Anti-fraud management method and device

Abstract

The invention provides an anti-fraud management method and device. The method is applied to the technical field of telephone security, and comprises the following steps: determining regional characteristics of corresponding numbers according to obtained signaling data corresponding to each number; clustering the numbers with the same regional characteristics to obtain a plurality of target regions; according to the number of fraud-related numbers and the number of risk numbers in the target area, calculating to obtain a corresponding area risk value; determining the risk level of the corresponding target area according to the area risk value; and performing anti-fraud management on the number corresponding to the target area according to the risk level. In this way, the efficiency of anti-fraud management can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of telephone security technology, and in particular to an anti-fraud management method and device. Background Art

[0002] Telephone fraud is a common form of fraud. Fraudsters disguise themselves as legitimate institutions or individuals and use false information to induce victims to provide personal information or transfer money, thereby illegally obtaining property. As a communication service provider, operators can play an important role in the front line of telephone communications. By implementing telephone anti-fraud management measures, they can effectively protect users' property safety and reduce economic losses caused by fraud. Operators can enhance users' awareness of telephone fraud prevention through SMS reminders, telephone reminders, anti-fraud education, etc., so that users will be more alert and confident when facing possible fraudulent behaviors, thereby improving users' satisfaction and trust in operator services. Large-scale telephone fraud cases may lead to a decline in public trust in financial institutions and social systems, thereby affecting social stability. By strengthening telephone anti-fraud management, operators can effectively reduce the frequency of fraud cases, thereby helping to maintain social stability and order, and help improve the overall sense of security in society and promote the harmonious development of society. Many countries and regions have issued laws and regulations against telephone fraud, and operators, as the main communication service providers, need to strictly abide by these regulations and implement them. By implementing effective anti-fraud measures, operators not only help users avoid risks, but also provide a solid foundation for the implementation of laws and regulations, thereby promoting the improvement and development of the legal system.

[0003] At present, existing operators usually judge fraudulent behavior based on call characteristics and algorithm models in signaling data when conducting anti-fraud management. However, since the algorithm models are directly deployed and controlled in provinces or cities under the jurisdiction of the operators, they have low differentiation among users and may accidentally harm normal users during anti-fraud management, resulting in low efficiency of anti-fraud management. Summary of the invention

[0004] The present invention provides an anti-fraud management method and device.

[0005] According to a first aspect of the present disclosure, an anti-fraud management method is provided. The method comprises: Determine the regional characteristics of the corresponding numbers according to the acquired signaling data corresponding to each number; Clustering numbers with the same regional characteristics to obtain multiple target areas; calculating corresponding regional risk values ​​according to the number of fraudulent numbers and the number of risky numbers in the target area; According to the regional risk value, the risk level of the corresponding target area is determined; according to the risk level, anti-fraud management is performed on the numbers corresponding to the target area.

[0006] Furthermore, the signaling data includes: calling number, called number, call time, call duration, province code, city code, base station code and cell code within a preset time period.

[0007] Further, the calculating of the corresponding regional risk value according to the number of fraudulent numbers and the number of risky numbers in the target area includes: Obtaining each number in the target area; If the call duration corresponding to the number is less than M seconds and / or the province code is empty and / or the city code is empty and / or the base station code is empty and / or the cell code is empty, the corresponding number is determined to be a risk number; M is the duration threshold; The risk number is matched with the fraud number database in the public security system. If the match is successful, the corresponding risk number is determined to be a fraud-related number; Based on the number of risky numbers and the number of fraudulent numbers, the corresponding regional risk value is calculated.

[0008] Furthermore, the method of calculating the corresponding regional risk value according to the number of fraudulent numbers and the number of risky numbers in the target area further includes: Obtaining each number in the target area; If there are more than Z numbers under the same user ID that make calls in different areas on the same day, the corresponding number is determined to be a risky number; Z is the number threshold; If the number of non-roaming call attempts on the day the number is added to the network is less than C1 times, the corresponding number is determined to be a risk number; C1 is the first number threshold; If the number has been silent for more than T days, and the call frequency of roaming to other places is greater than C2 times, and the caller ratio is ≥ B, and the number of called times is less than C3 times, then the corresponding number is determined to be a risk number; T is the day threshold; C2 is the second number threshold; B is the percentage threshold; C3 is the third number threshold; The risk number is matched with the fraud number database in the public security system. If the match is successful, the corresponding risk number is determined to be a fraud-related number; Based on the number of risky numbers and the number of fraudulent numbers, the corresponding regional risk value is calculated.

[0009] Furthermore, the calculation formula of the regional risk value is: ; Where P is the regional risk value; P f is the number of fraudulent numbers; P n is the number of risky numbers; k is the risk coefficient.

[0010] Further, determining the risk level of the corresponding target area according to the regional risk value includes: Select the highest regional risk value Pmax from the regional risk values; If the regional risk value = 0, the risk level of the corresponding target area is determined to be no risk; If 0<regional risk value≤D1×Pmax, the risk level of the corresponding target area is judged to be low risk; where D1 is the first level coefficient; If D1×Pmax<regional risk value≤D2×Pmax, the risk level of the corresponding target area is determined to be medium risk; wherein D2 is the second level coefficient, and 0<D1<D2<1; If D2×Pmax<regional risk value≤Pmax, the risk level of the corresponding target area is determined to be high risk.

[0011] Furthermore, the anti-fraud management of the numbers corresponding to the target area according to the risk level includes: If the risk level of the target area is no risk, the first management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; If the risk level of the target area is low risk, the second management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; If the risk level of the target area is medium risk, the third management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; If the risk level of the target area is high risk, the fourth management method is adopted to perform anti-fraud management on the numbers corresponding to the target area.

[0012] Furthermore, the method further comprises: Obtain fraudulent numbers in the target area; Analyze the position movement and track breaking characteristics of the fraudulent number to obtain a first approach degree; If the first approach degree ≤ Q1, the risk level of the target area corresponding to the secondary judgment is high risk; where Q1 is the first approach coefficient; If Q1<first approach coefficient≤Q2, the risk level of the target area corresponding to the secondary judgment is medium risk; wherein Q2 is the second approach coefficient; If Q2<first approach coefficient≤Q3, the risk level of the target area corresponding to the secondary judgment is low risk; wherein Q3 is the third approach coefficient, and 0<Q1<Q2<Q3<1.

[0013] Furthermore, the method further comprises: Obtain fraudulent numbers in the target area; Analyze the cyclic change trajectory characteristics of the fraudulent number under LAC to obtain the second approximation degree; If the second approach degree ≤ Q4, the risk level of the target area corresponding to the second judgment is high risk; wherein Q4 is the fourth approach coefficient; If Q4<second approach degree≤Q5, the risk level of the target area corresponding to the secondary judgment is medium risk; wherein Q5 is the fifth approach coefficient; If Q5<second approach coefficient≤Q6, the risk level of the target area corresponding to the secondary judgment is low risk; wherein Q6 is the sixth approach coefficient, and 0<Q4<Q5<Q6<1.

[0014] According to a second aspect of the present disclosure, an anti-fraud management device is provided. The device comprises: A determination module, used to determine the regional characteristics of the corresponding number based on the acquired signaling data corresponding to each number; A calculation module is used to cluster numbers with the same regional characteristics to obtain multiple target areas; and calculate the corresponding regional risk value according to the number of fraudulent numbers and the number of risky numbers in the target area; The management module is used to determine the risk level of the corresponding target area according to the regional risk value; and perform anti-fraud management on the numbers corresponding to the target area according to the risk level.

[0015] According to a third aspect of the present disclosure, an electronic device is provided. The electronic device includes: a memory and a processor, wherein a computer program is stored in the memory, and the method is implemented when the processor executes the program.

[0016] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and the program implements the method when executed by a processor.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: by clustering numbers with the same regional characteristics, the risk level of each target area can be clearly identified, and the fraud risk of different areas can be assessed more accurately, rather than relying solely on a single number or local data; with the continuous updating of signaling data, the risk level of each area can be dynamically adjusted, and new fraud risks can be discovered in a timely manner and potential threats can be responded to quickly; determining the risk level based on the regional risk value can help operators or anti-fraud agencies allocate resources and formulate strategies more effectively, thereby improving the efficiency of anti-fraud; by conducting risk assessments on target areas, more targeted anti-fraud strategies can be formulated, key prevention and control can be carried out, and the efficiency of anti-fraud can be improved.

[0018] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein: Figure 1 A flow chart of an anti-fraud management method according to an embodiment of the present disclosure is shown; Figure 2 A block diagram of an anti-fraud management device according to an embodiment of the present disclosure is shown; Figure 3 A block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0021] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0022] Figure 1 A flowchart of an anti-fraud management method 100 according to an embodiment of the present disclosure is shown. The method 100 includes: S101, determining the regional characteristics of the corresponding numbers according to the acquired signaling data corresponding to the numbers.

[0023] In some embodiments, the regional characteristics of the corresponding numbers are determined based on the acquired signaling data corresponding to each number, which can be specifically: extracting relevant information from the acquired signaling data of the number, for example, the "caller number", "recipient number" and "call time" in the call record; constructing a feature library containing the correspondence between telephone number prefixes and regions. This feature library can be based on the country's telephone area code allocation rules, for example, China's telephone area codes (such as 010 for Beijing, 021 for Shanghai), and the United States' telephone area codes (such as 212 for New York City); matching the regional information in the feature library based on the prefix of the telephone number, for example, the prefix of the telephone number "01012345678" is "010", and according to the feature library, the regional characteristic of this number is "Beijing".

[0024] In some embodiments, the regional characteristics of the corresponding numbers are determined based on the acquired signaling data corresponding to each number. Specifically, relevant information can be extracted from the acquired signaling data of the number, such as the "caller number", "receiver number" and "call time" in the call record; a feature library containing the correspondence between the telephone number prefix and the region is constructed. This feature library can be based on the country's telephone area code allocation rules, such as China's telephone area code (such as 010 for Beijing, 021 for Shanghai), and the United States' telephone area code (such as 212 for New York City). Combined with the data in the call record, the active area of ​​the phone is further confirmed and analyzed. For example, there are the following telephone numbers and signaling data: telephone number 01012345678 has called numbers from Beijing many times, and telephone number 02198765432 has called numbers from Shanghai many times; the prefixes of the telephone numbers "01012345678" and "02198765432" are extracted from the signaling data; combined with the call records, analysis is performed to confirm that "01012345678" often calls numbers in Beijing, and its regional feature is confirmed to be "Beijing", and "02198765432" often calls numbers in Shanghai, and its regional feature is confirmed to be "Shanghai"; finally, the regional feature corresponding to each telephone number is output, for example, the regional feature of the telephone number "01012345678" is "Beijing", and the regional feature of the telephone number "02198765432" is "Shanghai".

[0025] In some embodiments, the signaling data includes: the calling number (such as 12345612345), the called number (such as 12345123456), the call time (such as 2024-08-29 14:00:00), the call duration (such as 300 seconds), the province code (such as 11), the city code (such as 010), the base station code (such as 1234567) and the cell code (such as 7654321) within a preset time period.

[0026] S102, clustering numbers with the same regional characteristics to obtain multiple target areas; and calculating corresponding regional risk values ​​according to the number of fraudulent numbers and the number of risky numbers in the target areas.

[0027] In some embodiments, the calculation of the corresponding regional risk value according to the number of fraudulent numbers and the number of risk numbers in the target area includes: obtaining each number in the target area; if the call duration corresponding to the number is less than 1 second, the corresponding number is determined to be a risk number; in some embodiments, if the number corresponds to , the corresponding number is determined to be a risk number; in some embodiments, if the province code corresponding to the number is empty, the corresponding number is determined to be a risk number; in some embodiments, if the city code corresponding to the number is empty, the corresponding number is determined to be a risk number; in some embodiments, if the base station code corresponding to the number is empty, the corresponding number is determined to be a risk number; in some embodiments, if the cell code corresponding to the number is empty, the corresponding number is determined to be a risk number; in some embodiments, if the number corresponds to , the corresponding number is determined to be a risk number; in some embodiments, if the number corresponds to , the corresponding number is determined to be a risk number; The risk number is matched with the fraud number database in the public security system. If the match is successful (i.e. the risk number has been confirmed by the public security system as a number that has been used for fraudulent activities), the corresponding risk number is determined to be a fraudulent number; Based on the number of risky numbers and the number of fraudulent numbers, the corresponding regional risk value is calculated.

[0028] According to the embodiments of the present invention, by setting multiple judgment conditions (such as call duration, missing code, etc.), risk numbers can be accurately identified and the misjudgment rate can be reduced; covering multi-dimensional information of the number (such as province code, base station code, etc.), it helps to deeply analyze the authenticity and risk level of the number; matching the risk number with the fraud number database of the public security system can quickly confirm whether the number involves fraud, thereby improving recognition efficiency; calculating the regional risk value based on the number of risk numbers and fraud-related numbers helps to assess the fraud risk in a specific area and optimize anti-fraud strategies; realizing automated risk number judgment and matching, reducing manual intervention, and improving system response speed and accuracy, thereby improving the efficiency of anti-fraud management.

[0029] In some embodiments, the calculation of the corresponding regional risk value according to the number of fraudulent numbers and the number of risk numbers in the target area also includes: obtaining each number in the target area; if there are more than two numbers under the same user ID that make calls in different areas on the same day, the corresponding number is determined to be a risk number; in some embodiments, if the number of non-roaming call attempts on the day the number is connected to the network is less than 5 times, the corresponding number is determined to be a risk number; in some embodiments, if the number is silent for more than 4 days, and the frequency of roaming calls to a different place is greater than 15 times, and the calling proportion is ≥80%, and the number of called times is less than 8 times, the corresponding number is determined to be a risk number; The risk number is matched with the fraud number database in the public security system. If the match is successful, the corresponding risk number is determined to be a fraud-related number; Based on the number of risky numbers and the number of fraudulent numbers, the corresponding regional risk value is calculated.

[0030] In some embodiments, the calculation formula of the regional risk value may be: ; Where P is the regional risk value; P f is the number of fraudulent numbers; P n is the number of risk numbers.

[0031] S103, determining the risk level of the corresponding target area according to the regional risk value; and performing anti-fraud management on the numbers corresponding to the target area according to the risk level.

[0032] In some embodiments, determining the risk level of the corresponding target area based on the regional risk value includes: selecting the highest regional risk value Pmax from the regional risk values; if the regional risk value = 0, then determining the risk level of the corresponding target area is no risk; if 0<regional risk value ≤ 0.3×Pmax, then determining the risk level of the corresponding target area is low risk; if 0.3×Pmax<regional risk value ≤ 0.6×Pmax, then determining the risk level of the corresponding target area is medium risk; if 0.6×Pmax<regional risk value ≤ Pmax, then determining the risk level of the corresponding target area is high risk.

[0033] According to an embodiment of the present invention, by defining clear risk levels (no risk, low risk, medium risk, high risk), it can help relevant departments or institutions to better understand and manage risk situations, so as to take corresponding countermeasures; using regional risk values ​​to compare with the highest regional risk values ​​can accurately assess the risk level of each region, avoiding the subjective problem caused by absolute values; setting multiple risk levels (low, medium, high) can refine risk management strategies, help to allocate resources more accurately and take preventive measures; based on the relative calculation of regional risk values, the risk level assessment can be automatically adjusted as the data changes, with strong adaptability and the ability to timely reflect the actual risk situation; the risk level division rules are simple and easy to understand, easy to implement and communicate, which can help managers make decisions quickly and convey information to relevant personnel or departments, thereby improving the efficiency of anti-fraud management.

[0034] In other embodiments, determining the risk level of the corresponding target area based on the regional risk value includes: selecting the highest regional risk value Pmax from the regional risk values; if the regional risk value = 0, then determining the risk level of the corresponding target area is no risk; if 0<regional risk value ≤ 0.2×Pmax, then determining the risk level of the corresponding target area is low risk; if 0.2×Pmax<regional risk value ≤ 0.6×Pmax, then determining the risk level of the corresponding target area is medium risk; if 0.6×Pmax<regional risk value ≤ Pmax, then determining the risk level of the corresponding target area is high risk.

[0035] In some embodiments, the anti-fraud management is performed on the numbers corresponding to the target area according to the risk level, including: if the risk level of the target area is no risk, a first management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; if the risk level of the target area is low risk, a second management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; if the risk level of the target area is medium risk, a third management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; if the risk level of the target area is high risk, a fourth management method is adopted to perform anti-fraud management on the numbers corresponding to the target area.

[0036] For example, if the risk level of the target area is no risk, no action will be taken on the corresponding number; if the risk level of the target area is low risk, online authentication management will be performed on the corresponding number; if the risk level of the target area is medium risk, offline authentication management will be performed on the corresponding number; if the risk level of the target area is high risk, online and offline authentication management will be shut down for the corresponding number.

[0037] According to an embodiment of the present invention, by implementing different management measures according to risk levels, anti-fraud management is made more targeted and effective; through risk grading, resources can be reasonably allocated, more preventive measures can be concentrated on high-risk areas, and management efficiency can be improved; management strategies can be adjusted according to changes in risks to maintain the timeliness and adaptability of response measures; and appropriate management methods are adopted for different risk levels, which helps to better prevent fraudulent activities and thereby improve the efficiency of anti-fraud management.

[0038] In some embodiments, the method also includes: obtaining the fraudulent numbers in the target area; analyzing the position movement and track breaking characteristics of the fraudulent numbers to obtain a first degree of proximity; if the first degree of proximity ≤ 0.2, the risk level of the target area corresponding to the secondary judgment is high risk; if 0.2 < first degree of proximity ≤ 0.4, the risk level of the target area corresponding to the secondary judgment is medium risk; if 0.4 < first degree of proximity ≤ 0.6, the risk level of the target area corresponding to the secondary judgment is low risk.

[0039] In other embodiments, the method further includes: obtaining the fraudulent numbers in the target area; analyzing the position movement and track breaking characteristics of the fraudulent numbers to obtain a first degree of proximity; if the first degree of proximity is ≤0.2, the risk level of the target area corresponding to the secondary determination is high risk; if 0.2<first degree of proximity ≤0.4, the risk level of the target area corresponding to the secondary determination is medium risk; if 0.4<first degree of proximity ≤0.8, the risk level of the target area corresponding to the secondary determination is low risk.

[0040] In some embodiments, the method further includes: obtaining the fraudulent numbers in the target area; analyzing the position motion track characteristics of the fraudulent numbers to obtain a first proximity; matching the risk of the fraudulent numbers with the fraudulent number risk database in the public security system; if the first proximity is ≤0.2, the risk level of the corresponding target area is determined to be high risk; if 0.2 < the first proximity is ≤0.4 and the risk level of the fraudulent numbers is high risk, the risk level of the corresponding target area is determined to be high risk; if 0.2 < the first proximity is ≤0.4 and the risk level of the fraudulent numbers is medium risk, the corresponding target area is determined to be high risk. The risk level of the target area is medium risk; if 0.2<first approach ≤0.4 and the risk level of the fraudulent number is low risk, then the risk level of the target area corresponding to the secondary determination is medium risk; if 0.4<first approach ≤0.8 and the risk level of the fraudulent number is high risk, then the risk level of the target area corresponding to the secondary determination is high risk; if 0.4<first approach ≤0.8 and the risk level of the fraudulent number is medium risk, then the risk level of the target area corresponding to the secondary determination is medium risk; if 0.4<first approach ≤0.8 and the risk level of the fraudulent number is low risk, then the risk level of the target area corresponding to the secondary determination is low risk.

[0041] In some embodiments, the method also includes: obtaining fraudulent numbers in the target area; analyzing the cyclic change trajectory characteristics of the fraudulent numbers under LAC to obtain a second degree of proximity; if the second degree of proximity ≤ 0.3, the risk level of the target area corresponding to the secondary judgment is high risk; if 0.3 < second degree of proximity ≤ 0.6, the risk level of the target area corresponding to the secondary judgment is medium risk; if 0.6 < second degree of proximity ≤ 0.9, the risk level of the target area corresponding to the secondary judgment is low risk.

[0042] In other embodiments, the method further includes: obtaining the fraudulent numbers in the target area; analyzing the cyclic change trajectory characteristics of the fraudulent numbers under LAC to obtain a second degree of proximity; if the second degree of proximity ≤ 0.2, the risk level of the target area corresponding to the secondary determination is high risk; if 0.2 < second degree of proximity ≤ 0.6, the risk level of the target area corresponding to the secondary determination is medium risk; if 0.6 < second degree of proximity ≤ 0.8, the risk level of the target area corresponding to the secondary determination is low risk.

[0043] In some embodiments, the method further includes: obtaining the fraudulent numbers in the target area; analyzing the cyclic change trajectory characteristics of the fraudulent numbers under the lac to obtain a second proximity; matching the risk of the fraudulent numbers with the fraudulent number risk library in the public security system; if the second proximity is ≤0.2, the risk level of the target area corresponding to the secondary determination is high risk; if 0.2 < the second proximity ≤0.6 and the risk level of the fraudulent numbers is high risk, the risk level of the target area corresponding to the secondary determination is high risk; if 0.2 < the second proximity ≤0.6 and the risk level of the fraudulent numbers is medium risk, the target area corresponding to the secondary determination is The risk level of the area is medium risk; if 0.2<second approach ≤0.6 and the risk level of the fraudulent number is low risk, then the risk level of the target area corresponding to the secondary determination is medium risk; if 0.6<second approach ≤0.8 and the risk level of the fraudulent number is high risk, then the risk level of the target area corresponding to the secondary determination is high risk; if 0.6<second approach ≤0.8 and the risk level of the fraudulent number is medium risk, then the risk level of the target area corresponding to the secondary determination is medium risk; if 0.6<second approach ≤0.8 and the risk level of the fraudulent number is low risk, then the risk level of the target area corresponding to the secondary determination is low risk.

[0044] In some embodiments, the first degree of proximity is obtained by the function "um(sum(risk area number P)) over (order by monthrows between track start area and track end area) total_sales from track feature table groupby risk area / fraud-related track maximum boundary value".

[0045] In some embodiments, the trajectory change list can be obtained through the function "LAG (number of lac changes) over (order by date) number of the previous day from trajectory change table"; the second degree of proximity is obtained according to (the distance between the changed trajectory lac and the fraud-related lac) / the maximum boundary value of the fraud-related trajectory lac.

[0046] According to an embodiment of the present invention, by clustering numbers with the same regional characteristics, the risk level of each target area can be clearly identified, and the fraud risk of different areas can be assessed more accurately, rather than relying solely on a single number or local data; as the signaling data is continuously updated, the risk level of each area can be dynamically adjusted, and new fraud risks can be discovered in a timely manner and potential threats can be responded to quickly; determining the risk level based on the regional risk value can help operators or anti-fraud agencies allocate resources and formulate strategies more effectively, thereby improving the efficiency of anti-fraud; by conducting risk assessments on target areas, more targeted anti-fraud strategies can be formulated, key prevention and control can be carried out, and the efficiency of anti-fraud can be improved.

[0047] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0048] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.

[0049] Figure 2 A block diagram of an anti-fraud management device 200 according to an embodiment of the present disclosure is shown, and the device 200 includes: The determination module 201 is used to determine the regional characteristics of the corresponding number according to the acquired signaling data corresponding to each number; The calculation module 202 is used to cluster numbers with the same regional characteristics to obtain multiple target areas; and calculate the corresponding regional risk value according to the number of fraudulent numbers and the number of risky numbers in the target area; The management module 203 is used to determine the risk level of the corresponding target area according to the regional risk value; and perform anti-fraud management on the numbers corresponding to the target area according to the risk level.

[0050] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0051] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0052] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0053] Figure 3 A schematic block diagram of an electronic device 300 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0054] The electronic device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a ROM 302 or a computer program loaded from a storage unit 308 into a RAM 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An I / O interface 305 is also connected to the bus 304.

[0055] A number of components in the electronic device 300 are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the electronic device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0056] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as the anti-fraud management method. For example, in some embodiments, the anti-fraud management method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the anti-fraud management method described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the anti-fraud management method in any other appropriate manner (e.g., by means of firmware).

[0057] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0058] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0059] In the context of the present disclosure, a readable storage medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A readable storage medium may be a machine-readable signal medium or a machine-readable storage medium. A readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. More specific examples of readable storage media may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0060] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0061] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0062] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0063] It should be understood that the above-mentioned various forms of processes can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of this disclosure can be achieved, and this document is not limited here.

[0064] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. An anti-fraud management method, characterized in that: include: Determine the regional characteristics of the corresponding numbers according to the acquired signaling data corresponding to each number; Cluster the numbers with the same regional characteristics to obtain multiple target areas; According to the number of fraudulent numbers and the number of risky numbers in the target area, a corresponding regional risk value is calculated; Determine the risk level of the corresponding target area according to the regional risk value; According to the risk level, anti-fraud management is performed on the numbers corresponding to the target area.

2. The anti-fraud management method according to claim 1, characterized in that: The signaling data includes: calling number, called number, call time, call duration, province code, city code, base station code and cell code within a preset time period.

3. The anti-fraud management method according to claim 2, characterized in that: The calculating the corresponding regional risk value according to the number of fraudulent numbers and the number of risky numbers in the target area includes: Obtaining each number in the target area; If the call duration corresponding to the number is less than M seconds and / or the province code is empty and / or the city code is empty and / or the base station code is empty and / or the cell code is empty, the corresponding number is determined to be a risk number; M is the duration threshold; The risk number is matched with the fraud number database in the public security system. If the match is successful, the corresponding risk number is determined to be a fraud-related number; Based on the number of risky numbers and the number of fraudulent numbers, the corresponding regional risk value is calculated.

4. The anti-fraud management method according to claim 2, characterized in that: The step of calculating the corresponding regional risk value according to the number of fraudulent numbers and the number of risky numbers in the target area further includes: Obtaining each number in the target area; If there are more than Z numbers under the same user ID that make calls in different areas on the same day, the corresponding number is determined to be a risky number; Z is the number threshold; If the number of non-roaming call attempts on the day the number is added to the network is less than C1 times, the corresponding number is determined to be a risk number; C1 is the first number threshold; If the number has been silent for more than T days, and the call frequency of roaming to other places is greater than C2 times, and the caller ratio is ≥ B, and the number of called times is less than C3 times, then the corresponding number is determined to be a risk number; T is the day threshold; C2 is the second number threshold; B is the percentage threshold; C3 is the third number threshold; The risk number is matched with the fraud number database in the public security system. If the match is successful, the corresponding risk number is determined to be a fraud-related number; Based on the number of risky numbers and the number of fraudulent numbers, the corresponding regional risk value is calculated.

5. The anti-fraud management method according to claim 3 or 4, characterized in that: The calculation formula of the regional risk value is: ； Where P is the regional risk value; P f is the number of fraudulent numbers; P n is the number of risky numbers; k is the risk coefficient.

6. The anti-fraud management method according to claim 5, characterized in that: Determining the risk level of the corresponding target area according to the regional risk value includes: Select the highest regional risk value Pmax from the regional risk values; If the regional risk value = 0, the risk level of the corresponding target area is determined to be no risk; If 0<regional risk value≤D1×Pmax, the risk level of the corresponding target area is judged to be low risk; where D1 is the first level coefficient; If D1×Pmax<regional risk value≤D2×Pmax, the risk level of the corresponding target area is determined to be medium risk; wherein D2 is the second level coefficient, and 0<D1<D2<1; If D2×Pmax<regional risk value≤Pmax, the risk level of the corresponding target area is determined to be high risk.

7. The anti-fraud management method according to claim 6, characterized in that: The anti-fraud management of the numbers corresponding to the target area according to the risk level includes: If the risk level of the target area is no risk, the first management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; If the risk level of the target area is low risk, the second management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; If the risk level of the target area is medium risk, the third management method is adopted to perform anti-fraud management on the numbers corresponding to the target area; If the risk level of the target area is high risk, the fourth management method is adopted to perform anti-fraud management on the numbers corresponding to the target area.

8. The anti-fraud management method according to claim 7, characterized in that: The method further comprises: Obtain fraudulent numbers in the target area; Analyze the position movement and track breaking characteristics of the fraudulent number to obtain a first approach degree; If the first approach degree ≤ Q1, the risk level of the target area corresponding to the secondary judgment is high risk; where Q1 is the first approach coefficient; If Q1<first approach coefficient≤Q2, the risk level of the target area corresponding to the secondary judgment is medium risk; wherein Q2 is the second approach coefficient; If Q2<first approach coefficient≤Q3, the risk level of the target area corresponding to the secondary judgment is low risk; wherein Q3 is the third approach coefficient, and 0<Q1<Q2<Q3<1.

9. The anti-fraud management method according to claim 7, characterized in that: The method further comprises: Obtain fraudulent numbers in the target area; Analyze the cyclic change trajectory characteristics of the fraudulent number under LAC to obtain the second approximation degree; If the second approach degree ≤ Q4, the risk level of the target area corresponding to the second judgment is high risk; wherein Q4 is the fourth approach coefficient; If Q4<second approach degree≤Q5, the risk level of the target area corresponding to the secondary judgment is medium risk; wherein Q5 is the fifth approach coefficient; If Q5<second approach coefficient≤Q6, the risk level of the target area corresponding to the secondary judgment is low risk; wherein Q6 is the sixth approach coefficient, and 0<Q4<Q5<Q6<1. 10.An anti-fraud management device, characterized in that: include: A determination module, used to determine the regional characteristics of the corresponding number based on the acquired signaling data corresponding to each number; A calculation module, used for clustering numbers with the same regional characteristics to obtain multiple target areas; According to the number of fraudulent numbers and the number of risky numbers in the target area, a corresponding regional risk value is calculated; A management module, used to determine the risk level of the corresponding target area according to the regional risk value; According to the risk level, anti-fraud management is performed on the numbers corresponding to the target area.

Images