Anti-fraud interception method based on intelligent information recognition assistance

Abstract

The present application relates to the field of digital information transmission technology, and specifically to an anti-fraud interception method based on intelligent information recognition assistance, the method comprising: obtaining social related information of the caller and the user; determining the probability of the caller's unfamiliar information to the user based on the social related information; determining the risk of the caller's call fraud to the user based on the unfamiliar information probability; and intercepting the caller's fraud information based on the call fraud risk. The method can more accurately assess the caller's fraud risk to the user through the unfamiliar information probability, thereby accurately identifying fraud information without infringing the user's privacy, and accurately and effectively intercepting it.

Description

Technical Field

[0001] The present application relates to the technical field of digital information transmission, and in particular to an anti-fraud interception method based on intelligent information recognition assistance in the technical field of digital information transmission. Background Art

[0002] Telecommunications fraud is the illegal profit-making behavior of defrauding others of their property by fabricating false information, setting up scams, and using telecommunications methods such as telephone, text messages, and the Internet.

[0003] In recent years, a variety of telecom fraud identification methods have been proposed, such as the combination of the blacklist system to identify abnormal signals, which can quickly assess whether fraud is involved by monitoring the circulation trajectory of suspected mobile phone black cards; constructing a semantic model of fraud information to realize the identification of fraudulent calls and information, and other telecommunications fraud identification methods, using artificial intelligence technology to effectively analyze a large amount of telecommunications data and identify fraudulent texts and other information. However, these methods cannot accurately identify the increasingly developed telecom fraud methods. For example, when constructing a semantic model of fraud information to prevent and identify fraud, fraudsters deliberately use synonyms, related words, abnormal word order and other means in the communication content to evade screening, which increases the difficulty of using traditional means to train and identify telecom fraud content; and the combination of the blacklist system to identify abnormal signals requires continuous operation and maintenance investment, making it difficult to identify and intervene in fraudulent behavior in a timely and effective manner. Summary of the invention

[0004] In order to solve the technical problem that the existing technology cannot accurately identify the increasingly developed electronic fraud methods, the purpose of this application is to provide an anti-fraud interception method based on intelligent information recognition assistance. The technical solutions adopted are as follows:

[0005] The present application embodiment provides an anti-fraud interception method based on intelligent information recognition assistance, the method comprising:

[0006] Get social related information of callers and users;

[0007] Determine, based on the social related information, a probability that the caller is unfamiliar with the user;

[0008] Determining the call fraud risk of the caller to the user based on the unfamiliar information probability;

[0009] Based on the risk of telephone fraud, the telephone fraud information of the caller is intercepted.

[0010] In combination with the first aspect above, in some possible implementations, obtaining the social related information of the caller and the user includes:

[0011] Obtaining the corresponding communication information between the caller and the user within a preset time period and basic information of the communication object;

[0012] The communication information and the basic information are determined as the social related information.

[0013] In the above method, by analyzing the communication information of the contact and the basic information of the communication object, the social related information of the user is obtained, so as to more accurately judge and detect the electronic fraud information through the social related information, thereby providing the auxiliary interception system with corresponding information to be intercepted.

[0014] In combination with the first aspect above, in some possible implementations, determining the probability of the caller being a stranger to the user based on the social related information includes:

[0015] Based on the social related information, determine the relationship index between the common contact and the caller and the user; wherein the common contact is the same contact between the caller and the user;

[0016] Based on the relationship proximity indicator, the probability that the caller is unfamiliar with the user is determined.

[0017] In the above method, the closeness of the relationship between the common contact and the caller and the user is reflected by analyzing the closeness of the relationship between the caller and the user, so that the probability of the caller being unfamiliar with the user can be accurately calculated through the closeness of the relationship index.

[0018] In combination with the first aspect above, in some possible implementations, determining the call fraud risk of the caller to the user based on the stranger information probability includes:

[0019] If the probability of the unfamiliar information is greater than a preset evaluation threshold, the caller is determined to be a candidate contact;

[0020] Determining common characteristics of candidate victims based on the communication records of the candidate contacts;

[0021] Determining the suspected fraud probability of the intermediate contact in the communication record of the candidate victim;

[0022] If the suspected fraud probability is greater than or equal to a preset suspected fraud probability threshold, determining the intermediate contact as a candidate group member;

[0023] Determining a candidate gathering place for the candidate group of people;

[0024] Based on the common characteristics of the candidate victims and the candidate gathering places, the call fraud risk of the caller to the user is determined.

[0025] In the above method, by analyzing the social scope of the two contacts and the commonality of many social objects, the electronic fraud information is further judged and detected, thereby providing the auxiliary interception system with corresponding information to be intercepted.

[0026] In combination with the first aspect above, in some possible implementations, determining the common features of the candidate deceived persons based on the communication records of the candidate contacts includes:

[0027] Determine the basic information of the candidate victim based on the communication records of the candidate contact;

[0028] Based on the basic information of the candidate victims, the common characteristics of the candidate victims are determined.

[0029] In the above method, the basic information of the candidate victims can be accurately analyzed through the communication records of the candidate contacts, thereby facilitating accurate statistics of the common characteristics of the candidate victims.

[0030] In combination with the first aspect above, in some possible implementations, determining the suspected fraud probability of the intermediate contact in the communication record of the candidate victim includes:

[0031] respectively determining a first number of the candidate deceived persons and a second number of the candidate deceived persons who have contacted the intermediate contact person;

[0032] Based on the first number and the second number, the suspected fraud probability of the intermediate contact in the communication record of the candidate victim is determined.

[0033] In the above method, by analyzing the number of contacted candidate deceived persons and the number of candidate deceived persons, the suspected fraud probability of the intermediate contact can be accurately calculated, and then the candidate group members can be accurately located through the suspected fraud probability.

[0034] In combination with the first aspect above, in some possible implementations, determining the candidate gathering place of the candidate group members includes:

[0035] Obtaining the contact addresses of the candidate group members to obtain multiple contact addresses;

[0036] For any contact address among the multiple contact addresses, based on the total number of the candidate group members and the number of the candidate group members corresponding to the any contact address, determine the address suspiciousness of the any contact address;

[0037] The contact addresses whose address suspicion is greater than or equal to a preset suspicion threshold are determined as the candidate gathering places.

[0038] In the above method, by analyzing the contact addresses of each candidate group member, the suspiciousness of each contact address is calculated, and then the gathering place of the candidate group members, that is, the candidate gathering place, can be accurately analyzed.

[0039] In combination with the first aspect above, in some possible implementations, determining the call fraud risk of the caller to the user based on the common features of the candidate victims and the candidate gathering places includes:

[0040] Determining a common characteristic factor between the user and the common characteristic;

[0041] Based on the candidate gathering places, determining the suspiciousness of the account of the candidate contact;

[0042] Based on the account suspiciousness and the same characteristic factors, the call fraud risk of the caller to the user is determined.

[0043] In the above method, by analyzing the same characteristic factors between the user and the common characteristics, the account suspicion of the candidate contact is analyzed, and then the risk of telephone fraud by the caller to the user can be accurately determined through the account suspicion and the same characteristic factors.

[0044] In combination with the first aspect above, in some possible implementations, intercepting the caller's fraud information based on the call fraud risk includes:

[0045] If the call fraud risk is greater than or equal to a preset risk threshold, determining that the caller is a telecommunications fraudster;

[0046] The preset interception rules are used to intercept the telephone fraud information of the caller.

[0047] In combination with the first aspect above, in some possible implementations, the preset interception rule includes:

[0048] Traverse all candidate contacts and obtain the caller's call fraud risk for each candidate contact. If the call fraud risk of the candidate contact is greater than or equal to the preset risk threshold, the candidate contact is considered to be a telecommunications fraudster.

[0049] In a second aspect, a computer program product is provided, which includes: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0050] In a third aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the first aspect or any possible implementation of the first aspect.

[0051] The present application has the following beneficial effects: by obtaining social related information of the caller and the user; according to the social related information, determining the probability of the caller's unfamiliar information to the user; in this way, by determining the probability of the caller's unfamiliar information to the user, the closeness of the connection between the caller and the user is analyzed, thereby effectively avoiding misjudgment of telecommunications information due to insufficient discrimination methods, and then determining the risk of call fraud from the caller to the user based on the probability of unfamiliar information, and intercepting the caller's fraud information based on the risk of call fraud; in this way, the risk of call fraud from the caller to the user can be more accurately assessed through the probability of unfamiliar information, so that fraud information can be accurately identified without infringing on user privacy, and accurately and effectively intercepted. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 It is a schematic diagram of the implementation process of the anti-fraud interception method based on intelligent information recognition assistance provided in an embodiment of the present application;

[0054] Figure 2 This is another implementation flow diagram of the anti-fraud interception method based on intelligent information recognition assistance provided by an embodiment of the present application;

[0055] Figure 3 This is another implementation flow diagram of the anti-fraud interception method based on intelligent information recognition assistance provided in an embodiment of the present application;

[0056] Figure 4 It is another implementation flow diagram of the anti-fraud interception method based on intelligent information recognition assistance provided in an embodiment of the present application;

[0057] Figure 5 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to further explain the technical means and effects adopted by the present application to achieve the predetermined invention purpose, the following is a detailed description of the anti-fraud interception method based on intelligent information recognition assistance proposed in the present application, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0059] In the description of the embodiments of the present application, unless otherwise specified, " / " means or. For example, A / B can mean A or B. The "and / or" in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" refers to two or more than two.

[0060] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0061] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0062] The specific scheme of the anti-fraud interception method based on intelligent information recognition assistance provided by the present application is described in detail below with reference to the accompanying drawings.

[0063] See also Figure 1 , which shows an implementation flow chart of an anti-fraud interception method based on intelligent information recognition assistance provided by an embodiment of the present application. The method can be implemented by the following steps:

[0064] 101, collecting social related information of two contacts.

[0065] Here, the two contacts are the caller and the user.

[0066] 102. By analyzing the social circles of both parties, candidate contacts are preliminarily determined.

[0067] Here, the candidate contact is a suspicious contact.

[0068] 103, analyzing the social scope of the candidate contacts, and comparing the social scope with the relevant features of the user, to further screen the candidate contacts.

[0069] 104, calculating the call fraud risk of the candidate contact to the user.

[0070] 105, the identified electronic fraud information is fed back to the user and intercepted using preset interception rules.

[0071] In the embodiment of the present application, by examining the intersection of the social scopes of the two contacts and further determining the closeness of the relationship between the two contacts, it is possible to effectively avoid misjudgment of telecommunications information due to insufficient discrimination methods. On this basis, by analyzing the relevant features of the many social objects of the contact and comparing their similarities with the contact features, telecommunications information with the possibility of telecommunications fraud can be effectively screened out without infringing the user's privacy.

[0072] The present application embodiment provides an anti-fraud interception method based on intelligent information recognition assistance, such as Figure 2 As shown, combined Figure 2 The steps shown are explained below:

[0073] 201, obtaining social related information of the caller and the user.

[0074] Here, social related information can be stored in the form of a database, including but not limited to basic information of contacts (e.g., name, age, gender, etc. of the account owner, as well as the location of the number, the location of the call, etc.), and communication records. Communication records include but are not limited to call time, call duration, and text message sending time.

[0075] In some possible implementations, the corresponding communication information between the caller and the user within a preset time period and the basic information of the communication object are obtained; and the communication information and the basic information are determined as the social related information. For example, all contacts of the two people and the corresponding communication information (including call time, call duration, and SMS sending time) in the past period of time (preset to one year) are collected separately, and the basic information of the communication object is retrieved (such as the name, age, gender, etc. of the number owner, as well as the number’s location, the location of the call, etc.), so as to obtain the social related information. In this way, by analyzing the communication information of the contact and the basic information of the communication object, the social related information of the user is obtained, so that the electronic fraud information can be more accurately judged and detected through the social related information, thereby providing the corresponding information to be intercepted for the auxiliary interception system.

[0076] 202. Determine, based on the social related information, a probability that the caller is unfamiliar with the user.

[0077] Here, the probability of the caller's unfamiliar information to the user is used to characterize the intimacy between the caller and the user. In some possible implementations, since the scammer randomly selects the victim within the target range, the scammer has not contacted the victim before, which at least shows that the two are strangers to each other, and the scammer will not use his own private channels when committing fraud, which also leads to a very small intersection between the contact circle of the scammer's contact method and the social circle of the victim.

[0078] The better the relationship between the two people involved in the communication, the higher the frequency of their communication, and most of the time the chat time is longer. This is because the two people need to maintain the relationship, emotional needs (such as the need to be understood, sharing happiness, etc.) or discussion of interest targets. This high-frequency and long-term communication will increase the probability that the caller and the user have the same and contacted contacts, that is, common contacts. The more common contacts there are between the caller and the user, the higher the contact frequency between the caller and the common contacts, and the user and the common contacts in the collected social related information, the longer the call duration, and the more telecommunications information generated. Therefore, it is possible to evaluate whether the relationship between the common contact and the caller and the user is close through the similarity between the social related information generated when the caller, the user and the common contact communicate, so as to analyze the probability of whether the caller is a stranger to the user.

[0079] Based on this, the above step 202 can be implemented by the following steps 221 and 222 (not shown):

[0080] 221. Determine, based on the social related information, a relationship index between the common contact and the caller and the user.

[0081] Here, a relationship distance index is constructed to evaluate the possibility that each common contact has a high frequency of contact with the caller or the user. The relationship distance index can be implemented by formula (1):

[0082] (1);

[0083] in, Indicates the caller With users Common contacts The relationship indicator between the two, where the common contact is a contact that has been in contact with both the caller and the user. and Both are not 0. Indicates common contact With users Average contact frequency in the past (in times / month). Indicates common contact With the caller Average contact frequency in the past (in times / month); Indicates common contact With users In the past Length of call at the first contact; Indicates common contact With the caller In the past Length of call at the first contact; Indicates common contact With users Total number of contacts in the past; Indicates common contact With the caller Total number of contacts in the past; Represents the hyperbolic tangent function, which is used for direct proportional normalization.

[0084] 222. Determine the probability of the caller being unfamiliar with the user based on the relationship proximity indicator.

[0085] Here, generally speaking, the more common contacts there are between the caller and the user involved in the call, and the closer the social relationship between the caller and the user, the lower the probability that fraudulent information exists in the social-related information generated between the caller and the user during the call, and the information generated during the call is likely to be interests, hobbies, experience plans, and other information related to non-fraudulent behavior.

[0086] Based on this, the probability of unfamiliar information is constructed to calculate the possibility that the telecommunications information generated between callers and users contains unfamiliar fraud information. With users The probability of unfamiliar information between The calculation formula is shown in formula (2):

[0087] (2);

[0088] in, Indicates the caller With users The total number of common contacts; Indicates common contact Indicators of the proximity to both; Indicates the caller The total number of contacts; Indicates user The total number of contacts; In this way, the caller is characterized by analyzing the relationship between the common contacts and the caller and the user, as well as the possibility of fraud in the social related information generated by the common contacts between the caller and the user. ,user The possibility of fraudulent information being generated due to unfamiliar content during a call between the two parties can be accurately calculated, thereby accurately calculating the possibility of the caller generating unfamiliar fraudulent information to the user during the call.

[0089] 203. Determine the call fraud risk of the caller to the user based on the unfamiliar information probability.

[0090] In some possible implementations, the above step 203 can be performed by Figure 3 The steps shown achieve:

[0091] 301: If the probability of the unfamiliar information is greater than a preset evaluation threshold, the caller is determined to be a candidate contact.

[0092] Here, after calculating the probability of the caller and the user being unfamiliar, the evaluation threshold is preset. Screening, preset evaluation threshold If the probability of unfamiliar information is greater than or equal to the preset evaluation threshold , the corresponding user is marked as a candidate contact. If the probability of the unfamiliar information is less than the preset evaluation threshold , then this user has a certain degree of normal communication with the other callers and will not be marked.

[0093] 302. Determine common features of the candidate deceived persons based on the communication records of the candidate contacts.

[0094] Here, the communication records of the candidate contacts include: call time, call duration, and SMS sending time, etc. The basic information of the candidate victim is analyzed through the communication records of the candidate contacts, so as to calculate the common feature evaluation, and then determine the common features of the candidate victim through the common feature evaluation.

[0095] In some possible implementations, the above step 302 may be implemented by the following process:

[0096] The first step is to determine the basic information of the candidate victim based on the communication records of the candidate contacts.

[0097] Here, when a fraud group commits a crime, it needs to cite evidence to gain the trust of the deceived person, and it is not easy to produce relevant evidence. This leads to the fact that the routines adopted by a fraud group are relatively stable. For this reason, the "customer" groups faced by a fraud group mostly have certain characteristics, that is, the people contacted by the fraud group are relatively likely to be deceived. When a fraud group commits a crime, it generally spreads the fraud information widely first to contact a large number of potential victims, and then quickly screens out the people who respond to the fraud information. These people may be more easily persuaded or interested in the corresponding information. The fraud group then further contacts these people with the intention of completing the fraud. By obtaining possible victims and retrieving the communication records of candidate contacts, the fraud group screens those who have communicated with them for more than (Default ) times, and then record these people as candidate victims. The basic information of the candidate victims includes: name, gender, age, location, etc.

[0098] The second step is to determine the common characteristics of the candidate victims based on their basic information.

[0099] Here, the process of obtaining candidate deceived persons and their common characteristics (deceived characteristics) is as follows: first, determine the candidate deceived persons.

[0100] Then, the basic information of the candidate victims is retrieved, and a one-dimensional data space is established with each dimension of the basic information (name, age, location, etc.). The candidate victims are used as data points, and all candidate victims are placed in the data space to obtain many single-dimensional databases.

[0101] Specifically, the LOF (Local Outlier Factor) outlier factor detection algorithm is used to detect the data in each dimension in the data space, and the similarity of the data features of the data points in each dimension is evaluated by the degree of aggregation of the detection results under multiple local reachable densities.

[0102] Finally, we examine the density of data points in each data space, and the dimension with the highest density is the relevant feature that may be deceived. Evaluation of common features , as shown in formula (3):

[0103] (3);

[0104] in, Represents the dimensions in the data space The corresponding indivual Locally accessible density; Indicated in indivual The number of data points in the cluster corresponding to the local reachability density; represents the total number of candidate deceived persons; It represents the maximum value function, which takes the maximum value among different reachable densities; Represents the hyperbolic tangent function, which is used for direct proportional normalization.

[0105] Traverse all dimensions and calculate the corresponding common feature evaluation. If the common feature evaluation of a dimension is greater than or equal to the threshold , (default ), the dimension corresponding to the common feature evaluation is considered to be a possible common feature and is marked as a common feature. In this way, the basic information of the candidate victim can be accurately analyzed through the communication records of the candidate contact, so as to facilitate the accurate counting of the common features of the candidate victim.

[0106] 303, determining the suspected fraud probability of the intermediate contact in the communication record of the candidate victim.

[0107] Here, the intermediate contact is the contact involved in the communication record. In some possible implementations, when the fraud group is committing fraud, in order to better communicate the fraud steps and better divide the work and cooperate, in order to prevent internal leaks or betrayal by teammates, they gather together when committing the crime, so when they contact the deceived person, they contact different people through different steps. By retrieving the communication records of all candidate deceived persons, the suspected fraud probability of the contact in the communication record is calculated to characterize the possibility that the contact is a suspected fraud probability member of the fraud group.

[0108] The above step 303 can be implemented by the following process: first, by respectively determining the number of the candidate deceived persons, recorded as the first number, and the number of the candidate deceived persons who have contacted the intermediate contact person, recorded as the second number. Then, based on the first number and the second number, the suspected fraud probability of the intermediate contact person in the communication record of the candidate deceived person is determined. In this way, by analyzing the number of candidate deceived persons who have been contacted and the number of candidate deceived persons, the suspected fraud probability of the intermediate contact person can be accurately calculated, and then the candidate group members of the fraud group can be accurately located through the suspected fraud probability.

[0109] Here, the suspected fraud probability of the intermediate contact is shown in formula (4):

[0110] (4);

[0111] in, Indicates the contact person in the communication record The probability of suspected fraud. Indicates that the intermediary contact has been contacted The second number of candidate deceived persons; represents the total number of candidate deceived persons (i.e. the first number); represents the exponential function, which is used for inverse normalization. Represents the absolute value function.

[0112] 304. If the suspected fraud probability is greater than or equal to a preset suspected fraud probability threshold, determine that the intermediate contact is a candidate group member.

[0113] Here, we traverse all the intermediate contacts that appear in the communication records and calculate the suspected fraud probability corresponding to each intermediate contact. If the suspected fraud probability of an intermediate contact is greater than or equal to the threshold , (default ), it is considered that the intermediate contact corresponding to the suspected fraud probability has been contacted by all candidate deceived persons and is marked as a candidate member of the fraud group.

[0114] 305, determining candidate gathering places of the candidate group members.

[0115] Here, the suspiciousness of the contact address of the candidate group members is calculated, and then the candidate gathering places of the candidate group members are analyzed.

[0116] In some possible implementations, the above step 305 can be performed by Figure 4 The steps shown achieve:

[0117] 401, obtaining the contact addresses of the candidate group members, and obtaining multiple contact addresses.

[0118] Here, the corresponding contact addresses of all candidate deceived persons when they contact the candidate group members are retrieved (for example, the Internet Protocol (IP) address or the address when the call is received).

[0119] 402 : For any contact address among the multiple contact addresses, determine the address suspiciousness of the any contact address based on the total number of possible group members and the number of candidate group members corresponding to the any contact address.

[0120] Here, the address suspiciousness of any contact address is shown in formula (5):

[0121] (5);

[0122] in, Indicates any contact address The address is suspicious. Indicates that the contact address is address The number of candidate groups; Indicates the total number of candidate groups; Represents the exponential function, used for inverse normalization.

[0123] 403, determining the contact addresses whose address suspicion is greater than or equal to a preset suspicion threshold as the candidate gathering place.

[0124] Here, all the contact addresses of the candidate group members are traversed, and the corresponding address suspicious evaluation is calculated. If the address suspicious evaluation of a contact address is greater than or equal to the preset threshold, , (e.g., preset threshold ), the contact address corresponding to the suspicious evaluation of the training address is considered to be the address where the candidate group members gather, and it is marked as a candidate gathering place. In this way, by analyzing the contact addresses of each candidate group member, the suspiciousness of each contact address is calculated, and then the gathering place of the candidate group members, that is, the candidate gathering place, can be accurately analyzed.

[0125] 306. Determine the call fraud risk of the caller to the user based on the common characteristics of the candidate victims and the candidate gathering places.

[0126] Here, by determining the same characteristic factor between the user and the common characteristic, and then based on the candidate gathering place, determining the account suspiciousness of the candidate contact; finally, based on the account suspiciousness and the same characteristic factor, determining the caller's call fraud risk to the user. In this way, by analyzing the same characteristic factor between the user and the common characteristic, the account suspiciousness of the candidate contact is analyzed, and then the caller's call fraud risk to the user can be accurately judged through the account suspiciousness and the same characteristic factor.

[0127] In some possible implementations, when the fraud group commits a crime, they first "cast a wide net" and then "selectively capture", that is, most of the contacts that the fraud group communicates with many times are "customer groups" that are likely to be deceived, and these people have corresponding characteristics of being deceived; in addition, because the fraud group divides the work and cooperates when committing a crime, they gain the trust of the deceived in many ways, and in order to reduce the risk of internal leaks and betrayal, they are basically in the same place when contacting the deceived. Based on the correlation between user characteristics and users, combined with the addresses of the common contacts of the deceived group, possible telecom fraud information can be screened out. Based on this, the candidate contacts are calculated. For users The risk of phone fraud .

[0128] Among them, users Shared features The same characteristic factor As shown in formula (6):

[0129] (6);

[0130] in, Indicates no user Possible shared features Evaluation of common features of Indicates that it contains users Time characteristics The common characteristics evaluation of and are two opposite parameters, so and will not be equal, so It will not be 0; Represents the exponential function, used for inverse normalization.

[0131] Candidate Contacts Suspiciousness of IP account As shown in formula (7):

[0132] (7);

[0133] in, Indicates candidate contacts Corresponding contact addresses and candidate gathering places The distance in km; Representation calculation The function of the minimum value of is used to obtain the minimum distance between the contact address and the candidate gathering place. There are multiple candidate gathering places. Since the contact address and the candidate gathering place The minimum distance is greater than 0, so Greater than 0. Represents the exponential function, used for inverse normalization.

[0134] Calculate candidate contacts For users The risk of phone fraud As shown in formula (8):

[0135] (8);

[0136] in, Indicates user Shared features with The same characteristic factor of Indicates candidate contacts The IP account is suspicious.

[0137] In the above steps 301 to 306, by analyzing the social scope of the two contacts and the commonality of many social objects, the electronic fraud information is further determined and detected, thereby providing the auxiliary interception system with corresponding information to be intercepted.

[0138] 204. Based on the risk of incoming call fraud, intercept the caller's fraud information.

[0139] Here, if the call fraud risk is greater than or equal to the preset risk threshold, the caller is determined to be a telecommunications fraudster; the preset interception rules are used to intercept the caller's telecommunications fraud information. In this way, by analyzing the size of the call fraud risk, it is accurately determined whether the caller is a telecommunications fraudster, and then the telecommunications fraud information is effectively intercepted through the set interception rules.

[0140] In some possible implementations, all candidate contacts are traversed to obtain the caller's call fraud risk for each candidate contact, and the risk threshold is preset. Screen the risk of incoming phone fraud and preset risk thresholds If the candidate contact's call fraud risk is greater than or equal to the preset risk threshold , then the candidate contact is considered to be a telecom fraudster, and these data are marked and recorded as telecom fraudsters. So far, based on the social scope of the candidate contact, the common feature dimensions and the contacts of the candidate contact are analyzed to further determine the telecom fraudster. When it is detected that the contact user is a telecom fraudster, a corresponding warning logo is added to the caller ID interface. If the user has set up preset interception rules in the mobile phone's harassment interception and other related interception systems, the telecom fraudster is compared with the interception rules. If it meets the corresponding interception rules, the signal is marked, added to the interception preset rules, and intercepted.

[0141] In an embodiment of the present application, social related information of the caller and the user is obtained; according to the social related information, the probability of the caller's unfamiliar information to the user is determined; in this way, by determining the probability of the caller's unfamiliar information to the user, the closeness of the connection between the caller and the user is analyzed, so as to effectively avoid misjudgment of telecommunications information due to insufficient discrimination method, and then based on the probability of unfamiliar information, the risk of call fraud from the caller to the user is determined, and based on the risk of call fraud, the caller's telephone fraud information is intercepted; in this way, the probability of unfamiliar information can be used to more accurately evaluate the risk of call fraud from the caller to the user, so that telephone fraud information can be accurately identified without infringing on user privacy, and accurately and effectively intercepted.

[0142] Optionally, in the present application, the transmission medium may be a wired link (for example, but not limited to, coaxial cable, optical fiber, and digital subscriber line (DSL)) or a wireless link (for example, but not limited to, wireless Fidelity (WIFI), Bluetooth, and mobile device network).

[0143] It should be noted that: the device provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device is divided into different functional modules to complete all or part of the functions described above. In addition, the method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0144] Figure 5 is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. For example, Figure 5 As shown, the computer device 500 includes: a memory 501, a processor 502, and a computer program 503 stored in the memory 501 and running on the processor 502, wherein when the processor 502 executes the computer program 503, the computer device can execute any of the anti-fraud interception methods based on intelligent information recognition assistance introduced above.

[0145] In addition, an embodiment of the present application also protects a device, which may include a memory and a processor, wherein the memory stores executable program code, and the processor is used to call and execute the executable program code to execute the anti-fraud interception method based on intelligent information recognition assistance provided by an embodiment of the present application.

[0146] This embodiment can divide the functional modules of the device according to the above method example. For example, it can correspond to each functional module, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0147] It should be understood that the device provided in this embodiment is used to execute the above-mentioned anti-fraud interception method based on intelligent information identification assistance, so the same effect as the above-mentioned implementation method can be achieved. In the case of an integrated unit, the device may include a processing module and a storage module. Among them, when the device is applied to a device, the processing module can be used to control and manage the actions of the device. The storage module can be used to support the device to execute mutual program codes, etc. Among them, the processing module can be a processor or a controller, which can implement or execute various exemplary logical boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc., and the storage module can be a memory.

[0148] In addition, the device provided in the embodiment of the present application may be a chip, a component or a module, and the chip may include a connected processor and a memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute the anti-fraud interception method based on intelligent information identification assistance provided in the above embodiment. This embodiment also provides a computer-readable storage medium, in which a computer program code is stored, and when the computer program code is run on a computer, the computer executes the above-mentioned related method steps to implement the anti-fraud interception method based on intelligent information identification assistance provided in the above embodiment.

[0149] This embodiment also provides a computer program product, when the computer program product is run on a computer, the computer executes the above-mentioned related steps to implement the anti-fraud interception method based on intelligent information identification assistance provided by the above embodiment. Among them, the device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding method provided above, so the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here. Through the description of the above implementation mode, the technicians in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In the embodiments provided in this application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiment described above is only schematic, for example, the division of modules or units is only a logical function division, and there can be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, which may be electrical, mechanical or other forms.

[0150] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. The process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-tasking and parallel processing are also possible or may be advantageous. The various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments. The above content is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the scope of protection of the present application.

Claims

1. An anti-fraud interception method based on intelligent information recognition assistance, characterized in that: The method comprises: Get social related information of callers and users; Determine, based on the social related information, a probability that the caller is unfamiliar with the user; Determining the call fraud risk of the caller to the user based on the unfamiliar information probability; Based on the risk of the incoming call fraud, intercepting the caller's fraud information; The acquisition of social related information of the caller and the user includes: Obtaining the corresponding communication information between the caller and the user within a preset time period and basic information of the communication object; Determining the communication information and the basic information as the social related information; The determining, based on the social related information, a probability that the caller is unfamiliar with the user includes: Based on the social related information, determine the relationship index between the common contact and the caller and the user; wherein the common contact is the same contact between the caller and the user; Based on the relationship proximity index, determining the probability of the caller being an unfamiliar person to the user; The determining, based on the unfamiliar information probability, the caller's call fraud risk to the user includes: If the probability of the unfamiliar information is greater than a preset evaluation threshold, the caller is determined to be a candidate contact; Determining common characteristics of candidate victims based on the communication records of the candidate contacts; Determining the suspected fraud probability of the intermediate contact in the communication record of the candidate victim; If the suspected fraud probability is greater than or equal to a preset suspected fraud probability threshold, determining the intermediate contact as a candidate group member; Determining a candidate gathering place for the candidate group of people; Based on the common characteristics of the candidate victims and the candidate gathering places, the call fraud risk of the caller to the user is determined.

2. The anti-fraud interception method based on intelligent information recognition assistance according to claim 1 is characterized in that: The determining of the common characteristics of the candidate deceived persons based on the communication records of the candidate contacts includes: Determine the basic information of the candidate victim based on the communication records of the candidate contact; Based on the basic information of the candidate victims, the common characteristics of the candidate victims are determined.

3. The anti-fraud interception method based on intelligent information recognition assistance according to claim 1 is characterized in that: Determining the suspected fraud probability of the intermediate contact in the communication record of the candidate victim includes: respectively determining a first number of the candidate deceived persons and a second number of the candidate deceived persons who have contacted the intermediate contact person; Based on the first number and the second number, the suspected fraud probability of the intermediate contact in the communication record of the candidate victim is determined.

4. The anti-fraud interception method based on intelligent information recognition assistance according to claim 1 is characterized in that: The step of determining a candidate gathering place for the candidate group of people includes: Obtaining the contact addresses of the candidate group members to obtain multiple contact addresses; For any contact address among the multiple contact addresses, based on the total number of the candidate group members and the number of the candidate group members corresponding to the any contact address, determine the address suspiciousness of the any contact address; The contact addresses whose address suspicion is greater than or equal to a preset suspicion threshold are determined as the candidate gathering places.

5. The anti-fraud interception method based on intelligent information recognition assistance according to claim 1 is characterized in that: The determining the call fraud risk of the caller to the user based on the common features of the candidate victims and the candidate gathering places includes: Determining a common characteristic factor between the user and the common characteristic; Based on the candidate gathering places, determining the suspiciousness of the account of the candidate contact; Based on the account suspiciousness and the same characteristic factors, the call fraud risk of the caller to the user is determined.

6. The anti-fraud interception method based on intelligent information recognition assistance according to claim 1 is characterized in that: The intercepting of the caller's fraud information based on the call fraud risk includes: If the call fraud risk is greater than or equal to a preset risk threshold, determining that the caller is a telecommunications fraudster; The preset interception rules are used to intercept the telephone fraud information of the caller.

7. The anti-fraud interception method based on intelligent information recognition assistance according to claim 6 is characterized in that: The preset interception rules include: Traverse all candidate contacts and obtain the caller's call fraud risk for each candidate contact. If the call fraud risk of the candidate contact is greater than or equal to the preset risk threshold, the candidate contact is considered to be a telecommunications fraudster.

Images