Method and device for determining illegal video communication user and electronic equipment

Abstract

The invention provides an illegal video communication user determination method and device and electronic equipment, and relates to the technical field of communication, and the method comprises the steps: obtaining a user data set, communication confirmation flow and video communication flow; obtaining first ticket data corresponding to the user data set, second ticket data corresponding to the communication confirmation flow and third ticket data corresponding to the video communication flow; determining a target user set based on a ticket analysis result of the first ticket data and a ticket analysis result of the second ticket data, and determining model parameters of each calling user based on a ticket analysis result of the third ticket data; and determining an illegal video communication user set based on the model parameters of each calling user. According to the method and the device, the illegal video communication user is automatically determined, and the call ticket analysis results of the call ticket data corresponding to the user data set, the communication confirmation flow and the video communication flow of the video communication are adopted to determine, so that the accuracy of determining the illegal video communication user can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device and electronic device for determining an illegal video communication user. Background Art

[0002] Criminals impersonate customer service personnel of e-commerce platforms, financial platforms, etc. to make video calls through video communication software, inducing victims to provide key information such as accounts and verification codes. Therefore, it is necessary to monitor the legitimacy of video communication users.

[0003] In the related art, illegal users are usually monitored by voice calls or text message communication content, but since video communication is different from voice calls or text message communication, the monitoring method for voice calls or text message communication content cannot be applied to video communication monitoring. Therefore, it is urgent to propose a monitoring method for illegal video communication users. Summary of the invention

[0004] In view of the problems existing in the prior art, the present application provides a method, device and electronic device for determining illegal video communication users.

[0005] In a first aspect, an embodiment of the present application provides a method for determining an illegal video communication user, comprising: Acquire target data, the target data including user data sets, communication confirmation traffic and video communication traffic for video communication based on video communication software, the communication confirmation traffic being traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic being traffic generated by the calling user domain and the called user during the video communication process; Acquire first call record data corresponding to the user data set, second call record data corresponding to the communication confirmation flow, and third call record data corresponding to the video communication flow; Inputting the first call record data, the second call record data and the third call record data into a call record analysis model, and obtaining a call record analysis result of the first call record data, a call record analysis result of the second call record data and a call record analysis result of the third call record data output by the call record analysis model; Based on the call sheet analysis results of the first call sheet data and the call sheet analysis results of the second call sheet data, a target user set is determined, and based on the call sheet analysis results of the third call sheet data, a model parameter of each calling user in the target user set is determined, the model parameter including at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls made by the calling user to the called user, and the discreteness of the calls made by the calling user to the called user; The set of illegal video communication users is determined based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user.

[0006] In one embodiment, the target user set includes a first user set, the first user set includes users in a domestic user set who communicate with the Stun server and start a video connection, the domestic user set includes users corresponding to a domestic IP address that communicates with the signaling server; the method further includes: For each first user in the first user set, when the first user initiates a Stun application request, the first user is determined to be a calling user, or, when it is detected in the communication confirmation traffic that the first user is a user who receives a connectivity application sent by the Stun server, the opposite user of the first user is determined to be a calling user.

[0007] In one embodiment, the target user set further includes a second user set, the second user set includes a target user detected in the communication confirmation traffic, the target user is a user corresponding to an IP address of a peer of a user in the first user set; the method further includes: For each second user in the second user set, determining a first average message length sent by the second user to a peer user, and determining a second average message length sent by the peer user to the second user; The user corresponding to the maximum average message length between the first average message length and the second average message length is determined as the calling user.

[0008] In one embodiment, the determining of the illegal video communication user set based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of missed calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user comprises: For each calling user, the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls from the calling user to the called user, and the discreteness of the calls from the calling user to the called user are quantified to obtain a first quantization value corresponding to the call area, a second quantization value corresponding to the frequency, a third quantization value corresponding to the call duration, a fourth quantization value corresponding to the frequency of unanswered calls, and a fifth quantization value corresponding to the discreteness; Performing weighted summation on the first quantization value, the second quantization value, the third quantization value, the fourth quantization value, and the fifth quantization value to obtain a weighted quantization value; When the weighted quantization value is greater than a preset threshold, it is determined that the calling user is an illegal video communication user.

[0009] In one embodiment, the method further comprises: The reference threshold is obtained by weighted summing the quantized value corresponding to the highest risk call area, the quantized value corresponding to the preset maximum call frequency, the quantized value corresponding to the preset maximum call duration, the quantized value corresponding to the preset maximum missed call frequency, and the quantized value corresponding to the preset maximum discreteness; The preset threshold is determined based on the reference threshold.

[0010] In one embodiment, determining the model parameters of each calling user in the target user set based on the call record analysis result of the third call record data includes: Acquire a target message related to a video communication service, wherein the target message includes a signaling message and / or a data message; The model parameters of each calling user in the target user set are determined based on the call record analysis result of the third call record data and the target message.

[0011] In a second aspect, an embodiment of the present application provides a device for determining an illegal video communication user, including: A first acquisition unit is used to acquire target data, wherein the target data includes a user data set for video communication based on video communication software, communication confirmation traffic, and video communication traffic, wherein the communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic is the traffic generated by the calling user domain called user during the video communication process; A second acquisition unit, configured to acquire first call bill data corresponding to the user data set, second call bill data corresponding to the communication confirmation flow, and third call bill data corresponding to the video communication flow; An analysis unit, configured to input the first call record data, the second call record data, and the third call record data into a call record analysis model, and obtain a call record analysis result of the first call record data, a call record analysis result of the second call record data, and a call record analysis result of the third call record data output by the call record analysis model; A first determination unit is used to determine a target user set based on a call sheet analysis result of the first call sheet data and a call sheet analysis result of the second call sheet data, and determine a model parameter of each calling user in the target user set based on the call sheet analysis result of the third call sheet data, wherein the model parameter includes at least one of the following: a call area where the calling user is located, a frequency of calls initiated by the calling user, a call duration between the calling user and the called user, a frequency of missed calls made by the calling user to the called user, and a discreteness of calls made by the calling user to the called user; The second determination unit is used to determine the set of illegal video communication users based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of each calling user's calls to the called user.

[0012] In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for determining an illegal video communication user as described in any one of the above is implemented.

[0013] In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described methods for determining an illegal video communication user.

[0014] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned methods for determining an illegal video communication user.

[0015] The method, device and electronic device for determining illegal video communication users provided in the present application obtain target data, the target data includes a user data set, communication confirmation traffic and video communication traffic for video communication based on video communication software; and obtain first call bill data corresponding to the user data set, second call bill data corresponding to the communication confirmation traffic and third call bill data corresponding to the video communication traffic, determine the target user set based on the call bill analysis results of the first call bill data and the call bill analysis results of the second call bill data, and determine the model parameters of each calling user in the target user set based on the call bill analysis results of the third call bill data, and determine the set of illegal video communication users based on the model parameters of each calling user, thereby realizing automatic determination of illegal video communication users, and when determining illegal video communication users, the call bill analysis results of the user data set, communication confirmation traffic and video communication traffic corresponding to each of the user data sets for video communication based on the video communication software are used to determine the illegal video communication users, which can improve the accuracy of determining illegal video communication users. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 This is one of the flow charts of the method for determining illegal video communication users provided in an embodiment of the present application.

[0018] Figure 2 It is a schematic diagram of the video communication process provided by an embodiment of the present application.

[0019] Figure 3 It is a business logic analysis flow chart of the model analysis module provided in the embodiment of the present application.

[0020] Figure 4 This is the second flow chart of the method for determining illegal video communication users provided in the embodiment of the present application.

[0021] Figure 5 It is a flow chart of the behavior modeling analysis algorithm provided in the embodiment of the present application.

[0022] Figure 6 This is an architecture diagram of a system for determining illegal video communication users provided in an embodiment of the present application.

[0023] Figure 7 This is one of the overall flow charts of the method for determining illegal video communication users provided in the embodiment of the present application.

[0024] Figure 8 This is the second overall flow chart of the system for determining illegal video communication users provided in the embodiment of the present application.

[0025] Fig. 9 It is a structural diagram of a device for determining illegal video communication users provided in an embodiment of the present application.

[0026] Fig.10 It is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] The video fraud communication process of video communication software is consistent with the normal video communication process, with no obvious fraud features. In addition, the communication content between users is protected by end-to-end encryption (E2EE) on each device to ensure that the content transmitted between devices cannot be read. Therefore, it is difficult to directly determine whether the video communication of the video communication software involves fraud.

[0029] The video fraud communication process of the video communication software is that the fraud implementer (caller) first initiates a communication request to the server of the video communication software. After the called party responds to the call, the two parties establish a communication connection. The caller implements inducement measures to defraud the called party. The main fraud measures are as follows: 1. By setting a custom call nickname for the video communication software, the fraudster can impersonate customer service or staff of various platforms, thereby confusing and deceiving the caller's trust and manipulating the victim's account.

[0030] 2. Through the screen sharing function of the video communication software, the victim is guided to open an unfamiliar website to enter personal information, and perform operations such as account transfer and cancellation.

[0031] 3. Fraud committed through artificial intelligence (AI) technology, mainly including the use of AI voice synthesis, AI face-changing, etc. These fraud methods all involve personal information security issues, especially the illegal acquisition and use of personal voice and facial information. After the video communication is connected, the camera will be enabled, and the other party can obtain the user's facial information through screen recording, resulting in the leakage of user personal information.

[0032] At present, the main preventive measures against video fraud in video communication software are to turn off the function when not using video communication software, protect personal information, do not disclose passwords, verification codes and other personal information to strangers, and enable dual authentication of device identification to strengthen prevention. However, there is no effective countermeasure in terms of technology. The cross-border fraud monitoring method mentioned above has the following technical limitations: At present, the main preventive measures against FaceTime video fraud are to turn off the FaceTime function when not in use, protect personal information, do not disclose passwords, verification codes and other personal information to strangers, and enable Apple ID two-factor authentication to strengthen prevention. However, there is no effective countermeasure in terms of technology. In related technologies, illegal users are usually monitored for voice calls or text messages. However, since video communication is different from voice calls or text messages, the monitoring method for voice calls or text messages cannot be applied to video communication. Therefore, it is urgent to propose a monitoring method for illegal video communication users.

[0033] In view of the fact that the monitoring methods of voice calls or text message communication content cannot be applied to the monitoring of video communications, this application provides a method for determining illegal video communication users based on behavior modeling, which mainly solves the following problems: 1. Based on the video call communication mechanism, it aims at overseas or domestic video fraud scenarios and improves the deficiencies of fraud monitoring and governance measures; 2. This method monitors video communication traffic and message content, analyzes the network traffic-related protocols, business characteristics and call parameters of the video communication software, and conducts comprehensive modeling and analysis to solve the problem of monitoring and detecting network video fraud behavior of video communication software.

[0034] Combine the following Figure 1-Figure 8 The present invention describes a method for determining illegal video communication users. The execution subject of the method for determining illegal video communication users can be electronic devices such as computers and servers, or a device for determining illegal video communication users set in the electronic device. The device for determining illegal video communication users can be implemented by software, hardware, or a combination of the two.

[0035] Figure 1 FIG. 1 is one of the flow charts of the method for determining an illegal video communication user provided in an embodiment of the present application, such as Figure 1 As shown, the method for determining the illegal video communication user includes the following steps: Step 101: Acquire target data, where the target data includes a user data set, communication confirmation flow, and video communication flow for video communication based on video communication software.

[0036] The communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic is the traffic generated by the calling user domain and the called user during the video communication process.

[0037] For example, Figure 2 is a schematic diagram of a video communication process provided by an embodiment of the present application, such as Figure 2As shown in the figure, the video communication process mainly includes the call establishment process and the communication connection process. The call establishment process is as follows: First, when the communication device uses the video communication software for the first time, there will be a Transport Layer Security Handshake (TLS) process to establish a Transmission Control Protocol (TCP) connection with the signaling server, which can be deployed overseas. Secondly, the calling user B (overseas user) uses the calling device to initiate a video communication request to the called device of the called user A (domestic user), and the called device of the called user A responds to the video communication request initiated by the calling device of the calling user B.

[0038] The communication connection process is as follows: The first part is communication confirmation: the calling device of the calling user B and the called device of the called user A both establish a User Datagram Protocol (UDP) connection with the Stun server (for example, NAT STUN server), report their own intranet IP Port (port), public network IP Port, the intranet IP Port and public network IP Port of the other end, and then determine whether the Stun NAT penetration is successful based on the binding Request message and bindingResponse message of the Stun protocol, and initiate video communication content transmission. Stun is a common way to negotiate direct communication between two devices across Network Address Translation (NAT), so that even devices without public Internet Protocol (IP) addresses can communicate with each other. The second part is communication connection: when it is determined that Stun NAT penetration is successful, the calling device of the calling user and the called device of the called user use point-to-point direct connection to communicate with each other. When the calling device of the calling user and the called device of the called user are set with fixed IP addresses and NAT penetration is not allowed, or Stun NAT penetration fails due to network type or version constraints of video communication software, the calling device of the calling user and the called device of the called user both use a point-to-service server method for video communication during the communication connection stage. This video communication relies on Real-time Transport Protocol (RTP), Session Initialization Protocol (SIP), Quick UDP Internet Connection (QUIC) or TLS to establish a session. This process can be identified as a specific video communication software based on Deep Packet Inspection (DPI) features.

[0039] In actual applications, a DPI monitoring module can be set on the outside of the international exit router. The DPI monitoring module can obtain the collection of international entry and exit target data through multiple business identification engines working in parallel or in association. The target data includes the user data set between the calling user's calling device and the signaling server and the user data set between the called user's called device and the signaling server, the communication confirmation traffic between the calling user's calling device and the called user's called device after a successful handshake, and the video communication traffic when the calling user's calling device and the called user's called device make a video call.

[0040] The user data set is based on Figure 2The traffic of 1.1 initiating a call and 1.2 responding to a call is determined. The called device of the called user accesses the signaling server, and the traffic passes through the international exit of the operator. The DPI monitoring module can obtain the TLS protocol, parse the SNI related information in the TLS protocol, and combine it with the IP address of the signaling server and the common service port to form a user data set, which can also be called the SJ1 data set.

[0041] Communication confirmation traffic is also called Stun traffic, which includes collecting candidate transmission addresses, exchanging candidate options in the signaling channel, performing connectivity checks, selecting address pairs that pass the detection and starting media, and maintaining heartbeat detection. Among them, the connectivity check is to send a Stun binding request message packet through the peer IP port and confirm whether a Stun binding response message packet is received. When one pair of candidate addresses passes the detection, the candidate address pair is selected, and the calling device of the calling user and the called device of the called user use the selected candidate address pair for video communication. Communication confirmation traffic can also be called SJ2 data set.

[0042] Video communication traffic includes NAT penetration video communication traffic and non-NAT penetration video communication traffic, such as Figure 2 As shown in the figure, when NAT penetration is successful, the calling device of the calling user and the called device of the called user directly communicate with each other through video traffic. Since the calling device is the initiator of the overseas video communication service, the traffic passes through the international exit of the operator, so the DPI monitoring module can obtain the NAT penetration video communication traffic. For the non-encrypted traffic between the calling device and the called device, the message content feature can be identified, and the SJ2 data set can be used to assist the feature identification; for the encrypted traffic between the calling device and the called device, the video traffic can be judged by DPI technology, and the SJ2 data set can be used to confirm the association identification, and finally the NAT penetration video communication traffic is formed. The NAT penetration video communication traffic can also be called the SJ3 data set. When NAT penetration fails, in the video communication stage, the called device of the called user accesses the service server to transmit the video communication traffic. The video communication traffic passes through the international exit of the operator, so the DPI monitoring module can obtain the Transmission Control Protocol (TCP) traffic, and parse the TCP traffic based on the server IP + application port identification method to obtain the non-NAT penetration video communication traffic. The non-NAT penetration video communication traffic can also be called the SJ4 data set.

[0043] The port information used by the DPI monitoring module during the video communication process of the video communication software is shown in Table 1.

[0044] Table 1

[0045] Among them, XMPP stands for Extensible Messaging and Presence Protocol, and APN stands for Access Point Name.

[0046] Step 102: Obtain first call record data corresponding to the user data set, second call record data corresponding to the communication confirmation flow, and third call record data corresponding to the video communication flow.

[0047] For example, when the user data set, communication confirmation flow and video communication flow are obtained, the DPI monitoring module performs service identification on the user data set, communication confirmation flow and video communication flow respectively, records the key information of the signaling flow corresponding to the user data set, and obtains the Extended Detection and Response (Extended Detection and Response, XDR) record corresponding to the user data set, and the XDR record corresponding to the user data set is the first call list data corresponding to the user data set; records the key information of the communication confirmation flow, obtains the XDR record corresponding to the communication confirmation flow, and the XDR record corresponding to the communication confirmation flow is the second call list data corresponding to the communication confirmation flow; records the key information of the video communication flow, obtains the XDR record corresponding to the video communication flow, and the XDR record corresponding to the video communication flow is the third call list data corresponding to the video communication flow. In addition, when performing service identification, the user session is taken as the unit, and one session forms an XDR record. The first call list data, the second call list data and the third call list data can all be five-tuple call list data, including but not limited to: domestic IP+port, overseas IP+port, TCP / UDP session duration, feature information, service attributes and protocol classification.

[0048] Step 103: input the first call record data, the second call record data and the third call record data into a call record analysis model to obtain the call record analysis results of the first call record data, the second call record data and the third call record data output by the call record analysis model.

[0049] The call record analysis model may be an XDR call record analysis module.

[0050] In example, when the first call record data, the second call record data and the third call record data are obtained, the first call record data, the second call record data and the third call record data are sent to the XDR call record analysis module, and the first call record data, the second call record data and the third call record data are analyzed by the XDR call record analysis module to obtain the call record analysis results of the first call record data, the call record analysis results of the second call record data and the call record analysis results of the third call record data. The call record analysis results include five-tuple information, feature / service information, connection start time, connection end time, connection duration, the number of messages / bytes in each direction, the total number of messages / bytes and other information.

[0051] Step 104: determine a target user set based on the call record analysis results of the first call record data and the call record analysis results of the second call record data, and determine the model parameters of each calling user in the target user set based on the call record analysis results of the third call record data, wherein the model parameters include at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls made by the calling user to the called user, and the discreteness of the calls made by the calling user to the called user.

[0052] For example, the call sheet analysis results of the first call sheet data, the call sheet analysis results of the second call sheet data, and the call sheet analysis results of the third call sheet data are sent to the model analysis module. The model analysis module determines the target user set based on the call sheet analysis results of the first call sheet data and the call sheet analysis results of the second call sheet data. The model analysis module also extracts basic parameters from the call sheet analysis results of the third call sheet data, including the name, code, and judgment method of each basic parameter, and then performs behavioral modeling analysis based on the business logic relationship of each basic parameter, and finally obtains the model parameters of each calling user in the target user set. Specifically, for each calling user, the model analysis module can obtain the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls from the calling user to the called user, and the discreteness of the calling user's calls to the called user based on the analysis of the call sheet analysis results of the third call sheet data. Among them, the calling area Region where the calling user is located is determined in the following manner: the calling device of the calling user can determine the regional affiliation of the domestic or international or domestic province according to the IP address. For calling users from abroad, the affiliation of the high-risk area can be further determined according to the definition of overseas risk areas. The frequency N_caller_s of the calling user initiating calls is the number of communications N_vdu_c between the domestic video user set C_vdu and the signaling server shown in Table 2. The call duration T_caller_v between the calling user and the called user is the video communication duration T_vdu_v between the domestic video user set C_vdu and other communication devices shown in Table 2. The calling user video communication frequency N_caller_v is the number of video communications N_vdu_v between C_vdu and other communication devices shown in Table 2, or the number of users in the overseas video user set C_vfu. The missed frequency N_caller_f of the calling user calling the called user is the difference between the frequency N_caller_s of the calling user initiating calls and the video communication frequency N_caller_v of the calling user. The method for determining the discreteness QTd_call_p of the calling user calling the called user is as follows: Based on the limited social circle, that is, a person usually only communicates with people he is familiar with via video, the discreteness can be used to detect abnormal behavior, such as abnormal discreteness of called numbers or abnormal discreteness of calling areas. Based on the called user information marked as Callee corresponding to the frequency of calls initiated by the calling user N_caller_s and the frequency of missed calls by the calling user to the called user N_caller_f, the discreteness of the called users called by the calling user in unit time is counted and calculated, including two vectors of number discreteness and area discreteness. When the model analysis module obtains the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the discreteness of the calling user calling the called user, these parameters are determined as the model parameters of the calling user.The extracted basic parameters are shown in Table 2.

[0053] Table 2

[0054] Step 105: Determine the set of illegal video communication users based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user.

[0055] For example, after obtaining the target user set and the model parameters of each calling user in the target user set, the model analysis module uses a weight factor method to make a judgment on suspicious illegal video communication users, and finally obtains the illegal video communication user set.

[0056] The method for determining illegal video communication users provided in the present application obtains target data, the target data includes a user data set, communication confirmation traffic and video communication traffic for video communication based on video communication software; and obtains first call bill data corresponding to the user data set, second call bill data corresponding to the communication confirmation traffic and third call bill data corresponding to the video communication traffic, determines the target user set based on the call bill analysis results of the first call bill data and the call bill analysis results of the second call bill data, determines the model parameters of each calling user in the target user set based on the call bill analysis results of the third call bill data, determines the set of illegal video communication users based on the model parameters of each calling user, thereby realizing automatic determination of illegal video communication users, and when determining illegal video communication users, the call bill analysis results of the call bill data corresponding to the user data set, communication confirmation traffic and video communication traffic for video communication based on the video communication software are used to determine the illegal video communication users, which can improve the accuracy of determining illegal video communication users.

[0057] In one embodiment, the target user set includes a first user set, the first user set includes users in a domestic user set who communicate with the Stun server and start a video connection, and the domestic user set includes users corresponding to domestic IP addresses that communicate with the signaling server; the method for determining the illegal video communication user can specifically determine the calling user by the following method: For each first user in the first user set, when the first user initiates a Stun application request, the first user is determined to be a calling user, or, when it is detected in the communication confirmation traffic that the first user is a user who receives a connectivity application sent by the Stun server, the opposite user of the first user is determined to be a calling user.

[0058] Among them, the first user set is the domestic video user set shown in Table 2.

[0059] For example, the data type and order relationship of the call record of call establishment and communication connection are analyzed: in the first user set C_vdu in {C_adu, SJ2} that communicates with the Stun server and starts the media connection, the first user who first sends the Stun application request is determined as the calling user; if the first user in the first user set C_vdu is the user who receives the connection application sent by the Stun server in SJ2, the opposite user of the first user is determined as the calling user. After determining the calling user, a calling tag Caller can be added to the calling user, and a called tag Callee can be added to the opposite end of the calling user.

[0060] In this embodiment, the first user who first sends a Stun application request is determined as the calling user, or the first user who receives a connection application sent by the Stun server is determined as the calling user, thereby realizing automatic determination of the calling user.

[0061] In one embodiment, the target user set also includes a second user set, the second user set includes the target user detected in the communication confirmation traffic, and the target user is a user corresponding to the IP address of the opposite end of the user in the first user set; the method for determining the illegal video communication user can also specifically determine the calling user by the following method: For each second user in the second user set, determine the first average message length sent by the second user to the opposite user, and determine the second average message length sent by the opposite user to the second user; determine the user corresponding to the maximum average message length between the first average message length and the second average message length as the calling user.

[0062] Among them, the second user set is the overseas video user set shown in Table 2.

[0063] For example, determine the second average message length L_vdu_v sent by the domestic video user (first user) C_vdu to the overseas video user (second user) in video communication, and the first average message length L_vfu_v sent by the overseas video user C_vfu to the domestic video user in video communication in {SJ3, SJ4}, compare the first average message length L_vfu_v with the second average message length L_vdu_v, determine the user corresponding to the maximum average message length as the calling user, add a calling tag Caller to the calling user, and add a called tag Callee to the calling user's counterpart.

[0064] Figure 3 is a business logic analysis flow chart of the model analysis module provided in the embodiment of the present application, such as Figure 3As shown, for the domestic video user set C_vdu and the overseas video user set C_vfu, based on the type and sequence of bill data for call establishment and communication connection, the calling user who meets the calling behavior characteristics is determined, and a calling tag is added to each calling user, and a called tag is added to the other end of the calling user, to determine the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls from the calling user to the called user, the discreteness of the calling user's calls to the called user, and the frequency of video communications of the calling user.

[0065] In this embodiment, the user corresponding to the maximum average message length is determined as the calling user, thereby realizing automatic determination of the calling user. In addition, using two methods to determine the calling user can also improve the accuracy of determining the calling user.

[0066] In one embodiment, Figure 4 FIG. 2 is a flow chart of a method for determining an illegal video communication user provided in an embodiment of the present application. Figure 4 As shown, the above step 105 determines the set of illegal video communication users based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of missed calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user. Specifically, it can be implemented by the following steps: Step 1051: For each calling user, the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls from the calling user to the called user, and the discreteness of the calls from the calling user to the called user are quantified to obtain a first quantization value corresponding to the call area, a second quantization value corresponding to the frequency, a third quantization value corresponding to the call duration, a fourth quantization value corresponding to the frequency of unanswered calls, and a fifth quantization value corresponding to the discreteness.

[0067] For example, for each calling user, illegal communication modeling analysis is performed based on the model parameters of five dimensions: the call area Region where the calling user is located, the frequency of calls initiated by the calling user N_caller_s, the call duration T_caller_v between the calling user and the called user, the frequency of missed calls from the calling user to the called user N_caller_f, and the discreteness QTd_call_p of the calling user calling the called user. In the modeling analysis, the modeling duration can be determined according to business needs. The modeling duration can be 1 hour, 1 day or 1 week, etc. For key focus objects, it can be extended to monthly data modeling. Tracking analysis, specifically, profile analysis is performed on the model parameters of the five dimensions of the calling user. First, the parameter values ​​of the five parameters are quantified. For example, taking the call area Region as an example, it can be quantified according to the risk level of the call area, divided into the highest risk call area, high risk call area, medium risk call area and low risk call area. For example, the highest risk call area is quantified as 1, the high risk call area is quantified as 0.8, the medium risk call area is quantified as 0.6, the low risk call area is quantified as 0.4, etc., and the quantification is achieved by using a step-like assignment. The parameters of other dimensions are similar. The step-like assignment is used to achieve quantification, and the assignment can be flexibly based on the development of the video communication fraud business.

[0068] Step 1052: Perform weighted summation on the first quantization value, the second quantization value, the third quantization value, the fourth quantization value, and the fifth quantization value to obtain a weighted quantization value.

[0069] For example, Table 3 shows the correspondence between the parameter name, code, weight and weight default priority of the model parameters of the five dimensions. The weight and weight default priority of each model parameter shown in Table 3 are used to calculate the weighted quantization value based on the judgment function represented by the following formula (1): (1)

[0070] Among them, the quantization function It means that the model parameters of the five dimensions are quantified according to the preset standards. For example, the preset standard of the call area is quantified according to the risk level. W It indicates the default priority of the weight in the judgment function. The larger the number of the weight default priority, the higher the priority, and the greater the influence of the corresponding model parameters on the judgment of illegal video communication users.

[0071] Table 3

[0072] Step 1053: When the weighted quantization value is greater than a preset threshold, determine that the calling user is an illegal video communication user.

[0073] For example, when a weighted quantization value is obtained, the weighted quantization value is compared with a preset threshold value. When the weighted quantization value is greater than the preset threshold value, the calling user corresponding to the weighted quantization value is determined to be an illegal video communication user. When the weighted quantization value is less than or equal to the preset threshold value, the calling user corresponding to the weighted quantization value is determined to be a legal video communication user. For each calling user, the same method is used to finally determine the set of illegal video communication users. Specifically, the set of illegal video communication users can be determined based on the following formula (2). The IP address of the communication device of each user in the set of illegal video communication users is stored in an address library to obtain an illegal user address library, thereby realizing monitoring of illegal video communications based on behavior modeling.

[0074] (2)

[0075] in, Represents the set of illegal video communication users. When the weighted quantization value is greater than the preset threshold, , when the weighted quantization value is less than or equal to the preset threshold, ,Will The corresponding calling user is determined to be a set of illegal video communication users. Indicates the preset threshold.

[0076] Figure 5 is a flow chart of the behavior modeling analysis algorithm provided in the embodiment of the present application, such as Figure 5 As shown, for the calling user, the call area Region where the calling user is located, the frequency N_caller_s of calls initiated by the calling user, the call duration T_caller_v between the calling user and the called user, the frequency N_caller_f of missed calls made by the calling user to the called user, and the discreteness QTd_call_p of calls made by the calling user to the called user are quantized by quantization processor 1 (Quantize 1), quantization processor 2 (Quantize 2), quantization processor 3 (Quantize 3), quantization processor 4 (Quantize 4), and quantization processor 5 (Quantize 5), respectively, and the quantization results are weighted and summed to obtain a weighted quantization value. When the weighted quantization value is greater than a preset threshold, the calling user is determined to be an illegal video communication user. When the weighted quantization value is less than or equal to the preset threshold, the calling user is determined to be a legal video communication user.

[0077] In this embodiment, the model parameters of the five dimensions of the calling user are quantized, and the illegal video communication user is determined based on the comparison between the quantized value and the preset threshold. Since the model parameters of the five dimensions are typical parameters that can represent the video communication behavior of the calling user, the accuracy of determining the illegal video communication user can be improved.

[0078] In one embodiment, before the above step 101, the method for determining the illegal video communication user further includes the following steps: The quantified value corresponding to the highest risk call area, the quantified value corresponding to the preset maximum call frequency, the quantified value corresponding to the preset maximum call duration, the quantified value corresponding to the preset maximum missed call frequency and the quantified value corresponding to the preset maximum discreteness are weightedly summed to obtain a reference threshold; the preset threshold is determined based on the reference threshold.

[0079] For example, the maximum value of the model parameter of each dimension is taken, that is, the quantitative value corresponding to the highest risk call area, the quantitative value corresponding to the preset maximum call frequency, the quantitative value corresponding to the preset maximum call duration, the quantitative value corresponding to the preset maximum missed call frequency and the quantitative value corresponding to the preset maximum discreteness are weighted and summed to obtain the reference threshold, and the reference threshold is multiplied by the default coefficient to obtain the preset threshold. Specifically, the preset threshold is expressed by the following formula (3): (3)

[0080] in, It represents the default coefficient. The value of K can be set based on the demand. Preferably, K can be set to 60%.

[0081] In this embodiment, based on the quantitative value corresponding to the highest risk call area, the quantitative value corresponding to the preset maximum call frequency, the quantitative value corresponding to the preset maximum call duration, the quantitative value corresponding to the preset maximum missed call frequency and the quantitative value corresponding to the preset maximum discreteness, the preset threshold for measuring whether the user is an illegal video communication user is determined to improve the accuracy of determining illegal video communication users.

[0082] In one embodiment, the step 104 above determines the model parameters of each calling user in the target user set based on the call record analysis result of the third call record data, which can be specifically implemented in the following manner: Obtain target messages related to the video communication service, wherein the target messages include signaling messages and / or data messages; determine the model parameters of each calling user in the target user set based on the call record analysis result of the third call record data and the target messages.

[0083] For example, the DPI monitoring module can mirror the signaling messages and / or data messages related to the video communication service according to system requirements, such as the first N messages specified by the service session, and send the mirrored signaling messages and / or data messages to the model analysis module for use as data enhancement analysis, that is, the model analysis module receives the signaling messages and / or data messages sent by the DPI monitoring module and the call record analysis results of the third call record data sent by the XDR call record analysis module, and merges the signaling messages and / or data messages sent by the DPI monitoring module with the call record analysis results of the XDR call record analysis module to form comprehensive user video communication behavior data, extract key features from the merged user video communication behavior data, such as traffic characteristics and signaling message characteristics of video communication, and use the extracted key features to determine the model parameters of the calling user.

[0084] It should be noted that the model analysis module can be a module obtained by continuously optimizing model parameters through machine learning or deep learning algorithms. The specific training process of the model analysis module is as follows: obtain sample call list analysis results, sample signaling messages and sample data messages of multiple sample users, input the sample call list analysis results, sample signaling messages and sample data messages of multiple sample users into the initial model analysis module, and obtain the prediction model parameters of each sample user output by the initial model analysis module; based on the prediction model parameters of each sample user and the model parameter label of each sample user, adjust the model parameters of the initial model analysis module until the convergence conditions are reached to obtain the final model analysis module.

[0085] In this embodiment, the model analysis module determines the model parameters of each calling user in the target user set based on the third call record data and the target message, and uses the target message as data enhancement analysis, thereby improving the accuracy of model parameter determination and further improving the accuracy of determining illegal video communication users.

[0086] Figure 6 is an architecture diagram of a system for determining illegal video communication users provided in an embodiment of the present application, such as Figure 6 As shown, the system for determining illegal video communication users includes communication equipment of domestic video communication users, backbone routers, international export routers, service servers, communication equipment of overseas video communication users and monitoring equipment. The monitoring equipment includes a DPI monitoring module, an XDR call record analysis module, a model analysis module and an illegal user address library. Figure 7 This is one of the overall flow charts of the method for determining an illegal video communication user provided in an embodiment of the present application. Figure 8 This is the second overall flow chart of the system for determining illegal video communication users provided by the embodiment of the present application, such as Figure 7 and Figure 8As shown, the DPI monitoring module collects the user data set SJ1, communication confirmation traffic SJ2, NAT penetration video communication traffic SJ3 and non-NAT penetration video communication traffic SJ4 for video communication based on video communication software at the international exit of the Internet, mirrors the signaling messages and / or data messages related to the video communication service according to the system requirements, and obtains the first call list data corresponding to the user data set, the second call list data corresponding to the communication confirmation traffic and the third call list data corresponding to the video communication traffic, and sends each call list data to the XDR call list analysis module, and performs call list analysis on the first call list data, the second call list data and the third call list data through the XDR call list analysis module to obtain the call list analysis results of the first call list data, the call list analysis results of the second call list data and the call list analysis results of the third call list data. The XDR call sheet analysis module sends the analysis results of each call sheet to the model analysis module, and the DPI monitoring module also sends the signaling message and / or data message related to the mirrored video communication service to the model analysis module. The model analysis module determines the target user set based on the call sheet analysis results of the first call sheet data and the call sheet analysis results of the second call sheet data, and determines the model parameters of the calling user based on the signaling message and / or data message and the call sheet analysis results of the third call sheet data. The model parameters of the calling user include the call area Region where the calling user is located, the frequency N_callle of calls initiated by the calling user r_s, the call duration between the calling user and the called user T_caller_v, the frequency of missed calls from the calling user to the called user N_caller_f and the discreteness of the calling user calling the called user QTd_call_p, and then based on the model parameters of the calling user, the weight factor method is used to determine whether the user is an illegal video communication user, and finally a set of illegal video communication users is formed and stored in the illegal user address database. The illegal user address database is reported to the relevant departments for investigation and locking down the source of fraud, and combined with blocking and other disposal measures to reduce the risk of users answering video calls and reduce the property losses of the people.

[0087] This application is applicable to the monitoring of overseas video communication fraud business, especially for modeling and analyzing video communication business initiated in overseas high-risk areas for fraud, monitoring and identifying the IP addresses of video communication users with high frequency, high discreteness, and high frequency of missed calls in the specified time period in the area, and establishing an illegal user address database, which can be provided to relevant departments for further verification and disposal. This application can also be expanded to be applied to the monitoring of video communication fraud business, so as to deal with the scenario in which telecommunications network fraud gangs use remote control to initiate video communications to victims using "GOIP equipment" built in the country, thereby committing fraud. In addition, this application uses user IP as the identifier of illegal video communication users. Illegal elements may use virtual IP or IP address proxy technology, so the tracing problem from IP to the actual fraud terminal still needs to be considered in actual application.

[0088] The following is a description of the device for determining an illegal video communication user provided by the present application. The device for determining an illegal video communication user described below and the method for determining an illegal video communication user described above can refer to each other.

[0089] Fig. 9 is a schematic diagram of the structure of the device for determining illegal video communication users provided in an embodiment of the present application, such as Fig. 9 As shown, the illegal video communication user determination device 900 includes a first acquisition unit 901, a second acquisition unit 902, an analysis unit 903, a first determination unit 904 and a second determination unit 905; wherein: The first acquisition unit 901 is used to acquire target data, wherein the target data includes a user data set for video communication based on video communication software, communication confirmation traffic, and video communication traffic, wherein the communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic is the traffic generated by the calling user domain called user during the video communication process; The second acquisition unit 902 is used to acquire first call bill data corresponding to the user data set, second call bill data corresponding to the communication confirmation flow, and third call bill data corresponding to the video communication flow; An analysis unit 903 is used to input the first call record data, the second call record data and the third call record data into a call record analysis model, and obtain a call record analysis result of the first call record data, a call record analysis result of the second call record data and a call record analysis result of the third call record data output by the call record analysis model; A first determination unit 904 is used to determine a target user set based on a call sheet analysis result of the first call sheet data and a call sheet analysis result of the second call sheet data, and determine a model parameter of each calling user in the target user set based on the call sheet analysis result of the third call sheet data, wherein the model parameter includes at least one of the following: a call area where the calling user is located, a frequency of calls initiated by the calling user, a call duration between the calling user and the called user, a frequency of missed calls made by the calling user to the called user, and a discreteness of calls made by the calling user to the called user; The second determination unit 905 is used to determine the set of illegal video communication users based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of each calling user's calls to the called user.

[0090] The device for determining illegal video communication users provided by the present application obtains target data, the target data includes a user data set, communication confirmation traffic and video communication traffic for video communication based on video communication software; and obtains first call bill data corresponding to the user data set, second call bill data corresponding to the communication confirmation traffic and third call bill data corresponding to the video communication traffic, determines the target user set based on the call bill analysis result of the first call bill data and the call bill analysis result of the second call bill data, determines the model parameters of each calling user in the target user set based on the call bill analysis result of the third call bill data, and determines the set of illegal video communication users based on the model parameters of each calling user, thereby realizing automatic determination of illegal video communication users, and when determining illegal video communication users, the call bill analysis results of the call bill data corresponding to the user data set, communication confirmation traffic and video communication traffic for video communication based on the video communication software are used to determine the illegal video communication users, which can improve the accuracy of determining illegal video communication users.

[0091] Based on any of the above embodiments, the target user set includes a first user set, the first user set includes users in a domestic user set who communicate with the Stun server and start a video connection, the domestic user set includes users corresponding to a domestic IP address that communicates with the signaling server; the illegal video communication user determination device 900 also includes: The third determination unit is used to determine, for each first user in the first user set, that the first user is a calling user when the first user initiates a Stun application request, or to determine the opposite user of the first user as a calling user when it is detected in the communication confirmation traffic that the first user is a user who receives a connectivity application sent by the Stun server.

[0092] Based on any of the above embodiments, the target user set also includes a second user set, the second user set includes the target user detected in the communication confirmation traffic, and the target user is a user corresponding to the IP address of the opposite end of the user in the first user set; the illegal video communication user determination device 900 also includes: a fourth determining unit, configured to determine, for each second user in the second user set, a first average message length sent by the second user to the opposite user, and determine a second average message length sent by the opposite user to the second user; A fifth determining unit is used to determine a user corresponding to a maximum average message length between the first average message length and the second average message length as the calling user.

[0093] Based on any of the foregoing embodiments, the second determining unit 905 is specifically configured to: For each calling user, the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls from the calling user to the called user, and the discreteness of the calls from the calling user to the called user are quantified to obtain a first quantization value corresponding to the call area, a second quantization value corresponding to the frequency, a third quantization value corresponding to the call duration, a fourth quantization value corresponding to the frequency of unanswered calls, and a fifth quantization value corresponding to the discreteness; Performing weighted summation on the first quantization value, the second quantization value, the third quantization value, the fourth quantization value, and the fifth quantization value to obtain a weighted quantization value; When the weighted quantization value is greater than a preset threshold, it is determined that the calling user is an illegal video communication user.

[0094] Based on any of the above embodiments, the device for determining an illegal video communication user further includes: a calculation unit, configured to perform weighted summation on the quantized value corresponding to the highest risk call area, the quantized value corresponding to the preset maximum call frequency, the quantized value corresponding to the preset maximum call duration, the quantized value corresponding to the preset maximum missed call frequency, and the quantized value corresponding to the preset maximum discreteness to obtain a reference threshold; A sixth determining unit is configured to determine the preset threshold based on the reference threshold.

[0095] Based on any of the foregoing embodiments, the first determining unit 904 is specifically configured to: Acquire a target message related to a video communication service, wherein the target message includes a signaling message and / or a data message; The model parameters of each calling user in the target user set are determined based on the call record analysis result of the third call record data and the target message.

[0096] Fig.10 is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application, such as Fig.10As shown, the electronic device may include: a processor 1010, a communications interface 1020, a memory 1030 and a communications bus 1040, wherein the processor 1010, the communications interface 1020 and the memory 1030 communicate with each other through the communications bus 1040. The processor 1010 may call the logic instructions in the memory 1030 to execute a method for determining an illegal video communication user, the method comprising: obtaining target data, the target data comprising a user data set for video communication based on video communication software, communication confirmation traffic and video communication traffic, the communication confirmation traffic being traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic being traffic generated by the calling user domain called user during the video communication process; Acquire first call record data corresponding to the user data set, second call record data corresponding to the communication confirmation flow, and third call record data corresponding to the video communication flow; Inputting the first call record data, the second call record data and the third call record data into a call record analysis model, and obtaining a call record analysis result of the first call record data, a call record analysis result of the second call record data and a call record analysis result of the third call record data output by the call record analysis model; Based on the call sheet analysis results of the first call sheet data and the call sheet analysis results of the second call sheet data, a target user set is determined, and based on the call sheet analysis results of the third call sheet data, a model parameter of each calling user in the target user set is determined, the model parameter including at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls made by the calling user to the called user, and the discreteness of the calls made by the calling user to the called user; The set of illegal video communication users is determined based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user.

[0097] In addition, the logic instructions in the above-mentioned memory 1030 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0098] On the other hand, the present application also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the method for determining illegal video communication users provided by the above methods, the method comprising: obtaining target data, the target data including a user data set, communication confirmation traffic and video communication traffic for video communication based on video communication software, the communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic is the traffic generated by the calling user domain called user during the video communication process; Acquire first call record data corresponding to the user data set, second call record data corresponding to the communication confirmation flow, and third call record data corresponding to the video communication flow; Inputting the first call record data, the second call record data and the third call record data into a call record analysis model, and obtaining a call record analysis result of the first call record data, a call record analysis result of the second call record data and a call record analysis result of the third call record data output by the call record analysis model; Based on the call sheet analysis results of the first call sheet data and the call sheet analysis results of the second call sheet data, a target user set is determined, and based on the call sheet analysis results of the third call sheet data, a model parameter of each calling user in the target user set is determined, the model parameter including at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls made by the calling user to the called user, and the discreteness of the calls made by the calling user to the called user; The set of illegal video communication users is determined based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user.

[0099] On the other hand, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the method for determining an illegal video communication user provided by the above methods, the method comprising: obtaining target data, the target data comprising a user data set for video communication based on video communication software, communication confirmation traffic, and video communication traffic, the communication confirmation traffic being traffic generated when communication confirmation is performed during a video communication connection process, and the video communication traffic being traffic generated by a calling user domain called user during a video communication process; Acquire first call record data corresponding to the user data set, second call record data corresponding to the communication confirmation flow, and third call record data corresponding to the video communication flow; Inputting the first call record data, the second call record data and the third call record data into a call record analysis model, and obtaining a call record analysis result of the first call record data, a call record analysis result of the second call record data and a call record analysis result of the third call record data output by the call record analysis model; Based on the call sheet analysis results of the first call sheet data and the call sheet analysis results of the second call sheet data, a target user set is determined, and based on the call sheet analysis results of the third call sheet data, a model parameter of each calling user in the target user set is determined, the model parameter including at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls made by the calling user to the called user, and the discreteness of the calls made by the calling user to the called user; The set of illegal video communication users is determined based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user.

[0100] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0101] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for determining an illegal video communication user, characterized in that: include: Acquire target data, the target data including user data sets, communication confirmation traffic and video communication traffic for video communication based on video communication software, the communication confirmation traffic being traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic being traffic generated by the calling user domain and the called user during the video communication process; Acquire first call record data corresponding to the user data set, second call record data corresponding to the communication confirmation flow, and third call record data corresponding to the video communication flow; Inputting the first call record data, the second call record data and the third call record data into a call record analysis model, and obtaining a call record analysis result of the first call record data, a call record analysis result of the second call record data and a call record analysis result of the third call record data output by the call record analysis model; Based on the call sheet analysis results of the first call sheet data and the call sheet analysis results of the second call sheet data, a target user set is determined, and based on the call sheet analysis results of the third call sheet data, a model parameter of each calling user in the target user set is determined, the model parameter including at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls made by the calling user to the called user, and the discreteness of the calls made by the calling user to the called user; The set of illegal video communication users is determined based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user.

2. The method for determining an illegal video communication user according to claim 1, characterized in that: The target user set includes a first user set, the first user set includes users in a domestic user set who communicate with the Stun server and start a video connection, and the domestic user set includes users corresponding to domestic IP addresses that communicate with the signaling server; The method further comprises: For each first user in the first user set, when the first user initiates a Stun application request, the first user is determined to be a calling user, or, when it is detected in the communication confirmation traffic that the first user is a user who receives a connectivity application sent by the Stun server, the opposite user of the first user is determined to be a calling user.

3. The method for determining an illegal video communication user according to claim 2, characterized in that: The target user set also includes a second user set, the second user set includes target users detected in the communication confirmation traffic, and the target users are users corresponding to the IP addresses of the peers of the users in the first user set; the method also includes: For each second user in the second user set, determining a first average message length sent by the second user to a peer user, and determining a second average message length sent by the peer user to the second user; The user corresponding to the maximum average message length between the first average message length and the second average message length is determined as the calling user.

4. The method for determining an illegal video communication user according to claim 1, characterized in that: The step of determining the illegal video communication user set based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of missed calls made by each calling user to the called user, and the discreteness of calls made by each calling user to the called user comprises: For each calling user, the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of unanswered calls from the calling user to the called user, and the discreteness of the calls from the calling user to the called user are quantified to obtain a first quantization value corresponding to the call area, a second quantization value corresponding to the frequency, a third quantization value corresponding to the call duration, a fourth quantization value corresponding to the frequency of unanswered calls, and a fifth quantization value corresponding to the discreteness; Performing weighted summation on the first quantization value, the second quantization value, the third quantization value, the fourth quantization value, and the fifth quantization value to obtain a weighted quantization value; When the weighted quantization value is greater than a preset threshold, it is determined that the calling user is an illegal video communication user.

5. The method for determining an illegal video communication user according to claim 4, characterized in that: The method further comprises: The reference threshold is obtained by weighted summing the quantized value corresponding to the highest risk call area, the quantized value corresponding to the preset maximum call frequency, the quantized value corresponding to the preset maximum call duration, the quantized value corresponding to the preset maximum missed call frequency, and the quantized value corresponding to the preset maximum discreteness; The preset threshold is determined based on the reference threshold.

6. The method for determining an illegal video communication user according to any one of claims 1 to 5, characterized in that: The determining the model parameters of each calling user in the target user set based on the call record analysis result of the third call record data includes: Acquire a target message related to a video communication service, wherein the target message includes a signaling message and / or a data message; The model parameters of each calling user in the target user set are determined based on the call record analysis result of the third call record data and the target message.

7. A device for determining an illegal video communication user, characterized in that: include: A first acquisition unit is used to acquire target data, wherein the target data includes a user data set for video communication based on video communication software, communication confirmation traffic, and video communication traffic, wherein the communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic is the traffic generated by the calling user domain called user during the video communication process; A second acquisition unit, configured to acquire first call bill data corresponding to the user data set, second call bill data corresponding to the communication confirmation flow, and third call bill data corresponding to the video communication flow; An analysis unit, configured to input the first call record data, the second call record data, and the third call record data into a call record analysis model, and obtain a call record analysis result of the first call record data, a call record analysis result of the second call record data, and a call record analysis result of the third call record data output by the call record analysis model; A first determination unit is used to determine a target user set based on a call sheet analysis result of the first call sheet data and a call sheet analysis result of the second call sheet data, and determine a model parameter of each calling user in the target user set based on the call sheet analysis result of the third call sheet data, wherein the model parameter includes at least one of the following: a call area where the calling user is located, a frequency of calls initiated by the calling user, a call duration between the calling user and the called user, a frequency of missed calls made by the calling user to the called user, and a discreteness of calls made by the calling user to the called user; The second determination unit is used to determine the set of illegal video communication users based on at least one of the call area where each calling user is located, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of unanswered calls made by each calling user to the called user, and the discreteness of each calling user's calls to the called user.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for determining an illegal video communication user according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for determining an illegal video communication user according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for determining an illegal video communication user according to any one of claims 1 to 6 is implemented.

Images