A fraud risk early warning system and anti-fraud method thereof

Abstract

Multiple embodiments of this specification relate to the field of information technology, and specifically to a fraud risk warning system and an anti-fraud method thereof. The system includes a user end and a server end, the user end runs on the user's handheld device, and the user end runs a data acquisition module, a data security module, and a behavior model module. The data acquisition module collects the user end's usage data, and the usage data includes call data, SMS data, network data, and application data. The data security module extracts the data features of the usage data and uploads the data features to the server end. The behavior model module establishes a user behavior model based on the usage data. The server end identifies risk behaviors based on multiple data features received within a preset time period, and sends the risk behaviors to the behavior model module of the user end. The behavior model module obtains the matching degree between the risk behavior and the user behavior model, and issues an alarm when the matching degree is lower than a preset threshold, and reports the matching degree to the server end.

Description

Technical Field

[0001] Multiple embodiments of this specification relate to the field of information technology, and specifically to a fraud risk early warning system and an anti-fraud method thereof. Background Art

[0002] Fraud refers to the act of illegally obtaining another person's property or other benefits through deception. Fraudulent behavior usually involves deliberately concealing the truth, providing false information, or creating illusions to mislead others and cause them to suffer losses. Fraud can occur in many fields, such as finance, business, and the Internet, and with the development of technology, fraud methods are becoming more and more diverse and covert. The main types of fraud include financial fraud, telecommunications network fraud, commercial fraud, and Internet fraud.

[0003] Among them, commercial fraud is relatively more concealed, because it is usually hidden under the name of the service or product transaction provided, and usually has a longer period of time. As a result, the current anti-fraud technology cannot effectively indicate the risk of fraud. Therefore, it is necessary to continue to study anti-fraud technology. Summary of the invention

[0004] Multiple embodiments of this specification describe a fraud risk early warning system and an anti-fraud method thereof.

[0005] In a first aspect, the embodiments of this specification provide a fraud risk early warning system, including a user end and a server end.

[0006] The user terminal runs on the user's handheld device, and the user terminal runs a data acquisition module, a data security module and a behavior model module.

[0007] The data collection module collects the usage data of the user end, the usage data includes call data, SMS data, network data and application data, the data security module extracts the data features of the usage data, and uploads the data features to the server end,

[0008] The behavior model module establishes a user behavior model based on the usage data,

[0009] The server identifies risky behaviors based on multiple data features received within a preset time period, and sends the risky behaviors to the behavior model module of the user end. The behavior model module derives the matching degree between the risky behaviors and the user behavior model, and issues an alarm when the matching degree is lower than a preset threshold, and reports the matching degree to the server.

[0010] In a second aspect, the embodiments of this specification provide an anti-fraud method, comprising the steps of:

[0011] Setting a user terminal and a server terminal, wherein the user terminal runs on a user's handheld device;

[0012] The user terminal runs a data acquisition module, a data security module and a behavior model module;

[0013] The data collection module of the user terminal collects the usage data of the user terminal, and the usage data includes call data, text message data, network data and application data;

[0014] The data security module of the user end extracts the data features of the usage data and uploads the data features to the server end,

[0015] The behavior model module of the user terminal establishes a user behavior model according to the usage data,

[0016] The server identifies risky behaviors according to multiple data features received within a preset time period, and sends the risky behaviors to the behavior model module of the user terminal;

[0017] The behavior model module of the user terminal obtains the matching degree between the risk behavior and the user behavior model, issues an alarm when the matching degree is lower than a preset threshold, and reports the matching degree to the service terminal.

[0018] In a third aspect, an embodiment of this specification provides an electronic device, including a processor and a memory;

[0019] The processor is connected to the memory;

[0020] The memory is used to store executable program code;

[0021] The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in any one of the above aspects.

[0022] In a fourth aspect, an embodiment of the present specification provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the above aspects.

[0023] In a fifth aspect, an embodiment of this specification provides a computer program product, including a computer program, which implements the method described in any of the above aspects when executed by a processor.

[0024] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0025] In multiple embodiments of this specification, the fraud risk warning system and anti-fraud method provided can provide identification and warning for merchant fraud, and differentiate warnings for different users, which helps to protect the rights and interests of high-risk users, while minimizing the impact on the use of low-risk users, effectively filling the current lack of effective identification and warning technology for fraud caused by merchant fraud or fraudulent operations. By establishing a user behavior model through a behavior model module and storing the user behavior model, there is no need to store the user's usage data, which can effectively protect the privacy of the user's usage data. The data security module uploads the hash value of the usage data to the server, so that the original usage data does not need to leave the user end, and does not affect the risk identification of the server while effectively protecting the privacy of the user's usage data.

[0026] Other features and advantages of the various embodiments of the present specification will be further disclosed in the following detailed description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 A schematic diagram of the fraud risk warning system architecture provided in the embodiments of this specification.

[0029] Figure 2 This is a workflow timing diagram of the fraud risk warning system provided in the embodiments of this specification.

[0030] Figure 3 A schematic diagram of data collection and use by the fraud risk warning system provided in the embodiments of this specification.

[0031] Figure 4 A schematic diagram of establishing a user behavior model for the fraud risk warning system provided in the embodiment of this specification.

[0032] Figure 5 A schematic diagram of identifying risky behaviors of a fraud risk warning system provided in an embodiment of this specification.

[0033] Figure 6 A schematic diagram of calculating the matching degree of the fraud risk warning system provided in the embodiment of this specification.

[0034] Figure 7 A schematic diagram of the anti-fraud method provided in the embodiments of this specification.

[0035] Figure 8A schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0036] The following is an explanation and description of the technical solutions of the embodiments of this specification in conjunction with the drawings of the embodiments of this specification, but the following embodiments are only preferred embodiments of this specification, not all. Based on the embodiments in the implementation mode, other embodiments obtained by those skilled in the art without creative work are all within the scope of protection of this specification.

[0037] The terms "first", "second", "third", etc. in the description and claims of this specification and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0038] In the following description, terms such as "inside", "outside", "up", "down", "left", "right", etc. that indicate directions or positional relationships are only used to facilitate the description of the embodiments and simplify the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation of this specification.

[0039] The data involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection of relevant data complies with the relevant laws, regulations and standards of relevant countries and regions.

[0040] Before describing the technical solution in this specification, the application scenarios and related technologies of the technical solution are introduced.

[0041] Many commercial frauds are difficult to detect in the early stages, as fraudsters often use elaborate means to conceal their true purpose. Risks and problems will only be directly revealed after a long period of time, when it is often difficult for consumers to recover their losses. With technological advances and social changes, commercial fraud methods are constantly being updated, from traditional face-to-face fraud to current online fraud, in various forms.

[0042] Although commercial fraud is highly concealed and difficult to identify directly. However, commercial fraud usually strives to market in order to quickly develop users in a short period of time, so as to accumulate sufficient funds before the first batch of users discover that they have been defrauded. From the user's perspective, the development of a large number of users in a short period of time usually reflects that the users have entered a new industry or field. When a large number of users are also involved in a new industry in a short period of time, it can be judged that there is a risk of commercial fraud. However, there is currently a lack of technology to identify these characteristics. This specification aims to disclose a system that combines a user terminal 20 and a server terminal 10 to achieve data collection and risk identification. During the process, the original data of the user's usage data never leaves the user terminal 20, which can effectively protect the privacy and security of the user's usage data.

[0043] The technical solution provided in this application is applied to Figure 1 The system architecture shown, Figure 1 is a schematic diagram of the system architecture in the embodiment of the present application, such as Figure 1 As shown, the system architecture includes a server 10 and a user terminal 20. The user terminal 20 has a user interface that can be displayed based on the user's operation. The user interface can be displayed on the user terminal 20 in the form of a browser, or in the form of an independent application (application, APP), etc. The specific display form of the client is not limited here. The user interface is used to view information related to risk warnings. At the same time, the user terminal 20 runs a service that implements the technical steps recorded in this application in the background. The server 10 involved in this application can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms. The handheld device can be a smart phone, a tablet computer, a laptop, a PDA, a smart watch, a car device, a wearable device, etc., but is not limited to this. The number of server 10 and user terminal 20 is also not limited. The solution provided in the present application can be completed independently by the user end 20, can also be completed independently by the server end 10, or can be completed by the user end 20 and the server end 10 in cooperation. This application does not make any specific limitations on this.

[0044] Since this application involves some professional terms, these professional terms will be introduced below.

[0045] Hash value

[0046] A hash value is a string output that is converted into a fixed length of data (such as a string, file, etc.) through a hash algorithm. This output is usually composed of numbers and letters, and has a fixed length (depending on the hash algorithm used). There are many types of hash algorithms, such as MD5, SHA-1, SHA-256, etc. If the hash values ​​of two texts or files are the same, it means that the contents of the two are the same.

[0047] Large Language Model

[0048] Large language models are deep learning models with large parameter counts that are designed to understand and generate natural language. These models learn patterns and structures in language by training on large amounts of text data, enabling them to perform a variety of natural language tasks such as machine translation, text summarization, sentiment analysis, question-answering systems, etc. Large language models have millions or even billions of parameters, which enables them to capture very complex patterns in language.

[0049] Natural language tasks

[0050] Natural language tasks refer to natural language processing. Natural language processing (NLP) is an interdisciplinary subject in the fields of computer science, artificial intelligence, and linguistics, which aims to enable computers to understand, interpret, and generate human language. Natural language tasks (NLP tasks) refer to a series of language-related tasks completed through algorithms and technologies.

[0051] This specification first provides a fraud risk early warning system, including a user terminal 20 and a server terminal 10.

[0052] The user terminal 20 runs on the user's handheld device, and the user terminal 20 runs a data acquisition module, a data security module and a behavior model module.

[0053] The data collection module collects the usage data of the user terminal 20, the usage data includes call data, SMS data, network data and application data, the data security module extracts the data features of the usage data, and uploads the data features to the server 10,

[0054] The behavior model module establishes a user behavior model based on the usage data,

[0055] The server 10 identifies risky behaviors based on multiple data features received within a preset time period, and sends the risky behaviors to the behavior model module of the user terminal 20. The behavior model module derives the matching degree between the risky behaviors and the user behavior model, and issues an alarm when the matching degree is lower than a preset threshold, and reports the matching degree to the server 10.

[0056] Please see attached Figure 2 This is a timing diagram of the processing steps of this embodiment. The user terminal 20 first collects the user's usage data and establishes a user behavior model based on the user's usage data. The user behavior model is used for subsequent risk analysis. The user behavior model records the behavioral habits formed by the user over a long period of time, and records the fields and participation of the user. It shows the user's habitual living space and is a representation of the scope of the user's expertise. That is, in behaviors similar to the user behavior model, the possibility of the user being defrauded is low. In behaviors and industries with low matching degrees with the user behavior model, the possibility of the user being defrauded is high. In particular, when a large number of users appear in a short period of time and are involved in behaviors and industries with low matching degrees with their respective user behavior models, and these behaviors and industries also have some correlations, there is a high possibility that merchants are committing fraudulent activities. At this time, an alarm should be issued to remind users to beware of fraudulent activities.

[0057] The data security module extracts the data features of the usage data, and the method of extracting the data features should make it impossible to reversely restore the usage data based on the data features. In this embodiment, the method of extracting the hash value of the usage data is adopted. When commercial fraud activities do exist, the commercial fraud activities will affect multiple users. At this time, multiple user terminals 20 upload the data features to the server 10, so that the server 10 can collect a large number of data features with certain similarities in a short time. The data features have similarities, such as at least one of the other party's number, name, industry, behavior, and website is the same or has a high degree of similarity. So that the server 10 can discover risky behaviors suspected of fraud. The server 10 sends the risk behavior to each user terminal 20, and the user terminal 20 compares the risk behavior with the user behavior model. If the matching degree with the user behavior model is low, it means that it belongs to the industry that is newly involved and has a high possibility of being defrauded. At this time, an alarm is issued to remind the user to take precautions. On the other hand, the alarm can also be synchronized to the relevant competent department for subsequent disposal.

[0058] Specifically, the usage data includes the other party's number, title, industry, and behavior identified and extracted during the call, the other party's number, title, industry, and behavior identified and extracted in the text message, the URL, industry, and behavior in the network data, and the industry and behavior identified and extracted in the application. The behaviors include preparing to purchase, purchasing, refunding, using, and others.

[0059] On the other hand, please see the attached Figure 3 The data collection module performs the following steps when collecting the usage data of the user terminal 20:

[0060] Step S101) reading usage data of the user terminal 20 and attempting to identify the type of the usage data.

[0061] Step S102) When the type of the usage data is call data, extract the other party's number, identify the call text and record it as call text, try to identify the address from the call text, extract several keywords from the call text, and identify the industry and behavior based on the several keywords.

[0062] Step S103) When the type of the usage data is SMS data, extract the other party's number, try to identify the address from the SMS text, and identify the industry and behavior based on the keywords extracted from the SMS text.

[0063] Step S104) When the type of data used is network data, the website address is extracted, the text is identified from the network data, and the industry and behavior are identified based on the keywords extracted from the text.

[0064] Step S105) When the type of the usage data is application data, the name of the application is identified, and the industry and behavior of the application data are obtained according to the name and a pre-configured application reference table.

[0065] When recognizing the text of a call, the technology already disclosed in the art can be used. The art has disclosed the technology of speech recognition text. Recognizing the name through the call text can be achieved by constructing a natural language task and submitting it to a pre-connected large language model. Exemplarily, the natural language task constructed is "Extract the name from the following text: {call text}". After submitting it to the large language model, the result will be obtained. Extracting keywords from the call text can also be achieved by constructing a natural language task and submitting it to a pre-connected large language model. Exemplarily, the natural language task constructed is "Extract the keywords from the following text: {call text}". To extract the other party's number, that is, the mobile phone number, you can use the rule matching method, that is, match 11 digits, and the beginning is the beginning of the adopted mobile phone number. To extract the URL, you can use the domain name rule matching, such as matching using the regular expression disclosed in the art. Or use the large language model in combination with the natural language task. Identify industries and behaviors through keywords, and construct natural speech tasks and submit them to the large language model for implementation. For example, the constructed natural language task is "obtain industries and behaviors through the following keywords: KeyWords1, KeyWords2, ..., KeyWords5, behaviors include: prepare to buy, buy, refund, use, and others." After submitting it to the large language model, the corresponding industries and behaviors can be obtained. Submit the natural language task: "obtain industries and behaviors through the following keywords: health, body shaping, fat loss, muscle gain, private training, behaviors include: prepare to buy, buy, refund, use, and others." to the large language model, and the response content obtained is "Based on the keywords you provided, "health, body shaping, fat loss, muscle gain, private training", combined with the user's possible behaviors (prepare to buy, buy, refund, use, and others), we can analyze that the industry involved in the user communication is mainly the fitness industry, and infer that the user's most likely current behavior is preparing to buy."

[0066] On the other hand, please see the attached Figure 4 When the behavior model module establishes the user behavior model according to the usage data, the following steps are performed:

[0067] Step S201) Eliminate the usage data of other behaviors, group the remaining data according to industries, obtain industry groups, and configure industry behaviors as default values.

[0068] Step S202) When the behaviors included in the industry group only include preparation for purchase, the industry behavior is set to preparation for participation.

[0069] Step S203) When the behaviors included in the industry group include purchases but do not include refunds, the industry behaviors are set to simple participation.

[0070] Step S204) When the behaviors included in the industry group only include refund, the industry behavior is set to exit.

[0071] Step S205) The rest of the industry behaviors are set to complex participation.

[0072] Step S206) Set the participation level of each industry behavior, associate each industry with its industry behavior and participation level, and obtain a user behavior model.

[0073] When the behavior is other, it is less helpful for establishing the user behavior model, so it is screened out. Group the usage data according to the industry according to the above steps. Because user usage data is generated by calls, text messages, network access and APP use, there will be one or more usage data for the same industry. After grouping by industry, the corresponding industry behavior can be obtained by combining the behaviors that appear in the industry group. The industry behavior describes the current user's participation in the industry. When preparing to participate, the user will receive a large number of related calls and text messages in the industry, as well as usage data generated by the corresponding network and APP. When the merchants corresponding to the industry are operating normally, the development of users will not increase dramatically in a short period of time. If the number of new users entering the industry is not large within the preset time, that is, it is lower than the preset threshold, it is judged as normal business behavior. At this time, the large amount of related usage data that appears is judged as normal interaction and no alarm is issued.

[0074] When the data security module extracts the data features of the usage data and uploads the data features to the server 10, the following steps are performed: extract the hash value of the other party's number, name, industry, behavior, and the hash value of the domain name of the website in the usage data as the data features of the usage data. The same hash value indicates that the corresponding original text is the same, but the server 10 cannot infer the original text through the hash value, so that it does not affect the grouping and protects the privacy security of the relevant data.

[0075] For details, please refer to the attached Figure 5 When the server 10 identifies risk behaviors based on multiple data features received within a preset time period, the server 10 performs the following steps:

[0076] Step S301) classifying data features into multiple categories according to the hash values ​​of the other party's number, name, industry, and domain name;

[0077] Step S302) traverse each category, and when the data feature data included in the category exceeds a preset threshold, read the behavior included in the category;

[0078] Step S303) Calculate the proportion of occurrences of each behavior in the category, obtain the behavior with the largest proportion, and record it as the main behavior;

[0079] Step S304) When the proportion of the main behavior exceeds a preset reference threshold, it is determined that there is a risk behavior, and the risk behavior is obtained by associating the industry with the main behavior.

[0080] When not only the user is new to the industry within a short period of time, but there are also more users who are involved in the industry, exceeding the preset threshold, it indicates that the merchant's marketing is too aggressive, that is, it exceeds the normal business needs, and there is a risk of fraud, and an alarm is issued at this time. Through the above steps, the server 10 can identify risky behaviors through the received data features. After the risky behavior is identified, it cannot be finally determined whether the risky behavior is really a fraudulent risk behavior, and in this embodiment, different processing methods are used for different users. It is specifically determined based on the matching degree between the user behavior model of each user and the risky behavior.

[0081] Please see attached Figure 6 When the user terminal 20 obtains the matching degree between the risk behavior and the user behavior model, the following steps are performed:

[0082] Step S401) comparing the risk behavior with each industry included in the user behavior model in turn;

[0083] Step S402) When the main behavior included in the risk behavior is the same as the currently compared industry behavior, the comparison correlation degree is set to the participation degree; when the main behavior included in the risk behavior is different from the currently compared industry behavior, the comparison correlation degree is set to zero;

[0084] Step S403) Calculate the similarity between the industry included in the risk behavior and the current comparison industry;

[0085] Step S404) Calculate the product of the correlation degree and the similarity degree as the industry matching degree of the current comparison industry;

[0086] Step S405) Obtain the maximum value of the industry matching degree as the matching degree between the risk behavior and the user behavior model.

[0087] Through the above steps, the matching degree between risky behavior and user behavior model is obtained. When the matching degree is low, it means that the user has entered a new industry and lacks relevant knowledge about the new industry, and the risk of being defrauded is high. Therefore, an alarm is issued to remind the user to carefully identify. However, for those users who have already entered the industry, no alarm processing is performed. At this time, the matching degree between the user behavior model of such users and risky behavior is relatively high. The reason why no alarm processing is performed is that if the user has already entered the industry, he has accumulated certain knowledge about the industry's price, service and product conditions, and has a strong ability to judge fraud risks.

[0088] On the other hand, this manual provides an anti-fraud method, please refer to the attached Figure 7 , including the steps of:

[0089] Step S501) Setting the user terminal 20 and the server terminal 10, wherein the user terminal 20 runs on the user's handheld device;

[0090] Step S502) The user terminal 20 runs a data acquisition module, a data security module and a behavior model module;

[0091] Step S503) The data collection module of the user terminal 20 collects usage data of the user terminal 20, wherein the usage data includes call data, SMS data, network data and application data;

[0092] Step S504) The data security module of the user terminal 20 extracts data features of the usage data and uploads the data features to the server terminal 10;

[0093] Step S505) The behavior model module of the user terminal 20 establishes a user behavior model according to the usage data;

[0094] Step S506) The server 10 identifies risky behaviors according to multiple data features received within a preset time period, and sends the risky behaviors to the behavior model module of the user terminal 20;

[0095] Step S507 ) The behavior model module of the user terminal 20 obtains the matching degree between the risk behavior and the user behavior model, issues an alarm when the matching degree is lower than a preset threshold, and reports the matching degree to the server 10 .

[0096] See also Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification is shown.

[0097] like Figure 8As shown, the electronic device 1100 may include: at least one processor 1101, at least one network interface 1104, a user interface 1103, a memory 1105 and at least one communication bus 1102. Among them, the communication bus 1102 can be used to realize the connection and communication of the above-mentioned components. Among them, the user interface 1103 may include a button, and the optional user interface may also include a standard wired interface and a wireless interface. Among them, the network interface 1104 may include but is not limited to a Bluetooth module, an NFC module, a Wi-Fi module, etc. Among them, the processor 1101 may include one or more processing cores. The processor 1101 uses various interfaces and lines to connect various parts in the entire electronic device 1100, and executes various functions and processes data of the routing device 1100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1105, and calling data stored in the memory 1105. Optionally, the processor 1101 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 1101 may integrate one or a combination of CPU, GPU and modem, etc. Among them, the CPU mainly processes the operating system, user interface and application programs, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communication.

[0098] It is understandable that the above-mentioned modem may not be integrated into the processor 1101, but may be implemented by a separate chip.

[0099] Among them, the memory 1105 may include RAM or ROM. Optionally, the memory 1105 includes a non-transitory computer-readable medium. The memory 1105 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1105 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1105 may also be at least one storage device located away from the aforementioned processor 1101. The memory 1105 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application. The processor 1101 may be used to call the application stored in the memory 1105 and execute the methods in the above-mentioned multiple embodiments.

[0100] The embodiments of this specification also provide a computer-readable storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes the multiple steps in the above embodiments. If the components of the above electronic device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0101] The embodiments of this specification also provide a computer program product, including a computer program, which implements multiple steps in the above embodiments when executed by a processor.

[0102] In the absence of conflict, the technical features in this embodiment and implementation scheme can be combined arbitrarily.

[0103] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes a plurality of computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of this specification is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes multiple available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state drive (SSD)).

[0104] When implemented by hardware or firmware, the aforementioned method flow is programmed into the hardware circuit to obtain the corresponding hardware circuit structure and realize the corresponding function. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit, and its logic function is determined by the user programming the device. The designer programs by himself to "integrate" a digital system on a PLD, without asking a chip manufacturer to design and make a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when writing program development, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL), and HDL is not just one, but many. Those skilled in the art should also be aware that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit to easily obtain the hardware circuit that implements the logic method flow.

[0105] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Without departing from the design spirit of this specification, various modifications and improvements made to the technical solutions of this specification by ordinary technicians in this field should fall within the scope of protection determined by the claims of this specification.

Claims

1. A fraud risk early warning system, characterized in that: Including the user side and the server side, The user terminal runs on the user's handheld device, and the user terminal runs a data acquisition module, a data security module and a behavior model module. The data collection module collects the usage data of the user end, the usage data includes call data, SMS data, network data and application data, the data security module extracts the data features of the usage data, and uploads the data features to the server end, The behavior model module establishes a user behavior model based on the usage data, The server identifies risky behaviors according to multiple data features received within a preset time period, and sends the risky behaviors to the behavior model module of the user end. The behavior model module obtains the matching degree between the risky behaviors and the user behavior model, and issues an alarm when the matching degree is lower than a preset threshold, and reports the matching degree to the server end; The usage data includes the other party's number, name, industry, and behavior identified and extracted during the call, the other party's number, name, industry, and behavior identified and extracted in the text message, the website, industry, and behavior in the network data, and the industry and behavior identified and extracted in the application. The behavior includes preparing to buy, buying, refunding, using, and others; When the behavior model module establishes the user behavior model according to the usage data, the following steps are performed: Eliminate the behavior as other usage data, group the remaining data by industry, obtain industry groups, and configure industry behaviors as default values; When the behaviors included in the industry group only include preparation to buy, set the industry behavior to preparation to participate; When the behaviors included in the industry group include purchases and do not include refunds, set the industry behavior to simple participation; When the actions included in the industry group only include refunds, set the industry action to withdrawal; The rest all set the industry behavior to complex participation; Set the participation level of each industry behavior, associate each industry with its industry behavior and participation level, and obtain the user behavior model; When the data security module extracts the data features of the usage data and uploads the data features to the server, the following steps are performed: Extracting the hash value of the other party's number, name, industry, behavior, and the hash value of the domain name of the website in the usage data as data features of the usage data, When the server identifies risky behaviors based on multiple data features received within a preset time period, the server performs the following steps: The data features are divided into multiple categories according to the hash values ​​of the other party's number, name, industry, and domain name; Traverse each category, and when the data feature data included in the category exceeds a preset threshold, read the behavior included in the category; Calculate the proportion of occurrences of each behavior in the category, and obtain the behavior with the largest proportion, which is recorded as the main behavior; When the proportion of the main behavior exceeds a preset reference threshold, it is determined that there is a risk behavior, and the risk behavior is obtained by associating the industry with the main behavior; When the user terminal obtains the matching degree between the risk behavior and the user behavior model, the following steps are performed: Comparing the risk behavior with each industry included in the user behavior model in turn; When the main behavior included in the risk behavior is the same as the currently compared industry behavior, the comparison correlation is set to the participation degree of the industry behavior; when the main behavior included in the risk behavior is different from the currently compared industry behavior, the comparison correlation is set to zero; Calculate the similarity between the industries included in the risk behavior and the current comparison industry; Calculate the product of the correlation degree and the similarity degree as the industry matching degree of the current comparison industry; The maximum value of the industry matching degree is obtained as the matching degree between the risk behavior and the user behavior model.

2. A fraud risk early warning system according to claim 1, characterized in that: The data collection module performs the following steps when collecting the usage data of the user terminal: Read the usage data of the user end and identify the type of usage data; When the type of the usage data is call data, the other party's number is extracted, the text of the call is identified and recorded as the call text, the address is identified from the call text, several keywords are extracted from the call text, and the industry and behavior are identified based on the several keywords; When the type of data used is SMS data, extract the other party's number, identify the address from the SMS text, and identify the industry and behavior based on the keywords extracted from the SMS text; When the type of data used is network data, extracting the URL, identifying the text from the network data, and identifying the industry and behavior based on the keywords extracted from the text; When the type of the usage data is application data, the name of the application is identified, and the industry and behavior of the application data are obtained according to the name and a pre-configured application reference table.

3. An anti-fraud method, characterized in that: Includes steps: Setting a user terminal and a server terminal, wherein the user terminal runs on a user's handheld device; The user terminal runs a data acquisition module, a data security module and a behavior model module; The data collection module of the user terminal collects usage data of the user terminal, and the usage data includes call data, text message data, network data and application data; The data security module of the user end extracts the data features of the usage data and uploads the data features to the server end, The behavior model module of the user terminal establishes a user behavior model according to the usage data, The server identifies risky behaviors according to multiple data features received within a preset time period, and sends the risky behaviors to the behavior model module of the user terminal; The behavior model module of the user terminal obtains the matching degree between the risk behavior and the user behavior model, issues an alarm when the matching degree is lower than a preset threshold, and reports the matching degree to the server terminal; The usage data includes the other party's number, name, industry, and behavior identified and extracted during the call, the other party's number, name, industry, and behavior identified and extracted in the text message, the website, industry, and behavior in the network data, and the industry and behavior identified and extracted in the application. The behavior includes preparing to buy, buying, refunding, using, and others; When the behavior model module establishes the user behavior model according to the usage data, the following steps are performed: Eliminate the behavior as other usage data, group the remaining data by industry, obtain industry groups, and configure industry behaviors as default values; When the behaviors included in the industry group only include preparation to buy, set the industry behavior to preparation to participate; When the behaviors included in the industry group include purchases and do not include refunds, set the industry behavior to simple participation; When the actions included in the industry group only include refunds, set the industry action to withdrawal; The rest all set the industry behavior to complex participation; Set the participation level of each industry behavior, associate each industry with its industry behavior and participation level, and obtain the user behavior model; When the data security module extracts the data features of the usage data and uploads the data features to the server, the following steps are performed: Extracting the hash value of the other party's number, name, industry, behavior, and the hash value of the domain name of the website in the usage data as data features of the usage data, When the server identifies risky behaviors based on multiple data features received within a preset time period, the server performs the following steps: The data features are divided into multiple categories according to the hash values ​​of the other party's number, name, industry, and domain name; Traverse each category, and when the data feature data included in the category exceeds a preset threshold, read the behavior included in the category; Calculate the proportion of occurrences of each behavior in the category, and obtain the behavior with the largest proportion, which is recorded as the main behavior; When the proportion of the main behavior exceeds a preset reference threshold, it is determined that there is a risk behavior, and the risk behavior is obtained by associating the industry with the main behavior; When the user terminal obtains the matching degree between the risk behavior and the user behavior model, the following steps are performed: Comparing the risk behavior with each industry included in the user behavior model in turn; When the main behavior included in the risk behavior is the same as the currently compared industry behavior, the comparison correlation is set to the participation degree of the industry behavior; when the main behavior included in the risk behavior is different from the currently compared industry behavior, the comparison correlation is set to zero; Calculate the similarity between the industries included in the risk behavior and the current comparison industry; Calculate the product of the correlation degree and the similarity degree as the industry matching degree of the current comparison industry; The maximum value of the industry matching degree is obtained as the matching degree between the risk behavior and the user behavior model.

4. An electronic device, characterized in that including a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to claim 3.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to claim 3 is implemented.

6. Computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to claim 3 is implemented.

Images