Telecommunication fraud phone recognition method based on multi-data fusion

Abstract

The invention provides a multi-data fusion telecommunication fraud phone recognition method, which belongs to the technical field of communication, and comprises the following steps: firstly, collecting and processing basic call data and user attribute data of a user, carrying out feature extraction on the data, and carrying out aggregation and classification on the data by using a deep learning algorithm and a machine learning algorithm; then selecting known black sample data as a training sample to establish a training model, and continuously optimizing and adjusting the model to realize the target of accurately identifying the fraud phone; the fraud phone number hidden in the network is identified through a technical means, the identification accuracy of the fraud phone is improved, and the property and information security of a user is protected.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a multi-data fusion telecommunication fraud call identification method. Background Art

[0002] The rapid development of telecommunications networks has brought great convenience to people's lives, but it has also provided opportunities for telecommunications fraudsters. Telecommunications network fraud criminals use technical means to obtain the target user's phone and personal information, establish contact with the target user through phone / text messages / Internet and other network connections, fabricate facts, set up scams, and conduct remote, contactless fraud after gaining the trust of the target user to defraud the victim's property. In order to suppress telecommunications fraud and help victims, financial institutions and related companies minimize property losses, various departments have jointly carried out telecommunications network fraud phone management work with telecommunications operators, using operator data to identify fraudulent phone numbers and intercept and block them.

[0003] In recent years, telecommunications fraud methods have become diverse and constantly evolving, posing a huge challenge to the identification of traditional fraud calls, especially the increasingly rampant "card-and-machine separation" GOIP fraud calls in recent years. Fraud call identification using traditional rule matching methods is difficult to cope with complex and changing fraud methods and scenarios. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a multi-data fusion telecommunications fraud call identification method, which realizes intelligent identification of fraud calls by fusing multiple data sources and utilizing big data analysis technology, machine learning technology, deep learning technology, model building technology and artificial intelligence technology, thereby improving the identification accuracy and efficiency of telecommunications fraud calls.

[0005] The technical solution of the present invention is:

[0006] A method for identifying telecommunication fraud calls by fusion of multiple data, specifically:

[0007] 1. Data collection and preprocessing: (1) Operators have rich user attribute information and user service call records. Through Sftp / ftp and other methods, operators’ 2 / 3 / 4 / 5G network domain xDR data, CRM data, billing data and other data are collected, the data is cleaned, and the attribute information of each user is associated with the daily business behavior information, laying the foundation for subsequent analysis.

[0008] 2. Sample collection: Collect the historical fraud phone number list and high-risk area information list provided by the public security, and pre-process the xDR data, CRM data, Billing billing and other historical data of the fraud number list as blacklist sample data;

[0009] 3. Feature extraction: Extract data from the preprocessed data and sort out features that are related to fraud, such as multiple numbers on one ID, caller ratio, short call ratio, called party dispersion, user location, etc. These features will be used as input for model training later.

[0010] 4. Model training: Use the random forest classification algorithm and K-Means clustering algorithm to train the extracted feature data and output the model to be evaluated.

[0011] 5. Model evaluation: Normal users and illegal users form evaluation samples, and the model is evaluated using cross-validation and self-help methods. Focus on recognition accuracy, precision, recall, F1 score, and R square. Cross-validation method: Divide the data set into multiple subsets, take each subset as the test set in turn, and the remaining subsets as the training set, train and evaluate the model multiple times. Self-help method: Generate multiple training sets and test sets through sampling with replacement, and evaluate the model.

[0012] 6. Production test: Deploy the trained model to the production system. Input the live network user data into the model. The model matches the features of each user and outputs the percentage of each user being a fraudulent user. For users with a higher probability, identification and verification are performed through methods such as call back and call content sampling.

[0013] 7. Model self-learning: Continuously collect feedback on actual fraud cases and the real fraud numbers identified and verified in step 6, continuously optimize and update the model, and form a model self-learning mode to adapt to changes in fraud methods and improve the system's intelligence level and response capabilities.

[0014] 8. Result visualization: The present invention not only involves a fraudulent call identification method, but also builds a fraudulent call identification system, which presents the identification results, user portraits, and model training process in a visual interface on the front end. This allows for an intuitive presentation of the fraudulent call analysis process and strengthens the basis for fraudulent call governance. The following figure is a system construction architecture diagram

[0015] The beneficial effects of the present invention are

[0016] 1. Improve recognition accuracy: Use artificial intelligence algorithms to establish a fraudulent call recognition model to improve the accuracy of fraudulent call recognition, achieve efficient and accurate recognition of fraudulent calls, and reduce missed reports and false alarms;

[0017] 2. Enhanced intelligence level: The model has the ability of self-learning. By continuously analyzing and learning real fraud number data, it can automatically adjust model parameters, adapt to complex and changeable fraud methods, and maintain the effectiveness and stability of the model.

[0018] 3. Improve the handling of fraudulent calls: Periodically output a list of potential fraudulent phone numbers in the network to effectively assist operators and public security departments in managing fraudulent calls. At the same time, output detailed user portraits for fraudulent phone numbers and present the fraud analysis process, making the operator / public security fraud control process more reasonable and well-founded. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of the technical architecture of the present invention;

[0020] Figure 2 It is a flowchart of model training, model evaluation and production testing;

[0021] Figure 3 It is a system construction architecture diagram of the present invention;

[0022] Figure 4 It is a schematic diagram of the workflow of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] The present invention combines advanced technologies such as communication network technology, big data analysis technology, machine learning technology, deep learning technology, model building technology and artificial intelligence technology, and effectively utilizes data such as operator 2 / 3 / 4 / 5G xDR, CRM customer information, Billing billing, blacklist data, etc., to analyze key information and features such as user card activation information, package information, call behavior characteristics, call frequency characteristics, location behavior characteristics, roaming trajectory characteristics, etc., to construct a user portrait of fraudulent calls, and use AI recognition technology to achieve accurate screening and identification of fraudulent phone numbers.

[0025] The present invention provides an efficient fraud call identification method with multiple data sources. First, the basic call data and user attribute data of users are collected and processed, and features are extracted from the data. The data are aggregated and classified using deep learning algorithms and machine learning algorithms. Then, known black sample data are selected as training samples to establish a training model, and the goal of accurately identifying fraud calls is achieved through continuous optimization and adjustment of the model.

[0026] The method and system of the present invention specifically include the following 8 steps:

[0027] 1. Data collection and preprocessing: (1) Operators have rich user attribute information and user service call records. Through Sftp / ftp and other methods, operators’ 2 / 3 / 4 / 5G network domain xDR data, CRM data, billing data and other data are collected, the data is cleaned, and the attribute information of each user is associated with the daily business behavior information, laying the foundation for subsequent analysis.

[0028] xDR data contains all records of user call behavior in each 2 / 3 / 4 / 5G network domain. The xDR data is lightly aggregated to obtain the business behavior results of each user every day, with fields such as: the number of user's calling / called, the proportion of calling / called, the roaming location of calling / called, the duration of the call, the resident cell, etc.

[0029] CRM data includes basic user attribute information such as name, age, address, number of SIM cards in the user's name, card purchase channel, etc.

[0030] Billing data includes SIM card billing related data, such as SIM rate package type, payment method, call charges, SMS charges, etc.

[0031] The above three types of data of each user are fused to generate extracted feature data.

[0032] 2. Sample collection: Collect the historical fraud phone number list and high-risk area information list provided by the public security, and pre-process the xDR data, CRM data, Billing billing and other historical data of the fraud number list as blacklist sample data;

[0033] 3. Feature extraction: Extract data from the preprocessed data and sort out features that are related to fraud, such as multiple numbers on one ID, caller ratio, short call ratio, called party dispersion, user location, etc. These features will be used as input for model training later.

[0034] 4. Model training: Use the random forest classification algorithm and K-Means clustering algorithm to train the extracted feature data and output the model to be evaluated.

[0035] 5. Model evaluation: Normal users and illegal users form evaluation samples, and the model is evaluated using cross-validation and self-help methods. Focus on recognition accuracy, precision, recall, F1 score, and R square. Cross-validation method: Divide the data set into multiple subsets, take each subset as the test set in turn, and the remaining subsets as the training set, train and evaluate the model multiple times. Self-help method: Generate multiple training sets and test sets through sampling with replacement, and evaluate the model.

[0036] 6. Production test: Deploy the trained model to the production system. Input the live network user data into the model. The model matches the features of each user and outputs the percentage of each user being a fraudulent user. For users with a higher probability, identification and verification are performed through methods such as call back and call content sampling.

[0037] Model training, model evaluation, and production test process Figure 2 shown.

[0038] 7. Model self-learning: Continuously collect actual fraud cases reported by the police, as well as the real fraud numbers identified and verified in step 6, and continuously optimize and update the model to form a model self-learning mode to adapt to changes in fraud methods and improve the system's intelligence level and response capabilities;

[0039] 8. Result visualization: The present invention not only relates to a fraudulent call identification method, but also builds a fraudulent call identification system, which presents the identification results, user portraits, and model training process in a visual interface on the front end, so as to intuitively present the fraudulent call analysis process and strengthen the basis for fraudulent call management. Figure 3 Build an architecture diagram for the system.

[0040] The above description is only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, and is not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A multi-data fusion telecommunication fraud call identification method, characterized in that: First, we collect and process users’ basic call data and user attribute data, extract features from the data, and use deep learning algorithms and machine learning algorithms to aggregate and classify the data. Then we select known black sample data as training samples to establish a training model, and through continuous optimization and adjustment of the model, we can achieve the goal of accurately identifying fraudulent calls.

2. The method according to claim 1, characterized in that (1) Integrate xDR data, CRM data, and billing data from the entire 2 / 3 / 4 / 5G network domain to build basic user information; (2) Preliminary construction of fraud call user profiles based on user telephone service frequency, called call dispersion, roaming trajectory, and number of SIM cards in the user's name; (3) Use the k-Means algorithm and random forest algorithm to combine modeling, train and analyze the data; (4) The verified real fraudulent phone number information is continuously input into the model to form a self-learning mode of the model to adapt to the changes in fraud methods; (5) Build a fraudulent call identification system to periodically output a list of fraudulent calls and profiles of fraudulent call users.

3. The method according to claim 2, characterized in that Clean the data fused in step (1) and associate the attribute information of each user with the daily business behavior information.

4. The method according to claim 3, characterized in that Collect historical fraudulent phone number lists and location information lists, and pre-process the xDR data, CRM data, and Billing data of the fraudulent number lists as blacklist sample data.

5. The method according to claim 4, characterized in that Data extraction is performed on the preprocessed data to sort out the features that are somewhat correlated with fraud. These features will be used as input for model training later.

6. The method according to claim 5, characterized in that Normal users and illegal users form evaluation samples, and the model is evaluated using cross-validation and self-service methods.

7. The method according to claim 6, characterized in that Cross-validation method: Divide the data set into several subsets, take each subset as the test set in turn, and use the remaining subsets as the training set, train and evaluate the model several times; Bootstrap method: Generate several training sets and test sets through sampling with replacement to evaluate the model.

8. The method according to claim 1, characterized in that Deploy the trained model; input the existing network user data into the model; the model performs feature matching on each user and outputs the probability percentage of each user being a fraudulent user; for users whose probability percentage is higher than the set value, identification and verification are performed through call back and call content sampling methods.

Images