A method, apparatus and medium for shutting down abnormal phone numbers based on risk assessment

Abstract

This application relates to the field of big data processing technology, and in particular to a method, apparatus, and medium for shutting down abnormal phone numbers based on risk assessment. The method collects multi-source data, selects a random forest algorithm as the core algorithm to construct the risk assessment model, dynamically selects a suitable shutdown strategy based on the risk assessment results, marks positive and negative samples, and updates the model using these samples. It also statistically analyzes historical shutdown records or reactivation counts, combining these two factors to assess whether a number is abnormal. This application can shut down abnormal numbers in real time, effectively preventing malicious reuse of numbers, while improving the accuracy of identifying normal numbers and reducing the false positive rate.

Description

Technical Field

[0001] This application relates to the field of big data processing technology, and in particular to a method, apparatus and medium for shutting down abnormal phone numbers based on risk assessment. Background Technology

[0002] With the increasing prevalence of telecommunications fraud, telecommunications operators need effective strategies to curb the proliferation of fraudulent phone numbers.

[0003] Existing number suspension mechanisms mostly employ a single, static strategy, often involving forced suspension or reinstatement after simple online liveness verification. This approach is insufficient in dealing with constantly evolving fraud tactics, frequently leading to the following problems: legitimate user numbers may be mistakenly suspended due to overly strict policies, resulting in user experience issues and complaints; fraudulent numbers can be reinstated through simple online liveness verification, failing to effectively prevent malicious reuse; the accuracy of identifying abnormal numbers is low; and abnormal numbers cannot be suspended promptly after identification.

[0004] Therefore, how to effectively prevent abnormal phone numbers from being maliciously reused is an urgent problem that needs to be solved. Summary of the Invention

[0005] This application provides a method for shutting down abnormal phone numbers based on risk assessment, which can effectively prevent abnormal numbers from being maliciously reused, shut down abnormal numbers in real time, and improve the accuracy of identifying normal numbers.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a method for shutting down abnormal phone numbers based on risk assessment, the method comprising:

[0008] Multi-source data on phone numbers are collected, and a pre-trained risk assessment model is used to evaluate the risk level of the phone numbers. The risk assessment model is constructed based on the random forest algorithm.

[0009] The policy corresponding to the risk level of the number is executed. The policy includes initiating a shutdown request to the operator's number management system and sending a liveness authentication request to the number.

[0010] If a liveness authentication policy is applied to a number, the result of the liveness authentication is obtained. Numbers with a result of failure are taken as positive samples, and numbers with a result of success are taken as negative samples.

[0011] Construct corresponding decision tree sub-models based on the positive and negative samples, update the risk assessment model based on the decision tree models, and obtain the target model;

[0012] The target model is used to assess the risk level of the number, and the target risk level is obtained.

[0013] If a number is subject to a policy that requests its shutdown to the operator's number management system and its liveness authentication is successful, a request to reactivate the number will be sent to the operator's number management system.

[0014] The system obtains the number of times a number has been shut down and reactivated, and determines whether the number is an abnormal number based on the target risk level. If so, it sends a request to the operator's number management system to shut down the abnormal number.

[0015] In a preferred embodiment of this application, the multi-source data may be further configured to include historical abnormal work order data of the number, normal complaint work order data, user behavior data, and device usage data.

[0016] In a preferred example of this application, it may further be configured to include:

[0017] The multi-source data is input into a big data platform, and the multi-source data is integrated according to dimensions to obtain training data;

[0018] The risk assessment model is trained using the training data to obtain the pre-trained risk assessment model.

[0019] In a preferred embodiment of this application, the step of applying a strategy corresponding to the risk level of the number based on its risk level, and if a liveness authentication strategy is applied to the number, obtaining the result of the liveness authentication, and using numbers with a failed result as positive samples and numbers with a passed result as negative samples, includes:

[0020] When the risk level of the number is medium risk, a request to shut down the number is sent to the operator's number management system. Then, a liveness authentication request is sent to the number. If the liveness authentication is successful, a request to reactivate the number is sent to the operator's number management system and the number is added to the negative sample. Otherwise, the number is added to the positive sample.

[0021] When the risk level of the number is low, a liveness authentication request is sent to the number. If the liveness authentication is successful, the number is added to the negative sample. Otherwise, a shutdown request is sent to the operator's number management system, and the number is added to the positive sample.

[0022] In a preferred example of this application, it may further be configured to include:

[0023] The number of times the number has been shut down is obtained. If the number of times the number has been shut down is greater than a preset threshold, then when the risk level of the number is medium risk, no request to reactivate the number is sent to the operator's number management system.

[0024] In a preferred embodiment of this application, the operator's number management system may be further configured to include:

[0025] Operator billing system or CRM system.

[0026] Secondly, this application provides a device for shutting down abnormal phone numbers based on risk assessment, the device comprising:

[0027] The data acquisition module is used to collect multi-source data on phone numbers and use a pre-trained risk assessment model to assess the risk level of the phone numbers. The risk assessment model is built based on the random forest algorithm.

[0028] The strategy execution module is used to execute a strategy corresponding to the risk level of the number based on the risk level of the number. The strategy includes initiating a shutdown request to the operator's number management system and sending a liveness authentication request to the number. If the liveness authentication strategy is executed on the number, the result of the liveness authentication of the number is obtained, and numbers with a result of failure are taken as positive samples, and numbers with a result of success are taken as negative samples.

[0029] The model update module is used to construct corresponding decision tree sub-models based on the positive samples and the negative samples, update the risk assessment model based on the decision tree models to obtain the target model, and use the target model to assess the risk level of the number to obtain the target risk level.

[0030] The shutdown module is used to initiate a reactivation request for a number to the operator's number management system if the policy of sending a shutdown request to the operator's number management system is executed and the result of its liveness authentication is passed; to obtain the number of shutdowns and reactivations, and to determine whether the number is an abnormal number based on the target risk level. If so, it initiates a shutdown request for the abnormal number to the operator's number management system.

[0031] Thirdly, this application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the abnormal number shutdown method based on risk assessment as described in any of the preceding claims.

[0032] Fourthly, this application provides a computer-readable storage medium storing a program, wherein when the program is executed by a processor, it implements the method for shutting down abnormal numbers based on risk assessment as described in any of the preceding claims.

[0033] Fifthly, this application provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the risk assessment-based abnormal number shutdown method as described in any of the preceding claims.

[0034] In summary, compared with the prior art, the beneficial effects of the technical solution provided in this application include at least the following:

[0035] This application provides a method for shutting down abnormal phone numbers based on risk assessment. By collecting multi-source data, a comprehensive data foundation is provided for risk assessment. A random forest algorithm is selected as the core algorithm to construct the risk assessment model, giving it the advantages of strong adaptability and ease of interpretation. Appropriate shutdown strategies are dynamically selected based on the risk assessment results, making this method highly flexible and capable of taking different actions based on the number's risk score and historical behavior. By labeling positive and negative samples and updating the model using these samples, more accurate training data is provided for the risk assessment model, resulting in more accurate assessment results, effectively reducing false shutdowns and improving user experience. By statistically analyzing historical shutdown records or reactivation counts and combining these two factors with risk levels to assess whether a number is abnormal, abnormal numbers can be shut down in real time, effectively preventing malicious reuse of numbers, while improving the accuracy of identifying normal numbers and reducing the false positive rate. Attached Figure Description

[0036] Figure 1 A flowchart illustrating a method for shutting down abnormal phone numbers based on risk assessment, provided as an embodiment of this application.

[0037] Figure 2 This is a structural diagram of a risk assessment-based abnormal number shutdown device provided in one embodiment of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] In one embodiment of this application, a method for shutting down abnormal phone numbers based on risk assessment is provided. Please refer to [link / reference]. Figure 1 As shown, the method includes:

[0040] S100: Collect multi-source data of the number and use a pre-trained risk assessment model to assess the risk level of the number. The risk assessment model is built based on the random forest algorithm.

[0041] Specifically, the multi-source data includes information from multiple data sources, including operator work orders, user behavior, and device data. The risk assessment model is built based on the random forest algorithm, and the assessment process includes the following steps:

[0042] (1) Data preparation: Integrate data from multiple sources, including number history, behavioral data, complaint records, and fraud case history. Then, clean the data, handle missing and outlier values, and extract key features.

[0043] (2) Model Construction: The Random Forest algorithm was chosen as the core algorithm due to its strong adaptability and ease of interpretation. The model was trained using the processed data, and optimized by adjusting parameters (such as the number and depth of trees).

[0044] (3) Performance evaluation: The model performance was evaluated using cross-validation and test set, with a focus on ROC AUC score to measure the model’s classification ability.

[0045] (4) Model tuning: Based on the evaluation results, the model is fine-tuned, which may include feature selection, weight adjustment, etc.

[0046] (5) Deployment and Application: Deploy the trained model into the system to achieve automated risk assessment of new phone numbers. Dynamically update the risk level and generate a risk score for subsequent risk management decisions.

[0047] (6) Monitoring and Maintenance: Monitor the performance of the model in the production environment, and promptly identify and resolve potential problems. Regularly collect new data and update the model to maintain its accuracy and timeliness.

[0048] In a preferred embodiment, the multi-source data includes historical abnormal work order data, normal complaint work order data, user behavior data, and device usage data for the number. In this embodiment, using multi-source data to assess the risk level of the number improves the accuracy of the assessment results.

[0049] In a preferred embodiment, the multi-source data is input into a big data platform, and the multi-source data is integrated according to dimensions to obtain training data. The training data is then used to train the risk assessment model to obtain the pre-trained risk assessment model. In this embodiment, by connecting with the big data platform, this data can be updated in real time and used as the basis for model evaluation, improving the real-time performance of number closure. In particular, on the data analysis platform, the system can identify and label positive and negative samples based on preset rules, providing more accurate training data for subsequent risk models.

[0050] S200: Execute a policy corresponding to the risk level of the number based on the risk level of the number. The policy includes initiating a shutdown request for the number to the operator's number management system and sending a liveness authentication request for the number.

[0051] Specifically, the risk levels are divided into high risk, medium risk, low risk, and no risk. Based on the risk assessment results, this step dynamically selects a suitable shutdown strategy, which includes: (1) Forced shutdown: High-risk numbers are directly and forcibly shut down, and online liveness authentication is not allowed for reactivation. Reactivation is only supported at offline business halls; (2) Shut down first and then authenticate: Medium-risk numbers are shut down first, and users can reactivate after passing online liveness authentication; (3) Authentication first and then shutdown: For low-risk numbers, users are required to pass online liveness authentication first, and then a decision is made on whether to shut down; (4) SMS reminder: Only SMS reminders are sent, and no other operations are performed; (5) Limit the number of times ...

[0052] The risk level of the number can be determined by numerical classification, allowing for the selection of an appropriate shutdown strategy based on the numerical value. This includes: a forced shutdown strategy when the risk score is greater than 0.9 or the number of attempts to reactivate is greater than or equal to 3; a shutdown-then-authentication strategy when the risk score is greater than 0.7 but not exceeding 0.9; an authentication-then-shutdown strategy when the risk score is greater than 0.5 but not exceeding 0.7; and an SMS notification strategy when the risk score is less than or equal to 0.5.

[0053] The method involves initiating requests for numbers to the operator's number management system, including requests to the operator's billing system or CRM system. This method integrates a module that interfaces with the number management system, enabling real-time communication and improving the real-time performance of number operations.

[0054] S300: If the number is subject to a liveness authentication policy, obtain the result of the liveness authentication for the number, and use the number whose result is "failed" as a positive sample and the number whose result is "passed" as a negative sample.

[0055] Specifically, the liveness authentication strategy involves sending a liveness authentication request to the number, using an HTTPS-based interface to interact with a third-party system. Liveness authentication is liveness detection, a method used in some identity verification scenarios to determine the true physiological characteristics of an object, typically used during real-name authentication.

[0056] S400: Construct a corresponding decision tree sub-model based on the positive samples and the negative samples, update the risk assessment model based on the decision tree model, and obtain the target model.

[0057] Specifically, the model is retrained using positive and negative sample data, and the model's structure or parameters are adjusted to obtain a target model with more accurate evaluation results.

[0058] S500: Use the target model to assess the risk level of the number to obtain the target risk level.

[0059] S600: If a number is subject to a policy that initiates a shutdown request to the operator's number management system and its liveness authentication result is successful, initiate a reactivation request for the number to the operator's number management system.

[0060] S700: Obtain the number of times the number has been shut down and reactivated, and determine whether the number is an abnormal number based on the target risk level. If so, initiate a shutdown request for the abnormal number to the operator's number management system.

[0061] Specifically, if a number has multiple shutdown or reactivation records and the target risk level is high, the number is determined to be an abnormal number, and the strategy of shutting down the number is directly implemented. Typically, a number is determined to be abnormal when it has more than 3 shutdown or reactivation records and the target risk level is high.

[0062] In this embodiment, a comprehensive data foundation is provided for risk assessment by collecting multi-source data. The random forest algorithm is selected as the core algorithm to construct the risk assessment model, giving it the advantages of strong adaptability and ease of interpretation. Appropriate shutdown strategies are dynamically selected based on the risk assessment results, making this method highly flexible and capable of taking different actions based on the number's risk score and historical behavior. By labeling positive and negative samples and updating the model using these samples, more accurate training data is provided for the risk assessment model, resulting in more accurate assessment results, effectively reducing false shutdowns and improving user experience. By statistically analyzing historical shutdown records or reactivation counts and combining these two factors with risk levels to assess whether a number is abnormal, abnormal numbers can be shut down in real time, effectively preventing malicious reuse of numbers, while improving the accuracy of identifying normal numbers and reducing the false positive rate.

[0063] In some embodiments, the step of applying a strategy corresponding to the risk level of the number based on its risk level, and if a liveness authentication strategy is applied to the number, obtaining the result of the liveness authentication for the number, and using numbers whose result is "failed" as positive samples and numbers whose result is "passed" as negative samples, includes:

[0064] When the risk level of the number is medium risk, a request to shut down the number is sent to the operator's number management system. Then, a liveness authentication request is sent to the number. If the liveness authentication is successful, a request to reactivate the number is sent to the operator's number management system and the number is added to the negative sample. Otherwise, the number is added to the positive sample.

[0065] When the risk level of the number is low, a liveness authentication request is sent to the number. If the liveness authentication is successful, the number is added to the negative sample. Otherwise, a shutdown request is sent to the operator's number management system, and the number is added to the positive sample.

[0066] In this embodiment, different response strategies are applied to numbers with different risk levels. This method differs from static rule-based shutdowns. Instead, the shutdown strategy can be dynamically adjusted based on real-time data, effectively reducing accidental shutdowns and improving user experience.

[0067] In some embodiments, it also includes:

[0068] The number of times the number has been shut down is obtained. If the number of times the number has been shut down is greater than a preset threshold, then when the risk level of the number is medium risk, no request to reactivate the number is sent to the operator's number management system.

[0069] In practice, if the number is shut down more than a preset threshold, and the number's risk level is determined to be medium risk, the reactivation process will not be executed even if the liveness authentication process is passed, meaning that no reactivation request will be sent to the operator's number management system.

[0070] In this embodiment, the possibility of reactivating a phone number through simple online liveness verification can be prevented, effectively preventing malicious reuse.

[0071] In some embodiments, the operator's number management system includes:

[0072] Operator billing system or CRM system.

[0073] In practical implementation, the CRM (Customer Relationship Management) system helps telecommunications companies manage interactions with customers, services, billing information, and provide personalized services, thereby enhancing customer satisfaction and improving operational efficiency. This method, through an integrated communication module, uses HTTPS requests to interface with the operator's billing system or CRM system to perform operations such as shutdown or reactivation.

[0074] In this embodiment, the real-time and reliable shutdown operation is ensured, and abnormal numbers can be shut down in a timely manner.

[0075] This application also provides a device for shutting down abnormal phone numbers based on risk assessment. Please refer to [link / reference]. Figure 2 As shown, the device includes:

[0076] The data acquisition module 100 is used to collect multi-source data of the number and use a pre-trained risk assessment model to assess the risk level of the number. The risk assessment model is constructed based on the random forest algorithm.

[0077] The strategy execution module 200 is used to execute a strategy corresponding to the risk level of the number based on the risk level of the number. The strategy includes initiating a shutdown request for the number to the operator's number management system and sending a liveness authentication request to the number. If the liveness authentication strategy is executed on the number, the result of the liveness authentication of the number is obtained, and numbers whose result is failure are taken as positive samples, and numbers whose result is success are taken as negative samples.

[0078] The model update module 300 is used to construct a corresponding decision tree sub-model based on the positive samples and the negative samples, update the risk assessment model based on the decision tree model to obtain a target model, and use the target model to assess the risk level of the number to obtain a target risk level.

[0079] The shutdown module 400 is used to initiate a reactivation request for a number to the operator's number management system if the number is subject to a policy that initiates a shutdown request to the operator's number management system and the result of its liveness authentication is passed; obtain the number of shutdowns and reactivations, and determine whether the number is an abnormal number based on the target risk level; if so, initiate a shutdown request for the abnormal number to the operator's number management system.

[0080] The functions of each module in the above-mentioned abnormal number shutdown device based on risk assessment correspond to the steps in the above-mentioned abnormal number shutdown method embodiment based on risk assessment. Their functions and implementation processes will not be described in detail here.

[0081] This application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the abnormal number shutdown method based on risk assessment as described in any of the above embodiments.

[0082] This application also provides a computer-readable storage medium storing a program. The computer-readable storage medium refers to a data storage medium, which may include, but is not limited to, floppy disks, optical disks, hard disks, flash memory, USB flash drives, and / or Memory Sticks. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The working process, details, and technical effects of the computer-readable storage medium provided in this embodiment can be found in the above embodiment regarding a method for shutting down abnormal phone numbers based on risk assessment, and will not be repeated here.

[0083] The application also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the risk assessment-based abnormal number shutdown method as described in any of the above embodiments.

[0084] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM).

[0085] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for shutting down abnormal phone numbers based on risk assessment, characterized in that, include: Multi-source data on phone numbers are collected, and a pre-trained risk assessment model is used to evaluate the risk level of the phone numbers. The risk assessment model is constructed based on the random forest algorithm. The policy corresponding to the risk level of the number is executed. The policy includes initiating a shutdown request to the operator's number management system and sending a liveness authentication request to the number. If a liveness authentication policy is applied to a number, the result of the liveness authentication is obtained, and numbers that fail the authentication are taken as positive samples, while numbers that pass the authentication are taken as negative samples. Construct corresponding decision tree sub-models based on the positive and negative samples, update the risk assessment model based on the decision tree models, and obtain the target model; The target model is used to assess the risk level of the number to obtain the target risk level; If a number is subject to a policy that requests its number to be shut down by the operator’s number management system and its liveness authentication is successful, a request to reactivate the number will be sent to the operator’s number management system. The system obtains the number of times a number has been shut down and reactivated, and determines whether the number is an abnormal number based on the target risk level. If so, it sends a request to the operator's number management system to shut down the abnormal number.

2. The method for shutting down abnormal phone numbers based on risk assessment according to claim 1, characterized in that, The multi-source data includes historical abnormal work order data of the number, normal complaint work order data, user behavior data, and device usage data.

3. The method for shutting down abnormal phone numbers based on risk assessment according to claim 2, characterized in that, Also includes: The multi-source data is input into a big data platform, and the multi-source data is integrated according to dimensions to obtain training data; The risk assessment model is trained using the training data to obtain the pre-trained risk assessment model.

4. The method for shutting down abnormal phone numbers based on risk assessment according to claim 1, characterized in that, The step of applying a corresponding risk level strategy to a number based on its risk level includes, if a liveness authentication strategy is applied to the number, obtaining the result of the liveness authentication, and designating numbers with a failed result as positive samples and numbers with a successful result as negative samples. When the risk level of the number is medium risk, a request to shut down the number is sent to the operator's number management system. Then, a liveness authentication request is sent to the number. If the liveness authentication is successful, a request to reactivate the number is sent to the operator's number management system and the number is added to the negative sample. Otherwise, the number is added to the positive sample. When the risk level of the number is low, a liveness authentication request is sent to the number. If the liveness authentication is successful, the number is added to the negative sample. Otherwise, a shutdown request is sent to the operator's number management system, and the number is added to the positive sample.

5. The method for shutting down abnormal phone numbers based on risk assessment according to claim 4, characterized in that, Also includes: The number of times the number has been shut down is obtained. If the number of times the number has been shut down is greater than a preset threshold, then when the risk level of the number is medium risk, no request to reactivate the number is sent to the operator's number management system.

6. The method for shutting down abnormal phone numbers based on risk assessment according to claim 1, characterized in that, The operator's number management system includes: Operator billing system or CRM system.

7. A device for shutting down abnormal phone numbers based on risk assessment, characterized in that, include: The data acquisition module is used to collect multi-source data on phone numbers and use a pre-trained risk assessment model to assess the risk level of the phone numbers. The risk assessment model is built based on the random forest algorithm. The strategy execution module is used to execute a strategy corresponding to the risk level of the number based on the risk level of the number. The strategy includes initiating a shutdown request to the operator's number management system and sending a liveness authentication request to the number. If a liveness authentication policy is applied to a number, the result of the liveness authentication is obtained, and numbers that fail the authentication are taken as positive samples, while numbers that pass the authentication are taken as negative samples. The model update module is used to construct corresponding decision tree sub-models based on the positive samples and the negative samples, update the risk assessment model based on the decision tree models to obtain the target model, and use the target model to assess the risk level of the number to obtain the target risk level. The shutdown module is used to initiate a reactivation request for a number to the operator's number management system if the policy of sending a shutdown request to the operator's number management system is executed and the result of its liveness authentication is passed; to obtain the number of shutdowns and reactivations, and to determine whether the number is an abnormal number based on the target risk level. If so, it initiates a shutdown request for the abnormal number to the operator's number management system.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the method for shutting down abnormal numbers based on risk assessment as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program, wherein when the program is executed by a processor, it implements the method for shutting down abnormal numbers based on risk assessment as described in any one of claims 1 to 6.

10. A computer program product comprising computer instructions, characterized in that, When executed by a processor, the computer instructions implement the method for shutting down abnormal numbers based on risk assessment as described in any one of claims 1 to 6.

Images