Risk call identification method and device, equipment, storage medium and product

Abstract

The invention provides a risk call identification method and device, equipment, a storage medium and a product, and the method comprises the steps: screening out first Internet call flow data from mobile Internet log data through monitoring the mobile Internet log data, the first internet call flow data comprises call flow data between a dialing end and a receiving end based on an internet call; based on the first Internet call flow data, applying to an Internet call flow identification model, and screening out second Internet call flow data from the first Internet call flow data, the risk call probability value of the second internet call flow data output by the internet call flow identification model represents that the risk call exists between the dialing end and the receiving end. Therefore, potential risk calls can be effectively identified and warned, and a safe and reliable internet call environment is provided.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device, equipment, storage medium and product for identifying risky calls. Background Art

[0002] With the rapid development of communication technology, the way of making calls is no longer limited to traditional phone numbers. Now, various voice and video exchanges can be realized through Internet calls. However, behind this convenience, new types of risky calls have also emerged. For example, using users' personal information, such as sensitive data such as account identification, and then impersonating official service agencies such as financial payment platforms, initiating video or voice calls to users through the instant messaging function of the Internet, and then guiding users to perform risky operations.

[0003] Therefore, strengthening the security protection of Internet calls and improving the ability to monitor, identify and respond to risky behaviors have become urgent issues that need to be addressed. Summary of the invention

[0004] The present invention provides a method, device, equipment, storage medium and product for identifying risky calls, so as to solve the defects existing in the prior art.

[0005] The present invention provides a method for identifying risky calls, comprising: Monitoring mobile Internet access log data, and filtering out first Internet call traffic data from the mobile Internet access log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; Based on the first Internet call traffic data, an Internet call traffic identification model is applied to screen out second Internet call traffic data from the first Internet call traffic data, and a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

[0006] According to a risk call identification method provided by the present invention, the Internet call traffic identification model is trained in the following manner: Acquire historical Internet call traffic data, wherein the historical Internet call traffic data includes positive sample Internet call traffic data and negative sample Internet call traffic data, wherein the positive sample Internet call traffic data is marked with a risky call label, and the negative sample Internet call traffic data is marked with a normal call label; Performing feature extraction on the historical Internet call traffic data to extract at least one type of traffic feature, wherein the traffic feature includes at least one of traffic metadata, data packet sequence, byte distribution probability, transport layer security protocol header field, and payloads of the first N data packets; Based on the positive sample Internet call traffic data, the negative sample Internet call traffic data and the corresponding traffic characteristics, the initial machine learning model is trained to obtain a trained Internet call traffic identification model.

[0007] According to a method for identifying risky calls provided by the present invention, the step of obtaining historical Internet call traffic data includes: parsing the Internet call traffic data corresponding to the predefined Internet call type to determine the communication port range and communication protocol corresponding to the predefined Internet call type; Based on the communication port range and communication protocol corresponding to the predefined Internet call type, historical Internet call traffic data is obtained from historical mobile Internet access log data.

[0008] According to a method for identifying risky calls provided by the present invention, the initial machine learning model includes an initial GBDT model, and the method further includes: Based on the positive sample Internet call traffic data marked with risky call labels and the negative sample Internet call traffic data marked with normal call labels, the parameters of the initial GBDT model are adjusted through a grid search strategy until the optimal parameter combination is selected to obtain a trained Internet call traffic identification model.

[0009] A method for identifying risky calls provided by the present invention further includes: determining a user number of the receiving end corresponding to the second Internet call traffic data,

[0010] Based on the user number of the receiving end, sending a first warning prompt message; or,

[0011] The receiving end is monitored for risky behavior, and when the receiving end has risky behavior, a second early warning message is sent based on the user number of the receiving end.

[0012] According to a method for identifying risky calls provided by the present invention, the communication port range between the dialing end and the receiving end includes at least one of 3478-3497, 16384-16387 and 16393-16402, and the communication protocol corresponding to the dialing end and the receiving end includes the UDP communication protocol.

[0013] The present invention also provides a device for identifying risky calls, comprising: A first identification module is used to monitor mobile Internet log data, and filter out first Internet call traffic data from the mobile Internet log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; A second identification module is used to apply an Internet call traffic identification model based on the first Internet call traffic data to screen out second Internet call traffic data from the first Internet call traffic data, wherein a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold value, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for identifying risky calls as described in any one of the above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the risk call identification methods described above.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method for identifying risky calls as described in any one of the above is implemented.

[0017] The risky call identification method, device, equipment, storage medium and product provided by the present invention can quickly locate the call flow data using the Internet by monitoring the mobile Internet log data in real time and screening out the flow data that meets the characteristics of Internet calls (i.e., the first Internet call flow data). Furthermore, a specific Internet call flow identification model is used to screen out the risky call flow (i.e., the second Internet call flow data) and effectively identify the risky calls. Therefore, the present invention can effectively identify and warn of potential new risky calls, and provide users with a safer and more reliable Internet call environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flowchart of the method for identifying risky calls provided by the present invention; Figure 2 It is a schematic diagram of the structure of the risk call identification device provided by the present invention; Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Figure 1 One of the flow charts of the method for identifying risky calls provided by the present invention; Figure 1 As shown, the method includes: Step 110, monitoring mobile Internet log data, and filtering out first Internet call traffic data from the mobile Internet log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; Here, the mobile Internet log data can be obtained from the operator's mobile Internet malicious program detection and disposal system or the Internet log retention system. Among them, the mobile Internet log data includes multiple key fields, including but not limited to the following: User identity and device information: such as International Mobile Subscriber Identity Number, user’s mobile phone number, and user terminal model.

[0022] Network access and location information: such as network access identification, network type (such as 3G / UTRAN, 2G / GERAN, WLAN, GAN, HSPA, etc.), base station number, cell number, cell global identifier.

[0023] Communication event details: such as event time, duration (the time from the start of traffic to the continuation of log recording), and feature library version number (used to identify the version of the detection rule).

[0024] Communication behavior and content: such as identifiers of network sessions or traffic flows, rule types (including multiple event types, such as snort events, mtx events, malicious resource monitoring events, etc.), action types (such as whitelist, block, redirect, monitor, etc.), redirection URLs, transport layer protocol types (such as TCP, UDP), and application layer protocols.

[0025] IP and port information: such as IP type (such as IPv4 and IPv6), source IP address, source port number, destination IP address, and destination port number.

[0026] Traffic and data packet statistics: such as upstream traffic, downstream traffic, number of upstream packets, number of downstream packets; HTTP related information: such as the response status of the HTTP request, file name, file length, size of the response body, HTTP method (such as GET, POST, etc.), media type of the response body, and the URL accessed by the HTTP protocol.

[0027] Encryption and security information: payload (core information encapsulated in the data packet), TLS cipher suite, TLS extension, public key length.

[0028] Specifically, in this embodiment, the first Internet call traffic data is screened out from the mobile Internet log data according to the predefined communication port range and communication protocol. Here, the first Internet call traffic data refers to the traffic data generated by the call activity conducted through the Internet, which includes all call traffic information between the dialing end (i.e., the party initiating the call) and the receiving end (i.e., the party receiving the call), the port numbers of the dialing end and the receiving end are both within the communication port range corresponding to the predefined Internet call type, and the communication protocol between the dialing end and the receiving end conforms to the communication protocol corresponding to the predefined Internet call type.

[0029] Specifically, in this embodiment, a predefined rule set is provided, which includes the communication port ranges used by different Internet call types (such as FACETIME calls, VoIP calls, video calls, etc.). When the system analyzes the mobile Internet log data, it checks whether the port number of each flow falls within the communication port range corresponding to the predefined Internet call type. If so, then this flow may be Internet call traffic.

[0030] In addition to the port number, the communication protocol is also an important basis for identifying Internet call traffic. Different Internet call types use different communication protocols to ensure the correct transmission and reception of data. Therefore, in this embodiment, it is also checked whether the communication protocol of each flow matches the predefined Internet call type. Only when the port number and the communication protocol meet the conditions corresponding to the predefined Internet call type, this flow will be regarded as Internet call traffic and extracted as the first Internet call traffic data.

[0031] In one example, the communication port range between the dialing end and the receiving end includes at least one of 3478-3497, 16384-16387 and 16393-16402, and the communication protocol corresponding to the dialing end and the receiving end includes the UDP communication protocol.

[0032] Specifically, when the predefined Internet call type is a FACETIME call, first Internet call traffic data whose communication port range includes at least one of 3478-3497, 16384-16387 and 16393-16402 and whose communication protocol is the UDP communication protocol can be screened out from the mobile Internet log data for subsequent FACETIME call risk detection.

[0033] It should be noted that FaceTime is a video call software that allows users to access the Internet through Wi-Fi or cellular data and implement video calls between two devices equipped with FaceTime. FaceTime calls have specific communication characteristics and port requirements. In this embodiment, the first Internet call traffic data that may be related to FaceTime calls is screened from the mobile Internet log data according to the port range used by FaceTime calls under the UDP protocol.

[0034] Step 120, based on the first Internet call traffic data, an Internet call traffic identification model is applied to screen out second Internet call traffic data from the first Internet call traffic data, and a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold value, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

[0035] Specifically, Internet call traffic data that is clearly marked as risky can be collected. Such Internet call traffic data includes but is not limited to Internet call traffic data containing malicious behavior, fraudulent activities, network attacks, etc. These Internet call traffic data are used as positive sample Internet call traffic data and are marked with risk call labels. In addition, Internet call traffic data that is clearly marked as normal calls are collected and used as negative sample Internet call traffic data and are marked with normal call labels.

[0036] Then, the corresponding traffic features are extracted from the Internet call traffic data, including but not limited to port number, protocol type, duration, packet size, IP address pattern, communication pattern, etc. The extracted traffic features and corresponding labels (risk call labels or normal call labels) are used to train the initial machine learning model to obtain a trained Internet call traffic recognition model.

[0037] After the first Internet call flow data is screened out from the mobile Internet log data, the Internet call flow identification model can be used to identify the first Internet call flow data, and the Internet call flow identification model will output a normal call probability value that the first Internet call flow data belongs to a normal call and a risk call probability value that the risk call belongs to a risk call. When the risk call probability value of the first Internet call flow data is greater than a preset threshold (such as 50%), the first Internet call flow data is determined to be the second Internet call flow data.

[0038] The risky call identification method proposed in the embodiment of the present invention monitors the mobile Internet log data in real time and screens out the traffic data that meets the characteristics of Internet calls (i.e., the first Internet call traffic data), thereby quickly locating the call traffic data conducted using the Internet. Furthermore, a specific Internet call traffic identification model is used to screen out the risky call traffic (i.e., the second Internet call traffic data), thereby effectively identifying the risky calls. Therefore, the present invention can effectively identify and warn of potential new risky calls, and provide users with a safer and more reliable Internet call environment.

[0039] In some embodiments, the Internet call traffic identification model is trained by: Acquire historical Internet call traffic data, wherein the historical Internet call traffic data includes positive sample Internet call traffic data and negative sample Internet call traffic data, wherein the positive sample Internet call traffic data is marked with a risky call label, and the negative sample Internet call traffic data is marked with a normal call label; Performing feature extraction on the historical Internet call traffic data to extract at least one type of traffic feature, wherein the traffic feature includes at least one of traffic metadata, data packet sequence, byte distribution probability, transport layer security protocol header field, and payloads of the first N data packets; Based on the positive sample Internet call traffic data, the negative sample Internet call traffic data and the corresponding traffic characteristics, the initial machine learning model is trained to obtain a trained Internet call traffic identification model.

[0040] In this embodiment, a large amount of historical Internet call traffic data is first collected as training data for the training model, wherein the historical Internet call traffic data includes two types of data: positive sample Internet call traffic data and negative sample Internet call traffic data.

[0041] After obtaining the historical Internet call traffic data, useful traffic features are extracted from the historical Internet call traffic data. These traffic features will serve as inputs to the initial machine learning model to help the initial machine learning model learn how to distinguish different types of Internet call traffic data.

[0042] It should be noted here that when performing feature extraction, the extracted traffic features include but are not limited to: traffic metadata (such as the number of upstream bytes, the number of downstream bytes, the number of upstream packets, the number of downstream packets, duration, etc.), data packet sequence (such as length sequence, interval time sequence, etc.), byte distribution probability, transport layer security protocol header field (such as TLS encryption suite, TLS extension, public key length), and the payload of the first N data packets.

[0043] Finally, based on the extracted positive sample Internet call traffic data, negative sample Internet call traffic data and their corresponding traffic characteristics, the initial machine learning model is trained to obtain a trained Internet call traffic recognition model.

[0044] The risk call identification method proposed in the embodiment of the present invention, through the above manner, realizes that the Internet call traffic identification model can automatically and in real time help identify potential network threats and improve the overall level of network security.

[0045] In some embodiments, obtaining historical Internet call traffic data includes: parsing the Internet call traffic data corresponding to the predefined Internet call type to determine the communication port range and communication protocol corresponding to the predefined Internet call type; Based on the communication port range and communication protocol corresponding to the predefined Internet call type, historical Internet call traffic data is obtained from historical mobile Internet access log data.

[0046] It should be noted that each Internet call type may use a specific port range to establish a connection and transmit data, and different Internet call types may use different communication protocols. Therefore, in this embodiment, the actual call traffic of the call application using the predefined Internet call type can be captured and analyzed to determine the communication port range and communication protocol corresponding to the predefined Internet call type.

[0047] Furthermore, according to the communication port range and communication protocol obtained by the analysis, a screening condition is set, and then the historical mobile Internet log database is searched using the set screening condition to screen out the historical Internet call flow data that meets the condition from the historical log data.

[0048] The risk call identification method proposed in the embodiment of the present invention can effectively extract historical Internet call traffic data related to a specific Internet call type from a large amount of historical mobile Internet log data through the above manner.

[0049] In some embodiments, the initial machine learning model includes an initial GBDT model, and the method further includes: Based on the positive sample Internet call traffic data marked with risky call labels and the negative sample Internet call traffic data marked with normal call labels, the parameters of the initial GBDT model are adjusted through a grid search strategy until the optimal parameter combination is selected to obtain a trained Internet call traffic identification model.

[0050] In this embodiment, the initial GBDT (Gradient Boosting Decision Tree) model is set as the initial machine learning model. When the GBDT model is applied to the Internet call traffic identification task, multiple parameters need to be adjusted to obtain the best performance. These parameters include but are not limited to the number of trees, the learning rate, the proportion of samples used to train each tree, the maximum depth of the tree, and the minimum number of samples required for a leaf node.

[0051] Specifically, in order to determine the optimal parameters, the grid search strategy is adopted in this embodiment to evaluate the performance of the model by continuously trying different parameter combinations. Here, grid search is an exhaustive search method that finds the optimal model parameters by traversing a given parameter combination. Specifically, grid search defines a set of parameter value ranges (grids), and then exhaustively enumerates all parameter combinations in this grid, trains the model separately, and uses methods such as cross-validation to evaluate the performance of the model under each parameter combination. Finally, the parameter combination with the best performance is selected as the optimal parameters of the model.

[0052] Specifically, when using the grid search strategy, first fix the parameters such as the maximum depth of the tree and the minimum number of samples required for the leaf node, and then adjust the number of trees, the learning rate, and the proportion of samples used to train each tree. Then, the grid search will traverse each set of parameter combinations, use positive samples (Internet call traffic data marked with risky call labels) and negative samples (Internet call traffic data marked with normal call labels) to train the initial GBDT model, and evaluate the performance of the model under each parameter combination through methods such as cross-validation. Finally, the parameter combination with the best performance is selected as the optimal parameter of the initial GBDT model, and the trained Internet call traffic recognition model can be obtained.

[0053] The risk call identification method proposed in the embodiment of the present invention can effectively identify and warn of potential new risk calls through the above method, thereby providing users with a safer and more reliable Internet call environment.

[0054] In some embodiments, it also includes: determining a user number of the receiving end corresponding to the second Internet call traffic data,

[0055] Based on the user number of the receiving end, sending a first warning prompt message; or,

[0056] The receiving end is monitored for risky behavior, and when the receiving end has risky behavior, a second early warning message is sent based on the user number of the receiving end.

[0057] In this embodiment, after identifying the second Internet call traffic data of the risky call, the user number of the receiving end in the second Internet call traffic data is determined, and a first early warning prompt message, such as a flash message prompt message, is sent to the user number of the receiving end to prompt the user of the receiving end that there is a risk in the dialing end of the current Internet call.

[0058] Furthermore, the receiver will be monitored for risky behaviors, such as real-time monitoring of the receiver's communication activities, device status, software installation, etc. The monitored risky behaviors include abnormal data transmission, unknown software installation, frequent communication attempts, etc.

[0059] When potential risk behaviors are monitored, further analysis and judgment will be conducted to determine whether these behaviors actually constitute risks. If the judgment result confirms the existence of risky behaviors, the system will send a second warning message based on the user number of the receiving end, such as through SMS, outbound calls, etc.

[0060] The method for identifying risky calls proposed in the embodiment of the present invention implements a rapid response mechanism for Internet call traffic risks through the above method, adapts to different security requirements and scenarios through different methods, and improves the efficiency of network security protection.

[0061] The device for identifying risky calls provided by the present invention is described below. The device for identifying risky calls described below and the method for identifying risky calls described above can be referenced to each other.

[0062] refer to Figure 2 In this embodiment, the device for identifying risky calls includes: a first identification module 210 and a second identification module 220.

[0063] A first identification module 210 is used to monitor the mobile Internet log data, and filter out first Internet call traffic data from the mobile Internet log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; The second identification module 2200 is used to apply an Internet call traffic identification model based on the first Internet call traffic data to filter out second Internet call traffic data from the first Internet call traffic data, wherein a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold value, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

[0064] The risky call identification device provided by the embodiment of the present invention can quickly locate the call flow data using the Internet by monitoring the mobile Internet log data in real time and screening out the flow data that meets the characteristics of Internet calls (i.e., the first Internet call flow data). Furthermore, by using a specific Internet call flow identification model, the risky call flow (i.e., the second Internet call flow data) is screened out, and the risky calls are effectively identified. Therefore, the present invention can effectively identify and warn of potential new risky calls, and provide users with a safer and more reliable Internet call environment.

[0065] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3 As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the risk call identification method, which includes: Monitoring mobile Internet access log data, and filtering out first Internet call traffic data from the mobile Internet access log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; Based on the first Internet call traffic data, an Internet call traffic identification model is applied to screen out second Internet call traffic data from the first Internet call traffic data, and a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

[0066] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0067] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program, the computer program can be stored in a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the risk call identification method provided by the above methods, the method comprising: Monitoring mobile Internet access log data, and filtering out first Internet call traffic data from the mobile Internet access log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; Based on the first Internet call traffic data, an Internet call traffic identification model is applied to screen out second Internet call traffic data from the first Internet call traffic data, and a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

[0068] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the risk call identification method provided by the above methods, the method comprising: Monitoring mobile Internet access log data, and filtering out first Internet call traffic data from the mobile Internet access log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; Based on the first Internet call traffic data, an Internet call traffic identification model is applied to screen out second Internet call traffic data from the first Internet call traffic data, and a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

[0069] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0070] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying risky calls, characterized in that: The method comprises: Monitoring mobile Internet access log data, and filtering out first Internet call traffic data from the mobile Internet access log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; Based on the first Internet call traffic data, an Internet call traffic identification model is applied to screen out second Internet call traffic data from the first Internet call traffic data, and a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

2. The method for identifying risky calls according to claim 1, characterized in that: The Internet call traffic identification model is trained in the following way: Acquire historical Internet call traffic data, wherein the historical Internet call traffic data includes positive sample Internet call traffic data and negative sample Internet call traffic data, wherein the positive sample Internet call traffic data is marked with a risky call label, and the negative sample Internet call traffic data is marked with a normal call label; Performing feature extraction on the historical Internet call traffic data to extract at least one type of traffic feature, wherein the traffic feature includes at least one of traffic metadata, data packet sequence, byte distribution probability, transport layer security protocol header field, and payloads of the first N data packets; Based on the positive sample Internet call traffic data, the negative sample Internet call traffic data and the corresponding traffic characteristics, the initial machine learning model is trained to obtain a trained Internet call traffic identification model.

3. The method for identifying risky calls according to claim 2, characterized in that: The obtaining of historical Internet call traffic data includes: parsing the Internet call traffic data corresponding to the predefined Internet call type to determine the communication port range and communication protocol corresponding to the predefined Internet call type; Based on the communication port range and communication protocol corresponding to the predefined Internet call type, historical Internet call traffic data is obtained from historical mobile Internet access log data.

4. The method for identifying risky calls according to claim 1, characterized in that: The initial machine learning model includes an initial GBDT model, and the method further includes: Based on the positive sample Internet call traffic data marked with risky call labels and the negative sample Internet call traffic data marked with normal call labels, the parameters of the initial GBDT model are adjusted through a grid search strategy until the optimal parameter combination is selected to obtain a trained Internet call traffic identification model.

5. The method for identifying risky calls according to claim 1, characterized in that: The method further comprises: determining a user number of the receiving end corresponding to the second Internet call traffic data, Based on the user number of the receiving end, sending a first warning prompt message; or, The receiving end is monitored for risky behavior, and when the receiving end has risky behavior, a second early warning message is sent based on the user number of the receiving end.

6. The method for identifying risky calls according to any one of claims 1 to 5, characterized in that: The communication port range between the dialing end and the receiving end includes at least one of 3478-3497, 16384-16387 and 16393-16402, and the communication protocol corresponding to the dialing end and the receiving end includes the UDP communication protocol.

7. A device for identifying risky calls, characterized in that: include: A first identification module is used to monitor mobile Internet log data, and filter out first Internet call traffic data from the mobile Internet log data, wherein the first Internet call traffic data includes call traffic data between a dialing end and a receiving end based on an Internet call; A second identification module is used to apply an Internet call traffic identification model based on the first Internet call traffic data to screen out second Internet call traffic data from the first Internet call traffic data, wherein a risk call probability value of the second Internet call traffic data output by the Internet call traffic identification model is greater than a preset threshold value, indicating that there is a risk call between the dialing end and the receiving end; Among them, the Internet call traffic identification model is obtained by training the initial machine learning model with positive sample Internet call traffic data marked with risky call labels and negative sample Internet call traffic data marked with normal call labels.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for identifying risky calls as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying risky calls as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for identifying risky calls as described in any one of claims 1 to 6 is implemented.

Images