Telecommunication fraud identification method and device based on social network behavior classification and medium

Abstract

The invention discloses a telecommunication fraud identification method and device based on social network behavior classification, and a medium. The method comprises the following steps: constructing a social network relationship graph of a target user; determining an abnormal contact person according to the social network relation graph, and obtaining target communication content of the abnormal contact person and the target user; performing sentiment analysis and topic identification on the target communication content, and judging whether the abnormal contact person has a risk or not according to a sentiment analysis result and a topic identification result; when the abnormal contact person has the risk, determining whether the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes according to the social network relation graph; and when the communication behavior mode of the target user changes before and after establishing the communication contact with the abnormal contact person, judging that the abnormal contact person is a high-risk contact person, and generating telecommunication fraud early warning information. The method improves the accuracy and timeliness of telecommunication fraud recognition, and can be widely applied to the technical field of information security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device and medium for identifying telecommunication fraud based on social network behavior classification. Background Art

[0002] In the modern telecommunications industry, telecommunications fraud has become a common and serious problem, especially affecting the elderly. As the elderly have relatively limited knowledge of emerging technologies and fraud methods, they are easily targeted by fraudsters. In the existing technology, the industry usually uses the following methods to identify and prevent telecommunications fraud:

[0003] 1) Keyword filtering: Filter the target communication content by pre-setting sensitive keywords to detect potential fraud information. However, fraudsters often use obscure language or replace sensitive keywords, making it difficult for the filtering system to accurately identify.

[0004] 2) Blacklist system: Add known fraudulent phone numbers to the blacklist to prevent these numbers from communicating with users. However, fraudsters frequently change their phone numbers and identity information, making it difficult for the blacklist system to effectively prevent fraud.

[0005] 3) Abnormal behavior detection: Based on the abnormal detection model of user communication behavior, communication behaviors that are different from normal behavior patterns are identified. However, the daily communication behaviors of the elderly are relatively few and simple, which makes the accuracy of abnormal behavior detection low in small sample conditions and the false alarm rate high.

[0006] These traditional methods are significantly inadequate when dealing with highly concealed fraud targeting the elderly and long-term relationships. Due to the lack of multi-dimensional comprehensive analysis, existing technologies are difficult to effectively identify and warn fraudsters in the early stages of establishing trust relationships.

[0007] Therefore, how to improve the accuracy and timeliness of telecommunications fraud identification and provide an early warning mechanism has become an urgent problem that needs to be solved. Summary of the invention

[0008] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0009] To this end, an object of an embodiment of the present invention is to provide a method for identifying telecommunications fraud based on social network behavior classification, which improves the accuracy and timeliness of telecommunications fraud identification.

[0010] Another object of an embodiment of the present invention is to provide a telecommunications fraud identification device based on social network behavior classification.

[0011] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0012] On the one hand, an embodiment of the present invention provides a telecommunications fraud identification method based on social network behavior classification, comprising the following steps:

[0013] Build a social network relationship map of target users;

[0014] Determine an abnormal contact according to the social network relationship graph, and obtain target communication content between the abnormal contact and the target user;

[0015] Perform sentiment analysis and topic recognition on the target communication content, and determine whether the abnormal contact is risky based on the sentiment analysis results and topic recognition results;

[0016] When the abnormal contact person is at risk, determining whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact person according to the social network relationship graph;

[0017] When the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact, the abnormal contact is determined to be a high-risk contact, and telecommunications fraud warning information is generated.

[0018] Furthermore, in one embodiment of the present invention, constructing a social network relationship graph of the target user specifically includes:

[0019] Acquire the communication records of the target user, wherein the communication records include at least one of call data, text message data, and social software communication data;

[0020] Determine a plurality of target contacts according to the communication records, and determine the communication frequency and communication duration between the target user and each of the target contacts, and then determine the communication intensity between the target user and each of the target contacts according to the communication frequency and the communication duration;

[0021] The target user and the target contact are taken as nodes, the communication records between the target user and each target contact are stored in the corresponding node of the target contact, and the weight of the edge between the target user and each target contact is determined according to the communication strength to obtain the social network relationship graph.

[0022] Further, in one embodiment of the present invention, determining the abnormal contact according to the social network relationship graph and obtaining the target communication content between the abnormal contact and the target user specifically includes:

[0023] Traversing the nodes of the social network relationship graph to obtain the communication records between the target user and each of the target contacts, and then filtering out a number of new contacts from the target contacts according to the communication records;

[0024] Determining a target communication strength between the target user and the newly added contact according to a weight of an edge between the target user and the newly added contact;

[0025] When the target communication strength is greater than or equal to a preset threshold, determining that the newly added contact is an abnormal contact;

[0026] The target communication content between the abnormal contact and the target user is obtained according to the communication record.

[0027] Further, in one embodiment of the present invention, the performing of sentiment analysis and topic recognition on the target communication content, and judging whether the abnormal contact person is risky according to the sentiment analysis result and topic recognition result, specifically includes:

[0028] Preprocessing the target communication content to remove noise and irrelevant information to obtain first communication content;

[0029] Identifying the first communication content through a preset sentiment analysis model to obtain the sentiment tendency of the abnormal contact;

[0030] Identify the first communication content through a preset topic identification model to obtain a topic type between the abnormal contact and the target user;

[0031] When the emotional tendency is a positive emotion, and the topic type includes at least one of a trust building topic, a money transaction topic, and an investment and financial management topic, it is determined that the abnormal contact has a risk.

[0032] Further, in an embodiment of the present invention, determining whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact according to the social network relationship graph specifically includes:

[0033] Traversing the nodes of the social network relationship graph to obtain the communication records between the target user and each of the target contacts, and then determining the target time for the target user to establish communication with the abnormal contact according to the communication records;

[0034] Taking the communication records before the target time as historical communication records, and determining the historical communication behavior pattern of the target user according to the historical communication records;

[0035] Taking the communication record after the target time as the current communication record, and determining the current communication behavior mode of the target user according to the current communication record;

[0036] It is determined whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact according to the historical communication behavior pattern and the current communication behavior pattern.

[0037] Further, in an embodiment of the present invention, determining the historical communication behavior pattern of the target user according to the historical communication record specifically includes:

[0038] Determining the communication behavior characteristics and time distribution characteristics of the target user according to the historical communication records;

[0039] The communication behavior characteristics and the time distribution characteristics are input into a pre-trained communication behavior pattern recognition model to obtain the historical communication behavior pattern.

[0040] Furthermore, in one embodiment of the present invention, the telecommunications fraud identification method further includes the following steps:

[0041] Corresponding telecommunications fraud prevention suggestions are obtained according to the user group to which the target user belongs, and the telecommunications fraud prevention suggestions are sent to the target user and / or the target user's family members.

[0042] On the other hand, an embodiment of the present invention provides a telecommunications fraud identification device based on social network behavior classification, comprising:

[0043] A social network relationship graph construction module is used to construct a social network relationship graph of target users;

[0044] An abnormal contact determination module is used to determine an abnormal contact according to the social network relationship map, and obtain the target communication content between the abnormal contact and the target user;

[0045] A communication content analysis and identification module is used to perform sentiment analysis and topic identification on the target communication content, and determine whether the abnormal contact is risky based on the sentiment analysis results and topic identification results;

[0046] A communication behavior pattern recognition module, used to determine whether the communication behavior pattern of the target user changes before and after establishing communication with the abnormal contact according to the social network relationship map when the abnormal contact presents a risk;

[0047] The early warning module is used to determine that the abnormal contact is a high-risk contact and generate telecommunications fraud early warning information when the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact.

[0048] On the other hand, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein the program, when executed by the processor, realizes the telecommunications fraud identification method based on social network behavior classification as described above.

[0049] On the other hand, an embodiment of the present invention further provides a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the telecommunications fraud identification method based on social network behavior classification as described above.

[0050] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0051] The embodiment of the present invention constructs a social network relationship map of the target user, determines abnormal contacts according to the social network relationship map, obtains the target communication content between the abnormal contacts and the target user, performs sentiment analysis and topic recognition on the target communication content, and judges whether the abnormal contacts are risky according to the sentiment analysis results and topic recognition results. When the abnormal contacts are risky, determine whether the communication behavior pattern of the target user before and after establishing communication with the abnormal contacts changes according to the social network relationship map. When the communication behavior pattern of the target user before and after establishing communication with the abnormal contacts changes, the abnormal contacts are judged to be high-risk contacts, and telecommunications fraud warning information is generated. The embodiment of the present invention can accurately identify abnormal contacts and judge whether the abnormal contacts are risky by constructing a social network relationship map, combining sentiment analysis and topic recognition. By comparing the communication behavior patterns of the target user before and after establishing communication with the abnormal contacts, potential high-risk communication relationships can be identified before the fraudsters have actually committed fraudulent acts, so that effective telecommunications fraud identification and warning can be performed in the early stage of establishing a trust relationship with the fraudsters. Compared with the existing methods based on keyword filtering and blacklists, the accuracy and timeliness of telecommunications fraud identification are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 A flowchart of a method for identifying telecommunication fraud based on social network behavior classification provided by an embodiment of the present invention;

[0054] Figure 2 A step flow chart of step S101 provided in an embodiment of the present invention;

[0055] Figure 3 A step flow chart of step S102 provided in an embodiment of the present invention;

[0056] Figure 4 A step flow chart of step S103 provided in an embodiment of the present invention;

[0057] Figure 5 A step flow chart of step S104 provided in an embodiment of the present invention;

[0058] Figure 6 A step flow chart of step S1042 provided in an embodiment of the present invention;

[0059] Figure 7 Another step flow chart of a telecommunications fraud identification method based on social network behavior classification provided by an embodiment of the present invention;

[0060] Figure 8 A schematic diagram of the overall process of a telecommunications fraud identification method based on social network behavior classification provided by an embodiment of the present invention;

[0061] Fig. 9 A schematic diagram of the structure of a telecommunications fraud identification device based on social network behavior classification provided by an embodiment of the present invention;

[0062] Fig.10 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention;

[0063] Fig.11 A schematic diagram of the structure of a storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limitations on the present application. It should be noted that, although the functional module division is performed in the system schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order from the module division in the system schematic diagram or the flow chart. For the step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0065] In the description of the present invention, the meaning of "a plurality" is two or more. If there is a description of the first or the second, it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by technicians in the technical field of this application. The terms used in this document are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0066] The telecommunications fraud identification method based on social network behavior classification provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, tablet computer, laptop computer, desktop computer, set-top box, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the telecommunications fraud identification method based on social network behavior classification, etc., but is not limited to the above forms.

[0067] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0068] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0069] like Figure 1 FIG. 1 is a flowchart of a method for identifying telecommunication fraud based on social network behavior classification according to an embodiment of the present invention. Figure 1 The embodiment of the present invention provides a telecommunication fraud identification method based on social network behavior classification, which is suitable for identifying telecommunication fraud targeting various types of users (especially elderly users), and specifically includes the following steps:

[0070] S101. Build a social network relationship map of target users.

[0071] like Figure 2 FIG. 1 is a flowchart of step S101 provided in an embodiment of the present invention, referring to FIG. Figure 2 As an optional implementation, a social network relationship graph of the target user is constructed, which specifically includes:

[0072] S1011, obtaining a communication record of a target user, where the communication record includes at least one of call data, text message data, and social software communication data;

[0073] S1012, determining multiple target contacts according to the communication records, and determining the communication frequency and communication duration between the target user and each target contact, and then determining the communication intensity between the target user and each target contact according to the communication frequency and communication duration;

[0074] S1013. Take the target user and the target contact as nodes, store the communication records between the target user and each target contact in the corresponding node of the target contact, and determine the weight of the edge between the target user and each target contact according to the communication intensity to obtain a social network relationship graph.

[0075] Specifically, the communication records of the target user are collected, including call and text message data, as well as social software communication data; based on the communication frequency, communication duration and communication content, a social network relationship graph is established, wherein the nodes of the social network relationship graph represent the target user and the target contact, and the edge weight represents the communication intensity between the target user and the target contact.

[0076] In some optional embodiments, the construction of the social network relationship map further includes performing a time series analysis on the communication frequency of the target user to identify abnormally high-frequency or low-frequency communication behavior patterns.

[0077] S102: Determine abnormal contacts according to the social network relationship graph, and obtain target communication content between the abnormal contacts and the target user.

[0078] like Figure 3 FIG. 1 is a flow chart of step S102 provided in an embodiment of the present invention, referring to FIG. Figure 3 As an optional implementation, the abnormal contact is determined according to the social network relationship graph, and the target communication content between the abnormal contact and the target user is obtained, which specifically includes:

[0079] S1021, traversing the nodes of the social network relationship graph to obtain the communication records between the target user and each target contact, and then screening out a number of new contacts from the target contacts according to the communication records;

[0080] S1022, determining a target communication strength between the target user and the newly added contact according to the weight of the edge between the target user and the newly added contact;

[0081] S1023. When the target communication strength is greater than or equal to a preset threshold, determining that the newly added contact is an abnormal contact;

[0082] S1024. Obtain target communication content between the abnormal contact and the target user according to the communication record.

[0083] Specifically, the communication frequency and duration of the newly added contacts are monitored based on the weights of the edges of the social network relationship graph. If the newly added contact communicates frequently in a short period of time and the relationship heats up quickly, the newly added contact is determined to be an abnormal contact, and the target communication content between the abnormal contact and the target user is obtained based on the communication records stored in the corresponding nodes of the social network relationship graph.

[0084] S103: Perform sentiment analysis and topic recognition on the target communication content, and determine whether the abnormal contact is risky based on the sentiment analysis results and topic recognition results.

[0085] like Figure 4 FIG. 1 is a flow chart of step S103 provided in an embodiment of the present invention, referring to FIG. Figure 4 As an optional implementation method, sentiment analysis and topic recognition are performed on the target communication content, and it is determined whether the abnormal contact has risks based on the sentiment analysis results and topic recognition results, which specifically includes:

[0086] S1031, preprocessing the target communication content to remove noise and irrelevant information to obtain first communication content;

[0087] S1032, identifying the first communication content through a preset sentiment analysis model to obtain the sentiment tendency of the abnormal contact;

[0088] S1033, identifying the first communication content by using a preset topic identification model to obtain a topic type between the abnormal contact and the target user;

[0089] S1034: When the emotional tendency is positive emotion, and the topic type includes at least one of a trust building topic, a money transaction topic, and an investment and financial management topic, it is determined that the abnormal contact person has a risk.

[0090] Specifically, natural language processing technology is used to pre-process the communication content to remove noise and irrelevant information; sentiment analysis models are used to identify sentiment tendencies in communication content and label positive, negative, and neutral sentiments; topic modeling technology (such as Latent Dirichlet Allocation, LDA) is used to identify the main topics in communication content, with particular attention paid to topics involving trust building, money transactions, and investment and financial management; combining the results of sentiment analysis and topic modeling, if an abnormal contact shows positive sentiment in the communication with the target user, and the content of the communication gradually involves topics such as trust building, money transactions, or investment and financial management, the abnormal contact will be marked as risky.

[0091] In some optional embodiments, the sentiment analysis model is trained using deep learning technology, which can automatically adapt to the emotional tendencies expressed in different languages ​​and improve the accuracy of sentiment analysis.

[0092] In some optional embodiments, the topic modeling technology is combined with dynamic topic modeling to update the topic model in real time to reflect the dynamic changes in the communication content.

[0093] S104: When there is a risk with the abnormal contact, determine whether the communication behavior pattern of the target user changes before and after establishing communication with the abnormal contact based on the social network relationship map.

[0094] like Figure 5 FIG. 1 is a flowchart of step S104 provided in an embodiment of the present invention, referring to FIG. Figure 5 As an optional implementation, determining whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact based on the social network relationship graph specifically includes:

[0095] S1041, traversing the nodes of the social network relationship graph to obtain the communication records between the target user and each target contact, and then determining the target time for the target user to establish communication contact with the abnormal contact according to the communication records;

[0096] S1042, taking the communication records before the target time as historical communication records, and determining the historical communication behavior pattern of the target user according to the historical communication records;

[0097] S1043, using the communication record after the target time as the current communication record, and determining the current communication behavior mode of the target user according to the current communication record;

[0098] S1044. Determine whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact based on the historical communication behavior pattern and the current communication behavior pattern.

[0099] Specifically, the target user's historical communication records are collected and analyzed to identify their normal communication behavior patterns; the changes in communication behavior patterns before and after the appearance of new contacts are compared to identify the gradual establishment process of abnormal relationships; if it is found that the target user's communication behavior pattern changes significantly after the appearance of new contacts and meets the criteria for high-risk marking, a fraud warning is generated.

[0100] like Figure 6 FIG. 1 is a flow chart of step S1042 provided in an embodiment of the present invention, referring to FIG. Figure 6 As an optional implementation, determining the historical communication behavior pattern of the target user according to the historical communication records specifically includes:

[0101] S10421. Determine the communication behavior characteristics and time distribution characteristics of the target user based on historical communication records;

[0102] S10422. Input the communication behavior characteristics and time distribution characteristics into a pre-trained communication behavior pattern recognition model to obtain a historical communication behavior pattern.

[0103] Specifically, the communication behavior characteristics and time distribution characteristics of the target user are determined based on the historical communication records, wherein the call behavior characteristics include call behavior characteristics and SMS behavior characteristics. The call behavior characteristics include the number of calls, the number of calls, the number of calls, the number of calls, the number of contacts, the number of contacts, the number of contacts, the number of contacts, the number of calls, the number of calls, the number of calls, the number of calls, the ratio of calls, the average duration of calls, the standard deviation of duration, the ratio of calls, the average duration of calls, the standard deviation of duration, the number of base stations involved and the characteristic attributes related to the call behavior; the SMS behavior characteristics include the number of SMS sent, the number of SMS received, the number of contacts sent, the number of contacts received, the number of contacts sent during the day, the number of contacts received during the day, the number of sends during the day, the number of receives during the day, the number of sends at night, the number of receives at night, the average length of SMS sent, the standard deviation of the length of SMS sent, the ratio of blank SMS sent, the average length of SMS received, the standard deviation of the length of SMS received, the characteristic attributes related to the SMS behavior of the number of blank SMS received; the time distribution characteristics count the distribution of communication behavior within the time window.

[0104] The communication behavior characteristics and time distribution characteristics are input into the pre-trained communication behavior pattern recognition model to obtain the historical communication behavior pattern. The communication behavior pattern recognition model is obtained by training the convolutional neural network, and its training process is a conventional training method in the prior art, which will not be described here.

[0105] S105. When the communication behavior pattern of the target user changes before and after establishing communication with the abnormal contact, the abnormal contact is determined to be a high-risk contact, and telecommunications fraud warning information is generated.

[0106] Specifically, after identifying high-risk communication behavior, early warning information is sent to the target user or his / her family in a timely manner to alert them to the possible risk of telecommunications fraud.

[0107] like Figure 7 FIG. 1 is another flow chart of the steps of a telecommunications fraud identification method based on social network behavior classification provided by an embodiment of the present invention, referring to FIG. Figure 7 As an optional implementation, the telecommunications fraud identification method further includes the following steps:

[0108] S106. Obtain corresponding telecommunications fraud prevention suggestions based on the user group to which the target user belongs, and send the telecommunications fraud prevention suggestions to the target user and / or the target user's family members.

[0109] Specifically, the early warning mechanism of the embodiment of the present invention includes an artificial intelligence-driven suggestion system, which can provide personalized preventive measures suggestions based on the identified high-risk behaviors and corresponding user groups, such as verifying the identity of new contacts and avoiding disclosing personal sensitive information.

[0110] like Figure 8 FIG. 1 is a schematic diagram of the overall process of the telecommunications fraud identification method based on social network behavior classification provided by an embodiment of the present invention, referring to FIG. Figure 8 , a specific embodiment of the embodiment of the present invention is as follows:

[0111] Assume that there is an elderly user Mr. Li, and his children (guardians) decide to use the method of the present invention to monitor and analyze his communication behavior in order to prevent telecommunications fraud.

[0112] First, by collecting Mr. Li’s communication data, including call records and text message content, we build a social network relationship graph of Mr. Li. In this process, communication frequency, call duration, and interaction content are used to determine the importance and relationship strength of each contact. Specifically, each contact is regarded as a node in the graph, and the frequency and duration of calls and text messages are used as edge weights to represent the strength of Mr. Li’s relationship with each contact.

[0113] Next, sentiment analysis and topic modeling are performed on Mr. Li's communication content. By using natural language processing technology, the communication content is first preprocessed to remove irrelevant information and noise. Then, the pre-trained deep learning sentiment analysis model is used to classify the sentiment of each text message and call record and identify the sentiment tendency (positive, negative or neutral). At the same time, Latent Dirichlet Allocation (LDA) topic modeling technology is used to identify the main topics in the communication content, with a special focus on topics involving trust building and money transactions.

[0114] During daily monitoring, the system discovered that Mr. Li frequently communicated with a new contact, and the frequency and content of the communications increased rapidly in a short period of time. Through the analysis of the social network relationship graph, the node weight of the new contact rose rapidly, indicating that the strength of his relationship with Mr. Li increased rapidly. Further sentiment analysis and topic modeling results showed that the content of these communications gradually involved topics related to trust building, and the new contact mentioned money-related topics many times.

[0115] To further confirm the risk, the system compared Mr. Li's communication behavior patterns before and after the new contact appeared. The results showed that Mr. Li's communication behavior changed significantly after the new contact appeared, especially in terms of emotions and topics, showing an abnormal trust-building process. Based on multi-dimensional analysis, the system marked the new contact as high risk and generated a warning message.

[0116] The warning information was promptly sent to Mr. Li and his children, reminding them of the possible fraud risks of the new contact. The system also provided personalized preventive measures, such as verifying the identity of the new contact and avoiding disclosing personal sensitive information. After receiving the warning information, Mr. Li and his children further verified the background of the new contact and finally found that the new contact was indeed suspected of fraud, successfully avoiding potential financial losses.

[0117] In this way, the method of the present invention not only improves the accuracy of telecommunications fraud identification, but also can provide early warning before the fraud actually occurs, protecting the property safety and mental health of elderly users. Compared with existing keyword filtering, blacklist systems and abnormal behavior detection methods, the present invention shows significant technological progress and innovation in identifying hidden fraudulent behaviors and providing personalized preventive measures. The method of the present invention is easy to implement and low-cost. Through multi-dimensional comprehensive analysis and early warning mechanisms, it provides effective anti-fraud protection for the elderly and other vulnerable groups, and has broad application prospects and social significance.

[0118] It can be recognized that the embodiments of the present invention, by constructing a social network relationship graph, combined with sentiment analysis and topic recognition, can accurately identify abnormal contacts and determine whether the abnormal contacts are risky. By comparing the communication behavior patterns of the target user before and after establishing communication with the abnormal contact, it is possible to identify potential high-risk communication relationships before the fraudsters carry out actual fraudulent behavior, thereby effectively identifying and warning of telecommunications fraud in the early stages of establishing a trust relationship with fraudsters. Compared with the existing methods based on keyword filtering and blacklists, the accuracy and timeliness of telecommunications fraud identification are improved.

[0119] Compared with the prior art, the embodiments of the present invention also have the following advantages:

[0120] 1) Improve recognition accuracy: By constructing a social network relationship graph, combined with sentiment analysis and topic modeling, the present invention can accurately identify the communication patterns between elderly users and new contacts, especially the hidden trust-building process. Compared with existing methods based on keyword filtering and blacklists, the present invention has a higher accuracy rate when dealing with highly concealed fraudulent behaviors that frequently change contact information.

[0121] 2) Early warning mechanism: By comparing the long-term patterns of communication behaviors of elderly users, the present invention can identify potential high-risk communication relationships before fraudsters actually commit fraud, and send early warning information to elderly users or their families in a timely manner, effectively preventing the occurrence of fraud. Compared with the existing technology, the present invention can provide early warnings and reduce the economic losses and psychological harm of elderly users.

[0122] 3) Multi-dimensional analysis: The present invention uses social network analysis, sentiment analysis and topic modeling technology to analyze and identify communication behaviors from multiple dimensions, avoiding the limitations of a single method. Through multi-dimensional comprehensive analysis, the present invention can more comprehensively cover various types of telecommunications fraud and improve the overall identification effect.

[0123] 4) Strong adaptability: The present invention is not only applicable to the elderly, but can also be extended to other vulnerable groups, such as teenagers or technology-blind groups. The versatility and flexibility of the method make it more widely applicable in practical applications.

[0124] 5) Personalized preventive measures: After identifying high-risk communication behaviors, the early warning mechanism of the present invention can provide personalized preventive measures, such as verifying the identity of new contacts, avoiding disclosure of personal sensitive information, etc. This personalized suggestion is more targeted and practical than the simple early warning of the prior art.

[0125] 6) The technical implementation is simple and effective: The method of the present invention mainly relies on existing communication data and natural language processing technology, which is easy to implement and low-cost. Its technical solution is clear, and ordinary technicians can easily implement it according to the specific implementation method, which has strong practical value.

[0126] like Fig. 9 FIG. 1 is a schematic diagram of a telecommunications fraud identification device based on social network behavior classification according to an embodiment of the present invention. Fig. 9 The embodiment of the present invention provides a telecommunication fraud identification device based on social network behavior classification, comprising:

[0127] A social network relationship graph construction module is used to construct a social network relationship graph of target users;

[0128] An abnormal contact determination module is used to determine abnormal contacts based on the social network relationship graph and obtain the target communication content between the abnormal contacts and the target user;

[0129] The communication content analysis and identification module is used to perform sentiment analysis and topic identification on the target communication content, and determine whether the abnormal contact has risks based on the sentiment analysis results and topic identification results;

[0130] The communication behavior pattern recognition module is used to determine whether the communication behavior pattern of the target user changes before and after establishing communication with the abnormal contact based on the social network relationship map when there is a risk of abnormal contact;

[0131] The early warning module is used to determine that the abnormal contact is a high-risk contact and generate telecommunications fraud early warning information when the communication behavior pattern of the target user changes before and after establishing communication with the abnormal contact.

[0132] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0133] The embodiment of the present invention also provides an electronic device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and when the program is executed by the processor, the above-mentioned telecommunication fraud identification method based on social network behavior classification is realized. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0134] like Fig.10 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention, referring to FIG. Fig.10 , an embodiment of the present invention provides an electronic device, including:

[0135] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0136] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiments of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the telecommunications fraud identification method based on social network behavior classification in the embodiment of the present invention;

[0137] Input / output interface 1003, used to implement information input and output;

[0138] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0139] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0140] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0141] like Fig.11 FIG. 1 is a schematic diagram of a storage medium according to an embodiment of the present invention. Fig.11 An embodiment of the present invention further provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs 1101, and the one or more programs 1101 can be executed by one or more processors to implement the above-mentioned telecommunications fraud identification method based on social network behavior classification.

[0142] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0143] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0144] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0145] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0146] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0147] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0148] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0149] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0150] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0151] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0152] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A telecommunications fraud identification method based on social network behavior classification, characterized in that: The following steps are involved: Build a social network relationship map of target users; Determine an abnormal contact according to the social network relationship graph, and obtain target communication content between the abnormal contact and the target user; Perform sentiment analysis and topic recognition on the target communication content, and determine whether the abnormal contact is risky based on the sentiment analysis results and topic recognition results; When the abnormal contact person is at risk, determining whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact person according to the social network relationship graph; When the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact, the abnormal contact is determined to be a high-risk contact, and telecommunications fraud warning information is generated.

2. According to claim 1, a telecommunication fraud identification method based on social network behavior classification is characterized in that: The step of constructing a social network relationship graph of a target user specifically includes: Acquire the communication records of the target user, wherein the communication records include at least one of call data, text message data, and social software communication data; Determine a plurality of target contacts according to the communication records, and determine the communication frequency and communication duration between the target user and each of the target contacts, and then determine the communication intensity between the target user and each of the target contacts according to the communication frequency and the communication duration; The target user and the target contact are taken as nodes, the communication records between the target user and each target contact are stored in the corresponding node of the target contact, and the weight of the edge between the target user and each target contact is determined according to the communication strength to obtain the social network relationship graph.

3. According to claim 2, a telecommunications fraud identification method based on social network behavior classification is characterized in that: The determining of abnormal contacts according to the social network relationship graph and obtaining target communication content between the abnormal contacts and the target user specifically includes: Traversing the nodes of the social network relationship graph to obtain the communication records between the target user and each of the target contacts, and then filtering out a number of new contacts from the target contacts according to the communication records; Determining a target communication strength between the target user and the newly added contact according to a weight of an edge between the target user and the newly added contact; When the target communication strength is greater than or equal to a preset threshold, determining that the newly added contact is an abnormal contact; The target communication content between the abnormal contact and the target user is obtained according to the communication record.

4. According to claim 1, a telecommunication fraud identification method based on social network behavior classification is characterized in that: The performing sentiment analysis and topic recognition on the target communication content, and judging whether the abnormal contact has a risk according to the sentiment analysis result and the topic recognition result, specifically includes: Preprocessing the target communication content to remove noise and irrelevant information to obtain first communication content; Identifying the first communication content through a preset sentiment analysis model to obtain the sentiment tendency of the abnormal contact; Identify the first communication content through a preset topic identification model to obtain a topic type between the abnormal contact and the target user; When the emotional tendency is a positive emotion, and the topic type includes at least one of a trust building topic, a money transaction topic, and an investment and financial management topic, it is determined that the abnormal contact person has a risk.

5. According to claim 2, a telecommunications fraud identification method based on social network behavior classification is characterized in that: The determining, based on the social network relationship graph, whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact person specifically includes: Traversing the nodes of the social network relationship graph to obtain the communication records between the target user and each of the target contacts, and then determining the target time for the target user to establish communication with the abnormal contact according to the communication records; Taking the communication records before the target time as historical communication records, and determining the historical communication behavior pattern of the target user according to the historical communication records; Taking the communication record after the target time as the current communication record, and determining the current communication behavior mode of the target user according to the current communication record; It is determined whether the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact according to the historical communication behavior pattern and the current communication behavior pattern.

6. A telecommunications fraud identification method based on social network behavior classification according to claim 5, characterized in that: The determining the historical communication behavior pattern of the target user according to the historical communication records specifically includes: Determining the communication behavior characteristics and time distribution characteristics of the target user according to the historical communication records; The communication behavior characteristics and the time distribution characteristics are input into a pre-trained communication behavior pattern recognition model to obtain the historical communication behavior pattern.

7. A telecommunication fraud identification method based on social network behavior classification according to claims 1 to 6, characterized in that: The telecommunications fraud identification method further comprises the following steps: Corresponding telecommunications fraud prevention suggestions are obtained according to the user group to which the target user belongs, and the telecommunications fraud prevention suggestions are sent to the target user and / or the target user's family members.

8. A telecommunications fraud identification device based on social network behavior classification, characterized in that: include: A social network relationship graph construction module is used to construct a social network relationship graph of target users; An abnormal contact determination module is used to determine an abnormal contact according to the social network relationship map, and obtain the target communication content between the abnormal contact and the target user; A communication content analysis and identification module is used to perform sentiment analysis and topic identification on the target communication content, and determine whether the abnormal contact is risky based on the sentiment analysis results and topic identification results; A communication behavior pattern recognition module, used to determine whether the communication behavior pattern of the target user changes before and after establishing communication with the abnormal contact according to the social network relationship map when the abnormal contact presents a risk; The early warning module is used to determine that the abnormal contact is a high-risk contact and generate telecommunications fraud early warning information when the communication behavior pattern of the target user changes before and after establishing communication contact with the abnormal contact.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the telecommunications fraud identification method based on social network behavior classification as described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the telecommunications fraud identification method based on social network behavior classification as described in any one of claims 1 to 7.

Images