similarity is greater than a preset second threshold, the fraud risk identification result 32 is determined to be risky.

[0100] See also Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification is shown.

[0101] like Figure 6 As shown, the electronic device 1100 may include: at least one processor 1101, at least one network interface 1104, a user interface 1103, a memory 1105 and at least one communication bus 1102. Among them, the communication bus 1102 can be used to realize the connection and communication of the above-mentioned components. Among them, the user interface 1103 may include a button, and the optional user interface may also include a standard wired interface and a wireless interface. Among them, the network interface 1104 may include but is not limited to a Bluetooth module, an NFC module, a Wi-Fi module, etc. Among them, the processor 1101 may include one or more processing cores. The processor 1101 uses various interfaces and lines to connect various parts in the entire electronic device 1100, and executes various functions and processes data of the routing device 1100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1105, and calling data stored in the memory 1105. Optionally, the processor 1101 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 1101 may integrate one or a combination of CPU, GPU and modem, etc. Among them, the CPU mainly processes the operating system, user interface and application programs, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communication.

[0102] It is understandable that the above-mentioned modem may not be integrated into the processor 1101, but may be implemented by a separate chip.

[0103] Among them, the memory 1105 may include RAM or ROM. Optionally, the memory 1105 includes a non-transitory computer-readable medium. The memory 1105 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1105 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1105 may also be at least one storage device located away from the aforementioned processor 1101. The memory 1105 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application. The processor 1101 may be used to call the application stored in the memory 1105 and execute the methods in the above-mentioned multiple embodiments.

[0104] The embodiments of this specification also provide a computer-readable storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes the multiple steps in the above embodiments. If the components of the above electronic device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0105] The embodiments of this specification also provide a computer program product, including a computer program, which implements multiple steps in the above embodiments when executed by a processor.

[0106] In the absence of conflict, the technical features in this embodiment and implementation scheme can be combined arbitrarily.

[0107] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes a plurality of computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of this specification is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line 20 (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes multiple available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state drive (SSD)).

[0108] When implemented by hardware or firmware, the aforementioned method flow is programmed into the hardware circuit to obtain the corresponding hardware circuit structure and realize the corresponding function. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit, and its logic function is determined by the user 20 programming the device. A digital system is "integrated" on a PLD by the designer himself, without the need to ask a chip manufacturer to design and make a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when writing program development, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL), and HDL is not just one, but many. Those skilled in the art should also be aware that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit to easily obtain the hardware circuit that implements the logic method flow.

[0109] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Without departing from the design spirit of this specification, various modifications and improvements made to the technical solutions of this specification by ordinary technicians in this field should fall within the scope of protection determined by the claims of this specification.

Claims

1. A network anti-telecom fraud system, characterized in that: It includes a server and a client, wherein the client runs on a user's handheld device and is connected to the server. The user terminal includes a data collection module, a local comparison module, a feature extraction module and a network comparison module. The data collection module collects usage data of the handheld device, the usage data includes operation behavior and operation content, the local comparison module stores preset reference data, the reference data includes reference behavior and reference content, the local comparison module compares the behavior with the reference behavior once, if the first comparison is consistent, then the operation content is compared with the reference content twice, if the second comparison is consistent, a risk warning is issued and a preset first disposal measure is initiated, The feature extraction module extracts data features of the operation content and uploads the data features to the server. If a comparison does not match, the server obtains a fraud risk identification result of the data features based on the data features uploaded by multiple user terminals. When the fraud risk identification result is that there is a risk, the fraud risk identification result and the reference library are fed back to the user terminal. The user terminal compares the operation content with the reference library. If the comparison matches, a risk warning is issued and a preset second disposal measure is initiated; The operation content includes the call number and call recording, When the data collection module collects call recordings, the following steps are performed: Collecting call recordings during a call, storing the call recordings after the call ends, and identifying and storing text content of the call recordings; When the feature extraction module extracts the data features of the operation content, the following steps are performed: Identify the topics and the order of topics involved in the text content, and record them as topic context; Respectively identifying the emotions of the two parties in the call recording, and recording them as the local call emotion sequence and the other party call emotion sequence respectively; Extracting the hash value of the call number, and using the hash value, topic context, the local call emotion sequence and the other party call emotion sequence as data features; When the server obtains the fraud risk identification result of the data features according to the data features uploaded by the multiple users, the server performs the following steps: According to the hash value of the call number, the received data features are grouped and recorded as a first group; Calculate the similarity of the topic context between the data features in the first group; If the similarity is greater than a preset first threshold, the fraud risk identification result is determined to be a risk; The received data features are grouped according to the topic context and recorded as the second group; Calculating the similarity of the local call emotion sequence and the other party call emotion sequence between the data features in the second group, and obtaining the comprehensive similarity according to the similarity of the local call emotion sequence and the other party call emotion sequence; If the comprehensive similarity is greater than a preset second threshold, the fraud risk identification result is determined to be risky.

2. A network anti-telecom fraud system according to claim 1, characterized in that: The reference behavior includes a call duration interval and a caller number fraud mark, and the local comparison module performs the following steps when comparing the behavior with the reference behavior: When the call duration matches the call duration interval of the reference behavior, the comparison is determined to be consistent; When the call is over, if the user operates the fraud mark on the incoming call number, the comparison is determined to be consistent.

3. A network anti-telecom fraud method, characterized in that: Includes steps: Setting up a server, setting up a user terminal on a user's handheld device, and the user terminal is in communication connection with the server; The user terminal collects usage data of the handheld device, wherein the usage data includes operation behavior and operation content; The user terminal stores preset reference data, and the reference data includes reference behavior and reference content; The user terminal compares the behavior with the reference behavior once. If the comparison is consistent, the operation content is compared with the reference content twice. If the comparison is consistent, the user terminal issues a risk warning and initiates a preset first disposal measure. The user terminal extracts data features of the operation content and uploads the data features to the server; If the comparison does not match, the server obtains a fraud risk identification result of the data features based on the data features uploaded by the multiple users; When the fraud risk identification result indicates that there is a risk, the server feeds back the fraud risk identification result and the reference library to the user terminal; The user terminal compares the operation content with the reference library, and if the comparison is consistent, a risk warning is issued and a preset second disposal measure is initiated; The operation content includes the call number and call recording, When collecting call recordings, perform the following steps: Collecting call recordings during a call, storing the call recordings after the call ends, and identifying and storing text content of the call recordings; When extracting the data features of the operation content, the following steps are performed: Identify the topics and the order of topics involved in the text content, and record them as topic context; Respectively identifying the emotions of the two parties in the call recording, and recording them as the local call emotion sequence and the other party call emotion sequence respectively; Extracting the hash value of the call number, and using the hash value, topic context, the local call emotion sequence and the other party call emotion sequence as data features; When the server obtains the fraud risk identification result of the data features according to the data features uploaded by the multiple users, the server performs the following steps: According to the hash value of the call number, the received data features are grouped and recorded as a first group; Calculate the similarity of the topic context between the data features in the first group; If the similarity is greater than a preset first threshold, the fraud risk identification result is determined to be a risk; The received data features are grouped according to the topic context and recorded as the second group; Calculating the similarity of the local call emotion sequence and the other party call emotion sequence between the data features in the second group, and obtaining the comprehensive similarity according to the similarity of the local call emotion sequence and the other party call emotion sequence; If the comprehensive similarity is greater than a preset second threshold, the fraud risk identification result is determined to be risky.

4. An electronic device, characterized in that including a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to claim 3.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to claim 3 is implemented.

6. Computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to claim 3 is implemented.

Images