Method, device and electronic equipment for determining illegal video communication users

Abstract

The application provides a method and device for determining illegal video communication users and electronic equipment, and relates to the technical field of communication. The method comprises the following steps: obtaining a user data set, communication confirmation traffic and video communication traffic; obtaining first call record data corresponding to the user data set, second call record data corresponding to the communication confirmation traffic and third call record data corresponding to the video communication traffic; determining a target user set based on a call record analysis result of the first call record data and a call record analysis result of the second call record data, and determining model parameters of each calling user based on a call record analysis result of the third call record data; and determining a set of illegal video communication users based on the model parameters of each calling user. The application realizes automatic determination of illegal video communication users, and determines the set of illegal video communication users based on call record analysis results of call record data corresponding to the user data set, the communication confirmation traffic and the video communication traffic, thereby improving the accuracy of determination of illegal video communication users.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, and electronic device for identifying illegal video communication users. Background Technology

[0002] Criminals impersonate customer service personnel from e-commerce platforms and financial platforms, making video calls via video communication software to induce victims to provide critical information such as account details and verification codes. Therefore, it is necessary to monitor the legitimacy of video communication users.

[0003] In related technologies, monitoring for unauthorized users typically targets voice calls or text messages. However, because video communication differs from voice calls or text messages, monitoring methods for voice calls or text messages are not applicable to video communication. Therefore, there is an urgent need to propose a monitoring method for unauthorized video communication users. Summary of the Invention

[0004] To address the problems existing in the prior art, this application provides a method, apparatus, and electronic device for identifying illegal video communication users.

[0005] In a first aspect, embodiments of this application provide a method for determining an illegal video communication user, including: Acquire target data, which includes user datasets, communication confirmation traffic, and video communication traffic based on video communication software. The communication confirmation traffic is the traffic generated during communication confirmation in the video communication connection process, and the video communication traffic is the traffic generated by the called user in the calling user domain during video communication. Obtain the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic; The first call detail record (CDR) data, the second CDR data, and the third CDR data are input into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the CDR analysis results of the second CDR data, and the CDR analysis results of the third CDR data output by the CDR analysis model. Based on the call detail record (CDR) analysis results of the first and second CDR data, a target user set is determined. Based on the CDR analysis results of the third CDR data, model parameters for each calling user in the target user set are determined. The model parameters include at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of calls by the calling user to the called user. The set of illegal video communication users is determined based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users.

[0006] In one embodiment, the target user set includes a first user set, which includes users in a domestic user set who communicate with the Stun server and initiate video connections, and the domestic user set includes users corresponding to domestic IP addresses that communicate with the signaling server; the method further includes: For each first user in the first user set, if the first user initiates a Stun request, the first user is determined to be the calling user; or, if the communication confirmation traffic detects that the first user is the user receiving the connection request sent by the Stun server, the peer user of the first user is determined to be the calling user.

[0007] In one embodiment, the target user set further includes a second user set, the second user set including target users detected in the communication acknowledgment traffic, the target users being users corresponding to the IP addresses of the peers of the users in the first user set; the method further includes: For each second user in the second user set, determine the first average message length sent by the second user to the peer user, and determine the second average message length sent by the peer user to the second user. The user corresponding to the maximum average message length between the first average message length and the second average message length is determined as the calling user.

[0008] In one embodiment, determining the set of illegal video communication users based on at least one of the following: the call area of ​​each calling user, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of missed calls by each calling user to the called user, and the dispersion of calls by each calling user to the called user, includes: For each calling user, the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user are quantized to obtain a first quantized value corresponding to the call area, a second quantized value corresponding to the frequency, a third quantized value corresponding to the call duration, a fourth quantized value corresponding to the missed call frequency, and a fifth quantized value corresponding to the dispersion. The first quantized value, the second quantized value, the third quantized value, the fourth quantized value, and the fifth quantized value are weighted and summed to obtain a weighted quantized value; If the weighted quantization value is greater than a preset threshold, the calling user is determined to be an illegal video communication user.

[0009] In one embodiment, the method further includes: The reference threshold is obtained by weighting and summing the quantized values ​​corresponding to the highest risk call area, the preset maximum call frequency, the preset maximum call duration, the preset maximum missed call frequency, and the preset maximum dispersion. The preset threshold is determined based on the reference threshold.

[0010] In one embodiment, determining the model parameters for each calling user in the target user set based on the call detail record (CDR) analysis results from the third CDR data includes: Acquire target messages related to video communication services, wherein the target messages include signaling messages and / or data messages; Based on the call detail record (CDR) analysis results of the third CDR data and the target message, the model parameters of each calling user in the target user set are determined.

[0011] Secondly, embodiments of this application provide an apparatus for determining unauthorized video communication users, comprising: The first acquisition unit is used to acquire target data, which includes a user dataset, communication confirmation traffic and video communication traffic based on video communication software, the communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic is the traffic generated by the called user in the calling user domain during the video communication process. The second acquisition unit is used to acquire the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic. The analysis unit is used to input the first call detail record (CDR) data, the second CDR data, and the third CDR data into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the CDR analysis results of the second CDR data, and the CDR analysis results of the third CDR data output by the CDR analysis model. The first determining unit is used to determine a target user set based on the call detail record (CDR) analysis results of the first CDR data and the CDR analysis results of the second CDR data, and to determine the model parameters of each calling user in the target user set based on the CDR analysis results of the third CDR data. The model parameters include at least one of the following: the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user. The second determining unit is used to determine the set of illegal video communication users based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users.

[0012] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for determining illegal video communication users as described above.

[0013] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for determining illegal video communication users as described above.

[0014] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method for determining illegal video communication users as described above.

[0015] The method, apparatus, and electronic device for determining illegal video communication users provided in this application acquire target data, including a user dataset, communication confirmation traffic, and video communication traffic based on video communication software. It acquires first call detail record (CDR) data corresponding to the user dataset, second CDR data corresponding to the communication confirmation traffic, and third CDR data corresponding to the video communication traffic. Based on the CDR analysis results of the first and second CDR data, a target user set is determined. Based on the CDR analysis results of the third CDR data, model parameters for each calling user in the target user set are determined. Based on the model parameters of each calling user, a set of illegal video communication users is determined. This achieves automatic determination of illegal video communication users. Furthermore, the determination of illegal video communication users is based on the CDR analysis results of the user dataset, communication confirmation traffic, and video communication traffic corresponding to the video communication software, which improves the accuracy of illegal video communication user determination. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is one of the flowcharts illustrating the method for determining illegal video communication users provided in the embodiments of this application.

[0018] Figure 2 This is a schematic diagram of the video communication process provided in an embodiment of this application.

[0019] Figure 3 This is a flowchart of the business logic analysis process of the model analysis module provided in this application embodiment.

[0020] Figure 4 This is the second flowchart illustrating the method for determining illegal video communication users provided in the embodiments of this application.

[0021] Figure 5 This is a flowchart illustrating the behavior modeling and analysis algorithm provided in the embodiments of this application.

[0022] Figure 6 This is an architecture diagram of the system for identifying illegal video communication users provided in the embodiments of this application.

[0023] Figure 7 This is one of the overall flowcharts of the method for determining illegal video communication users provided in the embodiments of this application.

[0024] Figure 8 This is the second overall flowchart of the system for determining illegal video communication users provided in the embodiments of this application.

[0025] Figure 9 This is a schematic diagram of the structure of the device for determining illegal video communication users provided in the embodiments of this application.

[0026] Figure 10 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] The video communication process of video communication software is consistent with the normal video communication process, without obvious fraudulent features. Moreover, the communication content between users is protected by end-to-end encryption (E2EE) on each device to ensure that the content transmitted between devices cannot be read. Therefore, it is difficult to directly determine whether the video communication of video communication software involves fraudulent behavior.

[0029] In video communication fraud, the perpetrator (caller) first initiates a communication request to the software's server. After the called party responds, a communication connection is established. The caller then uses deceptive tactics to defraud the called party. The main fraudulent methods include the following: 1. By setting custom call nicknames in video communication software, fraudsters can impersonate customer service or staff of various platforms to deceive and gain the trust of the recipient, and then control the victim's account.

[0030] 2. By using the screen sharing function built into video communication software, the perpetrators guide victims to open unfamiliar websites, enter personal information, and perform operations such as account transfers and account cancellations.

[0031] 3. Fraud using artificial intelligence (AI) technology, primarily including techniques such as AI voice synthesis and AI face swapping. These fraudulent methods all involve personal information security issues, especially the illegal acquisition and use of personal voice and facial information. After connecting a video call, the camera is activated, and the other party can obtain the user's facial information through screen recording, leading to the leakage of the user's personal information.

[0032] Currently, preventative measures are primarily taken against video fraud using video communication software. It is recommended to disable this function when not using the software, protect personal information by not disclosing passwords, verification codes, or other personal information to strangers, and enable two-factor authentication for device identification to enhance protection. However, there are currently no effective technical countermeasures. The cross-border fraud monitoring methods mentioned earlier have the following technical limitations: Currently, preventative measures are primarily used to combat FaceTime video scams. It is recommended to disable FaceTime when not in use, protect personal information by not revealing passwords, verification codes, or other personal information to strangers, and enable Apple ID two-factor authentication for enhanced protection. However, there are no effective technical countermeasures. Related technologies typically monitor unauthorized users' voice calls or text messages, but because video communication differs from voice calls or text messages, these monitoring methods are not applicable to video communication. Therefore, there is an urgent need to develop a method for monitoring unauthorized video communication users.

[0033] To address the issue that monitoring methods for voice calls or text messages are not applicable to monitoring video communications, this application provides a method for identifying illegal video communication users based on behavior modeling, primarily solving the following problems: 1. Based on the video call communication mechanism, address the shortcomings in fraud monitoring and governance methods for both overseas and domestic video fraud scenarios; 2. This method monitors video communication traffic and message content, analyzes network traffic-related protocols, service characteristics, and call parameters of video communication software, and performs comprehensive modeling and analysis to solve the problem of monitoring and detecting network video fraud by video communication software.

[0034] The following is combined Figures 1-8 This application describes a method for determining unauthorized video communication users. The subject executing this method can be an electronic device such as a computer or server, or a device for determining unauthorized video communication users installed in that electronic device. This device can be implemented through software, hardware, or a combination of both.

[0035] Figure 1 This is one of the flowcharts illustrating the method for determining illegal video communication users provided in the embodiments of this application, such as... Figure 1 As shown, the method for identifying the illegal video communication user includes the following steps: Step 101: Obtain target data, which includes user datasets, communication confirmation traffic, and video communication traffic based on video communication software.

[0036] The communication confirmation traffic refers to the traffic generated during the communication confirmation process in the video communication connection process, and the video communication traffic is the traffic generated by the called user in the calling user domain during the video communication process.

[0037] For example, Figure 2 This is a schematic diagram of the video communication process provided in the embodiments of this application, such as... Figure 2As shown, the video communication process mainly includes a call setup process and a communication connection process. The call setup process is as follows: First, when the communication device uses the video communication software for the first time, a Transport Layer Security Handshake (TLS) process is performed to establish a Transmission Control Protocol (TCP) connection with the signaling server. This signaling server can be deployed overseas. Second, the calling user B (overseas user) uses the calling device to initiate a video communication request to the called user A (domestic user)'s called device. The called user A's called device responds to the video communication request initiated by the calling user B's calling device.

[0038] The communication connection process is as follows: The first part is communication confirmation: Both the calling device of calling user B and the called device of called user A establish a User Datagram Protocol (UDP) connection with the Stun server (e.g., a NAT STUN server), reporting their respective internal IP ports, public IP ports, and the internal and public IP ports of the other end. Then, based on the binding request and binding response messages of the Stun protocol, they determine whether Stun NAT traversal is successful and initiate video communication content transmission. Stun is a common method used to negotiate direct communication between two devices across Network Address Translation (NAT), enabling communication even between devices without public Internet Protocol (IP) addresses. The second part is communication connection: Upon confirming successful Stun NAT traversal, the calling device of the calling user and the called device of the called user conduct video communication using a point-to-point direct connection. When both the calling device of the calling user and the called device of the called user have fixed IPs that do not allow NAT traversal, or when Stun NAT traversal fails due to network type or video communication software version constraints, during the communication connection phase, both the calling device of the calling user and the called device of the called user use a point-to-service server method for video communication. This video communication relies on Real-time Transport Protocol (RTP), Session Initialization Protocol (SIP), Quick UDP Internet Connections (QUIC), or TLS to establish a session. This process can be identified as a specific video communication software based on Deep Packet Inspection (DPI) features.

[0039] In practical applications, a DPI monitoring module can be installed outside the international exit router. The DPI monitoring module can collect target data of international entry and exit points through multiple service identification engines working in parallel or in conjunction. The target data includes the user data set between the calling device of the calling user and the signaling server, the user data set between the called device of the called user and the signaling server, the communication confirmation traffic between the calling device of the calling user and the called device of the called user after a successful handshake, and the video communication traffic when the calling device of the calling user and the called device of the called user conduct a video call.

[0040] The user dataset is based on Figure 2The traffic for initiating a call (1.1) and responding to a call (1.2) is determined. When the called device of the called user accesses the signaling server, this traffic passes through the operator's international exit. The DPI monitoring module can then obtain the TLS protocol, parse the SNI-related information in the TLS protocol, and combine it with the IP address of the signaling server and commonly used service ports to form a user dataset, which can also be called the SJ1 dataset.

[0041] Communication acknowledgment traffic, also known as STUN traffic, includes several processes: collecting candidate transport addresses, exchanging candidate options in the signaling channel, performing connectivity checks, selecting the passed address pair and initiating media, and maintaining heartbeat detection. Among these, connectivity checks are confirmed by sending STUN binding request messages to the peer's IP port and by whether STUN binding response messages are received. When a candidate address pair passes the test, that candidate address pair is selected, and the calling device of the calling user and the called device of the called user use the selected candidate address pair for video communication. Communication acknowledgment traffic can also be referred to as SJ2 dataset.

[0042] Video communication traffic includes NAT-through video communication traffic and non-NAT-through video communication traffic, such as... Figure 2 As shown, when NAT traversal is successful, the calling device of the calling user and the called device of the called user directly conduct video communication traffic. Since the calling device is the initiator of the overseas video communication service, this traffic passes through the operator's international exit, so the DPI monitoring module can obtain this NAT-traversed video communication traffic. For unencrypted traffic between the calling and called devices, the packet content features can be identified, combined with the SJ2 dataset for auxiliary feature identification. For encrypted traffic between the calling and called devices, DPI technology can be used to determine the video traffic, combined with the SJ2 dataset for confirmation of association identification, ultimately forming NAT-traversed video communication traffic, which can also be called the SJ3 dataset. When NAT traversal fails, during the video communication phase, the called device of the called user accesses the service server to transmit video communication traffic. This video communication traffic passes through the operator's international exit, so the DPI monitoring module can obtain Transmission Control Protocol (TCP) traffic. Based on the identification method of server IP + application port, the TCP traffic is parsed to obtain non-NAT-traversed video communication traffic, which can also be called the SJ4 dataset.

[0043] The port information used by the DPI monitoring module during video communication in the video communication software is shown in Table 1.

[0044] Table 1

[0045] XMPP stands for Extensible Messaging and Presence Protocol, and APN stands for Access Point Name.

[0046] Step 102: Obtain the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic.

[0047] For example, when acquiring user datasets, communication confirmation traffic, and video communication traffic, the DPI monitoring module performs service identification on these datasets and traffic respectively. Key information of the signaling traffic corresponding to the user dataset is recorded to obtain the Extended Detection and Response (XDR) record, which is the first call detail record (CDR) data corresponding to the user dataset. Key information of the communication confirmation traffic is also recorded to obtain the corresponding XDR record, which is the second CDR data. Similarly, key information of the video communication traffic is recorded to obtain the corresponding XDR record, which is the third CDR data. Furthermore, during service identification, each user session forms one XDR record. The first, second, and third CDR data can all be five-tuple CDR data, including but not limited to: domestic IP + port, overseas IP + port, TCP / UDP session duration, feature information, service attributes, and protocol classification.

[0048] Step 103: Input the first call detail record (CDR) data, the second CDR data, and the third CDR data into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the second CDR data, and the third CDR data output by the CDR analysis model.

[0049] The call detail record (CDR) analysis model can be the XDR CDR analysis module.

[0050] For example, when the first, second, and third call detail record (CDR) data are obtained, they are sent to the XDR CDR analysis module. The XDR CDR analysis module performs CDR analysis on the first, second, and third CDR data to obtain the CDR analysis results for the first, second, and third CDR data. The CDR analysis results include information such as five-tuple information, feature / service information, connection start time, connection end time, connection duration, number of packets / bytes in each direction, and total number of packets / bytes.

[0051] Step 104: Based on the call detail record (CDR) analysis results of the first CDR data and the second CDR data, determine the target user set, and based on the CDR analysis results of the third CDR data, determine the model parameters for each calling user in the target user set. The model parameters include at least one of the following: the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user.

[0052] For example, the call detail record (CDR) analysis results of the first, second, and third CDR data are sent to the model analysis module. Based on the CDR analysis results of the first and second CDR data, the model analysis module determines the target user set. The module also extracts basic parameters from the CDR analysis results of the third CDR data, including the name, encoding, and judgment method of each basic parameter. Then, based on the business logic relationships of each basic parameter, it performs behavioral modeling analysis, ultimately obtaining the model parameters for each calling user in the target user set. Specifically, for each calling user, the model analysis module can, based on the analysis of the CDR analysis results of the third CDR data, obtain the calling area of ​​the calling user, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of calls between the calling user and the called user. The calling region is determined as follows: the calling device can be assigned a domestic or international region, or a provincial region within China, based on its IP address. For calling users from overseas, the region can be further determined based on the definition of high-risk overseas regions. The frequency of calls initiated by the calling user, N_caller_s, is the number of communications between the domestic video user set C_vdu and the signaling server, as shown in Table 2, N_vdu_c. The call duration between the calling user and the called user, T_caller_v, is the video communication duration between the domestic video user set C_vdu and other communication devices, as shown in Table 2, T_vdu_v. The frequency of video communication by the calling user, N_caller_v, is the number of video communications between C_vdu and other communication devices, as shown in Table 2, N_vdu_v, or the number of users in the overseas video user set C_vfu. The frequency of missed calls by the calling user to the called user, N_caller_f, is the difference between the frequency of calls initiated by the calling user, N_caller_s, and the frequency of video communication by the calling user, N_caller_v. The method for determining the dispersion QTd_call_p of a caller's calls to a called user is as follows: Based on the limited nature of social circles, i.e., a person typically only engages in video communication with people they are familiar with, dispersion can be used to detect abnormal behavior, such as abnormal dispersion of the called number or call area. Based on the called user information marked as Callee in the caller's call frequency N_caller_s and the caller's missed call frequency N_caller_f, the dispersion of the called user's calls to called users per unit time is statistically calculated, including two vectors: number dispersion and area dispersion. When the model analysis module obtains the call area of ​​the caller, the call frequency of the caller, the call duration between the caller and the called user, the missed call frequency of the caller, and the dispersion of the caller's calls to the called user, these parameters are determined as the model parameters for the caller.The extracted basic parameters are shown in Table 2.

[0053] Table 2

[0054] Step 105: Determine the set of illegal video communication users based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users.

[0055] For example, after obtaining the target user set and the model parameters of each calling user in the target user set, the model analysis module uses the weighted factor method to judge suspicious illegal video communication users, and finally obtains the set of illegal video communication users.

[0056] The method for identifying illegal video communication users provided in this application acquires target data, including a user dataset, communication confirmation traffic, and video communication traffic based on video communication software. It then acquires first call detail record (CDR) data corresponding to the user dataset, second CDR data corresponding to the communication confirmation traffic, and third CDR data corresponding to the video communication traffic. Based on the CDR analysis results of the first and second CDR data, a target user set is determined. Based on the CDR analysis results of the third CDR data, model parameters for each calling user in the target user set are determined. Finally, based on the model parameters for each calling user, a set of illegal video communication users is determined. This method achieves automatic identification of illegal video communication users. Furthermore, the identification of illegal video communication users is based on the CDR analysis results of the user dataset, communication confirmation traffic, and video communication traffic corresponding to each of the video communication software, which improves the accuracy of illegal video communication user identification.

[0057] In one embodiment, the target user set includes a first user set, which includes users within the domestic user set who communicate with the Stun server and initiate video connections. The domestic user set includes users corresponding to domestic IP addresses that communicate with the signaling server. The method for determining the illegal video communication user can specifically determine the calling user in the following ways: For each first user in the first user set, if the first user initiates a Stun request, the first user is determined to be the calling user; or, if the communication confirmation traffic detects that the first user is the user receiving the connection request sent by the Stun server, the peer user of the first user is determined to be the calling user.

[0058] The first user set is the domestic video user set shown in Table 2.

[0059] For example, analyzing the data types and order of call detail records (CDRs) for call establishment and communication connections: In the first user set C_vdu within {C_adu, SJ2} that communicates with the Stun server and initiates a media connection, the first user to issue the Stun request is identified as the calling user. If the first user in the first user set C_vdu is the user in SJ2 who receives the connection request from the Stun server, then the peer user of that first user is identified as the calling user. After identifying the calling user, a calling flag (Caller) can be added to the calling user, and a called flag (Callee) can be added to the peer user of the calling user.

[0060] In this embodiment, the first user who sends the Stun request is determined as the calling user, or the first user who receives the connection request from the Stun server is determined as the calling user, thus realizing the automatic determination of the calling user.

[0061] In one embodiment, the target user set further includes a second user set, which includes target users detected in the communication acknowledgment traffic. The target users are users whose IP addresses correspond to the peers of the users in the first user set. The method for determining the illegal video communication user can further determine the calling user in the following ways: For each second user in the second user set, determine the first average message length sent by the second user to the peer user, and determine the second average message length sent by the peer user to the second user; determine the user corresponding to the maximum average message length between the first average message length and the second average message length as the calling user.

[0062] The second user set is the overseas video user set shown in Table 2.

[0063] For example, determine the second average message length L_vdu_v sent by the domestic video user (first user) C_vdu to the overseas video user (second user) in {SJ3, SJ4}, and the first average message length L_vfu_v sent by the overseas video user C_vfu to the domestic video user. Compare the first average message length L_vfu_v and the second average message length L_vdu_v, determine the user corresponding to the maximum average message length as the calling user, add a calling tag Caller to the calling user, and add a called tag Calllee to the other end of the calling user.

[0064] Figure 3 This is a flowchart of the business logic analysis process of the model analysis module provided in this application embodiment, such as... Figure 3As shown, for the domestic video user set C_vdu and the overseas video user set C_vfu, based on the data type and sequence relationship of call detail records (CDRs) of call establishment and communication connection, caller users who meet the caller behavior characteristics are identified, and a caller tag is added to each caller user. A called party tag is added to the other end of the caller user. The call area where the caller user is located, the frequency of the caller user initiating calls, the call duration between the caller user and the called party, the frequency of missed calls by the caller user to the called party, the dispersion of the caller user to the called party, and the frequency of video communication by the caller user are determined.

[0065] In this embodiment, the user corresponding to the maximum average message length is identified as the calling user, thus achieving automatic identification of the calling user. In addition, using two methods to identify the calling user can also improve the accuracy of the calling user identification.

[0066] In one embodiment, Figure 4 This is a second flowchart illustrating the method for determining illegal video communication users provided in this application embodiment, as shown below. Figure 4 As shown, step 105 above determines the set of illegal video communication users based on at least one of the following: the call area where each of the calling users is located, the frequency of each calling user initiating calls, the call duration between each calling user and the called user, the frequency of missed calls by each calling user to the called user, and the dispersion of each calling user to the called user. This can be achieved through the following steps: Step 1051: For each calling user, quantify the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user, to obtain a first quantized value corresponding to the call area, a second quantized value corresponding to the frequency, a third quantized value corresponding to the call duration, a fourth quantized value corresponding to the missed calls, and a fifth quantized value corresponding to the dispersion.

[0067] For example, for each calling user, illegal communication modeling analysis is performed based on five dimensions of model parameters: the calling user's call region, the frequency of calls initiated by the calling user N_caller_s, the call duration between the calling user and the called user T_caller_v, the frequency of missed calls from the calling user to the called user N_caller_f, and the dispersion of calls from the calling user to the called user QTd_call_p. During the modeling analysis, the modeling duration can be determined according to business needs; it can be 1 hour, 1 day, or 1 week, etc. For key targets, data modeling can be extended to a monthly period. The tracking and analysis specifically involves profiling the caller's five-dimensional model parameters. First, the values ​​of these five parameters are quantified. For example, taking the call region as an example, it can be quantified according to the risk level of the call region, divided into highest-risk, high-risk, medium-risk, and low-risk call regions. For instance, the highest-risk call region could be quantified as 1, the high-risk as 0.8, the medium-risk as 0.6, and the low-risk as 0.4, etc., using a tiered assignment method. The parameters for other dimensions are quantified similarly. This tiered assignment method allows for flexible value assignment based on the development of video communication fraud.

[0068] Step 1052: Perform a weighted summation of the first quantized value, the second quantized value, the third quantized value, the fourth quantized value, and the fifth quantized value to obtain a weighted quantized value.

[0069] For example, Table 3 shows the correspondence between the parameter names, codes, weights, and default weight priorities of the model parameters for these five dimensions. Using the weights and default weight priorities of each model parameter shown in Table 3, the weighted quantization value is calculated based on the judgment function represented by the following formula (1): (1)

[0070] Among them, the quantization function This indicates that the model parameters across five dimensions are quantified according to preset standards. For example, the preset standard for the call area is quantification based on risk level. W This indicates the default priority of the weights in the judgment function. The larger the default priority number, the higher the priority, and the greater the influence of the corresponding model parameters on the judgment of illegal video communication users.

[0071] Table 3

[0072] Step 1053: If the weighted quantization value is greater than a preset threshold, determine that the calling user is an illegal video communication user.

[0073] For example, when the weighted quantization value is obtained, the weighted quantization value is compared with a preset threshold. If the weighted quantization value is greater than the preset threshold, the calling user corresponding to the weighted quantization value is determined to be an illegal video communication user. If the weighted quantization value is less than or equal to the preset threshold, the calling user corresponding to the weighted quantization value is determined to be a legal video communication user. For each calling user, the same method is used to finally determine the set of illegal video communication users. Specifically, the set of illegal video communication users can be determined based on the following formula (2). The IP address of the communication device of each user in the set of illegal video communication users is stored in the address database to obtain the illegal user address database, thereby realizing the monitoring of illegal video communication based on behavior modeling.

[0074] (2)

[0075] in, This represents the set of users engaging in illegal video communication. When the weighted quantization value exceeds a preset threshold, When the weighted quantization value is less than or equal to a preset threshold, ,Will The corresponding calling users were identified as part of an illegal video communication user set. This indicates a preset threshold.

[0076] Figure 5 This is a flowchart illustrating the behavior modeling and analysis algorithm provided in an embodiment of this application, as shown below. Figure 5 As shown, for the calling user, the calling region, the frequency of calls initiated by the calling user N_caller_s, the call duration between the calling user and the called user T_caller_v, the frequency of missed calls from the calling user to the called user N_caller_f, and the dispersion of calls from the calling user to the called user QTd_call_p are quantized by quantization processor 1 (Quantize 1), quantization processor 2 (Quantize 2), quantization processor 3 (Quantize 3), quantization processor 4 (Quantize 4), and quantization processor 5 (Quantize 5), respectively. The quantization results are then weighted and summed to obtain a weighted quantization value. If the weighted quantization value is greater than a preset threshold, the calling user is determined to be an illegal video communication user. If the weighted quantization value is less than or equal to the preset threshold, the calling user is determined to be a legitimate video communication user.

[0077] In this embodiment, the model parameters of the calling user in five dimensions are quantized, and the illegal video communication user is determined based on the comparison between the quantized values ​​and the preset threshold. Since the model parameters in five dimensions are typical parameters that can represent the video communication behavior of the calling user, the accuracy of determining illegal video communication users can be improved.

[0078] In one embodiment, prior to step 101 above, the method for determining the illegal video communication user further includes the following steps: The reference threshold is obtained by weighted summing of the quantized values ​​corresponding to the highest risk call area, the preset maximum call frequency, the preset maximum call duration, the preset maximum missed call frequency, and the preset maximum dispersion; the preset threshold is then determined based on the reference threshold.

[0079] For example, the maximum value of the model parameters for each dimension is taken, that is, the weighted sum of the quantized values ​​corresponding to the highest risk call area, the preset maximum call frequency, the preset maximum call duration, the preset maximum missed call frequency, and the preset maximum dispersion, to obtain the reference threshold. The reference threshold is then multiplied by the default coefficient to obtain the preset threshold. Specifically, the preset threshold is represented by the following formula (3): (3)

[0080] in, This represents the default coefficient. The value of K can be set according to requirements. Preferably, K can be set to 60%.

[0081] In this embodiment, a preset threshold for determining whether a user is an illegal video communication user is determined based on the quantization value corresponding to the highest risk call area, the preset maximum call frequency, the preset maximum call duration, the preset maximum missed call frequency, and the preset maximum dispersion, so as to improve the accuracy of identifying illegal video communication users.

[0082] In one embodiment, the determination of model parameters for each calling user in the target user set based on the call detail record (CDR) analysis results of the third CDR data in step 104 above can be implemented in the following way: Obtain target messages related to video communication services, including signaling messages and / or data messages; determine model parameters for each calling user in the target user set based on the call detail record (CDR) analysis results of the third CDR data and the target messages.

[0083] For example, the DPI monitoring module can mirror signaling and / or data packets related to video communication services according to system requirements. Data packets include, for example, the first N packets specified in the service session. The mirrored signaling and / or data packets are then sent to the model analysis module for data augmentation analysis. Specifically, the model analysis module receives the signaling and / or data packets sent by the DPI monitoring module and the call detail record (CDR) data sent by the XDR CDR analysis module. It then merges the signaling and / or data packets sent by the DPI monitoring module with the CDR analysis results from the XDR CDR analysis module to form comprehensive user video communication behavior data. Key features, such as video communication traffic characteristics and signaling packet characteristics, are extracted from the merged user video communication behavior data. The extracted key features are then used to determine the model parameters of the calling user.

[0084] It should be noted that the model analysis module can be a module obtained by continuously optimizing model parameters through machine learning or deep learning algorithms. The specific training process of the model analysis module is as follows: obtain sample call detail record (CDR) analysis results, sample signaling messages, and sample data messages from multiple sample users; input these CDR analysis results, sample signaling messages, and sample data messages into the initial model analysis module to obtain the predicted model parameters for each sample user output by the initial model analysis module; and adjust the model parameters of the initial model analysis module based on the predicted model parameters and model parameter labels for each sample user until the convergence condition is met, thus obtaining the final model analysis module.

[0085] In this embodiment, the model analysis module determines the model parameters of each calling user in the target user set based on the third call detail record data and the target message, and uses the target message as data augmentation analysis, thereby improving the accuracy of model parameter determination and further improving the accuracy of identifying illegal video communication users.

[0086] Figure 6 This is an architecture diagram of the system for determining illegal video communication users provided in the embodiments of this application, such as... Figure 6 As shown, the system for identifying illegal video communication users includes communication equipment of domestic video communication users, backbone routers, international exit routers, service servers, communication equipment and monitoring equipment of overseas video communication users. The monitoring equipment includes a DPI monitoring module, an XDR call detail record analysis module, a model analysis module, and an illegal user address database. Figure 7 This is one of the overall flowcharts of the method for determining illegal video communication users provided in the embodiments of this application. Figure 8 This is the second overall flowchart of the system for determining illegal video communication users provided in the embodiments of this application, as follows: Figure 7 and Figure 8As shown, the DPI monitoring module collects user datasets SJ1, communication confirmation traffic SJ2, NAT-penetrating video communication traffic SJ3, and non-NAT-penetrating video communication traffic SJ4 from the international internet gateway for video communication using video communication software. It mirrors the signaling messages and / or data packets related to the video communication service according to system requirements, and obtains the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic. Each CDR data is then sent to the XDR CDR analysis module. The XDR CDR analysis module performs CDR analysis on the first, second, and third CDR data to obtain the CDR analysis results for the first, second, and third CDR data. The XDR call detail record (CDR) analysis module sends the CDR analysis results to the model analysis module. The DPI monitoring module also sends the mirrored video communication service-related signaling and / or data packets to the model analysis module. The model analysis module determines the target user set based on the CDR analysis results of the first and second CDR data, and determines the calling user's model parameters based on the signaling and / or data packets and the CDR analysis results of the third CDR data. The calling user's model parameters include the calling region where the calling user is located and the frequency N_calle of the calling user initiating calls. The system uses the following parameters: r_s, call duration T_caller_v, missed calls N_caller_f, and discreteness QTd_call_p. Based on these parameters, a weighted factor method is used to determine whether a user is an illegal video communication user. This results in a set of illegal video communication users, which is stored in an illegal user address database. This database is then reported to relevant departments to investigate and pinpoint the source of fraud. Combined with blocking and other measures, this reduces the risk of users receiving video calls and minimizes financial losses for the public.

[0087] This application is applicable to the monitoring of overseas video communication fraud, particularly for modeling and analyzing video communication services initiated from high-risk overseas fraud areas. It monitors and identifies the IP addresses of video communication users in these areas with high frequency, high dispersion, and a high frequency of missed calls within a specified time period, establishing a database of illegal user addresses for further verification and handling by relevant departments. This application can also be extended to the monitoring of video communication fraud, thereby addressing scenarios where telecommunications fraud gangs remotely control and use "GOIP devices" located within China to initiate video communications with victims to commit fraud. Furthermore, this application uses user IP addresses as identifiers for illegal video communication users. However, since criminals may use virtual IPs or IP address proxy technologies, the issue of tracing the IP address back to the actual fraudulent terminal still needs to be considered in practical applications.

[0088] The apparatus for determining illegal video communication users provided in this application is described below. The apparatus for determining illegal video communication users described below can be referred to in correspondence with the method for determining illegal video communication users described above.

[0089] Figure 9 This is a schematic diagram of the structure of the device for determining illegal video communication users provided in the embodiments of this application, as shown below. Figure 9 As shown, the device 900 for identifying illegal video communication users includes a first acquisition unit 901, a second acquisition unit 902, an analysis unit 903, a first determination unit 904, and a second determination unit 905; wherein: The first acquisition unit 901 is used to acquire target data, which includes user datasets, communication confirmation traffic and video communication traffic based on video communication software, communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and video communication traffic is the traffic generated by the called user in the calling user domain during the video communication process. The second acquisition unit 902 is used to acquire the first call detail record data corresponding to the user dataset, the second call detail record data corresponding to the communication confirmation traffic, and the third call detail record data corresponding to the video communication traffic. Analysis unit 903 is used to input the first call detail record (CDR) data, the second CDR data, and the third CDR data into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the second CDR data, and the third CDR data output by the CDR analysis model. The first determining unit 904 is used to determine a target user set based on the call detail record (CDR) analysis results of the first CDR data and the CDR analysis results of the second CDR data, and to determine the model parameters of each calling user in the target user set based on the CDR analysis results of the third CDR data. The model parameters include at least one of the following: the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user. The second determining unit 905 is used to determine the set of illegal video communication users based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users.

[0090] The device for identifying illegal video communication users provided in this application acquires target data, including a user dataset, communication confirmation traffic, and video communication traffic based on video communication software. It then acquires first call detail record (CDR) data corresponding to the user dataset, second CDR data corresponding to the communication confirmation traffic, and third CDR data corresponding to the video communication traffic. Based on the CDR analysis results of the first and second CDR data, it determines a target user set. Based on the CDR analysis results of the third CDR data, it determines the model parameters of each calling user in the target user set. Based on the model parameters of each calling user, it determines a set of illegal video communication users. This achieves automatic identification of illegal video communication users. Furthermore, the identification of illegal video communication users is based on the CDR analysis results of the user dataset, communication confirmation traffic, and video communication traffic corresponding to each of the video communication software, which improves the accuracy of illegal video communication user identification.

[0091] Based on any of the above embodiments, the target user set includes a first user set, which includes users in the domestic user set who communicate with the Stun server and initiate video connections, and the domestic user set includes users corresponding to domestic IP addresses that communicate with the signaling server; the illegal video communication user determination device 900 further includes: The third determining unit is used to determine the first user as the calling user when the first user initiates a STUN request, or to determine the peer user of the first user as the calling user when the communication confirmation traffic detects that the first user is the user receiving the connection request sent by the STUN server.

[0092] Based on any of the above embodiments, the target user set further includes a second user set, the second user set including target users detected in the communication confirmation traffic, the target users being users corresponding to the IP addresses of the peers of users in the first user set; the illegal video communication user determination device 900 further includes: The fourth determining unit is used to determine, for each second user in the second user set, the first average message length sent by the second user to the peer user, and the second average message length sent by the peer user to the second user. The fifth determining unit is used to determine the user corresponding to the maximum average message length between the first average message length and the second average message length as the calling user.

[0093] Based on any of the above embodiments, the second determining unit 905 is specifically used for: For each calling user, the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user are quantized to obtain a first quantized value corresponding to the call area, a second quantized value corresponding to the frequency, a third quantized value corresponding to the call duration, a fourth quantized value corresponding to the missed call frequency, and a fifth quantized value corresponding to the dispersion. The first quantized value, the second quantized value, the third quantized value, the fourth quantized value, and the fifth quantized value are weighted and summed to obtain a weighted quantized value; If the weighted quantization value is greater than a preset threshold, the calling user is determined to be an illegal video communication user.

[0094] Based on any of the above embodiments, the device for determining illegal video communication users further includes: The calculation unit is used to perform a weighted summation of the quantized values ​​corresponding to the highest risk call area, the preset maximum call frequency, the preset maximum call duration, the preset maximum missed call frequency, and the preset maximum dispersion to obtain a reference threshold. The sixth determining unit is used to determine the preset threshold based on the reference threshold.

[0095] Based on any of the above embodiments, the first determining unit 904 is specifically used for: Acquire target messages related to video communication services, wherein the target messages include signaling messages and / or data messages; Based on the call detail record (CDR) analysis results of the third CDR data and the target message, the model parameters of each calling user in the target user set are determined.

[0096] Figure 10 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application, such as... Figure 10As shown, the electronic device may include a processor 1010, a communications interface 1020, a memory 1030, and a communication bus 1040. The processor 1010, communications interface 1020, and memory 1030 communicate with each other via the communication bus 1040. The processor 1010 can call logical instructions in the memory 1030 to execute a method for determining illegal video communication users. This method includes: acquiring target data, which includes a user dataset for video communication based on video communication software, communication confirmation traffic, and video communication traffic. The communication confirmation traffic is the traffic generated during communication confirmation in the video communication connection process, and the video communication traffic is the traffic generated by the called user in the calling user domain during video communication. Obtain the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic; The first call detail record (CDR) data, the second CDR data, and the third CDR data are input into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the CDR analysis results of the second CDR data, and the CDR analysis results of the third CDR data output by the CDR analysis model. Based on the call detail record (CDR) analysis results of the first and second CDR data, a target user set is determined. Based on the CDR analysis results of the third CDR data, model parameters for each calling user in the target user set are determined. The model parameters include at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of calls by the calling user to the called user. The set of illegal video communication users is determined based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users.

[0097] Furthermore, the logical instructions in the aforementioned memory 1030 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0098] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the method for determining illegal video communication users provided by the above methods. The method includes: acquiring target data, which includes a user dataset for video communication based on video communication software, communication confirmation traffic, and video communication traffic. The communication confirmation traffic is the traffic generated when communication confirmation is performed during the video communication connection process, and the video communication traffic is the traffic generated by the called user in the calling user domain during the video communication process. Obtain the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic; The first call detail record (CDR) data, the second CDR data, and the third CDR data are input into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the CDR analysis results of the second CDR data, and the CDR analysis results of the third CDR data output by the CDR analysis model. Based on the call detail record (CDR) analysis results of the first and second CDR data, a target user set is determined. Based on the CDR analysis results of the third CDR data, model parameters for each calling user in the target user set are determined. The model parameters include at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of calls by the calling user to the called user. The set of illegal video communication users is determined based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users.

[0099] In another aspect, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program is implemented to perform the method for determining illegal video communication users provided by the above methods. The method includes: acquiring target data, the target data including a user dataset for video communication based on video communication software, communication confirmation traffic, and video communication traffic, wherein the communication confirmation traffic is the traffic generated during communication confirmation in the video communication connection process, and the video communication traffic is the traffic generated by the called user in the calling user domain during the video communication process. Obtain the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic; The first call detail record (CDR) data, the second CDR data, and the third CDR data are input into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the CDR analysis results of the second CDR data, and the CDR analysis results of the third CDR data output by the CDR analysis model. Based on the call detail record (CDR) analysis results of the first and second CDR data, a target user set is determined. Based on the CDR analysis results of the third CDR data, model parameters for each calling user in the target user set are determined. The model parameters include at least one of the following: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of calls by the calling user to the called user. The set of illegal video communication users is determined based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users.

[0100] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0101] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for determining an illegal video communication user, characterized in that, include: Acquire target data, which includes user datasets, communication confirmation traffic, and video communication traffic based on video communication software. The communication confirmation traffic is the traffic generated during communication confirmation in the video communication connection process, and the video communication traffic is the traffic generated by the calling user and the called user during video communication. Obtain the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic; The first call detail record (CDR) data, the second CDR data, and the third CDR data are input into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the CDR analysis results of the second CDR data, and the CDR analysis results of the third CDR data output by the CDR analysis model. Based on the call detail record (CDR) analysis results of the first and second CDR data, a target user set is determined. Based on the CDR analysis results of the third CDR data, model parameters for each calling user in the target user set are determined. The model parameters include: the call area where the calling user is located, the frequency of calls initiated by the calling user, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of calls by the calling user to the called user. The set of illegal video communication users is determined based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users. The target user set includes a first user set, which includes users within the domestic user set who communicate with the Stun server and initiate video connections. The domestic user set includes users corresponding to domestic IP addresses that communicate with the signaling server. The method further includes: For each first user in the first user set, if the first user initiates a Stun request, the first user is determined to be the calling user; or, if the communication confirmation traffic detects that the first user is the user receiving the connection request sent by the Stun server, the peer user of the first user is determined to be the calling user. The target user set further includes a second user set, which includes target users detected in the communication acknowledgment traffic, wherein the target users are users corresponding to the IP addresses of the peers of the users in the first user set; the method further includes: For each second user in the second user set, determine the first average message length sent by the second user to the peer user, and determine the second average message length sent by the peer user to the second user. The user corresponding to the maximum average message length between the first average message length and the second average message length is determined as the calling user.

2. The method for determining illegal video communication users according to claim 1, characterized in that, The determination of the illegal video communication user set is based on at least one of the following: the call area of ​​each calling user, the frequency of calls initiated by each calling user, the call duration between each calling user and the called user, the frequency of missed calls by each calling user to the called user, and the dispersion of calls by each calling user to the called user. For each calling user, the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user are quantized to obtain a first quantized value corresponding to the call area, a second quantized value corresponding to the frequency, a third quantized value corresponding to the call duration, a fourth quantized value corresponding to the missed call frequency, and a fifth quantized value corresponding to the dispersion. The first quantized value, the second quantized value, the third quantized value, the fourth quantized value, and the fifth quantized value are weighted and summed to obtain a weighted quantized value; If the weighted quantization value is greater than a preset threshold, the calling user is determined to be an illegal video communication user.

3. The method for determining illegal video communication users according to claim 2, characterized in that, The method further includes: The reference threshold is obtained by weighting and summing the quantized values ​​corresponding to the highest risk call area, the preset maximum call frequency, the preset maximum call duration, the preset maximum missed call frequency, and the preset maximum dispersion. The preset threshold is determined based on the reference threshold.

4. The method for determining illegal video communication users according to any one of claims 1-3, characterized in that, The model parameters for each calling user in the target user set are determined based on the call detail record (CDR) analysis results from the third CDR data, including: Acquire target messages related to video communication services, wherein the target messages include signaling messages and / or data messages; Based on the call detail record (CDR) analysis results of the third CDR data and the target message, the model parameters of each calling user in the target user set are determined.

5. A device for identifying illegal video communication users, characterized in that, include: The first acquisition unit is used to acquire target data, which includes a user dataset, communication confirmation traffic, and video communication traffic based on video communication software. The communication confirmation traffic is the traffic generated when communication is confirmed during the video communication connection process, and the video communication traffic is the traffic generated by the calling user and the called user during the video communication process. The second acquisition unit is used to acquire the first call detail record (CDR) data corresponding to the user dataset, the second CDR data corresponding to the communication confirmation traffic, and the third CDR data corresponding to the video communication traffic. The analysis unit is used to input the first call detail record (CDR) data, the second CDR data, and the third CDR data into the CDR analysis model to obtain the CDR analysis results of the first CDR data, the CDR analysis results of the second CDR data, and the CDR analysis results of the third CDR data output by the CDR analysis model. The first determining unit is used to determine a target user set based on the call detail record (CDR) analysis results of the first CDR data and the CDR analysis results of the second CDR data, and to determine the model parameters of each calling user in the target user set based on the CDR analysis results of the third CDR data. The model parameters include: the call area where the calling user is located, the frequency of the calling user initiating calls, the call duration between the calling user and the called user, the frequency of missed calls by the calling user to the called user, and the dispersion of the calling user to the called user. The second determining unit is used to determine the set of illegal video communication users based on at least one of the following: the call area where each of the calling users is located, the frequency of each of the calling users initiating calls, the call duration between each of the calling users and the called users, the frequency of missed calls by each of the calling users to the called users, and the dispersion of each of the calling users to the called users. The target user set includes a first user set, which includes users within the domestic user set who communicate with the Stun server and initiate video connections. The domestic user set includes users corresponding to domestic IP addresses that communicate with the signaling server. The device further includes: The third determining unit is used to determine the first user as the calling user when the first user initiates a Stun request, or to determine the peer user of the first user as the calling user when the communication confirmation traffic detects that the first user is the user receiving the connection request sent by the Stun server. The target user set further includes a second user set, which includes target users detected in the communication acknowledgment traffic, wherein the target users are users corresponding to the IP addresses of the peers of the users in the first user set; the device further includes: The fourth determining unit is used to determine, for each second user in the second user set, the first average message length sent by the second user to the peer user, and the second average message length sent by the peer user to the second user. The fifth determining unit is used to determine the user corresponding to the maximum average message length between the first average message length and the second average message length as the calling user.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method for determining illegal video communication users as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method for determining illegal video communication users as described in any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method for determining illegal video communication users as described in any one of claims 1 to 4.

Images