Fraud identification method, device, equipment, medium and computer program product
By extracting target fraud features in multi-dimensional data and combining the fraud decision model and the judgment model, the problem of low fraud identification accuracy in the existing technology is solved and higher fraud identification accuracy is achieved.
Patent Information
- Application Number
- CN202411363428.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-27
- Publication Date
- 2025-01-21
AI Technical Summary
In the prior art, fraud identification is low, inaccurate blacklists lead to misjudgment, and the data provided by operators is not enough to support model training, resulting in low model identification accuracy.
Based on the multi -dimensional data extraction target fraud characteristics based on the multi -dimensional data to be identified, combined with fraud decision -making models and fraud judgment models, the scoring risk score and judgment results were determined, and the results of fraud identification were finally determined.
Improve the accuracy of fraud recognition, and reduce the problems of misjudgment and lack of identification through the identification results of comprehensive decision -making models and judgment models.
Smart Images
Figure CN119337245A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of fraud identification technology, and in particular to a fraud identification method, device, equipment, medium and computer program product. Background Art
[0002] With the popularization of the Internet and the rapid development of mobile communication technology, it has become easier and easier for people to connect to each other through the Internet, but this has also increased the difficulty of distinguishing the authenticity of information on the Internet. False network communication information may be accompanied by fraud incidents, posing a hidden danger to people's property safety.
[0003] Existing fraud identification solutions mainly include: 1. Building a blacklist database of fraudulent numbers; 2. Building a machine learning model to identify fraudulent behavior based on data provided by communication network operators. The former will produce misjudgments if the blacklist is inaccurate, affecting the use of normal users. The latter, the data provided by operators are mostly data of defrauded users, which is insufficient to support model training, resulting in low accuracy of model identification. Summary of the invention
[0004] The present invention provides a fraud identification method, device, equipment, medium and computer program product, which are used to solve the defect of low fraud identification accuracy in the prior art and improve the fraud identification accuracy.
[0005] The present invention provides a fraud identification method, comprising the following steps.
[0006] Extracting target fraud features of the object to be identified based on the multi-dimensional data of the object to be identified; Determining a fraud risk score of the object to be identified based on the target fraud characteristics and a fraud decision model; the fraud decision model is constructed based on historical fraud data; Generate information to be identified based on the network access content of the object to be identified, and search for fraud-related content corresponding to the information to be identified in an external knowledge base; Inputting the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result; the fraud judgment model is constructed based on historical network access information; Based on the fraud risk score and the fraud judgment result, a fraud identification result of the object to be identified is determined.
[0007] According to a fraud identification method provided by the present invention, the fraud identification method further includes: Obtain multi-dimensional user data and historical fraud data; Constructing a historical fraud feature set based on feature indicators and the historical fraud data; the feature indicators are constructed based on the multi-dimensional user data; Dividing the historical fraud feature set into a training set and a test set; A fraud decision model is constructed based on the training set and the test set.
[0008] According to a fraud identification method provided by the present invention, the fraud identification method further includes: Acquiring historical network access information; the historical network access information includes network access instructions; Capturing the network access content corresponding to the network access instruction to obtain key access content; A fraud determination model is constructed based on the external knowledge base and the key access content.
[0009] According to a fraud identification method provided by the present invention, the fraud identification method further includes: Extracting network access information marked as fraudulent from the historical network access information; Determining an access indication blacklist and fraud-related content based on the network access information marked as fraudulent; The external knowledge base is constructed based on the access indication blacklist and the fraud-related content.
[0010] According to a fraud identification method provided by the present invention, the inputting the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result includes: Generate prompt information based on the information to be identified and the fraud-related content; The information to be identified, the fraud-related content and the prompt information are input into a fraud determination model to obtain a fraud determination result.
[0011] According to a fraud identification method provided by the present invention, the fraud identification result of the object to be identified is determined based on the fraud risk score and the fraud judgment result, and then includes: Determining an early warning scheme corresponding to the fraud identification result based on the fraud risk level and the fraud judgment result; the fraud risk level is determined based on the fraud risk score; Outputting a warning prompt to the object to be identified based on the warning scheme.
[0012] The present invention also provides a fraud identification device, comprising the following modules: A fraud feature extraction module, used to extract target fraud features of the object to be identified based on the multi-dimensional data of the object to be identified; A fraud risk score determination module, used to determine the fraud risk score of the object to be identified based on the target fraud characteristics and a fraud decision model; the fraud decision model is constructed based on historical fraud data; A fraud-related content search module, used to generate information to be identified based on the network access content of the object to be identified, and search the external knowledge base for fraud-related content corresponding to the information to be identified; A fraud judgment result determination module, used for inputting the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result; the fraud judgment model is constructed based on historical network access information; A fraud identification result determination module is used to determine the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result.
[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the fraud identification methods described above is implemented.
[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the fraud identification method as described above is implemented.
[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the fraud identification method described above is implemented.
[0016] The fraud identification method, device, equipment, medium and computer program product provided by the present invention extracts the target fraud features from the acquired multi-dimensional data of the object to be identified, inputs the target fraud features into the fraud decision model to obtain the fraud risk score of the object to be identified; generates the information to be identified through the network access content of the object to be identified, searches for the fraud-related content corresponding to the information to be identified in the external knowledge base, inputs the information to be identified and the fraud-related content into the fraud judgment model to obtain the fraud judgment result, and finally comprehensively determines the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result. The accuracy of fraud identification is improved by combining the identification results of the fraud decision model and the fraud judgment model. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0018] Figure 1 This is one of the flow charts of the fraud identification method provided by the present invention.
[0019] Figure 2 This is the second flow chart of the fraud identification method provided by the present invention.
[0020] Figure 3 It is a schematic diagram of the structure of the fraud identification device provided by the present invention.
[0021] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION
[0022] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0023] Combine the following Figure 1-Figure 4 The fraud identification method, apparatus, device, medium and computer program product of the present invention are described.
[0024] Figure 1 is one of the flow charts of the fraud identification method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 100: extracting target fraud features of the object to be identified based on the multi-dimensional data of the object to be identified; The fraud identification method provided in this application mainly includes two parts: one is the risk assessment of the fraud decision-making part, and the other is the confirmation of the fraud result of the fraud judgment part.
[0025] In the fraud decision part, it is first necessary to obtain multi-dimensional data of the object to be identified, where the object to be identified can be a network user, a communication user or a virtual account, etc. The multi-dimensional data may include communication records, network access records, location information, and business handling information, etc. After feature extraction of these multi-dimensional data, fraud risk features are obtained, that is, the target fraud features of the object to be identified in this embodiment.
[0026] Step 200: Determine the fraud risk score of the object to be identified based on the target fraud characteristics and the fraud decision model; the fraud decision model is constructed based on historical fraud data; The fraud decision model in this embodiment can be an XGBoost (optimized distributed gradient boosting library) model. XGBoost is an efficient and accurate gradient boosting decision tree algorithm that can efficiently process large-scale data sets and automatically learn complex feature combinations to obtain excellent prediction accuracy. It is an algorithm model that can be used for data modeling.
[0027] After the XGBoost model training is completed, the XGBoost model is used to generate fraud scores for all users. For each object to be identified, the target fraud features are input into the fraud decision model, and the fraud decision model calculates a predicted probability based on its multi-dimensional feature data, indicating the risk of fraud for the object to be identified. This predicted probability can be converted into a more intuitive fraud score (i.e., the fraud risk score in this embodiment) to support subsequent fraud decisions.
[0028] Step 300: Generate information to be identified based on the network access content of the object to be identified, and search for fraud-related content corresponding to the information to be identified in an external knowledge base; The big model is combined with the self-built fraud information knowledge base (i.e., the external knowledge base in this embodiment) to conduct in-depth analysis of URL access content to accurately determine whether the access content is related to fraud. To achieve this goal, crawler tools and basic big models can be used to build and optimize external fraud-related knowledge bases, and retrieval augmented generation (RAG) technology can be integrated to ensure the comprehensiveness and efficiency of the fraud identification process.
[0029] The access information obtained by crawling has high requirements for comprehension ability. Relying solely on the knowledge base of the basic large model itself cannot quickly and accurately judge fraud. Therefore, fraud-related content corresponding to the information to be identified can be searched in the external knowledge base to assist in enhancing the fraud identification ability of the basic large model.
[0030] Step 400: input the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result; the fraud judgment model is constructed based on historical network access information; The page content text file obtained by crawler technology (i.e., the information to be identified in this embodiment) is imported into the fraud judgment model, and the massive text content is divided into text segments of limited length using a word segmentation tool, which is then vectorized to obtain a vector list to meet the requirements of the input fraud judgment model.
[0031] Next, the contents in the vector list are input into the fraud judgment model in turn, and the RAG technology-related tools are used to associate the model’s own fraud knowledge base to enhance retrieval and obtain the fraud judgment result.
[0032] Step 500: Determine a fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result.
[0033] Through the above model identification, two fraud identification results can be obtained: fraud risk score a (including low risk, medium risk and high risk) and fraud judgment result b (including no fraud, suspected fraud and obvious fraud).
[0034] A fraud identification result matrix can be constructed based on specific circumstances, such as the following table:
[0035] Table 1
[0036] This embodiment extracts the target fraud features from the acquired multi-dimensional data of the object to be identified, inputs the target fraud features into the fraud decision model to obtain the fraud risk score of the object to be identified; generates the information to be identified through the network access content of the object to be identified, searches for fraud-related content corresponding to the information to be identified in the external knowledge base, inputs the information to be identified and the fraud-related content into the fraud judgment model to obtain the fraud judgment result, and finally comprehensively determines the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result. By combining the identification results of the fraud decision model and the fraud judgment model, the accuracy of fraud identification is improved.
[0037] Figure 2 FIG. 2 is a flow chart of the fraud identification method provided by the present invention. Figure 2 As shown, the method may also include: Step 10: Obtain multi-dimensional user data and historical fraud data; Step 20: construct a historical fraud feature set based on feature indicators and the historical fraud data; the feature indicators are constructed based on the multi-dimensional user data; Step 30: dividing the historical fraud feature set into a training set and a test set; Step 40: construct a fraud decision model based on the training set and the test set.
[0038] In the training phase of the fraud decision model, first, multi-dimensional user data is obtained from the big data resources of the network / communication operators. The multi-dimensional user data includes but is not limited to call / sms records, uniform resource locator (URL) access history, location information, and business handling details. These multi-dimensional user data need to be cleaned and pre-processed to eliminate noise and outliers, ensure the consistency and integrity of the data, and build preliminary feature indicators.
[0039] Secondly, obtain the historical fraud records of the network / communication operators, including the defrauded users and the time of the defraud, and perform dual association of primary key and time with the summarized feature indicators to build a fraud positive sample set. At the same time, select users with no fraud records to build a fraud negative sample set. The ratio of positive and negative samples can be set specifically according to the situation to obtain a sample data set.
[0040] Then, feature processing and derivation are performed to construct a feature set that can reflect the risk of user fraud. For example, the app (application) access history is analyzed to extract key information such as the access frequency and access duration of various apps; location information is clustered in time and space to identify indicators such as the user's permanent residence and abnormal movement patterns; call and text message records are statistically summarized to evaluate data such as the user's social circle and call frequency.
[0041] The processed sample data set is divided into a training set and a test set, and the training set data is used to train the XGBoost model. The XGBoost model improves prediction performance by combining multiple decision trees. During the training process, XGBoost optimizes the prediction accuracy of the model by iteratively adding new decision trees. Each new tree aims to correct the prediction error of the previous tree. At the same time, the gradient optimization algorithm and regularization algorithm are used to minimize the loss function of the XGBoost model to improve the generalization ability of the XGBoost model.
[0042] The prediction performance of the model is evaluated through the test set data, and the quality of the model is measured by calculating indicators such as prediction accuracy and recall rate. If the model performance does not meet the requirements, parameter tuning is performed, such as adjusting the number of iterations, learning rate, regularization coefficient, tree depth, and tree width, and iterative training of the model. In addition, feature importance scores can be used to identify the features that have the greatest impact on the prediction results and further optimize the feature data set.
[0043] This embodiment improves the accuracy of fraud assessment by training and building a fraud decision model.
[0044] In one embodiment, the fraud identification method provided in the embodiment of the present application may further include: Step 50: Obtain historical network access information; the historical network access information includes a network access indication; Step 60: Capture the network access content corresponding to the network access instruction to obtain key access content; Step 70: construct a fraud judgment model based on the external knowledge base and the key access content.
[0045] Specifically, when training a fraud judgment model, you can use an open source crawler framework (such as Scrapy) to automatically crawl the web page content pointed to by the URL visited by the user. Scrapy supports custom request headers and middleware to flexibly process http requests, parse web page structures, and extract key information.
[0046] For the obtained URL access history, Scrapy will automatically traverse these URLs, grab key parts such as the title, body, and metadata of each page, and store them as text files in formats such as txt and doc for subsequent analysis.
[0047] The fraud judgment model can be a large language model based on the Transformer structure, which has text understanding and generation capabilities and is suitable for the web page content analysis involved in the present invention.
[0048] From a mechanistic point of view, the crawled URL page content can be used as the input of the fraud judgment model, and its deep semantic understanding ability can be used to perform fraud analysis on the text. However, the knowledge base of the fraud judgment model itself is not enough to accurately distinguish the fraud content that is diverse, rapidly updated, and highly concealed. Therefore, this application proposes an independently constructed and independently maintained fraud content knowledge base (i.e., an external knowledge base), and combines RAG technology to enhance the discrimination ability of the fraud judgment model.
[0049] This embodiment builds a fraud determination model through crawled access content, and further enhances the fraud determination capability of the model through an external fraud knowledge base.
[0050] In one embodiment, the fraud identification method provided in the embodiment of the present application may further include: Step 600: extracting the network access information marked as fraudulent from the historical network access information; Step 700: Determine an access indication blacklist and fraud-related content based on the network access information marked as fraudulent; Step 800: construct the external knowledge base based on the access indication blacklist and the fraud-related content.
[0051] Specifically, RAG technology combines retrieval with generation, allowing the model to refer to external knowledge sources when generating responses. This application proposes to build an autonomous fraud information knowledge base, which includes but is not limited to: historical fraud cases, collecting and analyzing various fraud cases that have occurred in history, extracting fraud methods, keywords and features, etc.; blacklist URLs, recording known or highly fraudulent URL addresses and their features, such as domain name registration information and IP address associations, etc.; fraud words and keywords, summarizing and organizing common fraud words, keywords and phrases for fast matching and identification.
[0052] This embodiment further enhances the recognition accuracy of the fraud judgment model by constructing a fraud knowledge base.
[0053] In one embodiment, the fraud identification method provided in the embodiment of the present application may further include: Step 410: Generate prompt information based on the information to be identified and the fraud-related content; Step 420: input the information to be identified, the fraud-related content, and the prompt information into a fraud determination model to obtain a fraud determination result.
[0054] For the fraud judgment results of the fraud judgment model, prompt word engineering can be used to require the large model to only output fixed responses such as "obvious fraud information retrieved", "suspected fraud information retrieved" and "no fraud information retrieved". In this way, simple text matching can be used to convert them into quantitative results such as 1 / 0.5 / 0 for joint evaluation with the machine learning model results.
[0055] This embodiment simplifies the fraud judgment result of the fraud judgment model through prompt word engineering to facilitate subsequent processing.
[0056] In one embodiment, the fraud identification method provided in the embodiment of the present application may further include: Step 510: Determine an early warning scheme corresponding to the fraud identification result based on the fraud risk level and the fraud judgment result; the fraud risk level is determined based on the fraud risk score; Step 520: Output a warning prompt to the object to be identified based on the warning scheme.
[0057]
[0058] According to Table 1 above, a fraud warning matrix can be constructed based on specific circumstances, such as the following table: The thresholds corresponding to the risk levels and fraud situations in the matrix can be adjusted according to the actual application scenarios and needs. The matrix is only used as a reference for the implementation plan of the early warning mechanism.
[0059] Through the above technical solution, we can efficiently combine the big model technology with the machine learning model and build an autonomous fraud information knowledge base. This solution not only improves the accuracy and efficiency of identifying the defrauded population, but also provides strong technical support for subsequent anti-fraud work.
[0060] This embodiment provides a fraud warning solution through a fraud warning mechanism, thereby further improving the efficiency of fraud identification.
[0061] The fraud identification device provided by the present invention is described below. The fraud identification device described below and the fraud identification method described above can be referenced to each other.
[0062] Please refer to Figure 3 The present invention also provides a fraud identification device, comprising: A fraud feature extraction module 301 is used to extract target fraud features of the object to be identified based on the multi-dimensional data of the object to be identified; A fraud risk score determination module 302, for determining a fraud risk score of the object to be identified based on the target fraud characteristics and a fraud decision model; the fraud decision model is constructed based on historical fraud data; A fraud-related content search module 303 is used to generate information to be identified based on the network access content of the object to be identified, and search the external knowledge base for fraud-related content corresponding to the information to be identified; A fraud judgment result determination module 304 is used to input the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result; the fraud judgment model is constructed based on historical network access information; The fraud identification result determination module 305 is used to determine the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result.
[0063] Optionally, the fraud identification device further includes: Data acquisition module, used to obtain multi-dimensional user data and historical fraud data; A feature set construction module, used to construct a historical fraud feature set based on feature indicators and the historical fraud data; the feature indicators are constructed based on the multi-dimensional user data; A feature set division module, used for dividing the historical fraud feature set into a training set and a test set; The fraud decision model building module is used to build a fraud decision model based on the training set and the test set.
[0064] Optionally, the fraud identification device further includes: A historical network access information acquisition module, used to acquire historical network access information; the historical network access information includes a network access indication; A network access content capture module, used to capture the network access content corresponding to the network access instruction to obtain key access content; A fraud judgment model building module is used to build a fraud judgment model based on the external knowledge base and the key access content.
[0065] Optionally, the fraud identification device further includes: A network access information extraction module, used to extract the network access information marked as fraudulent in the historical network access information; An access indication blacklist and fraud-related content determination module, used to determine an access indication blacklist and fraud-related content based on the network access information marked as fraudulent; The external knowledge base construction module is used to construct the external knowledge base based on the access indication blacklist and the fraud-related content.
[0066] Optionally, the fraud judgment result determination module includes: A prompt information generating unit, configured to generate prompt information based on the information to be identified and the fraud-related content; The fraud judgment result determination unit is used to input the information to be identified, the fraud-related content and the prompt information into a fraud judgment model to obtain a fraud judgment result.
[0067] Optionally, the fraud identification device further includes: An early warning scheme determination module, used to determine an early warning scheme corresponding to the fraud identification result based on the fraud risk level and the fraud judgment result; the fraud risk level is determined based on the fraud risk score; The early warning output module is used to output an early warning prompt to the object to be identified based on the early warning scheme.
[0068] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the fraud identification method, which includes: extracting the target fraud features of the object to be identified based on the multi-dimensional data of the object to be identified; determining the fraud risk score of the object to be identified based on the target fraud features and the fraud decision model; the fraud decision model is constructed based on historical fraud data; generating information to be identified based on the network access content of the object to be identified, and searching for fraud-related content corresponding to the information to be identified in an external knowledge base; inputting the information to be identified and the fraud-related content into the fraud judgment model to obtain a fraud judgment result; the fraud judgment model is constructed based on historical network access information; and determining the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result.
[0069] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.
[0070] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the fraud identification method provided by the above-mentioned methods, which includes: extracting target fraud features of the object to be identified based on multi-dimensional data of the object to be identified; determining the fraud risk score of the object to be identified based on the target fraud features and a fraud decision model; the fraud decision model is constructed based on historical fraud data; generating information to be identified based on the network access content of the object to be identified, and searching for fraud-related content corresponding to the information to be identified in an external knowledge base; inputting the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result; the fraud judgment model is constructed based on historical network access information; and determining the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result.
[0071] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the fraud identification method provided by the above-mentioned methods, the method comprising: extracting target fraud features of the object to be identified based on multi-dimensional data of the object to be identified; determining the fraud risk score of the object to be identified based on the target fraud features and a fraud decision model; the fraud decision model is constructed based on historical fraud data; generating information to be identified based on the network access content of the object to be identified, and searching for fraud-related content corresponding to the information to be identified in an external knowledge base; inputting the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result; the fraud judgment model is constructed based on historical network access information; and determining the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result.
[0072] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
[0073] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A fraud identification method, characterized in that: include: Extracting target fraud features of the object to be identified based on the multi-dimensional data of the object to be identified; Determining a fraud risk score of the object to be identified based on the target fraud characteristics and the fraud decision model; The fraud decision model is constructed based on historical fraud data; Generate information to be identified based on the network access content of the object to be identified, and search for fraud-related content corresponding to the information to be identified in an external knowledge base; Inputting the information to be identified and the fraud-related content into a fraud determination model to obtain a fraud determination result; The fraud determination model is constructed based on historical network access information; Based on the fraud risk score and the fraud judgment result, a fraud identification result of the object to be identified is determined.
2. The fraud identification method according to claim 1, characterized in that: The fraud identification method further includes: Obtain multi-dimensional user data and historical fraud data; Constructing a historical fraud feature set based on feature indicators and the historical fraud data; the feature indicators are constructed based on the multi-dimensional user data; Dividing the historical fraud feature set into a training set and a test set; A fraud decision model is constructed based on the training set and the test set.
3. The fraud identification method according to claim 1, characterized in that: The fraud identification method further includes: Acquiring historical network access information; the historical network access information includes network access instructions; Capturing the network access content corresponding to the network access instruction to obtain key access content; A fraud determination model is constructed based on the external knowledge base and the key access content.
4. The fraud identification method according to claim 3, characterized in that: The fraud identification method further includes: Extracting network access information marked as fraudulent from the historical network access information; Determining an access indication blacklist and fraud-related content based on the network access information marked as fraudulent; The external knowledge base is constructed based on the access indication blacklist and the fraud-related content.
5. The fraud identification method according to claim 1, characterized in that: The inputting the information to be identified and the fraud-related content into a fraud determination model to obtain a fraud determination result includes: Generate prompt information based on the information to be identified and the fraud-related content; The information to be identified, the fraud-related content and the prompt information are input into a fraud determination model to obtain a fraud determination result.
6. The fraud identification method according to claim 1, characterized in that: The step of determining the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result comprises: Determining an early warning scheme corresponding to the fraud identification result based on the fraud risk level and the fraud judgment result; the fraud risk level is determined based on the fraud risk score; Outputting a warning prompt to the object to be identified based on the warning scheme.
7. A fraud identification device, characterized in that: include: A fraud feature extraction module, used to extract target fraud features of the object to be identified based on the multi-dimensional data of the object to be identified; A fraud risk score determination module, used to determine the fraud risk score of the object to be identified based on the target fraud characteristics and the fraud decision model; The fraud decision model is constructed based on historical fraud data; A fraud-related content search module, used to generate information to be identified based on the network access content of the object to be identified, and search the external knowledge base for fraud-related content corresponding to the information to be identified; A fraud judgment result determination module, used for inputting the information to be identified and the fraud-related content into a fraud judgment model to obtain a fraud judgment result; The fraud determination model is constructed based on historical network access information; A fraud identification result determination module is used to determine the fraud identification result of the object to be identified based on the fraud risk score and the fraud judgment result.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the fraud identification method according to any one of claims 1 to 6 is implemented.
9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the fraud identification method according to any one of claims 1 to 6 is implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the fraud identification method according to any one of claims 1 to 6 is implemented.