Method and device for identifying telecom fraud based on social network behavior classification, and medium

Abstract

The application discloses a telecom fraud identification method and device based on social network behavior classification and a medium, comprising: constructing a social network relationship graph of a target user; determining an abnormal contact person according to the social network relationship graph and obtaining target communication content between the abnormal contact person and the target user; performing sentiment analysis and topic identification on the target communication content, and judging whether the abnormal contact person is at risk according to the sentiment analysis result and the topic identification result; when the abnormal contact person is at risk, judging whether the communication behavior mode of the target user before and after establishing a communication connection with the abnormal contact person changes according to the social network relationship graph; when the communication behavior mode of the target user before and after establishing a communication connection with the abnormal contact person changes, determining that the abnormal contact person is a high-risk contact person, and generating a telecom fraud warning information. The application improves the accuracy and timeliness of telecom fraud identification and can be widely applied in the field of information security technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a telecommunications fraud identification method and device based on social network behavior classification and a medium. BACKGROUND

[0002] In the modern telecommunications field, telecommunications fraud has become a common and serious problem, especially for the elderly population. The elderly are more susceptible to becoming targets of fraudsters due to their limited understanding of emerging technologies and fraud methods. In the prior art, the industry usually adopts the following methods to identify and prevent telecommunications fraud:

[0003] 1) Keyword filtering: By presetting sensitive keywords to filter target communication content to detect potential fraud information. However, fraudsters often use ambiguous language or replace sensitive keywords, making it difficult for the filtering system to accurately identify.

[0004] 2) Blacklist system: Known fraud phone numbers are added to the blacklist to prevent these numbers from communicating with users. However, fraudsters frequently change phone numbers and identity information, making it difficult for the blacklist system to effectively prevent fraud.

[0005] 3) Abnormal behavior detection: Based on an abnormal behavior detection model of user communication behavior, identify communication behavior that deviates from normal behavior patterns. However, the elderly have less and single daily communication behavior, making the accuracy of abnormal behavior detection low in small sample cases, with a high false positive rate.

[0006] These traditional methods have significant shortcomings in dealing with strong concealment and long-term relationship building fraud behaviors targeting the elderly. Due to the lack of multi-dimensional comprehensive analysis, the prior art is difficult to effectively identify and warn in the early stages of fraudsters establishing trust relationships.

[0007] Therefore, how to improve the accuracy and timeliness of telecommunications fraud identification and provide an early warning mechanism has become a problem that needs to be solved. SUMMARY

[0008] The present application aims to at least partially solve one of the technical problems in the prior art.

[0009] To this end, one object of the present application is to provide a telecommunications fraud identification method based on social network behavior classification, which improves the accuracy and timeliness of telecommunications fraud identification.

[0010] Another object of the present application is to provide a telecommunications fraud identification device based on social network behavior classification.

[0011] In order to achieve the above technical purpose, the technical solution adopted by the present application comprises:

[0012] In one aspect, the embodiment of the present application provides a telecom fraud identification method based on social network behavior classification, comprising the following steps:

[0013] constructing a social network relationship graph of a target user;

[0014] determining an abnormal contact person according to the social network relationship graph, and obtaining target communication content of the abnormal contact person and the target user;

[0015] performing sentiment analysis and topic identification on the target communication content, and determining whether the abnormal contact person is at risk according to the sentiment analysis result and the topic identification result;

[0016] when the abnormal contact person is at risk, determining whether the communication behavior mode of the target user before and after establishing communication contact with the abnormal contact person changes according to the social network relationship graph;

[0017] when the communication behavior mode of the target user before and after establishing communication contact with the abnormal contact person changes, determining that the abnormal contact person is a high-risk contact person, and generating a telecom fraud warning information.

[0018] Further, in one embodiment of the present application, the constructing a social network relationship graph of a target user specifically comprises:

[0019] obtaining communication records of the target user, wherein the communication records comprise at least one of call data, short message data and social software communication data;

[0020] determining a plurality of target contact persons according to the communication records, and determining the communication frequency and the communication duration of the target user and each target contact person, and further determining the communication intensity of the target user and each target contact person according to the communication frequency and the communication duration;

[0021] taking the target user and the target contact person as nodes, storing the communication records of the target user and each target contact person to the node of the corresponding target contact person, and determining the weight of the edge between the target user and each target contact person according to the communication intensity, to obtain the social network relationship graph.

[0022] Further, in one embodiment of the present application, the determining an abnormal contact person according to the social network relationship graph, and obtaining target communication content of the abnormal contact person and the target user specifically comprises:

[0023] traverse nodes of the social network relationship graph to obtain the communication record of the target user and each target contact, and further filter a plurality of new contacts from the target contacts according to the communication record;

[0024] determine a target communication strength of the target user and the new contact according to a weight of an edge between the target user and the new contact;

[0025] when the target communication strength is greater than or equal to a preset threshold, determine that the new contact is an abnormal contact;

[0026] obtain the target communication content of the abnormal contact and the target user according to the communication record.

[0027] Further, in an embodiment of the present application, the target communication content is subjected to sentiment analysis and topic identification, and whether the abnormal contact is at risk is determined according to the sentiment analysis result and the topic identification result, which specifically comprises:

[0028] preprocess the target communication content to remove noise and irrelevant information, and obtain first communication content;

[0029] identify the first communication content through a preset sentiment analysis model to obtain a sentiment tendency of the abnormal contact;

[0030] identify the first communication content through a preset topic identification model to obtain a topic type of the abnormal contact and the target user;

[0031] when the sentiment tendency is a positive sentiment, and the topic type includes at least one of a trust establishment topic, a money transaction topic, and an investment and financial planning topic, it is determined that the abnormal contact is at risk.

[0032] Further, in an embodiment of the present application, whether the communication behavior mode of the target user before and after establishing communication contact with the abnormal contact changes is determined according to the social network relationship graph, which specifically comprises:

[0033] traverse nodes of the social network relationship graph to obtain the communication record of the target user and each target contact, and further determine a target time when the target user establishes communication contact with the abnormal contact according to the communication record;

[0034] take the communication record before the target time as a historical communication record, and determine a historical communication behavior mode of the target user according to the historical communication record;

[0035] determine a current communication behavior mode of the target user according to the current communication record;

[0036] determine whether the communication behavior mode of the target user before and after establishing communication contact with the abnormal contact person changes according to the historical communication behavior mode and the current communication behavior mode.

[0037] Further, in an embodiment of the present application, the determining the historical communication behavior mode of the target user according to the historical communication record specifically comprises:

[0038] determining a communication behavior feature and a time distribution feature of the target user according to the historical communication record;

[0039] inputting the communication behavior feature and the time distribution feature into a pre-trained communication behavior mode recognition model to obtain the historical communication behavior mode.

[0040] Further, in an embodiment of the present application, the telecom fraud identification method further comprises the following steps:

[0041] obtaining a corresponding telecom fraud prevention suggestion according to the user group to which the target user belongs, and sending the telecom fraud prevention suggestion to the target user and / or family members of the target user.

[0042] On the other hand, an embodiment of the present application provides a telecom fraud identification device based on social network behavior classification, comprising:

[0043] a social network relationship graph construction module, configured to construct a social network relationship graph of a target user;

[0044] an abnormal contact person determination module, configured to determine an abnormal contact person according to the social network relationship graph, and obtain target communication content between the abnormal contact person and the target user;

[0045] a communication content analysis and recognition module, configured to perform sentiment analysis and topic recognition on the target communication content, and determine whether the abnormal contact person is at risk according to the sentiment analysis result and the topic recognition result;

[0046] a communication behavior mode recognition module, configured to determine whether the communication behavior mode of the target user before and after establishing communication contact with the abnormal contact person changes according to the social network relationship graph when the abnormal contact person is at risk;

[0047] The early warning module is configured to determine that the abnormal contact person is a high-risk contact person and generate a telecom fraud early warning information when the communication behavior mode of the target user before and after establishing a communication contact with the abnormal contact person changes.

[0048] In another aspect, an electronic device is provided, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection communication between the processor and the memory, and the program is executed by the processor to realize the telecom fraud identification method based on social network behavior classification as described above.

[0049] In another aspect, a storage medium is also provided, which is a computer readable storage medium for computer readable storage, and the storage medium stores one or more programs executable by one or more processors to realize the telecom fraud identification method based on social network behavior classification as described above.

[0050] The advantages and beneficial effects of the present application will be partially given in the following description, partially will become obvious from the following description, or will be understood through the practice of the present application:

[0051] The embodiment of the present application constructs a social network relationship graph of a target user, determines an abnormal contact person according to the social network relationship graph, and obtains target communication content of the abnormal contact person and the target user, performs sentiment analysis and topic identification on the target communication content, and determines whether the abnormal contact person is at risk according to the sentiment analysis result and the topic identification result, when the abnormal contact person is at risk, determines whether the communication behavior mode of the target user before and after establishing a communication contact with the abnormal contact person changes according to the social network relationship graph, when the communication behavior mode of the target user before and after establishing a communication contact with the abnormal contact person changes, determines that the abnormal contact person is a high-risk contact person, and generates a telecom fraud early warning information. The embodiment of the present application can accurately identify an abnormal contact person and determine whether the abnormal contact person is at risk by constructing a social network relationship graph and combining sentiment analysis and topic identification, and can identify a potential high-risk communication relationship before a fraudster implements an actual fraud behavior by comparing the communication behavior mode of the target user before and after establishing a communication contact with the abnormal contact person, so that effective telecom fraud identification and early warning can be performed in an early stage of establishing a trust relationship by a fraudster, and compared with the existing method based on keyword filtering and a blacklist, the accuracy and timeliness of telecom fraud identification are improved. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following introduces the drawings needed to be used in the embodiments of the present application. It should be understood that the drawings introduced in the following are only for the convenience of clearly describing some of the embodiments in the technical solutions of the present application, and for those skilled in the art, other drawings can also be obtained without paying creative labor on the premise.

[0053] Figure 1 A step flow chart of the method for identifying telecom fraud based on social network behavior classification provided by the embodiments of the present application is provided.

[0054] Figure 2 A step flow chart of step S101 provided by the embodiments of the present application is provided.

[0055] Figure 3 A step flow chart of step S102 provided by the embodiments of the present application is provided.

[0056] Figure 4 A step flow chart of step S103 provided by the embodiments of the present application is provided.

[0057] Figure 5 A step flow chart of step S104 provided by the embodiments of the present application is provided.

[0058] Figure 6 A step flow chart of step S1042 provided by the embodiments of the present application is provided.

[0059] Figure 7 Another step flow chart of the method for identifying telecom fraud based on social network behavior classification provided by the embodiments of the present application is provided.

[0060] Figure 8 A whole flow chart of the method for identifying telecom fraud based on social network behavior classification provided by the embodiments of the present application is provided.

[0061] Figure 9 A structure schematic diagram of the device for identifying telecom fraud based on social network behavior classification provided by the embodiments of the present application is provided.

[0062] Figure 10 A hardware structure schematic diagram of the electronic device provided by the embodiments of the present application is provided.

[0063] Figure 11 A structure schematic diagram of the storage medium provided by the embodiments of the present application is provided. DETAILED DESCRIPTION

[0064] Embodiments of the present application are described in detail below with reference to the accompanying drawings, of which examples are shown, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary only, and are used only for explanation of the present application, and are not to be understood as limiting the present application. It should be noted that although functional modules are divided in the system schematic diagram, and logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in a manner different from the module division in the system schematic diagram, or the order in the flowchart. For the step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0065] In the description of the present application, the meaning of multiple is two or more, and if the first, the second is described, it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the sequence of indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application, and are not intended to limit the present application.

[0066] The method for identifying telecom fraud based on social network behavior classification provided by the embodiments of the present application can be applied in a terminal, can also be applied in a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a set-top box, etc.; the server can be configured as an independent physical server, can also be configured as a server cluster or a distributed system composed of multiple physical servers, can also be configured as a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, CDN, and big data and artificial intelligence platform; and the software can be an application for implementing the method for identifying telecom fraud based on social network behavior classification, but is not limited to the above forms.

[0067] The application is operable in a multitude of generic or specific computer system environments or configurations. Examples of well known computing systems, environments, and / or configurations that can be suitable for use with the application include personal computers, server computers, handheld or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, that perform particular tasks or implement particular abstract data types. The application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in local and remote computer storage media including memory storage devices.

[0068] It should be noted that in each of the specific embodiments of the present application, when it is necessary to carry out relevant processing according to user information, user behavior data, user historical data and user location information and other data related to the identity or characteristics of the user, the user's permission or consent will be obtained first, and the collection, use and processing of these data will comply with the relevant laws, regulations and standards of the relevant countries and regions. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the separate permission or separate consent of the user will be obtained through a pop-up window or by jumping to a confirmation page, and after obtaining the separate permission or separate consent of the user, the necessary user-related data for enabling the embodiments of the present application to normally operate will be obtained.

[0069] As shown in Figure 1 Figure is a step flow chart of a telecommunications fraud identification method based on social network behavior classification provided by an embodiment of the present application, referring to Figure 1 , the embodiment of the present application provides a telecommunications fraud identification method based on social network behavior classification, which is suitable for identifying telecommunications frauds against various users (especially elderly users), and specifically includes the following steps:

[0070] S101, constructing a social network relationship graph of a target user.

[0071] As shown in Figure 2 Figure is a step flow chart of step S101 provided by an embodiment of the present application, referring to Figure 2 , further as an optional implementation, constructing a social network relationship graph of a target user, which specifically includes:

[0072] S1011, obtaining communication records of the target user, the communication records including at least one of call data, short message data and social software communication data;

[0073] S1012, determine a plurality of target contacts according to the communication records, and determine the communication frequency and the communication time length of the target user and each target contact, and further determine the communication strength of the target user and each target contact according to the communication frequency and the communication time length;

[0074] S1013, taking the target user and the target contact as a node, storing the communication records of the target user and each target contact to the node of the corresponding target contact, and determining the weight of the edge between the target user and each target contact according to the communication strength, obtaining a social network relationship graph.

[0075] Specifically, the communication records of the target user are collected, including call and short message data, and social software communication data; a social network relationship graph is established based on the communication frequency, the communication time length and the communication content, wherein the node of the social network relationship graph represents the target user and the target contact, and the weight of the edge represents the communication strength of the target user and the target contact.

[0076] In some optional embodiments, the construction of the social network relationship graph further includes time series analysis on the communication frequency of the target user to identify abnormal high-frequency or low-frequency communication behavior patterns.

[0077] S102, determine an abnormal contact according to the social network relationship graph, and obtain target communication content of the abnormal contact and the target user.

[0078] As Figure 3 The step flow chart of step S102 provided by the embodiment of the application is shown, and the details are described with reference to Figure 3 Further, as an optional implementation, the abnormal contact is determined according to the social network relationship graph, and the target communication content of the abnormal contact and the target user is obtained, which specifically includes:

[0079] S1021, traverse the node of the social network relationship graph to obtain the communication records of the target user and each target contact, and further screen a plurality of new contacts from the target contacts according to the communication records;

[0080] S1022, determine the target communication strength of the target user and the new contact according to the weight of the edge between the target user and the new contact;

[0081] S1023, when the target communication strength is greater than or equal to a preset threshold, determine that the new contact is an abnormal contact;

[0082] S1024, obtain the target communication content of the abnormal contact and the target user according to the communication records.

[0083] Specifically, the communication frequency and communication duration of the new contact are monitored based on the weight of the edge of the social network relationship graph, if the new contact frequently communicates in a short period and the relationship rapidly warms up, the new contact is determined as an abnormal contact, and the target communication content between the abnormal contact and the target user is obtained according to the communication record stored in the corresponding node of the social network relationship graph.

[0084] S103, performing sentiment analysis and topic identification on the target communication content, and determining whether the abnormal contact is at risk according to the sentiment analysis result and the topic identification result.

[0085] As Figure 4 It is shown as a step flow chart of step S103 provided by the embodiment of the application, referring to Figure 4 , further as an optional implementation, performing sentiment analysis and topic identification on the target communication content, and determining whether the abnormal contact is at risk according to the sentiment analysis result and the topic identification result, which specifically includes:

[0086] S1031, preprocessing the target communication content to remove noise and irrelevant information, and obtaining first communication content;

[0087] S1032, identifying the first communication content through a preset sentiment analysis model to obtain the sentiment tendency of the abnormal contact;

[0088] S1033, identifying the first communication content through a preset topic identification model to obtain the topic type of the abnormal contact and the target user;

[0089] S1034, when the sentiment tendency is positive sentiment, and the topic type includes at least one of the trust establishment topic, the money transaction topic and the investment and financial planning topic, it is determined that the abnormal contact is at risk.

[0090] Specifically, the natural language processing technology is used to preprocess the communication content to remove noise and irrelevant information, the sentiment tendency in the communication content is identified through the sentiment analysis model, and the positive, negative and neutral sentiment is marked, the main topic in the communication content is identified using the topic modeling technology (such as Latent Dirichlet Allocation, LDA), and the topics involving trust establishment, money transaction and investment and financial planning are particularly focused on, and if the abnormal contact presents positive sentiment in the communication with the target user, and the communication content gradually involves the topics of trust establishment, money transaction or investment and financial planning, the abnormal contact is marked as at risk.

[0091] In some optional embodiments, the sentiment analysis model is trained using deep learning technology, which can automatically adapt to the sentiment tendency of different language expressions, and improve the accuracy of sentiment analysis.

[0092] In some optional embodiments, the topic modeling technique is combined with dynamic topic modeling, which can update the topic model in real time to reflect the dynamic changes of the communication content.

[0093] S104, when the abnormal contact person is at risk, determining whether the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes according to the social network relationship graph.

[0094] As Figure 5 shown is a step flow chart of step S104 provided by the embodiment of the application, with reference to Figure 5 , further as an optional implementation, determining whether the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes according to the social network relationship graph, which specifically includes:

[0095] S1041, traversing the nodes of the social network relationship graph to obtain the communication records of the target user and each target contact person, and then determining the target time when the target user establishes the communication contact with the abnormal contact person according to the communication records;

[0096] S1042, taking the communication records before the target time as the historical communication records, and determining the historical communication behavior mode of the target user according to the historical communication records;

[0097] S1043, taking the communication records after the target time as the current communication records, and determining the current communication behavior mode of the target user according to the current communication records;

[0098] S1044, judging whether the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes according to the historical communication behavior mode and the current communication behavior mode.

[0099] Specifically, the historical communication records of the target user are collected and analyzed to identify the normal communication behavior mode thereof; the change of the communication behavior mode before and after the appearance of the new contact person is compared to identify the gradual establishment process of the abnormal relationship; if it is found that the communication behavior mode of the target user changes significantly after the appearance of the new contact person and meets the standard of the high-risk marking, a fraud warning is generated.

[0100] As Figure 6 shown is a step flow chart of step S1042 provided by the embodiment of the application, with reference to Figure 6 , further as an optional implementation, determining the historical communication behavior mode of the target user according to the historical communication records, which specifically includes:

[0101] S10421, determining the communication behavior features and the time distribution features of the target user according to the historical communication records;

[0102] S10422. Input the communication behavior features and time distribution features into the pre-trained communication behavior pattern recognition model to obtain the historical communication behavior pattern.

[0103] Specifically, based on historical communication records, the communication behavior characteristics and time distribution characteristics of target users are determined. Call behavior characteristics include call behavior features and SMS behavior features. Call behavior features include the number of calls made, the number of calls received, the number of caller contacts, the number of callee contacts, the number of daytime caller contacts, the number of daytime callee contacts, the number of daytime calls made, the number of daytime calls received, the number of nighttime calls made, the number of nighttime calls received, the caller connection rate, the average call duration, the standard deviation of caller call duration, the caller connection rate, the average call duration, the standard deviation of callee call duration, and the number of base stations involved—all related to call behavior. SMS behavior characteristics include the number of SMS messages sent, the number of SMS messages received, the number of sender contacts, the number of receiver contacts, the number of daytime sender contacts, the number of daytime receiver contacts, the number of daytime senders, the number of daytime receivers, the number of nighttime senders, the number of nighttime receivers, the average length of sent SMS messages, the standard deviation of sent SMS message length, the proportion of blank SMS messages sent, the average length of received SMS messages, the standard deviation of received SMS message length, and the proportion of blank SMS messages received—all related to SMS behavior. Time distribution characteristics statistically analyze the distribution of communication behavior within a time window.

[0104] By inputting communication behavior features and temporal distribution features into a pre-trained communication behavior pattern recognition model, historical communication behavior patterns can be obtained. The communication behavior pattern recognition model is trained using a convolutional neural network, and its training process is a conventional training method in existing technologies, which will not be elaborated here.

[0105] S105. When the target user’s communication behavior pattern changes before and after establishing communication with an abnormal contact, the abnormal contact is determined to be a high-risk contact, and a telecom fraud warning message is generated.

[0106] Specifically, after identifying high-risk communication behavior, a warning message is promptly sent to the target user or their family members to alert them to the potential risk of telecommunications fraud.

[0107] like Figure 7 The diagram shown illustrates another step flowchart of the telecommunications fraud identification method based on social network behavior classification provided by an embodiment of the present invention. (Refer to...) Figure 7 As an optional implementation, the telecommunications fraud identification method further includes the following steps:

[0108] S106. Obtain corresponding telecommunications fraud prevention suggestions based on the user group to which the target user belongs, and send the telecommunications fraud prevention suggestions to the target user and / or the target user's family members.

[0109] Specifically, the early warning mechanism of the embodiment of the present application includes an artificial intelligence driven suggestion system, which can provide personalized prevention measure suggestions such as verifying the identity of new contacts and avoiding disclosure of personal sensitive information according to the identified high-risk behaviors and corresponding user groups.

[0110] As Figure 8 The overall flowchart of the method for identifying telecom fraud based on social network behavior classification provided by the embodiment of the present application is shown. Referring to Figure 8 , a specific implementation of the embodiment of the present application is as follows:

[0111] Suppose there is an elderly user Mr. Li, and his children (guardians) decide to use the method of the present application to monitor and analyze his communication behavior in order to prevent telecom fraud.

[0112] First, by collecting Mr. Li's communication data, including call records and message content, a social network relationship graph of Mr. Li is established. In this process, communication frequency, call duration and interaction content are used to determine the importance and relationship strength of each contact. Specifically, each contact is regarded as a node in the graph, and the frequency and duration of calls and messages are used as the weight of the edge, representing the relationship strength between Mr. Li and each contact.

[0113] Next, sentiment analysis and topic modeling are performed on Mr. Li's communication content. By using natural language processing technology, the communication content is first preprocessed to remove irrelevant information and noise. Then, a pre-trained deep learning sentiment analysis model is used to classify the sentiment of each message and call record, identifying the sentiment tendency (positive, negative or neutral). At the same time, the Latent Dirichlet Allocation (LDA) topic modeling technique is used to identify the main topics in the communication content, with particular attention to topics related to trust establishment and money transactions.

[0114] During routine monitoring, the system finds that Mr. Li frequently communicates with a new contact, and the communication frequency and content rapidly increase in a short period of time. Through analysis of the social network relationship graph, the node weight of the new contact rapidly rises, indicating that the relationship strength between the new contact and Mr. Li rapidly strengthens. Further sentiment analysis and topic modeling results show that these communication contents gradually involve the topic of trust establishment, and the new contact frequently mentions money-related topics.

[0115] In order to further confirm the risk, the system compares the communication behavior patterns before and after the appearance of Mr. Li's new contact. The results show that Mr. Li's communication behavior has changed significantly after the appearance of the new contact, especially in terms of sentiment and topic, showing an abnormal trust establishment process. Based on multi-dimensional analysis, the system marks the new contact as high-risk and generates a warning message.

[0116] Early warning information is sent to Mr. Li and his children in a timely manner, reminding them to pay attention to the potential fraud risk of the new contact. The system also provides personalized prevention measures, such as verifying the identity of the new contact and avoiding disclosure of personal sensitive information. After receiving the early warning information, Mr. Li and his children further verify the background of the new contact and ultimately discover that the new contact indeed has a suspicion of fraud, successfully avoiding potential property loss.

[0117] In this way, the method of the present application not only improves the identification accuracy of telecommunications fraud, but also provides early warning before the actual occurrence of fraudulent behavior, protecting the property safety and mental health of elderly users. Compared with existing keyword filtering, blacklist systems and abnormal behavior detection methods, the present application has made significant technical progress and innovation in identifying hidden fraudulent behavior and providing personalized prevention measures. The method of the present application is easy to implement and low in cost, and through multi-dimensional comprehensive analysis and early warning mechanism, it provides effective fraud prevention protection for the elderly and other vulnerable groups, and has wide application prospect and social significance.

[0118] It can be realized that, by constructing a social network relationship graph, combining sentiment analysis and topic identification, the embodiment of the present application can accurately identify abnormal contacts and judge whether the abnormal contacts have risks, by comparing the communication behavior patterns of the target user before and after establishing communication with the abnormal contacts, it can identify potential high-risk communication relationships before the fraudsters have implemented actual fraudulent behavior, so that effective telecommunications fraud identification and early warning can be carried out in the early stage of the fraudsters establishing trust relationships, compared with the existing keyword filtering and blacklist-based methods, the accuracy and timeliness of telecommunications fraud identification are improved.

[0119] Compared with the prior art, the embodiment of the present application also has the following advantages:

[0120] 1) Improve the identification accuracy: by constructing a social network relationship graph, combining sentiment analysis and topic modeling, the present application can accurately identify the communication patterns between elderly users and new contacts, especially the hidden trust establishment process. Compared with the existing keyword filtering and blacklist-based methods, the present application has higher accuracy when dealing with fraudulent behavior that is highly concealed and frequently changes contact methods.

[0121] 2) Early warning mechanism: the present application compares the long-term patterns of the communication behavior of elderly users, and can identify potential high-risk communication relationships before the fraudsters have implemented actual fraudulent behavior, and timely sends early warning information to the elderly users or their family members, effectively preventing the occurrence of fraudulent behavior. Compared with the prior art, the present application can provide early warning earlier, reducing the economic loss and psychological harm of elderly users.

[0122] 3) Multi-dimensional analysis: The application comprehensively utilizes social network analysis, sentiment analysis and topic modeling technology to analyze and identify communication behavior from multiple dimensions, avoiding the limitations of a single method. Through multi-dimensional comprehensive analysis, the application can more comprehensively cover various types of telecom fraud behaviors, improving the overall recognition effect.

[0123] 4) Strong adaptability: The application is not only suitable for the elderly population, but can also be extended to other vulnerable groups such as teenagers or technology blind groups. The universality and flexibility of its method make it more widely applicable in practical applications.

[0124] 5) Personalized prevention measures: After identifying high-risk communication behavior, the application's warning mechanism can provide personalized prevention measures such as verifying the identity of new contacts, avoiding disclosure of personal sensitive information, etc. This personalized suggestion is more targeted and practical than the simple warning of existing technology.

[0125] 6) Simple and effective technology implementation: The method of the application mainly relies on existing communication data and natural language processing technology, which is easy to implement and low in cost. Its technical solution is clear, and ordinary technical personnel can easily implement it according to the specific implementation mode, with strong practical value.

[0126] As Figure 9 shown is a structure schematic diagram of a telecom fraud identification device based on social network behavior classification provided by the embodiment of the application, referring to Figure 9 , the embodiment of the application provides a telecom fraud identification device based on social network behavior classification, which comprises:

[0127] A social network relationship graph construction module is configured to construct a social network relationship graph of a target user.

[0128] An abnormal contact determination module is configured to determine an abnormal contact according to the social network relationship graph, and obtain target communication content between the abnormal contact and the target user.

[0129] A communication content analysis and identification module is configured to perform sentiment analysis and topic identification on the target communication content, and determine whether the abnormal contact is at risk according to the sentiment analysis result and the topic identification result.

[0130] A communication behavior pattern identification module is configured to determine whether the communication behavior pattern of the target user before and after establishing communication contact with the abnormal contact changes when the abnormal contact is at risk according to the social network relationship graph.

[0131] A warning module is configured to determine that the abnormal contact is a high-risk contact when the communication behavior pattern of the target user before and after establishing communication contact with the abnormal contact changes, and generate a telecom fraud warning information.

[0132] The contents in the method embodiments are applicable to the device embodiments, the device embodiments specifically implement the functions same as the method embodiments, and achieve the same beneficial effects as the method embodiments.

[0133] The embodiment of the present application also provides an electronic device, which comprises a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program realizes the above-mentioned method for identifying telecom fraud based on social network behavior classification when executed by the processor. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer and the like.

[0134] As Figure 10 Fig. 1 shows a hardware structure schematic diagram of an electronic device provided by the embodiment of the present application, referring to Figure 10 The embodiment of the present application provides an electronic device, which comprises:

[0135] The processor 1001 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is used to execute related programs to realize the technical solutions provided by the embodiment of the present application.

[0136] The memory 1002 can be implemented in the form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory). The memory 1002 can store an operating system and other application programs, and when the technical solutions provided by the embodiment of the present application are implemented by software or firmware, the related program codes are saved in the memory 1002 and executed by the processor 1001 to realize the method for identifying telecom fraud based on social network behavior classification.

[0137] The input / output interface 1003 is used to realize information input and output.

[0138] The communication interface 1004 is used to realize the communication interaction between the device and other devices, and can realize communication through a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0139] A bus 1005 is used to transmit information between the various components of the device (e.g., the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004).

[0140] The processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 are communicatively connected to each other within the device through the bus 1005.

[0141] As shown in Figure 11 FIG. 1 is a structural schematic diagram of a storage medium provided by an embodiment of the present application. Referring to Figure 11 The embodiment of the present application further provides a storage medium, which is a computer readable storage medium, used for computer readable storage, and stores one or more programs 1101, which can be executed by one or more processors to implement the above-mentioned method for identifying telecom fraud based on social network behavior classification.

[0142] The memory is a non-transitory computer readable storage medium, which can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0143] The embodiment of the present application further discloses a computer program product or a computer program, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to make the computer device execute Figure 1 the method shown in FIG. 1.

[0144] In some alternative embodiments, the functions / operations mentioned in the block diagram can not occur in the order mentioned in the operation diagram. For example, depending on the functions / operations involved, two blocks shown in succession can actually be executed substantially simultaneously or the above-mentioned blocks can be executed in reverse order at times. In addition, the embodiments presented and described in the flowcharts of the present application are provided by way of example, and the purpose is to provide a more comprehensive understanding of the technology. The disclosed method is not limited to the operations and logical flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and in which sub-operations described as part of larger operations are independently executed.

[0145] Furthermore, although the present application is described in the context of functional modules, it is to be understood that one or more of the functions and / or features described above can be integrated in a single physical device and / or software module, or one or more functions and / or features can be implemented in separate physical devices or software modules, unless expressly stated otherwise. It is also to be understood that detailed discussion of the actual implementation of each module is unnecessary to an understanding of the present application. Rather, the properties, functions and internal relationships of the various functional modules disclosed in the devices herein are considered to be well within the reach of persons of ordinary skill in the art having the benefit of this disclosure. Therefore, the present application as set forth in the claims is not to be limited to the specific embodiments disclosed herein, but rather can be practiced with any device or software module that implements the concepts disclosed herein, using ordinary skill in the art, and without the need for undue experimentation. It is also to be understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present application, which is defined by the appended claims and their equivalents.

[0146] If the above functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described above in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0147] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logic functions, which can be specifically embodied in any computer readable medium for use by or in conjunction with an instruction execution system, device or apparatus, such as a computer-based system, a system including a processor or other system that can fetch and execute instructions from an instruction execution system, device or apparatus. For the purpose of this specification, "computer readable medium" can be any device that can contain, store, communicate, propagate or transport programs for use by or in conjunction with an instruction execution system, device or apparatus, or in conjunction with these instruction execution systems, devices or apparatus.

[0148] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can also be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

[0149] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the above embodiments, various steps or methods can be implemented in software or firmware which are stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or their combinations can be used: discrete logic circuitry having logic gates for implementing logic functions upon an application of data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0150] In the above description of the present specification, the description referring to the terms "one embodiment", "another embodiment", or "certain embodiments" or the like means that a specific feature, structure, material or characteristic described in connection with the embodiments or examples is included in at least one embodiment or example of the present application. The illustrative expressions of the above terms do not necessarily refer to the same embodiment or example in the present specification. Also, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0151] Although the embodiments of the present application have been shown and described, it will be appreciated by those skilled in the art that changes, modifications, alternatives and variations to these embodiments can be made without departing from the principles and spirit of the application, the scope of which is defined by the claims and their equivalents.

[0152] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the above-described embodiments, and those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present application, and these equivalent modifications or substitutions are included in the scope defined by the claims of the present application.

Claims

1. A method for identifying a telecom fraud based on social network behavior classification, characterized in that, The method comprises the following steps: constructing a social network relationship graph of a target user; determining an abnormal contact person according to the social network relationship graph, and obtaining target communication content between the abnormal contact person and the target user; performing sentiment analysis and topic identification on the target communication content, and determining whether the abnormal contact person is at risk according to the results of sentiment analysis and topic identification; when the abnormal contact person is at risk, determining whether the communication behavior mode of the target user before and after establishing communication contact with the abnormal contact person changes according to the social network relationship graph; when the communication behavior mode of the target user before and after establishing communication contact with the abnormal contact person changes, determining that the abnormal contact person is a high-risk contact person, and generating a telecom fraud warning information. 2.The method of claim 1, wherein, The method of constructing a social network relationship graph of a target user specifically comprises: obtaining communication records of the target user, the communication records comprising at least one of call data, short message data and social software communication data; determining a plurality of target contact persons according to the communication records, and determining the communication frequency and communication duration of the target user and each target contact person, and further determining the communication intensity of the target user and each target contact person according to the communication frequency and the communication duration; storing the communication records of the target user and each target contact person to the node of the corresponding target contact person, and determining the weight of the edge between the target user and each target contact person according to the communication intensity, to obtain the social network relationship graph. 3.The method of claim 2, wherein, The method of determining an abnormal contact person according to the social network relationship graph, and obtaining target communication content between the abnormal contact person and the target user specifically comprises: traversing the nodes of the social network relationship graph to obtain the communication records of the target user and each target contact person, and further screening a plurality of new contact persons from the target contact persons according to the communication records; determining the target communication intensity of the target user and the new contact person according to the weight of the edge between the target user and the new contact person; when the target communication intensity is greater than or equal to a preset threshold, determining that the new contact person is an abnormal contact person; obtaining the target communication content between the abnormal contact person and the target user according to the communication records. 4.The method of claim 1, wherein, The method of performing sentiment analysis and topic identification on the target communication content, and determining whether the abnormal contact person is at risk according to the results of sentiment analysis and topic identification specifically comprises: preprocessing the target communication content to remove noise and irrelevant information, to obtain first communication content; identifying the first communication content through a preset sentiment analysis model to obtain the sentiment tendency of the abnormal contact person; identifying the first communication content through a preset topic identification model to obtain the topic type of the abnormal contact person and the target user; when the sentiment tendency is positive sentiment, and the topic type comprises at least one of trust establishment topic, money transaction topic and investment and financial planning topic, determining that the abnormal contact person is at risk. 5.The method of claim 2, wherein the method further comprises: The determining whether the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes according to the social network relationship graph specifically comprises: Traversing nodes of the social network relationship graph to obtain the communication record of the target user and each target contact person, and then determining a target time when the target user establishes the communication contact with the abnormal contact person according to the communication record; Taking the communication record before the target time as historical communication record, and determining the historical communication behavior mode of the target user according to the historical communication record; Taking the communication record after the target time as current communication record, and determining the current communication behavior mode of the target user according to the current communication record; Determining whether the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes according to the historical communication behavior mode and the current communication behavior mode. 6.The method of claim 5, wherein the method further comprises: The determining the historical communication behavior mode of the target user according to the historical communication record specifically comprises: Determining the communication behavior feature and the time distribution feature of the target user according to the historical communication record; Inputting the communication behavior feature and the time distribution feature into a pre-trained communication behavior mode recognition model to obtain the historical communication behavior mode.

7. The method of claim 1 to 6, wherein the method is characterized in that, The telecom fraud identification method further comprises the following steps: Obtaining a corresponding telecom fraud prevention suggestion according to a user group to which the target user belongs, and sending the telecom fraud prevention suggestion to the target user and / or family members of the target user. 8.A device for identifying a telecom fraud based on social network behavior classification, characterized in that, Comprise: A social network relationship graph construction module for constructing a social network relationship graph of a target user; An abnormal contact person determination module for determining an abnormal contact person according to the social network relationship graph, and obtaining target communication content of the abnormal contact person and the target user; A communication content analysis and recognition module for performing sentiment analysis and topic recognition on the target communication content, and determining whether the abnormal contact person is at risk according to the sentiment analysis result and the topic recognition result; A communication behavior mode recognition module for determining whether the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes according to the social network relationship graph when the abnormal contact person is at risk; An early warning module for determining that the abnormal contact person is a high-risk contact person when the communication behavior mode of the target user before and after establishing the communication contact with the abnormal contact person changes, and generating a telecom fraud early warning information.

9. An electronic device, comprising: The electronic device comprises a memory, a processor, a program stored on the memory and executable on the processor, and a data bus for realizing connection communication between the processor and the memory, and the program is executed by the processor to realize the steps of the telecom fraud identification method based on social network behavior classification according to any one of claims 1 to 7.

10. A storage medium, the storage medium being a computer-readable storage medium for computer-readable storage, characterized in that, The storage medium stores one or more programs, and the one or more programs are executable by one or more processors to implement steps of the social network behavior classification-based telecom fraud identification method according to any one of claims 1 to 7.

Images