Method, system and device for detecting abnormal behavior of short message user and storage medium

Abstract

The invention discloses a short message user abnormal behavior detection method, system and device for a short message user with an abnormal behavior and a storage medium, and the method comprises the steps: obtaining an original short message record, and constructing a complex network according to the original short message record; initial nodes of the complex network represent short message users, edges between the initial nodes represent that short message records exist between the initial nodes, a sub-network of each initial node is obtained according to the complex network, and statistical characteristics of the sub-networks are extracted; the statistical features comprise the actual node number and the actual edge number of the sub-network, calculating the deviation degree of the statistical features and the node feature model, and screening the initial nodes according to the deviation degree to obtain the short message user with the abnormal behavior. The method can reduce false detection probability, save learning time and calculation cost, and can be widely applied to the technical field of short message security detection.

Description

Technical Field

[0001] The present invention relates to the technical field of SMS security detection, and in particular to a method, system, device and storage medium for detecting abnormal behavior of SMS users. Background Art

[0002] Internet fraud or telecommunications fraud is a high-incidence area at present. Social media stores and shares a large amount of personal information. Due to the openness of social media, malicious users can collect these users' personal information to carry out illegal activities, such as identity theft, network attacks, spam, fraudulent information dissemination and even terrorist attack plans. Such malicious activities seriously threaten the personal privacy of legitimate users, the security of user accounts, the trust between users and the personal experience of users. Therefore, abnormal user detection for such malicious behavior has become one of the key issues in social media security research.

[0003] The existing anti-fraud system of operators focuses on real-time monitoring of each SMS user node. The monitoring methods are mainly based on blacklists, traffic, and keyword rules. Big data methods are rarely used, making it difficult to discover the common behaviors of SMS users with abnormal behaviors. Some companies specializing in anti-fraud technology have proposed a fraud analysis method that builds a knowledge graph. This method builds a complex network, manually screens suspected nodes, and takes the node's in-and-out degree, number of calls, total number of SMS communications, discrete SMS duration, etc. as features as training feature sets. Through repeated training with machine learning algorithms, the prediction model of abnormal nodes is finally obtained. Such manual screening of initial samples requires strong experience dependence and is highly subjective, resulting in a high probability of false detection. In addition, the construction of an abnormal model requires repeated machine learning and training. After the model is trained, the node features extracted by the machine learning algorithm are cumbersome and complex, and the learning time and computing cost are high. Summary of the invention

[0004] In order to solve one of the above problems, the purpose of the present invention is to provide a method, system, device and storage medium for detecting abnormal behavior of SMS users, which can reduce the probability of false detection and save time and computing costs.

[0005] In one aspect, the present invention provides a method for detecting abnormal behavior of a text message user, comprising the following steps:

[0006] Get the original SMS records;

[0007] Constructing a complex network based on the original SMS records; the initial nodes of the complex network represent SMS users, and the edges between the initial nodes represent the existence of SMS records between the initial nodes;

[0008] Obtaining a subnetwork of each of the initial nodes according to the complex network, and extracting statistical features of the subnetwork; the statistical features include the actual number of nodes and the actual number of edges of the subnetwork;

[0009] The deviation of the statistical feature from the node feature model is calculated, and the initial nodes are screened according to the deviation to obtain SMS users with abnormal behavior.

[0010] Optionally, obtaining a subnetwork of each of the initial nodes according to the complex network specifically includes:

[0011] The initial node of the complex network is taken as the central node in turn, and the neighboring nodes in the preset neighborhood of the central node are traversed;

[0012] The edges between the central node and the neighboring nodes and the edges between different neighboring nodes of the central node are extracted to obtain a subnetwork of each central node.

[0013] Optionally, the node feature model is obtained by the following method:

[0014] Acquire several groups of normal SMS user characteristics; the normal SMS user characteristics include the number of sample nodes and the number of sample edges of the subnetwork;

[0015] Constructing a power-law distribution function of the normal SMS user characteristics; the independent variables of the power-law distribution function include a node number variable, and the dependent variables include an edge number variable;

[0016] The logarithm of the power-law distribution function is calculated, and the logarithm of the power-law distribution function is parameter-fitted using the least square method and the normal short message user characteristics to obtain the node feature model.

[0017] Optionally, the calculating the deviation between the statistical feature and the node feature model specifically includes:

[0018] Substituting the actual number of nodes of the sub-network into the node feature model to obtain the expected number of edges of the sub-network;

[0019] A scaling ratio is determined according to the expected number of edges and the actual number of edges, and the degree of deviation is obtained according to the scaling ratio, the expected number of edges and the actual number of edges.

[0020] Optionally, screening the initial nodes according to the deviation to obtain SMS users with abnormal behavior specifically includes:

[0021] Determine threshold range;

[0022] The initial node whose deviation degree is within the threshold range is regarded as a short message user with abnormal behavior.

[0023] Optionally, screening the initial nodes according to the deviation to obtain SMS users with abnormal behavior specifically includes:

[0024] Sorting all initial nodes according to the deviation;

[0025] According to the sorting result, the N initial nodes with the highest deviation are output as SMS users with abnormal behavior; wherein N is a natural number greater than 1.

[0026] Optionally, before extracting the statistical features of the sub-network, the method further includes:

[0027] The subnetwork of trusted nodes is eliminated according to the subnetwork structure of preset trusted SMS users; the trusted nodes include SMS users of the service provider.

[0028] On the other hand, the present invention provides a system for detecting abnormal behavior of SMS users, comprising a first module, a second module, a third module and a fourth module, wherein:

[0029] The first module is used to obtain original SMS records;

[0030] The second module is used to construct a complex network based on the original SMS records; the initial nodes of the complex network represent SMS users, and the edges between the initial nodes represent the existence of SMS records between the initial nodes;

[0031] The third module is used to obtain a sub-network of each of the initial nodes according to the complex network, and extract statistical features of the sub-network; the statistical features include the actual number of nodes and the actual number of edges of the sub-network;

[0032] The fourth module is used to calculate the deviation between the statistical features and the node feature model, and screen the initial nodes according to the deviation to obtain SMS users with abnormal behavior.

[0033] On the other hand, the present invention provides a device for detecting abnormal behavior of a short message user, comprising:

[0034] at least one processor;

[0035] at least one memory for storing at least one program;

[0036] When the at least one program is executed by the at least one processor, the at least one processor implements the method described above.

[0037] In another aspect, the present invention provides a computer-readable storage medium storing a program executable by a processor. When the program executable by the processor is executed by the processor, it is used to perform the method as described above.

[0038] The implementation of the present invention includes the following beneficial effects: the present invention obtains original SMS records, constructs a complex network according to the original SMS records, the initial nodes of the complex network represent SMS users, the edges between the initial nodes represent the existence of SMS records between the initial nodes, obtains a subnetwork of each initial node according to the complex network, and extracts statistical features of the subnetwork; the statistical features include the actual number of nodes and the actual number of edges of the subnetwork, calculates the deviation between the statistical features and the node feature model, and screens the initial nodes according to the deviation to obtain SMS users with abnormal behavior; the present invention pays attention to each SMS user (node) and extracts simplified statistical features of the nodes, uses mathematical statistical laws to avoid lengthy machine learning processes, shortens detection time and computing costs, compares the statistical features of SMS users with the node feature models of normal SMS users, does not require complex node features and manually screened highly subjective training samples, and reduces the probability of false detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of the steps of a method for detecting abnormal behavior of a text message user provided by the present invention;

[0040] Figure 2 It is a complex network schematic diagram including four initial nodes provided by the present invention;

[0041] Figure 3 It is a flow chart of steps for obtaining a sub-network of each node provided by the present invention;

[0042] Figure 4 It is a flowchart of the steps of constructing a node feature model provided by the present invention;

[0043] Figure 5 It is a flowchart of the steps of calculating the deviation of statistical features and node feature models provided by the present invention;

[0044] Figure 6 It is a comparison diagram of the deviation between the egonet characteristics of each initial node in a complex network and the node characteristic model provided by the present invention;

[0045] Figure 7 It is a flow chart of steps for obtaining SMS users with abnormal behavior provided by the present invention;

[0046] Figure 8 Another flowchart of steps for obtaining a text message user with abnormal behavior provided by the present invention;

[0047] Fig. 9 It is a comparison diagram of SP and point-to-point egonet sub-network structures provided by the present invention;

[0048] Fig.10 It is a flowchart of the steps of another method for detecting abnormal behavior of a text message user provided by the present invention;

[0049] Fig.11 It is a structural diagram of a system for detecting abnormal behavior of a short message user provided by the present invention;

[0050] Fig.12 It is a structural diagram of a device for detecting abnormal behavior of a short message user provided by the present invention. DETAILED DESCRIPTION

[0051] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only provided for the convenience of explanation and description, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0052] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the embodiments of the present application. The singular forms of "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0053] When the following description relates to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims. In the description of the present application, it is necessary to understand that the terms "first / S100", "second / S200", "third / S300", etc. are only used to distinguish similar objects, and do not have to be used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0054] In order to better understand the technical solution of the present invention, the following technical terms are explained:

[0055] Complex network: refers to a network that has some or all of the properties of self-organization, self-similarity, attractor, small world, and scale-free. It is an abstract model for understanding complex systems in the real world.

[0056] Egonet network: also known as self-centered network, the network nodes are composed of a single central node (ego) and the neighbors (alters) of this node, and the edges only include the edges between ego and alter, and between alter and alter. Egonet is a separate user node. If the egonet (SMS user node) given by the SMS system is completely different from other neighborhoods in the SMS record or the set normal feature model, it is abnormal. The basic research questions are: what features are used to describe a subnetwork; what are the characteristics of a normal neighbor user node; first define the terms: the k neighbors of user node i are the set of user node i, which is understood as all user nodes connected to it with a distance of k steps. This is the induced sub-user node graph, which is called the egonet network in analytical terms. Because the real social network graph has the smallest diameter, k needs to have the minimum value, and k can be set to 1. In some embodiments of the present invention, considering the social relationship of the neighbor nodes of SMS users, k is not limited to 1.

[0057] SP (Service Provider): Service provider refers to the direct provider of mobile Internet service content and application services, responsible for developing and providing services suitable for mobile phone users according to user requirements. For example, weather forecast, daily news, mobile QQ, download of ordinary pictures and ringtones, etc. These services are provided by SPs and the fees are collected by operators.

[0058] SP SMS: SMS service provided by third-party service providers. These service providers cooperate with operators to send SMS to users through the operator's SMS gateway.

[0059] Point-to-point SMS: Point-to-point SMS refers to the end-to-end text messaging service form that is sent and received between mobile phones. Point-to-point SMS refers to the service form that sends and receives text messages between mobile phones. Point-to-point SMS includes intra-network SMS, inter-network SMS, international SMS, etc. The point in point-to-point SMS is an independent user SMS tool in the abstract. This SMS tool may be a mobile phone or a client software. But no matter what the point is, the most basic purpose of point-to-point SMS is to achieve mutual communication between two or more points.

[0060] QoS (Quality of Service): refers to a network's ability to use various basic technologies to provide better service capabilities for designated network text messages. It is a network security mechanism and a technology used to solve problems such as network delays and congestion.

[0061] It is understandable that the method for detecting abnormal behavior of SMS users with abnormal behavior provided in the embodiment of the present invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud SMS, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this.

[0062] The implementation environment includes at least two servers, including at least one SMS system server and at least one server for detecting SMS users with abnormal behavior. The servers can be connected to each other through a wireless or wired network to complete data transmission and exchange.

[0063] In addition, the server can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0064] like Figure 1 As shown, Figure 1 The present invention provides a method for detecting abnormal behavior of a text message user by a text message user with abnormal behavior, comprising the following steps:

[0065] S100: Obtain original SMS records.

[0066] The type of the original SMS record may be, but is not limited to, a SMS record, an original call record, or a QoS SMS record.

[0067] Specifically, original SMS records within a certain time range may be obtained from the SMS system, and each SMS record may include but is not limited to a calling user and a called user. For example, the SMS record includes an SMS calling number and an SMS called number.

[0068] In addition, it is worth noting that a text message record can also include the text message duration, text message start time, text message end time, etc., so as to facilitate the subsequent identification of behavioral characteristics of the screened text message users with abnormal behavior, and further accurately identify the text message users with abnormal behavior. S200, construct a complex network based on the original text message records.

[0069] The initial node of the complex network represents the SMS user, and the edge between the initial nodes represents the existence of SMS records between the initial nodes. The initial node is only used to distinguish from the nodes of the sub-network and represents the node of the complex network.

[0070] Specifically, the original SMS records are preprocessed, and the preprocessing includes: based on the elimination principle that the calling user and the called user are not exactly the same, duplicate SMS records are eliminated to obtain new SMS records. For example, if two numbers in one SMS record are the same as two numbers in another SMS record, one of the SMS records is eliminated.

[0071] The SMS users in the new SMS records obtained after removing duplicate SMS records are used as the initial nodes of the complex network to form a node set. According to the SMS records, the edges between the nodes of the calling user and the called user are connected each time to form an edge set. The node set and the edge set are used to form a complex network, which can be but not limited to G(V,E). Among them, SMS users include calling users and called users. It is worth noting that the edges between two SMS users with SMS records form a complex network.

[0072] S300, obtaining a sub-network of each initial node according to the complex network, and extracting statistical features of the sub-network.

[0073] The statistical features include the actual number of nodes and the actual number of edges of the sub-network. The sub-network may be, but is not limited to, an egonet sub-network.

[0074] Specifically, the initial node of the complex network is taken as the central node in turn, the neighbor nodes in the preset neighborhood of the central node are traversed, the edges between the central node and the neighbor nodes and the edges between different neighbor nodes of the central node are extracted, and the sub-network of each central node is obtained. The actual number of nodes and the actual number of edges of each sub-network are extracted as statistical features. In some embodiments, the actual number of nodes, the actual number of edges, the weight of the sub-network nodes and the weight of the edges can also be extracted as statistical features, but not limited to. One initial node can correspond to, but not limited to, one sub-network.

[0075] Taking the actual number of nodes and edges of each sub-network as statistical features, one initial node corresponds to one sub-network as an example, the statistical features are extracted for each initial node in G(V,E), and the extraction function is recorded as The statistical characteristics of the initial node i are recorded as The statistical characteristics of all initial nodes of the network G(V, E) form a set F = {f1, f2, ... f i , …f n The network G(V, E) contains n egonet subnetworks. The actual number of nodes N and the actual number of edges E of the egonet subnetworks can be used as statistical features. Then The statistical feature set of the complex network is obtained, as shown in formula (1):

[0076] F={f1,f2,…f i , …f n}={(N1,E1),(N2,E2),…(N i , E i ), …(N n , E n )) (1)

[0077] by Figure 2 As shown in the example, Figure 2 It is a complex network diagram including four initial nodes. Figure 2 (a) represents the egonet subnetwork of the initial node 1. Figure 2 (b) represents the egonet subnetwork of the initial node 2. Figure 2 (c) represents the egonet subnetwork of the initial node 3. Figure 2 (d) represents the egonet subnetwork of the initial node 4. Therefore, the statistical characteristics can be recorded as

[0078] S400, calculating the deviation of the statistical feature from the node feature model, screening the initial nodes according to the deviation, and obtaining SMS users with abnormal behavior.

[0079] The node feature model refers to the statistical feature model of a normal node, which is used to characterize the distribution relationship between statistical features. For example, the number of nodes and edges in a subnetwork satisfies the power-law distribution.

[0080] Specifically, in this embodiment, it is considered that the number of nodes and the number of edges satisfy the power law distribution, as shown in formulas (2) and (3):

[0081]

[0082] Where C is a linear parameter that can be obtained through parameter fitting or experience.

[0083] Substitute the actual number of nodes in the sub-network into the node feature model, that is, the above formula (3), to obtain the expected number of edges in the sub-network. Determine the scaling ratio based on the expected number of edges and the actual number of edges. Then, obtain the deviation based on the scaling ratio, the expected number of edges and the actual number of edges.

[0084] Among them, the initial nodes are screened according to the deviation to obtain SMS users with abnormal behavior, which can include the following two methods:

[0085] 1. Determine a threshold range and regard the initial nodes with deviation within the threshold range as SMS users with abnormal behavior.

[0086] 2. Sort all initial nodes according to the degree of deviation; take the first N initial nodes after sorting as SMS users with abnormal behavior; where N is a natural number greater than 1.

[0087] In some embodiments, Figure 3 As shown, Figure 3 The flowchart is a step of obtaining a sub-network of each node. Step S300 obtains a sub-network of each node according to a complex network, specifically including:

[0088] S310, taking the initial node of the complex network as the central node in turn, and traversing the neighboring nodes in the preset neighborhood of the central node.

[0089] Among them, the neighbor node can be a node within one hop, such as Figure 2 In the example, the neighbor nodes of the central node 2 are nodes 1, 3, and 4 within one hop, or nodes within two hops, for example Figure 2 In the example, the neighbor nodes of central node 2 are nodes 1, 3, and 4 within one hop, and nodes within one hop of nodes 1, 3, and 4, and so on.

[0090] Specifically, we focus on the egonet network structure of each initial node in the complex network G(V,E), and take the initial node i as the central node and traverse the neighboring nodes of the central node in turn.

[0091] S320 , extracting the edges between the central node and the neighboring nodes and the edges between different neighboring nodes of the central node to obtain a subnetwork of each central node.

[0092] Specifically, for each central node, the neighbor nodes, the edges connecting the central node and the neighbor nodes, and the edges connecting the neighbor nodes and the neighbor nodes are constructed into the egonet sub-network of the initial node i.

[0093] In some embodiments, Figure 4 As shown, Figure 4 It is a flowchart of the steps of constructing a node feature model. The S400 node feature model is obtained by the following method:

[0094] S410: Obtain several groups of normal SMS user characteristics.

[0095] Among them, the normal SMS user characteristics include the number of sample nodes and sample edges in the sub-network.

[0096] Get a data set X = {x1, x2, ... x i ,…x n}, Y={y1,y2,…,y i ,…y n}, x i Indicates the number of sample nodes, y i The number of sample nodes and the number of sample edges can be statistical features of normal SMS users obtained historically, or can be statistical features of the initial nodes extracted in step S300.

[0097] In some embodiments, the normal SMS user characteristics may also include the number of sample nodes, the number of sample edges, the sample node weights, and the sample edge weights.

[0098] S420: Construct a power-law distribution function of normal SMS user characteristics.

[0099] The independent variables of the power-law distribution function include the node number variable, and the dependent variables include the edge number variable.

[0100] Specifically, in a complex network, the statistical characteristics of most nodes have regularity, and the present invention believes that nodes that conform to statistical laws are normal nodes in the network. The present invention believes that the number of nodes and edges in the egonet network conforms to the power law distribution, that is, in the complex network G(V,E), the statistical characteristics f of a normal node i ii The above formula (2) is satisfied.

[0101] Therefore, according to the above formula 2, the power law distribution function of normal SMS user characteristics can be constructed, as shown in formula (4):

[0102] y=C0x α (4)

[0103] Among them, y is the variable of edge number, x is the variable of node number, and C0 is the unknown parameter.

[0104] S430, calculating the logarithm of the power-law distribution function, performing parameter fitting on the logarithm of the power-law distribution function using the least square method and normal SMS user characteristics, obtaining parameter values ​​of the logarithm of the power-law distribution function, substituting the parameter values ​​back into the power-law distribution function, and obtaining a node feature model.

[0105] Specifically, for the power-law distribution function, the logarithm of both sides of the equal sign is taken to obtain the logarithm of the power-law distribution function, as shown in formula (5):

[0106] log(y)=αlog(x)+log(C0) (5)

[0107] The logarithm of the power law distribution function satisfies the linear relationship. i , …x n}, Y = {y1, y2, ..., y i ,…y n Substitute into formula (5), for the linear regression model y i =αx i +β+ε i , where ε i The least square method is used to linearly fit the error to obtain the logarithmic parameter values ​​C0 and α. For the parameter value α, the average value of X can be calculated first. and the mean of Y x i ,y i ,average value and average Substituting into formula (6), we get the parameter value α:

[0108]

[0109] in,

[0110] The average average value Substitute the parameter value α into the formula Get β.

[0111] Solve log(C0) = β and obtain the parameter value C0.

[0112] Substitute the parameter value C0 into C in the above formula (4), and substitute α into the above formula (4) to obtain the node feature model.

[0113] According to steps S410-S430, the least square method is used for estimation, which has two advantages compared with the commonly used maximum likelihood estimation. One is that the amount of calculation is small, and the other is that the robustness to outliers is high.

[0114] In step S400, the node feature model can be preset and the node feature model is the same for each detection, or it can be calculated through steps S410-S430 before or after step S300 during the abnormal detection process. In the latter case, in order to make the node feature model real-time, the statistical features of the normal users identified in step S400 can be recorded after each abnormal user detection, and used as the normal SMS user features for constructing the node feature model.

[0115] In some embodiments, Figure 5 As shown, Figure 5 The present invention is a flowchart of steps for calculating the deviation between the statistical features and the node feature model. In step S400, the deviation between the statistical features and the node feature model is calculated, which specifically includes:

[0116] S440, substituting the actual number of nodes of the sub-network into the node feature model to obtain the expected number of edges of the sub-network.

[0117] Specifically, define r i Represents the deviation between the statistical characteristics of the sub-network of the initial node i and the node feature model, denoted as r i =offset(f i ,θ),f i is the statistical feature of the initial node i, that is, the actual number of nodes N in the egonet sub-network of the initial node i i and the actual number of edges E i ; θ is the power law distribution function with C and α as parameters obtained by linear fitting in the previous step, that is, the node characteristic model.

[0118] Predict the expected number of edges of the initial node i based on the feature model distribution θ

[0119] S450, determining a scaling ratio according to the expected number of edges and the actual number of edges, and obtaining a degree of deviation according to the scaling ratio, the expected number of edges and the actual number of edges.

[0120] Specifically, the expected number of edges E' i The actual number of edges E i The closer it is, the i The smaller the r i The larger the actual number of edges E is, the i and the expected number of edges E' i The difference between the initial node i and the node feature model is used to measure the deviation between the actual point and the expected feature model, that is, the straight-line distance between the actual point and the expected feature model, and E is obtained. i and E' i The maximum and minimum values ​​of the two are obtained by using the ratio of the maximum value to the minimum value to obtain the scaling ratio, and the straight-line distance is scaled using the scaling ratio to obtain the deviation.

[0121] The scaling ratio, expected number of edges and actual number of edges can be substituted into formula (7) to obtain the deviation:

[0122]

[0123] in,

[0124] In this step, the scaling is innovatively introduced To measure the deviation, the error can be effectively reduced.

[0125] In some embodiments, the present invention provides a pseudo code for implementing the abnormality detection process, in which a node feature model is calculated according to steps S410-S430 before step S400, the several groups of normal SMS user features in S410 are the statistical features of each sub-network extracted in step S300, and then the deviation between the statistical features and the node feature model is calculated, as shown below:

[0126] Input: F = {f1, f2, ..., f i , …, f n}={(E1, N1), (E2, N2),…, (E i , N i ),…,(E n , N n )} / / Input the statistical features of each sub-network extracted in step S300

[0127] Output: r = {r1, r2, ..., r i ,…,r n}

[0128]

[0129]

[0130] Implement the above pseudo code, extract the SMS records of a certain time period to construct a complex network G(V,E), where the initial number of nodes of the complex network is N=332833, the number of edges is E=471586, and the statistical features F of each initial node are extracted in turn as input. After executing the linear fitting intermediate process, the parameters α=1.14120011, C=0.01511263 are obtained, and finally the deviation set r of all initial nodes of the complex network G(V,E) is output, and the node feature model and the statistical features of the initial nodes are drawn, as shown in Figure 6 As shown, Figure 6 It is a comparison chart of the deviation between the egonet features of each initial node in a complex network and the node feature model. Green represents the features of each initial node in the complex network, red represents the node feature model, and blue dots represent several initial nodes with higher deviations.

[0131] Then, the top 5 initial nodes with the highest deviation are selected from the above deviations from the largest to the smallest. The initial node information is shown in Table 1 below:

[0132] Table 1

[0133]

[0134] In some embodiments, Figure 7 As shown, Figure 7 The invention is a flowchart of steps for obtaining SMS users with abnormal behavior. In S400, the initial nodes are screened according to the deviation degree to obtain SMS users with abnormal behavior, which specifically includes:

[0135] S460: Determine a threshold range.

[0136] Specifically, in this embodiment, there are two methods for determining the threshold range, and any one or a combination of the two can be used:

[0137] 1. The threshold range can be set based on manual experience, which is suitable for situations where accurate abnormal values ​​are available or thresholds can be given based on manual experience. min ,s max ], then the threshold range is >s max and <s min The union of .

[0138] 2. According to the statistical law of normal distribution, the present invention believes that the deviation of the initial node meets the mean μ and the variance σ 2 The normal distribution N(μ,σ 2 ), the threshold range can be the union of >μ+3σ and <μ-3σ, the union of >μ+2σ and <μ-2σ, or the union of >μ+1σ and <μ-1σ.

[0139] S470: The initial node whose deviation degree is within the threshold range is regarded as a short message user with abnormal behavior.

[0140] Specifically, the initial nodes whose deviation falls within the threshold range are regarded as SMS users with abnormal behavior. For example, if the r of an initial node is i Falling within the threshold range>s max and <s min If it falls within the union of >μ+3σ and <μ-3σ, it is considered to be an SMS user with abnormal behavior; or if it falls within the union of >μ+2σ and <μ-2σ, it is considered to be an SMS user with abnormal behavior; or if it falls within the union of >μ+1σ and <μ-1σ, it is considered to be an SMS user with abnormal behavior; or if it falls within the threshold range >s max and <s min If a user falls within the range of any of the union of the union of >μ+3σ and <μ-3σ, the union of >μ+2σ and <μ-2σ, and the union of >μ+1σ and <μ-1σ, he or she is considered to be an SMS user with abnormal behavior.

[0141] In some embodiments, Figure 8 As shown, Figure 8 Another flowchart of steps for obtaining SMS users with abnormal behavior is shown in S400. The initial nodes are screened according to the deviation degree to obtain SMS users with abnormal behavior, which specifically includes:

[0142] S480, sorting all initial nodes according to the deviation.

[0143] Specifically, the deviation r of all initial nodes in the complex network can be i Sort from largest to smallest or from largest to smallest.

[0144] S490: Output N initial nodes with the highest deviations according to the sorting results as SMS users with abnormal behaviors.

[0145] Wherein, N is a natural number greater than 1.

[0146] Specifically, if the sorting is from large to small, the first N initial nodes after sorting are regarded as SMS users with abnormal behavior. For example, the top 10, top 20 or top 50 initial nodes in the screening sorting are abnormal nodes, that is, SMS users with abnormal behavior. If the sorting is from large to small, the last N initial nodes are regarded as SMS users with abnormal behavior.

[0147] In some embodiments, in addition to the aforementioned steps S100-S400, before extracting the statistical features of the sub-network, the method further includes:

[0148] The sub-network of trusted nodes is eliminated according to the sub-network structure of preset trusted SMS users.

[0149] Among them, the trusted nodes include SMS users of the service provider.

[0150] Specifically, the technical features identical to steps S100 - S400 are not described in detail herein.

[0151] According to the above method for detecting SMS users with abnormal behavior, the SMS users with abnormal behavior include both SP users, such as SP SMS numbers, SMS number 10001 in Table 1 is a SMS user of a service provider, and point-to-point users, such as point-to-point SMS numbers. SMS users of service providers are not untrustworthy, and their SMS behavior is normal.

[0152] The present invention traces back to the egonet sub-networks of the SMS users with abnormal behaviors to find the difference between SP users and point-to-point users. Fig. 9 As shown, Fig. 9 This is a comparison diagram of the SP and peer-to-peer egonet subnetwork structures. Fig. 9(a) is the sub-network structure diagram of SP SMS users. Fig. 9 (b) is the sub-network structure diagram of point-to-point SMS users.

[0153] from Fig. 9 It can be seen that the egonet subnetwork of the SP user presents an obvious star structure, and its neighbor nodes are almost unconnected; while the egonet subnetwork of the point-to-point short user presents a faction structure, and the neighbor nodes are closely connected. Therefore, in the present invention, before extracting the statistical features of the subnetwork, the subnetwork is identified according to the main node of the subnetwork, the subnetwork structure of each subnetwork is obtained, the SP node is obtained, the subnetwork structure of the SP node is compared with the subnetwork structure of the preset trusted SMS user, the untrusted SP SMS users set by the user are obtained, and the untrusted SP SMS users set by these users are excluded from the elimination list, and the subnetworks of the trusted SP nodes in the list are eliminated according to the comparison results, and then the statistical features of the subnetworks of the remaining nodes are extracted.

[0154] In this embodiment, the subnetwork structure of the trusted SMS users can be preset or determined according to the user's settings. Therefore, after obtaining the SP node, the trusted SMS users set by the user and the subnetwork structure of the trusted SMS users are obtained, and the subnetwork structure of the SP node is compared with the subnetwork structure of the set trusted SMS users. According to the comparison result, the subnetwork of the trusted SP node in the list is eliminated, and then the subnetworks of the remaining nodes are subjected to statistical feature extraction.

[0155] In some embodiments, after obtaining the SMS users with abnormal behavior in step S400, the behavioral characteristics of the screened abnormal nodes and neighboring nodes can be further analyzed to obtain the SMS users with abnormal behavior that are finally determined, wherein the behavioral characteristics of the abnormal nodes or neighboring nodes can include but are not limited to one or more of the duration of each SMS, the total duration of SMS with a single neighboring node, the average market of SMS with all neighboring nodes, the number of SMS, the frequency of SMS, etc. This can better assist our telecommunications or network anti-fraud work.

[0156] The implementation of the present invention includes the following beneficial effects: the present invention proposes to obtain a mathematical model based on the general mathematical statistical laws of the complex network community structure. Compared with the existing modeling method of anomaly detection which is machine learning, there is no need to provide historical fraud data as training samples for repeated learning, training and verification, which saves time and computing overhead, has high timeliness, and compares the statistical characteristics of SMS users with the node feature model of normal SMS users. There is no need for complex node features and highly subjective training samples screened manually, thereby reducing the probability of false detection.

[0157] The present invention adopts the least squares linear fitting method to estimate the parameters of the node feature model, which has two advantages compared with the commonly used maximum likelihood estimation. First, the closed-form solution of the parameters can be obtained by solving the linear equations, which is simple to calculate; second, it has good robustness to outliers, and can adapt relatively well to data with some outliers, and will not be overly affected by outliers.

[0158] When calculating the deviation, the present invention does not simply calculate the straight-line distance from the statistical characteristics of each initial node to the expected node of the model, but introduces Scaling the straight-line distance as a scaling ratio can effectively reduce the deviation error.

[0159] The present invention has high sensitivity in discovering abnormal behaviors of SMS users, strong pertinence and specificity, can distinguish the behaviors of SP SMS users and point-to-point SMS users, and improves the accuracy of intelligent anti-fraud capabilities.

[0160] In some embodiments, Fig.10 As shown, Fig.10 is another flow chart of the steps of a method for detecting abnormal behavior of SMS users with abnormal behavior, wherein the execution steps are as follows: Fig.10 As shown, SMS records are extracted from the SMS system, duplicate records in the SMS records are removed, and the SMS records after the duplicate SMS records are removed are converted into a complex network. The conversion method can be but is not limited to searching in sequence according to the SMS numbers; a subnetwork of each SMS user (for example, SMS number) in the complex network is constructed, and the statistical features of the subnetwork are extracted to determine whether each SMS user node in the complex network has been traversed. If there are SMS user nodes that have not been traversed, the traversal is started from the SMS user nodes that have not been traversed until all SMS user nodes have been traversed, and a statistical feature set including all SMS user nodes in the complex network is obtained. The power-law distribution function is parameter-fitted according to the statistical features in the statistical feature set to obtain the parameter value of the power-law distribution function, and the parameter value is substituted into the power-law distribution function to obtain a normal node feature model.

[0161] Calculate the deviation of each statistical feature in the statistical feature set from the normal node feature model, determine the method of anomaly detection, and if it is a sorting method, sort the SMS user nodes according to the deviation, and select the N SMS user nodes with the highest deviation after sorting as abnormal nodes.

[0162] If it is the threshold method, determine the method for calculating the threshold. If it is the first threshold calculation method, obtain the empirical custom threshold range set by the user. If it is the second threshold algorithm, determine the normal distribution function of the deviation and determine the threshold range based on the normal distribution function.

[0163] Determine in turn whether the deviation of each SMS user node is greater than the maximum value or less than the minimum value. If so, output the SMS user node as an SMS user with abnormal behavior; if not, output the SMS user node as a normal SMS user.

[0164] The functions specifically implemented by this method embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method embodiment.

[0165] like Fig.11 As shown, Fig.11 The present invention is a structural diagram of a system for detecting abnormal behavior of a short message user by a short message user with abnormal behavior. The present invention also provides a system including a first module, a second module, a third module and a fourth module, wherein:

[0166] The first module is used to obtain the original SMS records;

[0167] The second module is used to construct a complex network based on the original SMS records; the initial nodes of the complex network represent SMS users, and the edges between the initial nodes represent the existence of SMS records between the initial nodes;

[0168] The third module is used to obtain the sub-network of each initial node according to the complex network and extract the statistical characteristics of the sub-network; the statistical characteristics include the actual number of nodes and the actual number of edges of the sub-network;

[0169] The fourth module is used to calculate the deviation between the statistical features and the node feature model, and screen the initial nodes according to the deviation to obtain SMS users with abnormal behavior.

[0170] Specifically, for the functions of the first module, the second module, the third module and the fourth module, the contents in the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0171] The third module is specifically used to sequentially use the initial node of the complex network as the central node, traverse the neighboring nodes in the preset neighborhood of the central node, extract the edges between the central node and the neighboring nodes and the edges between different neighboring nodes of the central node, and obtain the subnetwork of each central node. The specific process is the same as the above method embodiment, and will not be repeated here.

[0172] The fourth module is specifically used to obtain several groups of normal SMS user characteristics; the normal SMS user characteristics include the number of sample nodes and the number of sample edges of the subnetwork; construct a power-law distribution function of the normal SMS user characteristics; the independent variable of the power-law distribution function includes the node number variable, and the dependent variable includes the edge number variable; calculate the logarithm of the power-law distribution function, use the least square method and the normal SMS user characteristics to perform parameter fitting on the logarithm of the power-law distribution function, obtain the parameter value of the logarithm of the power-law distribution function, bring the parameter value back to the power-law distribution function, and obtain the node feature model. The specific process is the same as the above method embodiment, and will not be repeated here.

[0173] The fourth module is also specifically used to substitute the actual number of nodes of the sub-network into the node feature model to obtain the expected number of edges of the sub-network; determine the scaling ratio according to the expected number of edges and the actual number of edges, and obtain the deviation according to the scaling ratio, the expected number of edges and the actual number of edges. The specific process is the same as that of the above method embodiment, and will not be repeated here.

[0174] The fourth module is also specifically used to determine the threshold range; the initial node whose deviation is within the threshold range is regarded as a short message user with abnormal behavior. The specific process is the same as the above method embodiment, and will not be repeated here.

[0175] The fourth module is also specifically used to sort all the initial nodes according to the deviation degree; the first N initial nodes after sorting are used as SMS users with abnormal behavior; wherein N is a natural number greater than 1. The specific process is the same as the above method embodiment, and will not be repeated here.

[0176] In some embodiments, the system for detecting abnormal behavior of SMS users further includes a fifth module for removing a subnetwork of trusted nodes according to a subnetwork structure of preset trusted SMS users; the trusted nodes include SMS users of the service provider. The specific process is the same as the above method embodiment, and will not be repeated here.

[0177] In some embodiments, the system for detecting abnormal behavior of SMS users with abnormal behavior further includes a sixth module, which is used to further analyze the behavior characteristics of the screened abnormal nodes and neighboring nodes after obtaining the SMS users with abnormal behavior, and obtain the SMS users with abnormal behavior that are finally determined. The specific process is the same as the above method embodiment, and will not be repeated here.

[0178] like Fig.12 As shown, Fig.12 The present invention is a structural diagram of a device for detecting abnormal behavior of a short message user by a short message user with abnormal behavior. The present invention also provides a device for detecting abnormal behavior of a short message user by a short message user with abnormal behavior, comprising:

[0179] at least one processor;

[0180] at least one memory for storing at least one program;

[0181] When the at least one program is executed by the at least one processor, the at least one processor implements the steps of the method for detecting abnormal behavior of a text message user by a text message user with abnormal behavior as described in the above method embodiment.

[0182] Among them, the memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. The memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a remote memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0183] It can be seen that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0184] In addition, the embodiment of the present application also discloses a computer program product or a computer program, and the computer program product or the computer program is stored in a computer-readable storage medium. The processor of the computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the above method. Similarly, the contents in the above method embodiment are all applicable to the storage medium embodiment, and the functions specifically implemented by the storage medium embodiment are the same as those in the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method embodiment.

[0185] The present invention also provides a computer-readable storage medium, which stores a program executable by a processor. The program executable by the processor is used to implement the above method when executed by the processor.

[0186] It is understood that all or some steps and systems in the disclosed method above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0187] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0188] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for detecting abnormal behavior of a text message user, characterized in that: The following steps are involved: Get the original SMS records; Constructing a complex network based on the original SMS records; The initial nodes of the complex network represent SMS users, and the edges between the initial nodes represent that there are SMS records between the initial nodes; Obtaining a subnetwork of each of the initial nodes according to the complex network, and extracting statistical features of the subnetwork; the statistical features include the actual number of nodes and the actual number of edges of the subnetwork; The deviation of the statistical feature from the node feature model is calculated, and the initial nodes are screened according to the deviation to obtain SMS users with abnormal behavior.

2. The method according to claim 1, characterized in that The step of obtaining a subnetwork of each initial node according to the complex network specifically includes: The initial node of the complex network is sequentially used as a central node, and neighbor nodes within a preset neighborhood of the central node are traversed; The edges between the central node and the neighboring nodes and the edges between different neighboring nodes of the central node are extracted to obtain a subnetwork of each central node.

3. The method according to claim 1, characterized in that The node feature model is obtained by the following method: Acquire several groups of normal SMS user characteristics; the normal SMS user characteristics include the number of sample nodes and the number of sample edges of the subnetwork; Constructing a power-law distribution function of the normal SMS user characteristics; the independent variable of the power-law distribution function includes a node number variable, and the dependent variable includes an edge number variable; The logarithm of the power-law distribution function is calculated, and the logarithm of the power-law distribution function is parameter-fitted using the least square method and the normal short message user characteristics to obtain the node feature model.

4. The method according to claim 1, characterized in that: The calculating of the deviation between the statistical feature and the node feature model specifically includes: Substituting the actual number of nodes of the sub-network into the node feature model to obtain the expected number of edges of the sub-network; A scaling ratio is determined according to the expected number of edges and the actual number of edges, and the degree of deviation is obtained according to the scaling ratio, the expected number of edges and the actual number of edges.

5. The method according to any one of claims 1 to 4, characterized in that: The screening of the initial nodes according to the deviation to obtain SMS users with abnormal behavior specifically includes: Determine threshold range; The initial node whose deviation degree is within the threshold range is regarded as a short message user with abnormal behavior.

6. The method according to any one of claims 1 to 4, characterized in that: The screening of the initial nodes according to the deviation to obtain SMS users with abnormal behavior specifically includes: Sorting all initial nodes according to the deviation; According to the sorting result, the N initial nodes with the highest deviation are output as SMS users with abnormal behavior; wherein N is a natural number greater than 1.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: The subnetwork of trusted nodes is eliminated according to the subnetwork structure of preset trusted SMS users; the trusted nodes include SMS users of the service provider.

8. A system for detecting abnormal behavior of SMS users, characterized in that: It includes a first module, a second module, a third module and a fourth module, wherein: The first module is used to obtain original SMS records; The second module is used to construct a complex network based on the original SMS records; the initial nodes of the complex network represent SMS users, and the edges between the initial nodes represent the existence of SMS records between the initial nodes; The third module is used to obtain a sub-network of each of the initial nodes according to the complex network, and extract statistical features of the sub-network; the statistical features include the actual number of nodes and the actual number of edges of the sub-network; The fourth module is used to calculate the deviation between the statistical features and the node feature model, and screen the initial nodes according to the deviation to obtain SMS users with abnormal behavior.

9. A device for detecting abnormal behavior of a text message user, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that: The processor-executable program is used to perform the method according to any one of claims 1 to 7 when executed by the processor.

Images