Fraud person identification method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a fraud person identification method and device, equipment and a storage medium. The method comprises the following steps: acquiring call information of a to-be-identified number; obtaining a user relation network corresponding to the to-be-identified number according to the call information of the to-be-identified number; according to a user relationship network corresponding to the to-be-identified number, determining call feature association vectors of a user corresponding to the to-be-identified number and a plurality of users; inputting the call feature association vector into a recognition model to obtain a recognition result; judging whether a user corresponding to the to-be-identified number is a fraud person or not according to the identification result; by constructing the user relation network and extracting the call feature association vector, the recognition model can capture more fine features related to fraud behaviors, so that the recognition accuracy is improved. The fraud recognition method has the beneficial effects that false alarm and missing alarm can be reduced, and the fraud recognition reliability is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a fraudster identification method, device, equipment and storage medium. Background Art

[0002] As the country continues to deepen its technical prevention work on telecommunications fraud, traditional telephone fraud has been curbed to a certain extent. In the existing technology, user portraits are generally used to detect whether a user is a fraudster, but the user portrait is not clear and it is impossible to accurately detect whether the user is a fraudster or a number dealer. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a fraudster identification method, apparatus, device and storage medium that overcome the above problems or at least partially solve the above problems.

[0004] In order to solve the above problems, an embodiment of the present invention discloses a method for identifying fraudsters, comprising:

[0005] Get the call information of the number to be identified;

[0006] Obtaining a user relationship network corresponding to the number to be identified according to the call information of the number to be identified;

[0007] Determining a call feature association vector between a user corresponding to the number to be identified and a plurality of users according to a user relationship network corresponding to the number to be identified;

[0008] Inputting the call feature association vector into a recognition model to obtain a recognition result;

[0009] It is determined whether the user corresponding to the number to be identified is a fraudster based on the identification result.

[0010] Optionally, the recognition model includes a graph convolution layer, a topology reconstruction layer, a graph contrast learning layer, and a fully connected layer;

[0011] The step of inputting the call feature association vector into a recognition model to obtain a recognition result includes:

[0012] Inputting the call feature association vector into the graph convolution layer to obtain a convolved feature graph vector;

[0013] Inputting the convolved feature graph vector into a topology reconstruction layer to obtain a reconstructed feature vector;

[0014] Inputting the reconstructed feature vector into the graph contrast learning layer to obtain the corrected node representation information;

[0015] The modified node representation information is input into the fully connected layer to obtain the recognition result.

[0016] Optionally, inputting the call feature association vector into the graph convolution layer to obtain a convolved feature graph vector includes:

[0017] Get the attenuation factor;

[0018] Determining a convolved user node feature vector according to the call feature association vector and the attenuation factor;

[0019] Calculating representation vectors of multiple convolutional layers according to the convolved user node feature vectors and weight coefficients;

[0020] According to the representation vectors of the multiple convolutional layers, the convolved feature map vector is determined.

[0021] Optionally, inputting the convolved feature graph vector into a topological reconstruction layer to obtain a reconstructed feature vector includes:

[0022] According to the convolved feature graph vector, the node is assigned to the community where the corresponding neighbor node is located, and the modularity change of the node is calculated;

[0023] Determine whether the modularity change is greater than a preset value, and if so, assign the node to a community where a neighboring node of the modularity change is located;

[0024] Traversing the entire user relationship graph of the user relationship network, and replacing the edges of each node pair in the feature graph with the edges of the node pairs that are close to it in the feature space;

[0025] Determine whether the node community status of the node of the node pair is the same as that of the original node pair; if the node community status of the node of the node pair is different from that of the original node pair, change the original edge and reconstruct the user relationship graph;

[0026] According to the reconstructed user relationship graph, a reconstructed feature vector is obtained.

[0027] Optionally, determining the modularity change of the node includes:

[0028] Obtain the number of edges and weight coefficients between nodes in the user relationship network;

[0029] The modularity change of the node is determined according to the number of edges of the user relationship network and the weight coefficients between the nodes.

[0030] Optionally, inputting the reconstructed feature vector into a graph contrast learning layer to obtain corrected node representation information includes:

[0031] Performing matrix concatenation calculation on the reconstructed feature vector to obtain an attention weight coefficient;

[0032] Determining contrast representation vectors of multiple convolutional layers according to the attention weight coefficients;

[0033] The corrected node representation information is obtained according to the comparison representation vectors of the multiple convolutional layers and the number of convolutional layers.

[0034] Optionally, the recognition result includes a target classification value, and the inputting the modified node representation information into the fully connected layer to obtain the recognition result includes:

[0035] Obtaining a probability value corresponding to each category according to the corrected node representation information;

[0036] The probability value corresponding to each category is normalized to obtain the target classification value.

[0037] The present invention also discloses a fraudster identification device, comprising:

[0038] An acquisition module, used to acquire call information of a number to be identified;

[0039] A network creation module, used to obtain a user relationship network corresponding to the number to be identified according to the call information of the number to be identified;

[0040] A determination module, configured to determine a call feature association vector between a user corresponding to the number to be identified and a plurality of users according to a user relationship network corresponding to the number to be identified;

[0041] An input module, used for inputting the call feature association vector into a recognition model to obtain a recognition result;

[0042] The judgment module is used to judge whether the user corresponding to the number to be identified is a fraudster according to the identification result.

[0043] Optionally, the recognition model includes a graph convolution layer, a topology reconstruction layer, a graph contrast learning layer, and a fully connected layer;

[0044] The input module comprises:

[0045] A first input submodule, used for inputting the call feature association vector into the graph convolution layer to obtain a convolved feature graph vector;

[0046] A second input submodule is used to input the convolved feature graph vector into a topological reconstruction layer to obtain a reconstructed feature vector;

[0047] A third input submodule is used to input the reconstructed feature vector into the graph contrast learning layer to obtain the corrected node representation information;

[0048] The fourth input submodule is used to input the corrected node representation information into the fully connected layer to obtain the recognition result.

[0049] Optionally, the first input submodule includes:

[0050] A first acquisition unit, used to acquire an attenuation factor;

[0051] A first determining unit, configured to determine a convolved user node feature vector according to the call feature association vector and the attenuation factor;

[0052] A first calculation unit, used to calculate the representation vectors of multiple convolutional layers according to the convolved user node feature vector and weight coefficient;

[0053] The second determining unit is used to determine the convolved feature map vector according to the representation vectors of the multiple convolutional layers.

[0054] Optionally, the second input submodule includes:

[0055] An allocation unit is used to allocate nodes to the communities where the corresponding neighboring nodes are located according to the convolved feature graph vector, and calculate the modularity change of the nodes;

[0056] A judging unit, configured to judge whether the modularity change is greater than a preset value, and if the modularity change is greater than the preset value, assigning the node to a community where a neighboring node of the modularity change is located;

[0057] A traversal unit, used to traverse the entire user relationship graph of the user relationship network, and replace the edges of each node pair in the feature graph with the edges of the node pairs that are close to it in the feature space;

[0058] A reconstruction unit, used to determine whether the node community status of the node of the node pair is the same as that of the original node pair, and if the node community status of the node of the node pair is different from that of the original node pair, change the original edge and reconstruct the user relationship graph;

[0059] The third determining unit is used to obtain a reconstructed feature vector according to the reconstructed user relationship graph.

[0060] Optionally, the allocation unit comprises:

[0061] An acquisition subunit, used to acquire the number of edges and weight coefficients between nodes of the user relationship network;

[0062] The determination subunit is used to determine the modularity change of the node according to the number of edges in the user relationship network and the weight coefficients between the nodes.

[0063] Optionally, the third input submodule includes:

[0064] A second calculation unit is used to perform matrix splicing calculation on the reconstructed feature vector to obtain an attention weight coefficient;

[0065] A fourth determining unit, configured to determine a comparison representation vector of a plurality of convolutional layers according to the attention weight coefficient;

[0066] The fifth determining unit is used to obtain the corrected node representation information according to the comparison representation vectors of the multiple convolutional layers and the number of convolutional layers.

[0067] Optionally, the fourth input submodule includes:

[0068] A sixth determining unit, configured to obtain a probability value corresponding to each category according to the corrected node representation information;

[0069] The normalization unit is used to normalize the probability value corresponding to each category to obtain the target classification value.

[0070] The present invention also discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the steps of the above-mentioned fraudster identification method when executed by the processor.

[0071] The present invention also discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the fraudster identification method as described above are implemented.

[0072] The embodiments of the present invention include the following advantages:

[0073] The present invention obtains the call information of the number to be identified; obtains the user relationship network corresponding to the number to be identified based on the call information of the number to be identified; determines the call feature association vector between the user corresponding to the number to be identified and multiple users based on the user relationship network corresponding to the number to be identified; inputs the call feature association vector into the recognition model to obtain the recognition result; determines whether the user corresponding to the number to be identified is a fraudster based on the recognition result; by constructing the user relationship network and extracting the call feature association vector, the recognition model can capture more subtle features related to fraudulent behavior, thereby improving the accuracy of recognition. Beneficial effects: The present invention can reduce false positives and false negatives, and improve the reliability of fraud recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 This is a flowchart of a fraud identification method provided by an embodiment of the present invention;

[0075] Figure 2 is a structural block diagram of a recognition model provided by an embodiment of the present invention;

[0076] Figure 3 is another flow chart of steps for training a recognition model provided by an embodiment of the present invention;

[0077] Figure 4 The present invention is a structural block diagram of a fraudster identification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0078] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and understandable, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0079] One of the core concepts of the embodiment of the present invention is to obtain the call information of the number to be identified; obtain the user relationship network corresponding to the number to be identified based on the call information of the number to be identified; determine the call feature association vector between the user corresponding to the number to be identified and multiple users based on the user relationship network corresponding to the number to be identified; input the call feature association vector into the recognition model to obtain the recognition result; determine whether the user corresponding to the number to be identified is a fraudster based on the recognition result; by constructing the user relationship network and extracting the call feature association vector, the recognition model can capture more subtle features related to fraudulent behavior, thereby improving the accuracy of recognition. Beneficial effects: The present invention can reduce false positives and false negatives, and improve the reliability of fraud recognition.

[0080] Reference Figure 1 , shows a flowchart of a fraud identification method provided by an embodiment of the present invention, the method may specifically include the following steps:

[0081] Step 101, obtaining call information of the number to be identified.

[0082] In the embodiment of the present invention, call information related to the number to be identified can be extracted from a call record database or other data sources. The call information may include call time, call duration, call frequency, call recipient, etc.

[0083] Step 102: Obtain a user relationship network corresponding to the number to be identified based on the call information of the number to be identified.

[0084] In the embodiment of the present invention, a user relationship network can be constructed based on the call information. The network can be represented as a graph structure, in which nodes represent users and edges represent the call relationships between users. The weight of the edge can represent the call frequency or call duration, etc.

[0085] In one example, the user relationship network can be represented by a directed graph G = (V, E, W, P), where V is a vertex set representing all calling and called user nodes; E is a directed edge set, and an edge eij of the directed edge set indicates that node vi has called the called node vj as a calling node; W is a set of attribute vectors of the edges eij in the directed edge set E, and the one-dimensional vector wij of W is the attribute vector of the edge eij, which represents the characteristics of the relationship between node vi and node vj, and reflects the closeness between node vi and node vj.

[0086] Step 103: determining a call feature association vector between the user corresponding to the number to be identified and a plurality of users according to the user relationship network corresponding to the number to be identified.

[0087] In an embodiment of the present invention, call features related to the number to be identified can be extracted from the user relationship network. These features may include call frequency, call duration, call time distribution, etc. with different users. These features are combined into a vector, called a call feature association vector.

[0088] Step 104, input the call feature association vector into the recognition model to obtain the recognition result.

[0089] In the embodiment of the present invention, Figure 2A flow chart showing the steps of a method for training a recognition model provided by an embodiment of the present invention may include: first creating a data set and dividing it into a training set, a validation set, and a test set; the data set may include call information of historical numbers, and then preprocessing the data, and then creating a user relationship network, and then determining the initial representation of the user node, defining evaluation indicators, activation functions, loss functions, and regularization processing; batch processing the data to obtain batch processed data; judging whether the batch processed data is empty, if it is empty, performing message transmission, and training parameters such as user feature vectors; reconstructing the user relationship network and retraining a new user feature vector, comparing the new user feature vector with the original user feature vector, saving and updating the model, and saving the model after training the best judgment model, inputting the number of the fraudster or number dealer, and the network model will output several numbers that are most closely related to the number, thereby excavating more potential criminals.

[0090] When training a model, make reasonable choices for some configurations other than model construction and model evaluation indicators. You can use the following methods to alleviate the fitting problem:

[0091] 1. Use Dropout to randomly discard neurons, thereby reducing the dependency between neurons to alleviate overfitting. The specific operation method is as follows:

[0092] (1) A Dropout layer is added between the fully connected layer and the softmax layer. During the training process, the outputs of some neurons are randomly set to 0, so that these neurons do not participate in back propagation and parameter updating.

[0093] (2) In the Dropout layer, a Dropout probability p is set, which indicates the probability that each neuron is set to 0.5 during training.

[0094] (3) During the forward propagation process, when the input data passes through the neural network, the Dropout layer will randomly set the output of some neurons to 0 according to the set Dropout probability p. Then, these neurons set to 0 will not participate in subsequent calculations until the next forward propagation.

[0095] (4) During the back-propagation process, the Dropout layer adjusts the gradient of the neuron according to the set Dropout probability p. For neurons that are set to 0, their gradients are also set to 0, so they do not participate in parameter updates. For neurons that are not set to 0, their gradients are multiplied by a factor of 1-p to compensate for the reduction in neuron output caused by Dropout.

[0096] (5) During the parameter update process, only the parameters of neurons that are not set to 0 will be updated. Specifically, the parameters of the neural network are updated using an optimization algorithm (such as stochastic gradient descent) based on the gradient calculated by backpropagation.

[0097] 2. Use L2 regularization technology to add penalty terms to limit the value range of model parameters to reduce the complexity of the model. The loss function calculation formula is as follows:

[0098]

[0099] In formula (1): y i Indicates the category of the i-th user node; Represents the model's predicted category for the i-th user node; λ represents the coefficient size of the L2 regularization penalty term; θ represents all trainable parameters of the model.

[0100] In one embodiment of the present invention, the recognition model includes a graph convolution layer, a topology reconstruction layer, a graph comparison learning layer, and a fully connected layer; the call feature association vector is input into the recognition model to obtain a recognition result, including: inputting the call feature association vector into the graph convolution layer to obtain a convolved feature graph vector; inputting the convolved feature graph vector into the topology reconstruction layer to obtain a reconstructed feature vector; inputting the reconstructed feature vector into the graph comparison learning layer to obtain a corrected node representation information; inputting the corrected node representation information into the fully connected layer to obtain a recognition result.

[0101] In an embodiment of the present invention, a graph convolutional layer is used to process graph structure data and extract local features in the graph through a convolution operation. The input call feature association vector is first converted into graph structure data and then convolution operation is performed through the graph convolutional layer to extract a feature graph vector.

[0102] The topology reconstruction layer is used to reconstruct the topology information of the graph structure, which may involve graph reconstruction or feature rearrangement. The convolved feature graph vector is input to the topology reconstruction layer, and the reconstructed feature vector is obtained through reconstruction operation.

[0103] The Graph Contrastive Learning Layer enhances the model’s understanding of the graph structure through contrastive learning. The reconstructed feature vector is input into the Graph Contrastive Learning Layer, and the modified node representation information is obtained through contrastive learning operations.

[0104] The fully connected layer is used to integrate the features extracted by the previous layers and output the final recognition result. The corrected node representation information is input into the fully connected layer, and the recognition result is obtained through the fully connected operation.

[0105] like Figure 3 A structural block diagram of a recognition model provided by an embodiment of the present invention is shown. After constructing the user relationship network, the call feature association vector can be input into the recognition model. The recognition model includes a graph convolution layer, a topology reconstruction layer, a graph contrast learning layer, and a fully connected softmax layer. The graph convolution layer can encode user features for the call feature association vector. The input call feature association vector is first converted into graph structure data, and then a convolution operation is performed through the graph convolution layer to extract a feature graph vector.

[0106] In one embodiment of the present invention, a call feature association vector is input into a graph convolution layer to obtain a feature graph vector after convolution, including: obtaining an attenuation factor; determining a user node feature vector after convolution based on the call feature association vector and the attenuation factor; calculating representation vectors of multiple convolution layers based on the user node feature vector after convolution and a weight coefficient; determining a feature graph vector after convolution based on the representation vectors of multiple convolution layers.

[0107] In the embodiment of the present invention, after obtaining the call feature vector, the call feature association vector can be input into the graph convolution layer to obtain the convolved feature graph vector, as shown in formulas (2)-(5):

[0108]

[0109] in, represents the user node feature vector of user node i after convolution, γ() represents the encoding function of input feature embedding, which is used to process and convert node features, is the call feature association vector; ρ i,j Represents the attenuation factor of information propagation, which appears in normalized form, i.e. N i ,N j represents the number of neighbors of the user, W is the weight matrix applied in the representation learning process; l represents the number of convolutional layers, H is the representation vector of each convolutional layer, and the node representation of each layer is averaged to obtain the final representation of the node. is the adjacency matrix after adding self-loops, is the corresponding diagonal matrix.

[0110] In one embodiment of the present invention, the convolved feature graph vector is input into a topological reconstruction layer to obtain a reconstructed feature vector, including: according to the convolved feature graph vector, the node is assigned to the community where the corresponding neighbor node is located, and the modularity change of the node is calculated; whether the modularity change is greater than a preset value, if the modularity change is greater than the preset value, the node is assigned to the community where the neighbor node of the modularity change is located; the entire user relationship graph of the user relationship network is traversed, and the edges of each node pair in the feature graph are replaced with the edges of the node pair that is close to it in the feature space; whether the node of the node pair is the same as the node community state of the original node pair, if the node of the node pair is different from the node community state of the original node pair, the original edge is changed, and the user relationship graph is reconstructed; according to the reconstructed user relationship graph, a reconstructed feature vector is obtained.

[0111] In the embodiment of the present invention, after the convolution feature graph vector is calculated, the convolution feature graph vector can be input into the topology reconstruction layer to obtain the reconstructed feature vector. Specifically, each node i in the feature graph can be regarded as an independent community, and the number of communities is the same as the number of nodes. For each node i, try to assign the node to the community where each of its neighboring nodes is located in turn, calculate the modularity change ΔQ before and after the allocation, and record the neighbor node with the largest ΔQ. If ΔQ>0, assign node i to the community where the neighbor node with the largest ΔQ is located, otherwise it remains unchanged. Repeat the process for each node i, and try to assign node i to each of its neighboring nodes in turn. The community where the node is located is calculated, the modularity change ΔQ before and after the allocation is calculated, and the neighbor node with the largest ΔQ is recorded. If ΔQ>0, node i is assigned to the community where the neighbor node with the largest ΔQ is located, otherwise it remains unchanged until the communities to which all nodes belong no longer change; then the feature graph is compressed, all nodes in the same community are compressed into a new node, the edge weights between nodes in the community are converted into the ring weights of the new node, and the edge weights between communities are converted into edge weights between new nodes; repeat the steps of treating each node in the graph as an independent community, with the number of communities being the same as the number of nodes, until the modularity of the entire graph no longer changes.

[0112] In one embodiment of the present invention, determining the change in modularity of a node includes: obtaining the number of edges in a user relationship network and weight coefficients between nodes; and determining the change in modularity of the node based on the number of edges in the user relationship network and the weight coefficients between nodes.

[0113] Specifically, it can be shown by formula (6)-formula (7):

[0114]

[0115] In formula (6)-formula (7), m is the number of edges in the user relationship network, k is i k j is the weight coefficient between nodes, δ() is used to determine whether two nodes are connected, k i,in represents the sum of the weights of the edges in the community where node i is located, ∑ tot k i Represents the sum of the weights of the edges connected to the community where node i is located.

[0116] Given a pair of user nodes (u i ,u j ) and the community affiliation of this pair of nodes C i,j , we need to find a pair of nodes (u a ,u b ) as counterfactual links to reconstruct the topological structure of the user relationship network. The counterfactual links are constructed according to the following formula: i ,u j ), its counterfactual link (u a ,u b )for

[0117]

[0118] Formula (8)-Formula (9): is the user node feature vector, h() measures the distance between node pairs in the context, using Euclidean distance as the metric, and d() is the distance between node pairs in the embedding space. The hyperparameter γ defines the maximum distance between two nodes that are considered similar. If no node pair meets the above conditions, then the given node pair will not be assigned any nearest neighbor node, so the reconstructed user community classification and the adjacency matrix The definition is as follows:

[0119]

[0120] In one embodiment of the present invention, the reconstructed feature vector is input into the graph contrast learning layer to obtain the revised node representation information, including: performing matrix splicing calculation on the reconstructed feature vector to obtain the attention weight coefficient; determining the contrast representation vectors of multiple convolutional layers according to the attention weight coefficient; and obtaining the revised node representation information according to the contrast representation vectors of multiple convolutional layers and the number of convolutional layers.

[0121] In the embodiment of the present invention, the graph contrast learning layer performs message transmission again on the reconstructed user relationship network, and uses the original user node representation as an anchor point to compare and correct the newly generated user node representation. Specifically, it can be expressed by formulas (10)-(13):

[0122]

[0123] In formula (10) - formula (13): h i ,h j Respectively represent the node v i and node v j The feature representation vector of || represents the matrix concatenation operation, a is the attention weight, l represents the number of convolutional layers, H is the representation of each convolutional layer, and the node representation of each level is averaged to obtain the final representation of the node. is the adjacency matrix after adding the self-loop, is the corresponding diagonal matrix, and W is the learnable weight matrix. By assigning different importance weights to each neighbor through the attention mechanism, the neighborhood information can be adaptively aggregated and the user node information can be captured more effectively.

[0124] In one embodiment of the present invention, the recognition result includes a target classification value, and the modified node representation information is input into the fully connected layer to obtain a recognition result, including: obtaining a probability value corresponding to each category based on the modified node representation information; normalizing the probability value corresponding to each category to obtain a target classification value.

[0125] In the embodiment of the present invention, during the training process of the Softmax fully connected layer, the input of the Softmax layer is usually an unnormalized vector, which represents the score or probability of each category. Then, the Softmax layer normalizes the vector so that each element falls within the interval [0, 1] and the sum of all elements is 1. Softmax is defined as follows:

[0126]

[0127] In formula (14): z i represents the output value of the i-th node; C represents the number of output nodes, that is, the number of classification categories;

[0128] The result will contain user features z i Send it to the fully connected layer and softmax layer to map d into the target classification p. The process is as follows:

[0129] p=softmax(W d ·z+b) Formula (15)

[0130] In formula (15), p represents the target classification, that is, the probability value of each category; W represents the weight matrix of softmax; and b represents the bias term of softmax.

[0131] In one embodiment of the present invention, in order to optimize the user node representation, the following loss function constraint model is adopted:

[0132]

[0133] In formula (16), i is the user in the sampling batch B, z u Is user u i In the user's original social graph G u The representation vector z′ is obtained by propagating through the graph neural network u is the user social graph G′ of the same user after reconstruction u The representation vector obtained by propagation in the middle, λ is a tuning parameter used to balance the influence of Euclidean distance and cosine similarity, and Yes u and z′ u The cosine vector value measures the consistency of the directions of the two vectors.

[0134] Step 105, judging whether the user corresponding to the number to be identified is a fraudster according to the identification result.

[0135] In an embodiment of the present invention, the identification result may include whether the user is a fraudster. If the identification result indicates that the user corresponding to the number to be identified is a fraudster, the number may be reported to prevent the number from committing fraud.

[0136] The present invention discloses a method for identifying fraudsters, which includes obtaining call information of a number to be identified; obtaining a user relationship network corresponding to the number to be identified based on the call information of the number to be identified; determining a call feature association vector between a user corresponding to the number to be identified and multiple users based on the user relationship network corresponding to the number to be identified; inputting the call feature association vector into a recognition model to obtain a recognition result; judging whether the user corresponding to the number to be identified is a fraudster based on the recognition result; and by constructing a user relationship network and extracting a call feature association vector, the recognition model can capture more subtle features related to fraudulent behavior, thereby improving the accuracy of recognition. Beneficial effects: The present invention can reduce false positives and false negatives, and improve the reliability of fraud recognition.

[0137] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0138] Reference Figure 3 , shows a structural block diagram of a fraud identification device provided by an embodiment of the present invention, which may include:

[0139] The acquisition module 201 is used to acquire the call information of the number to be identified;

[0140] A network creation module 202, configured to obtain a user relationship network corresponding to the number to be identified according to the call information of the number to be identified;

[0141] A determination module 203, configured to determine a call feature association vector between a user corresponding to the number to be identified and a plurality of users according to a user relationship network corresponding to the number to be identified;

[0142] An input module 204, used to input the call feature association vector into a recognition model to obtain a recognition result;

[0143] The judgment module 205 is used to judge whether the user corresponding to the number to be identified is a fraudster according to the identification result.

[0144] The present invention discloses a fraud identification device, which obtains call information of a number to be identified; obtains a user relationship network corresponding to the number to be identified based on the call information of the number to be identified; determines a call feature association vector between the user corresponding to the number to be identified and multiple users based on the user relationship network corresponding to the number to be identified; inputs the call feature association vector into a recognition model to obtain a recognition result; determines whether the user corresponding to the number to be identified is a fraud according to the recognition result; by constructing a user relationship network and extracting a call feature association vector, the recognition model can capture more subtle features related to fraudulent behavior, thereby improving the accuracy of recognition. Beneficial effects: The present invention can reduce false positives and false negatives, and improve the reliability of fraud identification.

[0145] In one embodiment of the present invention, the recognition model includes a graph convolution layer, a topology reconstruction layer, a graph contrast learning layer, and a fully connected layer;

[0146] Input modules, including:

[0147] A first input submodule, used to input the call feature association vector into the graph convolution layer to obtain a convolved feature graph vector;

[0148] The second input submodule is used to input the convolved feature map vector into the topology reconstruction layer to obtain a reconstructed feature vector;

[0149] The third input submodule is used to input the reconstructed feature vector into the graph contrast learning layer to obtain the corrected node representation information;

[0150] The fourth input submodule is used to input the corrected node representation information into the fully connected layer to obtain the recognition result.

[0151] In one embodiment of the present invention, the first input submodule includes:

[0152] A first acquisition unit, used to acquire an attenuation factor;

[0153] A first determining unit, configured to determine a convolved user node feature vector according to the call feature association vector and the attenuation factor;

[0154] A first calculation unit, used to calculate the representation vectors of multiple convolutional layers according to the convolved user node feature vectors and weight coefficients;

[0155] The second determining unit is used to determine the convolved feature map vector according to the representation vectors of multiple convolutional layers.

[0156] In one embodiment of the present invention, the second input submodule includes:

[0157] An allocation unit is used to allocate nodes to the communities where the corresponding neighboring nodes are located according to the convolved feature graph vector, and calculate the modularity change of the nodes;

[0158] A judging unit, used to judge whether the modularity change is greater than a preset value, and if the modularity change is greater than the preset value, assign the node to a community where a neighboring node of the modularity change is located;

[0159] A traversal unit, used to traverse the entire user relationship graph of the user relationship network, and replace the edges of each node pair in the feature graph with the edges of the node pairs that are close to it in the feature space;

[0160] A reconstruction unit, used to determine whether the node community status of the node of the node pair is the same as that of the original node pair, and if the node community status of the node of the node pair is different from that of the original node pair, change the original edge and reconstruct the user relationship graph;

[0161] The third determining unit is used to obtain a reconstructed feature vector according to the reconstructed user relationship graph.

[0162] In one embodiment of the present invention, the allocation unit includes:

[0163] The acquisition subunit is used to obtain the number of edges and weight coefficients between nodes in the user relationship network;

[0164] The determination subunit is used to determine the modularity change of the node according to the number of edges in the user relationship network and the weight coefficients between the nodes.

[0165] In one embodiment of the present invention, the third input submodule includes:

[0166] The second calculation unit is used to perform matrix concatenation calculation on the reconstructed feature vector to obtain the attention weight coefficient;

[0167] A fourth determining unit, configured to determine a comparison representation vector of a plurality of convolutional layers according to the attention weight coefficient;

[0168] The fifth determining unit is used to obtain the corrected node representation information according to the comparison representation vectors of the multiple convolutional layers and the number of convolutional layers.

[0169] In one embodiment of the present invention, the fourth input submodule includes:

[0170] A sixth determining unit, configured to obtain a probability value corresponding to each category according to the corrected node representation information;

[0171] The normalization unit is used to normalize the probability value corresponding to each category to obtain the target classification value.

[0172] The present invention discloses a fraud identification device, which obtains call information of a number to be identified; obtains a user relationship network corresponding to the number to be identified based on the call information of the number to be identified; determines a call feature association vector between the user corresponding to the number to be identified and multiple users based on the user relationship network corresponding to the number to be identified; inputs the call feature association vector into a recognition model to obtain a recognition result; determines whether the user corresponding to the number to be identified is a fraud according to the recognition result; by constructing a user relationship network and extracting a call feature association vector, the recognition model can capture more subtle features related to fraudulent behavior, thereby improving the accuracy of recognition. Beneficial effects: The present invention can reduce false positives and false negatives, and improve the reliability of fraud identification.

[0173] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0174] An embodiment of the present invention further provides an electronic device, including:

[0175] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned fraudster identification method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0176] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned fraudster identification method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0177] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0178] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0179] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0180] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0181] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0182] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0183] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0184] The above is a detailed introduction to a fraud identification method, device, equipment and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a person skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for identifying fraudsters, characterized in that: include: Get the call information of the number to be identified; Obtaining a user relationship network corresponding to the number to be identified according to the call information of the number to be identified; Determining a call feature association vector between a user corresponding to the number to be identified and a plurality of users according to a user relationship network corresponding to the number to be identified; Inputting the call feature association vector into a recognition model to obtain a recognition result; It is determined whether the user corresponding to the number to be identified is a fraudster based on the identification result.

2. The method according to claim 1, characterized in that The recognition model includes a graph convolution layer, a topology reconstruction layer, a graph contrast learning layer, and a fully connected layer; The step of inputting the call feature association vector into a recognition model to obtain a recognition result includes: Inputting the call feature association vector into the graph convolution layer to obtain a convolved feature graph vector; Inputting the convolved feature graph vector into a topology reconstruction layer to obtain a reconstructed feature vector; Inputting the reconstructed feature vector into the graph contrast learning layer to obtain the corrected node representation information; The modified node representation information is input into the fully connected layer to obtain the recognition result.

3. The method according to claim 2, characterized in that The step of inputting the call feature association vector into the graph convolution layer to obtain a convolved feature graph vector includes: Get the attenuation factor; Determining a convolved user node feature vector according to the call feature association vector and the attenuation factor; Calculating representation vectors of multiple convolutional layers according to the convolved user node feature vectors and weight coefficients; According to the representation vectors of the multiple convolutional layers, the convolved feature map vector is determined.

4. The method according to claim 2, characterized in that: The step of inputting the convolved feature graph vector into a topological reconstruction layer to obtain a reconstructed feature vector comprises: According to the convolved feature graph vector, the node is assigned to the community where the corresponding neighbor node is located, and the modularity change of the node is calculated; Determine whether the modularity change is greater than a preset value, and if so, assign the node to a community where a neighboring node of the modularity change is located; Traversing the entire user relationship graph of the user relationship network, and replacing the edges of each node pair in the feature graph with the edges of the node pairs that are close to it in the feature space; Determine whether the node community status of the node of the node pair is the same as that of the original node pair; if the node community status of the node of the node pair is different from that of the original node pair, change the original edge and reconstruct the user relationship graph; According to the reconstructed user relationship graph, a reconstructed feature vector is obtained.

5. The method according to claim 2, characterized in that: The determining of the modularity change of the node includes: Obtain the number of edges and weight coefficients between nodes in the user relationship network; The modularity change of the node is determined according to the number of edges of the user relationship network and the weight coefficients between the nodes.

6. The method according to claim 2, characterized in that The step of inputting the reconstructed feature vector into a graph contrast learning layer to obtain corrected node representation information includes: Performing matrix concatenation calculation on the reconstructed feature vector to obtain an attention weight coefficient; Determining contrast representation vectors of multiple convolutional layers according to the attention weight coefficients; The corrected node representation information is obtained according to the comparison representation vectors of the multiple convolutional layers and the number of convolutional layers.

7. The method according to claim 2, characterized in that The recognition result includes a target classification value, and the corrected node representation information is input into the fully connected layer to obtain the recognition result, including: Obtaining a probability value corresponding to each category according to the corrected node representation information; The probability value corresponding to each category is normalized to obtain the target classification value.

8. A fraudster identification device, characterized in that: include: An acquisition module, used to acquire call information of a number to be identified; A network creation module, used to obtain a user relationship network corresponding to the number to be identified according to the call information of the number to be identified; A determination module, configured to determine a call feature association vector between a user corresponding to the number to be identified and a plurality of users according to a user relationship network corresponding to the number to be identified; An input module, used for inputting the call feature association vector into a recognition model to obtain a recognition result; The judgment module is used to judge whether the user corresponding to the number to be identified is a fraudster according to the identification result.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the fraudster identification method as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the fraudster identification method according to any one of claims 1 to 7 are implemented.

Images