Abnormal number identification processing method and device

Abstract

The invention discloses an abnormal number identification processing method and device. The method comprises the following steps: acquiring a to-be-processed target number, first type of feature data which corresponds to the target number and reflects whether the target number is abnormal or not, and second type of feature data which reflects whether complaints occur or not after the target number is processed as an abnormal number; analyzing the first type of feature data by using a pre-trained abnormal number classification model to obtain a first prediction probability that the target number is an abnormal number; analyzing the second type of feature data by using a pre-trained complaint prediction model to obtain a second prediction probability of complaint after the target number is processed as an abnormal number; and comparing the first prediction probability with a first preset threshold value, comparing the second prediction probability with a second preset threshold value, and determining a target processing strategy for the target number according to a comparison result. According to the invention, the technical problem of user complaints caused by inaccurate identification results in related abnormal number identification schemes is solved.

Description

Technical Field

[0001] The present application relates to the field of communication service technology, and in particular to a method and device for identifying and processing abnormal numbers. Background Art

[0002] With the rapid advancement of information technology and the widespread popularity of smartphones, people's living, working and social patterns have undergone profound changes. However, this technological leap is also accompanied by an increasing number of criminals using communication technology to conduct illegal activities. In order to meet this challenge, operators have taken a series of abnormal number management measures, focusing on identifying phone numbers that may be involved in bad behavior or abnormal communications and handling them accordingly. However, current methods mainly focus on identifying the object itself, but often ignore the risk of user dissatisfaction or complaints that may be caused by handling these numbers, and lack effective prediction methods for such anomalies. At the same time, for the management goals of the number of phone numbers involved in abnormal behavior over a period of time and the number of user complaints caused by them, a more reliable and efficient control solution is urgently needed.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method and device for abnormal number identification and processing, so as to at least solve the technical problem that in the related abnormal number identification scheme, inaccurate identification results may easily lead to user complaints.

[0005] According to one aspect of an embodiment of the present application, a method for identifying and processing abnormal numbers is provided, including: obtaining a target number to be processed, a first type of feature data and a second type of feature data corresponding to the target number, wherein the first type of feature data is used to reflect whether the target number is abnormal, and the second type of feature data is used to reflect whether a complaint will occur after the target number is processed as an abnormal number; using a pre-trained abnormal number classification model to analyze the first type of feature data corresponding to the target number to obtain a first predicted probability that the target number is an abnormal number; using a pre-trained complaint prediction model to analyze the second type of feature data corresponding to the target number to obtain a second predicted probability that a complaint will occur after the target number is processed as an abnormal number; comparing the first predicted probability with a first preset threshold, and comparing the second predicted probability with a second preset threshold, and determining a target processing strategy for the target number based on the comparison result.

[0006] Optionally, the types of the first category of characteristic data include at least one of the following: the number's place of origin, whether roaming in other provinces, network access time, package type, number of calls within a preset time period, number of calling users, calling dispersion, number of calling provinces, number of calling cities, number of calling operator numbers, number of calls, number of called provinces, number of called cities; the types of the second category of characteristic data include at least one of the following: the number owner's age, gender, the number's place of origin, whether roaming in other provinces, network access time, package type, whether it is classified as an abnormal number, number of complaints within the province within a preset time period, total number of complaints, number of calls, number of shutdowns.

[0007] Optionally, the abnormal number classification model and the complaint prediction model are both lightweight gradient boosting models; the training process of the abnormal number classification model includes: obtaining multiple first numbers within a historical time period, taking the abnormal numbers among the multiple first numbers as the first positive samples, and taking the numbers among the multiple first numbers that have been closed and have caused complaints as the first negative samples; obtaining the first type of feature data and the second type of feature data corresponding to each first positive sample and the first negative sample, and training the abnormal number classification model based on the first type of feature data and the second type of feature data corresponding to each first positive sample and the first negative sample; the training process of the complaint prediction model includes: obtaining multiple second numbers that have been closed within a historical time period, taking the numbers among the multiple second numbers that have caused complaints as the second positive samples, and taking the numbers among the multiple second numbers that have not caused complaints as the second negative samples; obtaining the first type of feature data and the second type of feature data corresponding to each second positive sample and the second negative sample, and training the complaint prediction model based on the first type of feature data and the second type of feature data corresponding to each second positive sample and the second negative sample.

[0008] Optionally, when training the abnormal number classification model or the complaint prediction model, the method further includes: using a Bayesian optimization algorithm to determine the hyperparameters of the model, and using a K-fold cross-validation method to iteratively train the model, wherein the hyperparameters of the model include: learning rate, maximum depth, subsampling ratio, and column sampling ratio; in each iterative batch, using a target loss function to adjust the model parameters, and using an F1 score to evaluate the model obtained by the current batch training, wherein the target loss function formula is as follows: Where N is the number of samples in the current training batch; F m-1 (x i ; A m-1 ) indicates that the first m-1 trees in the model have parameter A m-1 Under the condition of i The predicted value of A m-1 The parameters a1,…,a of the first m-1 trees are included. m-1 ; L(y i ,F m-1 (xi ; A m-1 )) describes the input value x i The corresponding true value y i The logarithmic loss function of the error between the predicted value and the current model; coefficient Among them, y i =0 indicates a negative sample, y i =1 represents a positive sample, c is a preset constant greater than 1; λ1 represents the L1 regularization coefficient, λ2 represents the L2 regularization coefficient, Where M represents the number of features, ω j is the weight corresponding to the jth feature.

[0009] Optionally, the process of determining the first preset threshold and the second preset threshold includes: obtaining an abnormal number quantity index corresponding to the target time period, and determining the actual number of numbers that have been classified as abnormal numbers when the target number is obtained within the target time period; if the actual number of numbers is not greater than the abnormal number quantity index, determining a pair of thresholds with the highest scores from a preset threshold scoring table as the first preset threshold and the second preset threshold, wherein the threshold scoring table stores scores of multiple pairs of thresholds, each pair of thresholds includes a threshold for determining whether a number is an abnormal number and a threshold for determining whether a complaint will occur after the number is treated as an abnormal number, and the score is a result of comprehensively evaluating the classification effect of each pair of thresholds from the dimensions of abnormal number classification accuracy and user complaint rate; if the actual number of numbers is greater than the abnormal number quantity index, determining a third preset threshold with the highest corresponding score for determining whether a number is an abnormal number from the threshold scoring table, and determining a first preset threshold that meets the target condition based on the third preset threshold, determining a threshold pair with the highest score including the first preset threshold from the threshold scoring table, and using the other threshold in the threshold pair as the second preset threshold, wherein the target condition is: Where n is the actual number of numbers, E is the indicator of the number of abnormal numbers, θ is the third preset threshold, and N θ is the number of numbers that will be judged as abnormal numbers when the third preset threshold is applied within the target time period, θ′ is the first preset threshold, N θ′ The number of numbers that are judged as abnormal numbers when the first preset threshold is applied within the target time period.

[0010] Optionally, the target processing strategy includes: a shutdown strategy and a restart strategy. The target processing strategy for the target number is determined based on the comparison result, including: if the first predicted probability is not less than a first preset threshold, the shutdown strategy is determined to be direct double shutdown, and the restart strategy is a preset number unblocking process; if the first predicted probability is less than the first preset threshold and the second predicted probability is less than the second preset threshold, the shutdown strategy is determined to be manual outbound call verification number, and the restart strategy is live authentication self-service restart; if the first predicted probability is less than the first preset threshold and the second predicted probability is not less than the second preset threshold, the target number will not be shut down.

[0011] Optionally, the target number is a number that has been assigned and judged as a suspected abnormal number, and the method also includes: if the first type of feature data and the second type of feature data corresponding to the target number are not successfully obtained for a preset number of consecutive times, executing a preset number processing strategy; if the first prediction probability and the second prediction probability are not successfully obtained for a preset number of consecutive times, executing a preset number processing strategy; wherein the preset number processing strategy includes: if the target number is in use, directly perform a double stop; if the target number has been protectively single stopped, first restore the target number and then perform a double stop; if the target number has been double stopped, no longer process it.

[0012] According to another aspect of an embodiment of the present application, an abnormal number identification and processing device is also provided, including: an acquisition module, used to acquire a target number to be processed, a first type of feature data and a second type of feature data corresponding to the target number, wherein the first type of feature data is used to reflect whether the target number is abnormal, and the second type of feature data is used to reflect whether a complaint will occur after the target number is processed as an abnormal number; a first analysis module, used to analyze the first type of feature data corresponding to the target number using a pre-trained abnormal number classification model, and obtain a first predicted probability that the target number is an abnormal number; a second analysis module, used to analyze the second type of feature data corresponding to the target number using a pre-trained complaint prediction model, and obtain a second predicted probability that a complaint will occur after the target number is processed as an abnormal number; a determination module, used to compare the first predicted probability with a first preset threshold, and compare the second predicted probability with a second preset threshold, and determine the target processing strategy for the target number based on the comparison result.

[0013] According to another aspect of an embodiment of the present application, a computer program product is further provided, the computer program product comprising: a computer program, wherein when the computer program is executed by a processor, the above-mentioned abnormal number identification and processing method is implemented.

[0014] According to another aspect of an embodiment of the present application, an electronic device is further provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned abnormal number identification and processing method through the computer program.

[0015] In the embodiment of the present application, firstly, the target number to be processed and the first type of characteristic data corresponding to the target number reflecting whether the target number is abnormal and the second type of characteristic data reflecting whether a complaint will occur after the target number is processed as an abnormal number are obtained; then the first type of characteristic data is analyzed using the pre-trained abnormal number classification model to obtain the first prediction probability that the target number is an abnormal number; then the second type of characteristic data is analyzed using the pre-trained complaint prediction model to obtain the second prediction probability that a complaint will occur after the target number is processed as an abnormal number; finally, the first prediction probability is compared with the first preset threshold, and the second prediction probability is compared with the second preset threshold, and the target processing strategy for the target number is determined based on the comparison result. Through this method, not only the accuracy of abnormal number identification is improved, but also unnecessary user complaints can be effectively reduced by evaluating the potential complaint risk. This meticulous analysis and comprehensive judgment strategy ensures that the system can make more accurate and reasonable decisions when processing the target number, balancing the identification of abnormal behavior and the maintenance of user satisfaction, that is, the present application scheme effectively solves the technical problem that user complaints are easily caused by inaccurate identification results in the relevant abnormal number identification scheme. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 is a flowchart of an optional abnormal number identification and processing method according to an embodiment of the present application;

[0018] Figure 2 This is a schematic diagram of a process for abnormal number identification in an optional actual business process according to an embodiment of the present application;

[0019] Figure 3 is a schematic structural diagram of an optional abnormal number identification and processing device according to an embodiment of the present application;

[0020] Figure 4 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0024] LightGBM (Light Gradient Boosting Machine): An efficient gradient boosting decision tree model that aims to solve the problems of slow training speed and high memory usage of traditional gradient boosting tree algorithms on large data sets. LightGBM uses histograms to approximate the distribution of eigenvalues, thereby speeding up the process of finding split points. LightGBM uses a "Leaf-wise" splitting strategy instead of the traditional "Level-wise" splitting strategy, which enables the model to find the optimal splitting path faster. LightGBM also supports multi-threaded parallel training and can take advantage of multi-core processors.

[0025] Dispatching: The dispatching of this application refers to the process in which the relevant technology assigns the numbers to be processed to a special processing mechanism, such as a high-risk number prediction model, for processing during the process of processing abnormal numbers.

[0026] Example 1

[0027] According to an embodiment of the present application, a method for identifying and processing abnormal numbers is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 1 is a flow chart of an abnormal number identification and processing method provided according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0029] Step S102, obtaining a target number to be processed, first-type characteristic data and second-type characteristic data corresponding to the target number, wherein the first-type characteristic data is used to reflect whether the target number is abnormal, and the second-type characteristic data is used to reflect whether a complaint will occur after the target number is processed as an abnormal number;

[0030] Step S104, using the pre-trained abnormal number classification model to analyze the first type of feature data corresponding to the target number, to obtain a first prediction probability that the target number is an abnormal number;

[0031] Step S106, using the pre-trained complaint prediction model to analyze the second type of feature data corresponding to the target number, to obtain a second predicted probability of a complaint occurring after the target number is treated as an abnormal number;

[0032] Step S108, comparing the first predicted probability with the first preset threshold, and comparing the second predicted probability with the second preset threshold, and determining a target processing strategy for the target number according to the comparison results.

[0033] The following describes the various steps of the abnormal number identification and processing method in conjunction with a specific implementation process.

[0034] As an optional implementation, in order to improve the accuracy of abnormal number identification while reducing the user complaint rate, the embodiment of the present application introduces an abnormal number classification model and a complaint prediction model, respectively, to analyze the numbers from the two dimensions of abnormal number identification and user complaint prediction. Both models can be trained using the LightGBM model.

[0035] Optionally, the training process of the abnormal number classification model can be carried out in the following manner: first, obtain multiple first numbers within a historical time period, and the first numbers can include data under new high-risk calls, high-risk call models, and surge high-risk call models of the management and operation platform; take the abnormal numbers among the multiple first numbers as the first positive samples, and take the numbers that have been shut down and complained about among the multiple first numbers as the first negative samples; then obtain the first type of feature data corresponding to each first positive sample and the first negative sample, and train the abnormal number classification model based on the first type of feature data corresponding to each first positive sample and the first negative sample; wherein the type of the first type of feature data may include at least one of the following: the number's place of origin, whether roaming in other provinces, network access time, package type, number of calls within a preset time period, number of calling users, calling dispersion, number of calling provinces, number of calling cities, number of calling operator numbers, number of called numbers, number of called provinces, number of called cities, wherein the preset time period can be 1 day, 7 days, 1 month, 3 months, 6 months, 12 months, etc.

[0036] Optionally, the training process of the complaint prediction model can be carried out in the following manner: first, obtain multiple second numbers that have been shut down within a historical time period, and use the numbers that have been complained about among the multiple second numbers as the second positive samples, and use the numbers that have not been complained about among the multiple second numbers as the second negative samples; then obtain the second type of feature data corresponding to each second positive sample and the second negative sample, and train the complaint prediction model based on the second type of feature data corresponding to each second positive sample and the second negative sample. The type of the second type of feature data may include at least one of the following: the age, gender, place of number ownership, whether roaming in other provinces, network access time, package type, whether it is classified as an abnormal number, the number of complaints within the province within a preset time period, the total number of complaints, the number of calls, and the number of shutdowns. The preset time period can also be 1 day, 7 days, 1 month, 3 months, 6 months, 12 months, etc.

[0037] In view of the problem that abnormal number samples are relatively scarce in training data, in order to improve the accuracy of abnormal number recognition and reduce overfitting, the embodiment of the present application improves the loss function of the conventional LightGBM model, adds L1 and L2 regularization terms, and gives higher weights to abnormal samples. The specific training method is as follows:

[0038] In each iteration batch, the target loss function is used to adjust the model parameters, and the F1 score is used to evaluate the model trained in the current batch. The target loss function formula is as follows:

[0039]

[0040] In the above formula, N is the number of samples in the current training batch; F m-1 (xi ; A m-1 ) indicates that the first m-1 trees in the model have parameter A m-1 Under the condition of i The predicted value of A m-1 The parameters a1,…,a of the first m-1 trees are included. m-1 ; L(y i ,F m-1 (x i ; A m-1 )) describes the input value x i The corresponding true value y i The logarithmic loss function of the error between the predicted value and the current model; coefficient Among them, y i =0 indicates a negative sample, y i =1 represents a positive sample, c is a preset constant greater than 1; λ1 represents the L1 regularization coefficient, λ2 represents the L2 regularization coefficient, Where M represents the number of features, ω j is the weight corresponding to the jth feature.

[0041] As an optional implementation, in the process of optimizing and training the abnormal number classification model or complaint prediction model, an effective strategy is to introduce the Bayesian optimization algorithm to accurately determine the model's hyperparameters, which include but are not limited to the learning rate, maximum depth, subsampling ratio, and column sampling ratio. In order to further verify the stability and generalization ability of the model, the K-fold cross-validation method is used for iterative training to ensure that the model performs well on different data subsets.

[0042] Optionally, in order to comprehensively evaluate the performance of the model, recall, precision and F1 score are selected as key evaluation indicators. These indicators are constructed based on the confusion matrix, which is an n-row and n-column matrix that intuitively shows the correspondence between the model prediction results and the actual results. In the context of binary classification problems, it is generally expressed as shown in Table 1.

[0043] Table 1 Correspondence between predicted results and actual results in the context of binary classification problems

[0044]

[0045] In Table 1, T (True) is generally used to represent correct, F (False) represents error, P (Positive) represents 1, and N (Negative) represents 0. Among them:

[0046] TP: predicted as 1, actual as 0, the prediction is correct;

[0047] FP: predicted as 1, actual as 0, prediction error;

[0048] FN: The prediction is 0, the actual value is 1, the prediction is wrong;

[0049] TN: The prediction is 0, the actual value is 0, and the prediction is correct.

[0050] Precision refers to the prediction results, which means the probability of actually being a positive sample among all samples predicted to be positive. The expression is:

[0051] The recall rate refers to the original sample, which means the probability of being predicted as a positive sample among the actually positive samples. The expression is:

[0052] The F1 score takes into account both precision and recall, making them both as high as possible and achieving a balance. The expression is:

[0053]

[0054] By calculating and comparing these evaluation indicators, we can have a clear understanding of the performance of the abnormal number classification model and the complaint prediction model. If the performance of the model does not meet the expected standards, we continue to train it to optimize and improve it. If the performance evaluation of the model is qualified, we can directly output the final abnormal number classification model and complaint prediction model.

[0055] After obtaining the above abnormal number classification model and complaint prediction model, these two models are used to process the target number. The following is the specific process of using the two models to process the target number:

[0056] First, the target number to be processed is obtained. The target number can be a suspected abnormal number that has been judged through dispatch processing, or it can be a non-suspected abnormal number. After obtaining the target number, the first type of feature data and the second type of feature data corresponding to the target number are obtained.

[0057] The first type of feature data of the target number is imported into the abnormal number classification model to obtain the first prediction probability, and the second type of feature data of the target number is imported into the complaint prediction model to obtain the second prediction probability.

[0058] Optionally, after obtaining the predicted probability, the corresponding first preset threshold value and second preset threshold value can be set for the above-mentioned first predicted probability and second predicted probability according to the pre-stored threshold scoring table, so as to determine the processing strategy for the target number, wherein the threshold scoring table stores scores of multiple pairs of thresholds, each pair of thresholds includes a threshold for judging whether a number is an abnormal number and a threshold for judging whether a complaint will occur after the number is treated as an abnormal number, and the score is the result of comprehensively evaluating the classification effect of each pair of thresholds from the dimensions of abnormal number classification accuracy and user complaint rate.

[0059] As an alternative implementation, when setting the threshold score table, it is possible to analyze how the accuracy rates of the abnormal number classification model and the complaint prediction model change as the preset threshold is adjusted; at the same time, examine how the number of numbers processed changes with the changes of the first preset threshold and the second preset threshold under different processing strategies; in addition, it is also possible to observe the changing trends of the number of unclassified abnormal numbers and the number of complaints as these two thresholds are adjusted; by comprehensively evaluating these dimensions, a comprehensive understanding of the impact of each threshold combination can be obtained, so as to obtain the result of the threshold score and generate the threshold score table.

[0060] Optionally, in an actual scenario, for the identification of abnormal numbers and complaint prediction, it is often necessary to consider the abnormal number quantity index within the target time period, such as monthly index, etc. Due to the fluctuations in the abnormal number data, the number of abnormal numbers and complaints within the target time period may far exceed the abnormal number quantity index within this time period. The above process for determining the threshold is applicable when the actual number of numbers is not greater than the abnormal number quantity index. When the actual number of numbers is greater than the abnormal number quantity index, during the implementation of this application, a method is provided. This method will adjust the probability threshold set by the model according to the quantity index, so as to control the model prediction result. The design idea of the method is as follows:

[0061] Set the abnormal number quantity index within the target time period as E, and the actual number of numbers as n. If E < n, then the current excess quantity is: n - E, and the excess multiple is:

[0062] Determine the third preset threshold with the highest corresponding score in the threshold score table for judging whether a number is an abnormal number, and based on the third preset threshold, determine the first preset threshold that meets the target condition. Determine the threshold pair with the highest score including the first preset threshold from the threshold score table, and use the other threshold in the threshold pair as the second preset threshold. The target condition is:

[0063]

[0064] Simplify the above formula to get: where θ is the third preset threshold, N θ is the number of numbers that will be judged as abnormal numbers when applying the third preset threshold within the target time period, θ′ is the first preset threshold, and N θ′ is the number of numbers that will be judged as abnormal numbers when applying the first preset threshold within the target time period.

[0065] Optionally, after comparing the above-mentioned first predicted probability with the first preset threshold, and comparing the above-mentioned second predicted probability with the second preset threshold, determine the target processing strategy for the target number based on the comparison result. The target strategy includes a shutdown strategy and a restart strategy, wherein: if the first predicted probability is not less than the first preset threshold, the shutdown strategy is determined to be direct double shutdown, and the restart strategy is the preset number unblocking process; if the first predicted probability is less than the first preset threshold and the second predicted probability is less than the second preset threshold, the shutdown strategy is determined to be a manual outbound call to verify the number, and the restart strategy is a live authentication self-service restart; if the first predicted probability is less than the first preset threshold and the second predicted probability is not less than the second preset threshold, the target number is not shut down. Assume that Pa and Pb are set to the first preset threshold and the second preset threshold respectively, P1 is the first predicted probability, and P2 is the second predicted probability. As shown in Table 2, the target strategy is divided into three levels, namely strict, relatively strict, and loose, corresponding to the above three situations respectively.

[0066] Table 2 Target strategy diagram

[0067]

[0068] As an optional implementation, the processing method for determining whether a number is an abnormal number in the embodiment of the present application can be used alone or in combination with the existing abnormal number processing process.

[0069] In the existing abnormal number processing process, the most stringent shutdown or restoration strategy is adopted for suspected abnormal numbers generated by existing high-risk models, that is, the numbers in use or protective single suspension are upgraded to double suspension and require restoration materials for review. In the present application, feature extraction can be performed on suspected abnormal numbers generated by high-risk models, and the corresponding features are input into the abnormal number classification model and the complaint prediction model to obtain the probability of the number being judged as an abnormal number and the complaint probability, and the shutdown strategy adopted is determined according to the size of these two probability values, including strict level (double suspension), medium level (manual outbound call verification number) and loose level (no shutdown), among which, when manually calling out to verify the number, if the verification fails, the number will be protectively suspended, and if the verification passes, it will not be shut down.

[0070] As an optional implementation, if the target number is a number that has been assigned and is judged to be a suspected abnormal number, it can also be processed in the following manner: if the first type of feature data and the second type of feature data corresponding to the target number have not been successfully obtained for a preset number of consecutive times, the preset number processing strategy is executed; if the first prediction probability and the second prediction probability have not been successfully obtained for a preset number of consecutive times, the preset number processing strategy is executed; wherein, the preset number processing strategy is the existing abnormal number processing method, for example: if the target number is in use, double stop is performed directly; if the target number has been protectively single stopped, the target number is first restored and then double stopped; if the target number has been double stopped, no further processing is performed.

[0071] Figure 2 A business processing flow for numbers in this application is given, such as Figure 2 As shown, B is the number that is determined to be in use after automatic dispatch, C is the number that is protected after automatic dispatch, and E is the number that is not automatically dispatched. It can be a number automatically assigned or provided by a service or communication platform. This number directly enters the abnormal number comprehensive dispatch. The probability model in this process refers to the abnormal number classification model and complaint prediction model in this application. Figure 2 In the process, the suspected abnormal number after automatic dispatch is judged by the call type of the model. If it is not the type of high-risk call, the current status of the number is judged again. If it is not in use, it will not be processed. If it is in use, a comprehensive dispatch of abnormal numbers is performed; if it is a high-risk call type, the status of the current number is also judged. If it is a number suspected of being an abnormal number with single stop / double stop, the abnormal number classification model and the complaint prediction model are used to judge and execute the strategy of not shutting down, protective single stop, and double stop processing; for the numbers in B, C, and E, a comprehensive dispatch of abnormal numbers will be performed, and the call type will be judged by the model. If it is not the type of high-risk call, a manual outbound call will be made to verify the number. If the verification is passed, the number will not be shut down. If the verification fails, the number will be protectively single stopped; if it is the type of high-risk call, it will be divided into three situations after the abnormal number classification model and complaint prediction model of this application, namely: not shutting down, protective single stop, and double stop.

[0072] In the embodiment of the present application, firstly, the target number to be processed and the first type of characteristic data corresponding to the target number reflecting whether the target number is abnormal and the second type of characteristic data reflecting whether a complaint will occur after the target number is processed as an abnormal number are obtained; then the first type of characteristic data is analyzed using the pre-trained abnormal number classification model to obtain the first prediction probability that the target number is an abnormal number; then the second type of characteristic data is analyzed using the pre-trained complaint prediction model to obtain the second prediction probability that a complaint will occur after the target number is processed as an abnormal number; finally, the first prediction probability is compared with the first preset threshold, and the second prediction probability is compared with the second preset threshold, and the target processing strategy for the target number is determined based on the comparison result. Through this method, not only the accuracy of abnormal number identification is improved, but also unnecessary user complaints can be effectively reduced by evaluating the potential complaint risk. This meticulous analysis and comprehensive judgment strategy ensures that the system can make more accurate and reasonable decisions when processing the target number, balancing the identification of abnormal behavior and the maintenance of user satisfaction, that is, the present application scheme effectively solves the technical problem that user complaints are easily caused by inaccurate identification results in the relevant abnormal number identification scheme.

[0073] Example 2

[0074] According to an embodiment of the present application, an abnormal number identification processing device for implementing the abnormal number identification processing method in embodiment 1 is also provided. Figure 3 As shown, the abnormal number identification and processing device at least includes: an acquisition module 31, a first analysis module 32, a second analysis module 33, and a determination module 34, wherein:

[0075] An acquisition module 31 is used to acquire a target number to be processed, first-type feature data and second-type feature data corresponding to the target number, wherein the first-type feature data is used to reflect whether the target number is abnormal, and the second-type feature data is used to reflect whether a complaint will occur after the target number is processed as an abnormal number;

[0076] A first analysis module 32 is used to analyze the first type of feature data corresponding to the target number using a pre-trained abnormal number classification model to obtain a first prediction probability that the target number is an abnormal number;

[0077] The second analysis module 33 is used to analyze the second type of feature data corresponding to the target number using the pre-trained complaint prediction model to obtain a second prediction probability of a complaint occurring after the target number is treated as an abnormal number;

[0078] The determination module 34 is used to compare the first predicted probability with the first preset threshold, and compare the second predicted probability with the second preset threshold, and determine the target processing strategy for the target number according to the comparison results.

[0079] The functions of each module of the abnormal number identification and processing device are described below in conjunction with a specific implementation process.

[0080] First, the acquisition module obtains the target number to be processed, which can be a suspected abnormal number that has been judged by the existing model dispatch processing, or it can be a non-suspected abnormal number. After obtaining the target number, the first type of feature data and the second type of feature data corresponding to the target number are obtained.

[0081] The first analysis module imports the first type of feature data of the target number into the abnormal number classification model to obtain the first prediction probability, and the second analysis module imports the second type of feature data of the target number into the complaint prediction model to obtain the second prediction probability.

[0082] Optionally, after obtaining the predicted probability, the corresponding first preset threshold value and second preset threshold value can be set for the above-mentioned first predicted probability and second predicted probability according to the pre-stored threshold scoring table, so as to determine the processing strategy for the target number, wherein the threshold scoring table stores scores of multiple pairs of thresholds, each pair of thresholds includes a threshold for judging whether a number is an abnormal number and a threshold for judging whether a complaint will occur after the number is treated as an abnormal number, and the score is the result of comprehensively evaluating the classification effect of each pair of thresholds from the dimensions of abnormal number classification accuracy and user complaint rate.

[0083] As an optional implementation, when setting the threshold scoring table, it is possible to analyze how the accuracy of the abnormal number classification model and the complaint prediction model changes with the adjustment of the preset thresholds; at the same time, examine how the number of number processing changes with the changes in the first preset threshold and the second preset threshold under different processing strategies; in addition, it is also possible to observe the changing trends of the number of unclassified abnormal numbers and the number of complaints as these two thresholds are adjusted; by comprehensively evaluating these dimensions, it is possible to have a comprehensive understanding of the impact of each threshold combination, thereby obtaining the results of the threshold scoring and generating a threshold scoring table.

[0084] Optionally, in actual scenarios, abnormal number identification and complaint prediction often need to take into account the abnormal number quantity index within the target time period, such as the monthly index, etc. Due to the fluctuation of abnormal number data, the number of abnormal numbers and complaints within the target time period may far exceed the abnormal number quantity index within the time period. The above threshold determination process is applicable to the case where the actual number of numbers is not greater than the abnormal number quantity index. When the actual number of numbers is greater than the abnormal number quantity index, this application provides a method during implementation. The method adjusts the probability threshold set by the model according to the quantity index, thereby controlling the model prediction result. The method design idea is as follows:

[0085] Set the abnormal number quantity index within the target time period as E, and the actual number of numbers as n. If E < n, then the current excess quantity is: n - E, and the excess multiple is:

[0086] Determine the third preset threshold with the highest corresponding score in the threshold score table for judging whether a number is an abnormal number, and determine the first preset threshold that meets the target condition based on the third preset threshold. Determine the threshold pair with the highest score including the first preset threshold from the threshold score table, and use the other threshold in the threshold pair as the second preset threshold. The target condition is:

[0087]

[0088] Simplify the above formula to get: where θ is the third preset threshold, and N θ is the number of numbers that will be judged as abnormal numbers when applying the third preset threshold within the target time period, θ′ is the first preset threshold, and N θ′ is the number of numbers that will be judged as abnormal numbers when applying the first preset threshold within the target time period.

[0089] Optionally, after the determination module compares the above first prediction probability with the first preset threshold and compares the above second prediction probability with the second preset threshold, it determines the target processing strategy for the target number according to the comparison result. The target strategy includes a shutdown strategy and a restoration strategy, where: if the first prediction probability is not less than the first preset threshold, determine the shutdown strategy as direct dual shutdown, and the restoration strategy as a preset number解封流程; if the first prediction probability is less than the first preset threshold and the second prediction probability is less than the second preset threshold, determine the shutdown strategy as manual outbound call to verify the number, and the restoration strategy as self-service restoration through live body authentication; if the first prediction probability is less than the first preset threshold and the second prediction probability is not less than the second preset threshold, do not shut down the target number.

[0090] As an optional implementation manner, if the target number is a number that has been assigned a task and is judged as a suspected abnormal number, the following method can also be used for processing: if the first type of feature data and the second type of feature data corresponding to the target number cannot be successfully obtained continuously for a preset number of times, execute the preset number processing strategy; if the first prediction probability and the second prediction probability cannot be successfully obtained continuously for a preset number of times, execute the preset number processing strategy; where the preset number processing strategy is the existing abnormal number processing method, for example: if the target number is in use, directly perform dual shutdown, if the target number has been protectively single-shutdown, first restore the target number and then perform dual shutdown, if the target number has been dual-shutdown, do not process it anymore.

[0091] It should be noted that each module in the abnormal number identification and processing device in the embodiment of the present application corresponds one by one to each implementation step of the abnormal number identification and processing method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be repeated here.

[0092] Example 3

[0093] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, the abnormal number identification and processing method in Example 1 is implemented.

[0094] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the abnormal number identification and processing method in Example 1 by running the computer program.

[0095] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the abnormal number identification and processing method in Example 1 is executed when the computer program is running.

[0096] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the abnormal number identification and processing method in Example 1 through the computer program.

[0097] Specifically, the following steps are executed when the computer program is running: obtaining a target number to be processed, first-category feature data and second-category feature data corresponding to the target number, wherein the first-category feature data is used to reflect whether the target number is abnormal, and the second-category feature data is used to reflect whether a complaint will occur after the target number is processed as an abnormal number; using a pre-trained abnormal number classification model to analyze the first-category feature data corresponding to the target number to obtain a first predicted probability that the target number is an abnormal number; using a pre-trained complaint prediction model to analyze the second-category feature data corresponding to the target number to obtain a second predicted probability that a complaint will occur after the target number is processed as an abnormal number; comparing the first predicted probability with a first preset threshold, and comparing the second predicted probability with a second preset threshold, and determining a target processing strategy for the target number based on the comparison result.

[0098] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 4 FIG. 1 shows a hardware structure block diagram of an electronic device for implementing an abnormal number identification and processing method. Figure 4As shown, the electronic device 40 may include one or more (402a, 402b, ..., 402n are used to illustrate) processors 402 (the processor 402 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 404 for storing data, and a transmission device 406 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components as shown, or with Figure 4 Different configurations shown.

[0099] It should be noted that the one or more processors 402 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 40. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0100] The memory 404 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal number identification processing method in the embodiment of the present application. The processor 402 executes various functional applications and data processing by running the software programs and modules stored in the memory 404, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 404 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 404 may further include a memory remotely arranged relative to the processor 402, and these remote memories may be connected to the electronic device 40 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0101] The transmission device 406 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 40. In one example, the transmission device 406 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 406 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0102] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 40 .

[0103] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.

[0104] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0105] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0106] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0107] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0108] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0109] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for identifying and processing abnormal numbers, characterized in that: include: Acquire a target number to be processed, first-category feature data and second-category feature data corresponding to the target number, wherein the first-category feature data is used to reflect whether the target number is abnormal, and the second-category feature data is used to reflect whether a complaint will occur after the target number is processed as an abnormal number; Analyzing the first type of feature data corresponding to the target number using a pre-trained abnormal number classification model to obtain a first predicted probability that the target number is an abnormal number; Analyzing the second type of feature data corresponding to the target number using a pre-trained complaint prediction model to obtain a second predicted probability of a complaint occurring after the target number is treated as an abnormal number; The first predicted probability is compared with a first preset threshold, and the second predicted probability is compared with a second preset threshold, and a target processing strategy for the target number is determined according to the comparison results.

2. The method according to claim 1, characterized in that The types of the first type of characteristic data include at least one of the following: the place of origin of the number, whether roaming in other provinces, network access time, package type, number of calls within a preset time period, number of calling users, calling dispersion, number of calling provinces, number of calling cities, number of calling operator numbers, number of calls, number of called provinces, number of called cities; The types of the second category of characteristic data include at least one of the following: the age, gender, place of origin of the number, whether roaming in other provinces, network access time, package type, whether it is classified as an abnormal number, the number of complaints within the province within a preset time period, the total number of complaints, the number of calls, and the number of shutdowns.

3. The method according to claim 1, characterized in that The abnormal number classification model and the complaint prediction model are both lightweight gradient boosting models; The training process of the abnormal number classification model includes: obtaining multiple first numbers in a historical time period, taking abnormal numbers among the multiple first numbers as first positive samples, and taking numbers that have been shut down and have caused complaints among the multiple first numbers as first negative samples; obtaining the first type of feature data corresponding to each of the first positive samples and the first negative samples, and training the abnormal number classification model based on the first type of feature data corresponding to each of the first positive samples and the first negative samples; The training process of the complaint prediction model includes: obtaining multiple second numbers that have been shut down within a historical time period, taking the numbers among the multiple second numbers that have caused complaints as second positive samples, and taking the numbers among the multiple second numbers that have not caused complaints as second negative samples; obtaining the second category feature data corresponding to each of the second positive samples and the second negative samples, and training the complaint prediction model based on the second category feature data corresponding to each of the second positive samples and the second negative samples.

4. The method according to claim 3, characterized in that When training the abnormal number classification model or the complaint prediction model, the method further includes: The Bayesian optimization algorithm is used to determine the model's hyperparameters, and the K-fold cross-validation method is used to iteratively train the model. The model's hyperparameters include: learning rate, maximum depth, subsampling ratio, and column sampling ratio. In each iteration batch, the target loss function is used to adjust the model parameters, and the F1 score is used to evaluate the model trained in the current batch. The target loss function formula is as follows: Where N is the number of samples in the current training batch; F m-1 (x i ; A m-1 ) indicates that the first m-1 trees in the model have parameter A m-1 Under the condition of i The predicted value of A m-1 The parameters a1,…,a of the first m-1 trees are included. m-1 ; L(y i ,F m-1 (x i ; A m-1 )) describes the input value x i The corresponding true value y i The logarithmic loss function of the error between the predicted value and the current model; coefficient Among them, y i =0 indicates a negative sample, y i =1 represents a positive sample, c is a preset constant greater than 1; λ1 represents the L1 regularization coefficient, λ2 represents the L2 regularization coefficient, Where M represents the number of features, ω j is the weight corresponding to the jth feature.

5. The method according to claim 1, characterized in that The process of determining the first preset threshold and the second preset threshold includes: Obtaining an abnormal number quantity indicator corresponding to a target time period, and determining an actual quantity of numbers that have been classified as abnormal numbers when obtaining the target number within the target time period; If the actual number of numbers is not greater than the abnormal number number indicator, a pair of thresholds with the highest scores are determined from a preset threshold score table as the first preset threshold and the second preset threshold, wherein the threshold score table stores scores of multiple pairs of thresholds, each pair of thresholds includes a threshold for determining whether a number is an abnormal number and a threshold for determining whether a complaint will occur after the number is treated as an abnormal number, and the score is a result of comprehensively evaluating the classification effect of each pair of thresholds from the dimensions of abnormal number classification accuracy and user complaint rate; If the actual number of numbers is greater than the abnormal number number indicator, a third preset threshold with the highest corresponding score for determining whether a number is an abnormal number is determined from the threshold scoring table, and a first preset threshold that meets the target condition is determined based on the third preset threshold, and a threshold pair with the highest score including the first preset threshold is determined from the threshold scoring table, and another threshold in the threshold pair is used as the second preset threshold, wherein the target condition is: Where n is the actual number of numbers, E is the abnormal number number indicator, θ is the third preset threshold, N θ is the number of numbers that will be judged as abnormal numbers when the third preset threshold is applied within the target time period, θ′ is the first preset threshold, N θ′ It is the number of numbers that will be judged as abnormal numbers when the first preset threshold is applied within the target time period.

6. The method according to claim 1, characterized in that The target processing strategy includes: a shutdown strategy and a restart strategy. The target processing strategy for the target number is determined according to the comparison result, including: If the first predicted probability is not less than the first preset threshold, determining that the suspension strategy is direct double suspension, and the restoration strategy is a preset number unblocking process; If the first predicted probability is less than the first preset threshold and the second predicted probability is less than the second preset threshold, the shutdown strategy is determined to be a manual outbound call verification number, and the reactivation strategy is a liveness authentication self-service reactivation; If the first predicted probability is less than the first preset threshold and the second predicted probability is not less than the second preset threshold, the target number is not shut down.

7. The method according to claim 1, characterized in that The target number is a number that has been assigned and is determined to be a suspected abnormal number, and the method further includes: If the first type of characteristic data and the second type of characteristic data corresponding to the target number are not successfully obtained for a preset number of times in a row, executing a preset number processing strategy; If the first prediction probability and the second prediction probability are not successfully obtained for a preset number of times in a row, executing a preset number processing strategy; Among them, the preset number processing strategy includes: if the target number is in use, directly perform double stop, if the target number has been protectively single stopped, first restore the target number and then perform double stop, if the target number has been double stopped, no longer process it.

8. An abnormal number identification and processing device, characterized in that: include: an acquisition module, used to acquire a target number to be processed, first-category feature data and second-category feature data corresponding to the target number, wherein the first-category feature data is used to reflect whether the target number is abnormal, and the second-category feature data is used to reflect whether a complaint will occur after the target number is processed as an abnormal number; A first analysis module, configured to analyze the first type of feature data corresponding to the target number using a pre-trained abnormal number classification model to obtain a first predicted probability that the target number is an abnormal number; A second analysis module is used to analyze the second type of feature data corresponding to the target number using a pre-trained complaint prediction model to obtain a second predicted probability of a complaint occurring after the target number is treated as an abnormal number; The determination module is used to compare the first predicted probability with a first preset threshold, and compare the second predicted probability with a second preset threshold, and determine a target processing strategy for the target number according to the comparison results.

9. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the abnormal number identification and processing method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the abnormal number identification and processing method according to any one of claims 1 to 7 through the computer program.

Images