User number identification method and device, equipment, storage medium and program product

Abstract

The invention discloses a user number identification method and device, equipment, a storage medium and a program product, which are used for accurately distinguishing fraud numbers and harassment numbers. The user number identification method comprises the following steps: under the condition that a first user number is abnormal, performing frequency domain transformation on global communication data of the first user number in a first time period to obtain a frequency domain feature image of the first user number; and through a classification model, abnormal type information of the first user number is predicted based on the frequency domain feature image of the first user number, and the classification model is obtained by training based on the frequency domain feature image of a second user number with abnormity and an abnormal type label of the second user number.

Description

Technical Field

[0001] The present application relates to the field of mobile communication technology, and in particular to a user number identification method, device, equipment, storage medium and program product. Background Art

[0002] In recent years, with the development of network communication technology, telecommunications fraud and harassment cases have occurred frequently, with more and more fraud and harassment modes and increasingly covert means. In order to improve communication security and avoid affecting the normal communication process, it is necessary to accurately distinguish between fraud numbers and harassment numbers. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a user number identification method, device, equipment, storage medium and program product for accurately distinguishing between fraudulent numbers and harassment numbers.

[0004] In order to achieve the above objectives, the present application embodiment adopts the following technical solutions:

[0005] In a first aspect, an embodiment of the present application provides a user number identification method, including:

[0006] In the case that the first user number is abnormal, performing frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number;

[0007] The abnormal type information of the first user number is predicted based on the frequency domain feature image of the first user number through a classification model, and the classification model is trained based on the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number.

[0008] In a second aspect, an embodiment of the present application provides a user number identification device, including:

[0009] a transformation module, configured to perform frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number when there is an abnormality in the first user number;

[0010] A prediction module is used to predict the abnormal type of the first user number based on the frequency domain feature image of the first user number through a classification model, and the classification model is trained based on the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number.

[0011] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0012] processor;

[0013] a memory for storing instructions executable by the processor;

[0014] The processor is configured to execute the instructions to implement the user number identification method provided in the first aspect.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the user number identification method provided in the first aspect.

[0016] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute part or all of the steps in the user number identification method of the first aspect.

[0017] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0018] In the case that there is an abnormality in the first user number, the global communication data of the first user number in the first time period is used as the basis for abnormality type identification, so as to comprehensively cover the characteristics of the first user number in the entire communication process within a period of time, which is helpful to accurately identify the abnormal type of the first user number; on this basis, the global communication data of the first time period is transformed in the frequency domain to obtain the frequency domain feature image of the first user number, and the frequency domain feature image can objectively and accurately describe the temporal correlation of the communication behavior of the first user number; further, based on deep learning technology, the classification model is trained using the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number, so that the classification model can accurately learn the correlation between the communication behaviors of the fraudulent number and the harassment number at different times, and then identify the correlation between the communication behaviors of the first user number at different times from the frequency domain feature image of the first user number through the classification model, and use the correlation to accurately identify whether the abnormal type of the user number is a fraudulent number or a harassment number, thereby achieving accurate distinction between fraudulent numbers and harassment numbers. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 A flowchart of a user number identification method provided for an embodiment of the present application;

[0021] Figure 2A flowchart of a method for identifying abnormal user numbers provided by an embodiment of the present application;

[0022] Figure 3 A flowchart of a user number identification method provided by another embodiment of the present application;

[0023] Figure 4 A schematic diagram of a frequency domain transformation process provided for one embodiment of the present application;

[0024] Figure 5 A schematic diagram of a risk control strategy provided for an embodiment of the present application;

[0025] Figure 6 A schematic diagram of the structure of a user number identification device provided by an embodiment of the present application;

[0026] Figure 7 A schematic diagram of the structure of an electronic device provided for one embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0028] The terms "first", "second", etc. in this specification and claims are used to distinguish similar objects, and are not used to describe a particular order or precedence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein. In addition, "and / or" in this specification and claims means at least one of the connected objects, and the character " / " generally means that the objects associated with each other are in an "or" relationship.

[0029] Related concept description:

[0030] Telecommunications fraud refers to the act of fraudsters using communication methods such as telephone, Internet or text messages to fabricate false information, deceive users, and remotely trick users into transferring money to the fraudsters, causing financial losses to users.

[0031] Telecom harassment refers to the behavior of certain businesses, organizations or individuals using communication methods such as telephone, Internet or text messages to frequently harass users within a short period of time, spreading promotional information, false information or other information irrelevant to the users, causing distress to the users.

[0032] As mentioned above, in order to improve communication security and avoid affecting the normal communication process, it is necessary to accurately distinguish between fraudulent numbers and harassment numbers. At present, the identification of user numbers relies on a pre-defined telecommunications fraud library. For the endless fraud patterns, the telecommunications fraud library is difficult to guarantee coverage, resulting in low recognition accuracy. Secondly, it is impossible to distinguish between harassment numbers and fraudulent numbers, and only fraudulent numbers can be identified, resulting in incomplete identification coverage types. In addition, due to the similarities between harassment numbers and fraudulent numbers, it is easy to mistakenly identify harassment numbers as fraudulent numbers, resulting in improper handling measures and affecting the communication experience.

[0033] The applicant has studied a large number of user codes with abnormalities such as fraudulent numbers and harassment numbers and found that, on the one hand, communication behavior has a continuous characteristic, and there are obvious differences in the communication behavior of fraudulent numbers and harassment numbers over a period of time, while the global communication data of user numbers over a period of time can fully cover the characteristics of the entire communication process of the user number over a period of time. Therefore, by using the global communication data of user numbers over a period of time as the basis for abnormal type identification, it is helpful to accurately identify the abnormal type of user numbers.

[0034] On the other hand, the obvious difference in communication behavior between fraudulent numbers and harassment numbers is reflected in the correlation between communication behaviors at different times, and this correlation is usually deep and difficult to express in the time domain. Therefore, by transforming the global communication data in the time domain to the frequency domain, the resulting frequency domain feature image can objectively and accurately describe this deep correlation, thereby helping to accurately identify the abnormal type of user numbers.

[0035] On the other hand, considering that deep learning has the ability to learn hierarchical features, it can establish a detailed understanding of data by learning and identifying data patterns and features at different levels of abstraction, thus performing well in processing complex data. To this end, by processing the frequency domain feature images of user numbers with the help of deep learning technology, it is possible to accurately learn and identify the correlation between the communication behaviors of user numbers at different times, and then use this correlation to accurately identify the abnormal type of user numbers, whether they are fraudulent numbers or harassment numbers, and achieve accurate distinction between fraudulent numbers and harassment numbers.

[0036] Taking the above aspects into consideration, an embodiment of the present application proposes a user number identification method. When there is an abnormality in the first user number, the global communication data of the first user number in the first time period is used as the basis for abnormality type identification, so as to comprehensively cover the characteristics of the first user number in the entire communication process within a period of time, which is helpful to accurately identify the abnormal type of the first user number; on this basis, the global communication data of the first time period is transformed in the frequency domain to obtain the frequency domain feature image of the first user number, and the frequency domain feature image can objectively and accurately describe the temporal correlation of the communication behavior of the first user number; further, based on deep learning technology, the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number are used to train a classification model, so that the classification model can accurately learn the correlation between the communication behaviors of the fraudulent number and the harassment number at different times, and then identify the correlation between the communication behaviors of the first user number at different times from the frequency domain feature image of the first user number through the classification model, and use the correlation to accurately identify whether the abnormal type of the user number is a fraudulent number or a harassment number, so as to achieve accurate distinction between fraudulent numbers and harassment numbers.

[0037] It should be understood that the user number identification method provided in the embodiment of the present application can be executed by an electronic device. The electronic device referred to here may include a terminal device, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent voice interaction device, a smart home appliance, a smart watch, a vehicle terminal, an aircraft, etc.; or, the electronic device may also include a server, such as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0038] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0039] Please refer to Figure 1 , is a flow chart of a user number identification method provided by an embodiment of the present application, the method comprising the following steps:

[0040] S102, when there is an abnormality in the first user number, perform frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number.

[0041] The first user number refers to the user number to be identified. The first time period can be set according to actual needs. As an example, in order to improve the real-time performance of identification, the first time period can be a time period within a specified time period before the current time point. For example, if the current time point is September 1, 2024, the first time period can be August 25, 2024.

[0042] The global communication data of the first period includes the global communication data of multiple consecutive time units in the first period. A time unit refers to a paragraph or interval in time, which can be of any length, depending on the actual application or demand. As an example, the length of the time unit is a day. In this case, the global communication of the first period includes the global communication data of multiple consecutive days.

[0043] For each time unit, the global communication data of the time unit includes all relevant data generated by the first user number during the communication process within the time unit, and these data cover the entire communication process. As an example, the global communication data of each time unit may include, for example, but is not limited to, basic information data, communication behavior data, service usage data, consumption data, location data, etc. within the time unit.

[0044] Among them, basic information data includes but is not limited to: the device identification, brand, number of SIM (Subscriber Identity Module) cards that can be inserted, card information of SIM cards, identity information of the user to which the first user number belongs, etc. Communication behavior data is used to describe the communication behavior of the user number, and may include but is not limited to: number of calls, number of call transfers, called numbers, etc. Service usage data is used to describe the use of services by the user number, and may include but is not limited to: services used by the user number, the sale of the user number, the sales channels of the user number, etc. Consumption data is used to describe the consumption of the user number, and may include but is not limited to: the call duration of the user number, the traffic consumed, the number of text messages, etc. Location data is used to describe the location of the user number, and may include but is not limited to: the geographical location of the user number during each call, the geographical location when the user number is activated, the mailing address when the user number is processed, etc.

[0045] In the embodiment of the present application, the global communication data of the first user number in the first time period can be obtained by various appropriate methods, and the embodiment of the present application is not limited to this. In one implementation, if Figure 2 As shown, based on the big data platform, the global communication data related to telecommunications fraud and harassment in the first time period are extracted from the operation database; then, with the user number as the primary key, the extracted global communication data are aggregated to obtain the global communication data of each user number in the first time period; further, according to the preset data cleaning rules, the missing values ​​and abnormal values ​​in the global communication data of each user in the first time period are cleaned; finally, each unidentified user number can be used as the first user number, thereby obtaining the global communication data of the first user number in the first time period.

[0046] In the embodiment of the present application, various appropriate methods can be used to determine whether the first user number is abnormal, which is not limited in the embodiment of the present application. In one implementation, it can be determined whether the first user number is abnormal by manual review.

[0047] In another implementation, the global communication data of the first user number is input into a pre-trained anomaly recognition model to obtain the probability that the first user number is abnormal; if the probability is greater than the first preset probability, it is determined that the first user number is abnormal. The anomaly recognition model is trained by the global communication data of the third user number in the third time period and the anomaly label of the third user number.

[0048] The third user number refers to a user number that is known to be abnormal. The third time period may be a time period that is concurrent with the first time period, for example, if the first time period is from August 1, 2024 to September 1, 2024, then the third time period is from August 1, 2023 to September 1, 2023; or, the third time period may be a time period that is before the first time period and adjacent to the first time period, for example, if the first time period is from August 1, 2024 to September 1, 2024, then the third time period is from July 1, 2024 to August 1, 2024, and so on. The abnormal label of the third user number is used to indicate whether the third user number is abnormal.

[0049] In another implementation, before the above S102, it is determined whether there is an abnormality in the first user number through the following steps: step A1, based on the global communication data of the first user number in the first time period, determine the communication characteristics of the first user number in multiple dimensions; step A2, based on the abnormality identification strategy of each dimension and the communication characteristics of the first user number in each dimension, determine whether there is an abnormality in the first user number.

[0050] Among them, Figure 2As shown, the above multiple dimensions may include, but are not limited to, dimensions such as region, communication behavior, channel, terminal device, and service. The communication characteristics of the first user number in the region dimension are used to describe the geographical location of the first user number, and may include, but are not limited to, the geographical location of the first user number when activated, the geographical location of the first user number after activation, etc. The communication characteristics of the first user number in the channel dimension are used to describe the characteristics of the channel from which the first user number comes, and may include, but are not limited to, the channel from which the first user number comes, whether other user numbers sold by the channel include fraudulent numbers or harassment numbers, etc. The communication characteristics of the first user number in the terminal device dimension are used to describe the characteristics of the terminal device to which the first user number belongs, and may include, but are not limited to, the brand of the terminal device to which the first user number belongs, the number of SIM cards that can be inserted, whether other user numbers of the terminal device include fraudulent numbers or harassment numbers, etc. The communication characteristics of the first user number in the service dimension are used to describe the behavior of the first user number in using the service, and may include, but are not limited to, the time from activation to the first use of the call service, whether the first user number is resold after activation, the number of times the monthly fee is changed after activation, and the service used after activation, etc.

[0051] In the above step A1, for each dimension, statistics are collected on the global communication data of the first user number in the first time period to obtain the communication characteristics of the first user number in the dimension.

[0052] In the above step A2, the abnormality identification strategy of each dimension is used to identify whether the communication characteristics of any user number in the dimension are abnormal.

[0053] As an example, the abnormal identification strategy of each dimension may include abnormal communication characteristics of the dimension. For example, the abnormal communication characteristics of the regional dimension include: the activation location is inconsistent with the first call location, the call location is a high-risk location where fraud and harassment occur frequently, etc. The abnormal communication characteristics of the communication behavior dimension include: the call transfer frequency exceeds the first preset frequency, the calling frequency after activation exceeds the second preset frequency, etc. The abnormal communication characteristics of the channel dimension include: the channel from which the user number comes is an informal channel, and other user numbers sold by the channel from which the user number comes include fraud numbers or harassment numbers, etc. The abnormal traffic characteristics of the terminal device dimension include: the terminal device to which the user number belongs is a non-brand terminal, and other user numbers of the terminal device to which the user number belongs include fraud numbers or harassment numbers, etc. The abnormal communication characteristics of the business dimension include: the number of calls after the user number is activated is less than the preset number, the user number is resold to other users, and the cumulative traffic size used after the user number is activated is less than the preset traffic size, etc.

[0054] In this case, for each dimension, the communication characteristics of the first user number with the dimension are matched with the abnormal communication characteristics of the dimension. If the similarity between the two is greater than the preset similarity threshold, it is determined that the communication characteristics of the first user number in the dimension are abnormal; further, based on the abnormal identification results of the first user number in all dimensions, it is determined whether the first user number is abnormal. Specifically, if the communication characteristics of the first user number in any dimension are abnormal, the first user number is determined to be abnormal. Alternatively, if the communication characteristics of the first user number in any dimension are abnormal, the SMS interface is called to send an authentication SMS to the first user number to notify the user of the first user number to perform identity authentication; if the authentication request of the first user number is not received within the specified time after the authentication SMS is sent, or the user of the first user number fails the identity authentication, it is determined that the first user number is abnormal.

[0055] In the above step A2, the anomaly identification strategy for each dimension can be obtained in the following manner: obtain the global communication data of the second user number with the abnormality in the second time period; for each dimension, determine the communication characteristics of the second user in the dimension based on the global communication data in the second time period; based on the communication characteristics of the second user in the dimension, determine the abnormal communication characteristics of the dimension.

[0056] Exemplarily, there are multiple second user numbers. Taking the regional dimension as an example, the call locations of all second user numbers are counted. Assume that these locations include: location 1, location 2, and location 3. If the number of second user numbers whose call locations are located at location 1 is the largest, then it is determined that one of the abnormal call features of the regional dimension is: the call location is located at location 1.

[0057] It can be understood that the communication characteristics of the first user number in multiple dimensions can comprehensively describe the characteristics of the first user number in the communication process. Based on this, it is possible to quickly and accurately identify whether there is an abnormality in the first user number, and the identification result is also explainable.

[0058] In practical applications, the anomaly identification strategy of each dimension can be used for real-time anomaly monitoring of user numbers, and the anomaly identification strategy of each dimension can be continuously expanded according to situation requirements to improve the accuracy of anomaly monitoring, thereby improving the accuracy of identifying anomaly types.

[0059] In the above S102, the global communication data of the first user number in the first time period fully covers the characteristics of the first user number in the entire communication process within a period of time, which helps to accurately identify the abnormal type of the first user number. On this basis, the global communication data of the first time period is transformed in the frequency domain to obtain the frequency domain feature image of the first user number, which reflects the frequency characteristics of the global communication data of the first user number. The frequency domain feature image can objectively and accurately describe the correlation between the communication behaviors of the first user number at different times.

[0060] In the above S102, the global communication data of the first user in the first time period may be frequency-domain transformed in various appropriate ways, which is not limited in this embodiment of the present application.

[0061] In one implementation, frequency domain transformation is performed on the entire global communication data of the first user in the first time period to obtain a frequency domain feature image of the first user number.

[0062] In another implementation, the global communication data of the first time period includes global communication data of a plurality of consecutive time units. In this case, the above S102 includes the following steps:

[0063] Step B1, performing frequency domain transformation on the global communication data of multiple time units to obtain a frequency domain feature image of each time unit.

[0064] The frequency domain transformation in the present application can adopt various frequency domain transformation technologies, such as, but not limited to, STFT (Short-Time Fourier Transformer), DCT (Discrete Cosine Transform), WT (Wavelet Transform), Hilbert Transform, etc.

[0065] As an example, for the global-area communication data of each time unit in the global-area communication data of the first time period, a frequency domain transformation may be performed on the global-area communication data of the time unit to obtain a frequency domain feature image of the time unit.

[0066] As another example, considering that there may be abnormal global communication data in the global communication data of the first period, such data will affect the recognition accuracy of the abnormal type. For this reason, Figure 3As shown, the abnormal global communication data is filtered out by clustering, and then the remaining global communication data is transformed in the frequency domain to ensure the accuracy of the frequency domain feature image of the first user number, thereby providing reliable data support for subsequent abnormal type identification. In this way, not only can the impact of abnormal global communication data on the accuracy of abnormal type identification be reduced, but also the amount of calculation can be reduced and the efficiency of abnormal type identification can be improved.

[0067] Specifically, in the above step B1, the global communication data of multiple consecutive time units are clustered to obtain cluster centers; the distances between the cluster centers and the global communication data of each time unit are determined; from the global communication data of multiple consecutive time units, the global communication data of P time units closest to the cluster center are selected, where P is an integer greater than 1; and the global communication data of each of the selected P time units are transformed in the frequency domain to obtain a frequency domain feature image of each selected time unit.

[0068] Exemplarily assume that the global communication data of the first user in the first period includes global communication data for N consecutive days, N is an integer greater than 1, and the dimension of the global communication data for each day is D. In order to reduce the impact of abnormal data, the K-means clustering algorithm is used to cluster the global communication data for N consecutive days, and the number of clusters K is set to 1, and a cluster center and at least one day of global communication data close to the cluster center are obtained; the global communication data of M days outside the cluster is the abnormal global communication data. In this case, the global communication data contained in the cluster is selected to obtain P days of global communication data, P = NM.

[0069] Further, if Figure 4 As shown, for the global communication data of each day, the global communication data is transformed in the frequency domain to obtain the frequency domain feature image of the first user number on that day, and then the frequency domain feature image of P days.

[0070] Step B2: stacking frequency domain feature images of multiple time units to obtain a frequency domain feature image of the first user number.

[0071] For example, Figure 4 As shown, the frequency domain feature images of P days are combined in chronological order to obtain the frequency domain feature image of the first user number. The frequency domain feature image is a high-dimensional feature image with a dimension of D×D×P.

[0072] It can be understood that in the above implementation method, by performing frequency domain transformation on the global communication data of each time unit and then stacking them, the obtained frequency domain feature image can more accurately reflect the correlation between the communication behaviors of the first user number in different time units, thereby helping to further improve the accuracy of abnormal type identification.

[0073] S104: predicting abnormal type information of the first user number based on the frequency domain feature image of the first user number through a classification model.

[0074] The abnormal type information includes the abnormal type of the first user number and the probability that the first user number belongs to the abnormal type. Among them, the abnormal type includes a fraud number or a harassment number. The classification model is trained based on the frequency domain feature image of the abnormal second user number and the heterogeneous label of the second user number. The abnormal type label of the second user number indicates that the abnormal type of the second user number is a fraud number or a harassment number. As a result, the classification model can accurately learn the correlation between the communication behaviors of the fraud number and the harassment number at different times.

[0075] Based on this, the frequency domain feature image of the first user number is input into the classification model, and the classification model can identify the correlation between the communication behaviors of the first user number at different times, and use this correlation to accurately identify whether the abnormal type of the user number is a fraud number or a harassment number, thereby achieving accurate distinction between fraud numbers and harassment numbers.

[0076] In the embodiment of the present application, the classification model can be trained by various appropriate methods, which are not limited in the embodiment of the present application. In one embodiment, the second user number includes a fraud number and a harassment number. The classification model can be trained by the following steps:

[0077] Step C1, marking the fraudulent number with an abnormal type label representing a positive sample, and marking the harassing number with an abnormal type label representing a negative sample.

[0078] For example, the abnormal type label of a fraud number is marked as 1 to treat the fraud number as a positive sample; the abnormal type label of a harassment number is marked as 0 to treat the harassment number as a negative sample.

[0079] Step C2, convolution processing is performed on the frequency domain feature image of the fraudulent number through the convolution neural network of the classification model to obtain a first convolution result, and mapping processing is performed on the first convolution result based on the fully connected layer of the classification model to obtain abnormal type information of the fraudulent number.

[0080] For example, the frequency domain feature image of a fraudulent number is a high-dimensional tensor X, which includes P sub-matrices. The convolutional neural network contains L convolutional layers, and the convolution kernel W of each convolutional layer is also a high-dimensional tensor with dimensions of L×L×P, where L is the size of the convolution kernel, which is generally 3 or 5, and P is the depth of the convolution kernel, which needs to be consistent with the number of sub-matrices that are input. The set function of the convolution layer uses the ReLU function, so the output of the convolution layer is:

[0081]

[0082] Among them, represents the bias of the convolutional layer. Furthermore, the output of the lth layer (2≤l≤L-1) is as follows:

[0083] If the lth layer is a convolutional layer, the output is:

[0084]

[0085] If the lth layer is a pooling layer, the output is:

[0086] X l =pool(X l-1 ) (3)

[0087] If the lth layer is a fully connected layer, the output is:

[0088] X l =Sigmoid(W l X l-1 +b l ) (4)

[0089] Pooling refers to the process of reducing the input tensor according to the pooling area size k and the pooling standard (such as taking the maximum value max or taking the average average). Sigmoid represents the activation function of the lth layer.

[0090] The output of the Lth convolution layer is the first convolution result. The fully connected layer performs the following mapping processing on the first convolution result to obtain the probability that the first user number is a fraud number or a harassment number:

[0091] X L =Softmax(W L X L-1 +b L ) (5)

[0092] Among them, Softmax represents the activation function.

[0093] If the probability that the first user number is a fraud number is greater than a preset probability (for example, 0.5) or the probability that the first user number is a harassment number is less than or equal to the preset probability, the abnormal type of the first user number is determined to be a fraud number; otherwise, the abnormal type of the first user number is determined to be a harassment number.

[0094] Step C3: performing convolution processing on the frequency domain feature image of the harassing number through a convolutional neural network to obtain a second convolution result, and performing mapping processing on the second convolution result based on a fully connected layer to obtain abnormal type information of the harassing number.

[0095] The specific implementation of step C3 is similar to that of step C2, and will not be described in detail.

[0096] Step C4, based on the abnormal type label and abnormal type information of the fraudulent number, the abnormal type label and abnormal type information of the harassment number, the parameters of the convolutional neural network and the parameters of the fully connected layer are adjusted.

[0097] Exemplarily, a first loss can be determined based on the abnormal type label and abnormal type information of the fraudulent number, and the first loss represents the difference between the abnormal type label of the fraudulent number and the predicted abnormal type; a second loss can be determined based on the abnormal type label and abnormal type information of the harassment number, and the second loss represents the difference between the abnormal type label of the fraudulent number and the predicted abnormal type; further, based on the weighted sum of the first loss and the second loss, the parameters of the neural network and the parameters of the fully connected layer are adjusted using the back propagation algorithm.

[0098] It is worth noting that the above steps C1 to C4 are only a model training process. In practical applications, the classification model can be trained multiple times until the training stop condition is met. Among them, the training stop condition can be set according to actual needs, such as the weighted sum of the first loss and the second loss converges or the number of training times reaches a preset number of training times, etc., which is not limited in the embodiments of the present application.

[0099] The user number identification method provided in the embodiment of the present application uses the global communication data of the first user number in the first time period as the basis for identifying the abnormal type when there is an abnormality in the first user number, so as to comprehensively cover the characteristics of the first user number in the entire communication process within a period of time, which is helpful to accurately identify the abnormal type of the first user number; on this basis, the global communication data of the first time period is transformed in the frequency domain to obtain the frequency domain feature image of the first user number, and the frequency domain feature image can objectively and accurately describe the temporal correlation of the communication behavior of the first user number; further, based on deep learning technology, the classification model is trained using the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number, so that the classification model can accurately learn the correlation between the communication behaviors of the fraudulent number and the harassment number at different times, and then identify the correlation between the communication behaviors of the first user number at different times from the frequency domain feature image of the first user number through the classification model, and use the correlation to accurately identify whether the abnormal type of the user number is a fraudulent number or a harassment number, thereby achieving accurate distinction between fraudulent numbers and harassment numbers.

[0100] In another embodiment of the present application, after predicting the abnormal type of the first user number, a corresponding processing strategy may be used to perform risk control on the first user number according to the abnormal type of the first user number.

[0101] Specifically, the abnormal type information of the first user number includes the abnormal type of the first user number and the probability that the first user number belongs to the abnormal type. After the above S104, the user number identification method provided in the embodiment of the present application further includes:

[0102] S106: Determine a risk level of the first user number under the abnormal type based on the probability that the first user number belongs to the abnormal type.

[0103] For example, Figure 5 As shown, the risk level of a fraudulent number may include high risk and medium risk. If the probability that the first user number is a fraudulent number is less than or equal to 0.75 and greater than 0.5, the risk level of the first user number under this abnormal type is determined to be medium risk; if the probability that the first user number is a fraudulent number is greater than 0.75 and less than or equal to 1, the risk level of the first user number under this abnormal type is determined to be high risk.

[0104] The risk level of a harassing number may include high risk and medium risk. If the probability that the first user number is a harassing number is less than or equal to 0.25 and greater than or equal to 0, the risk level of the first user number under this abnormal type is determined to be high risk; if the probability that the first user number is a harassing number is greater than 0.25 and less than or equal to 0.5, the risk level of the first user number under this abnormal type is determined to be medium risk.

[0105] It is worth noting that in actual applications, the risk level, probability threshold, etc. of each abnormal type can be flexibly adjusted according to the current fraud, harassment situation and actual data conditions.

[0106] S108: Perform risk control on the first user number based on a processing strategy matching the risk level.

[0107] For example, Figure 5 As shown, for the high risk level under the fraud type, the matching processing strategy includes management shutdown. In this case, if the abnormal type of the first user number is a fraud number and the risk level is high risk, the following risk control is performed on the first user number: the first user number is shut down, and a message is sent or a robot calls to explain that the first user number is abnormal and has been handled, and the message does not include a real-name authentication link entrance, and the user is required to bring relevant documents to the business hall for on-site processing and recovery.

[0108] For the medium risk level under the fraud type, the corresponding processing strategies include early warning reminders and management shutdown. In this case, if the abnormal type of the first user number is a fraud number and the risk level is medium risk, the following risk control is performed on the first user number: the first user number is shut down, and a message is sent or a robot calls to explain that the first user number is abnormal and has been handled, and the message is accompanied by a real-name authentication link entrance, allowing the user to enter the real-name authentication platform for authentication; if the authentication is passed, the first user number is restored; if the authentication fails or is not authenticated, it remains in a shutdown state, and the user is required to bring relevant documents to the business hall for on-site processing and recovery.

[0109] For high-risk levels under the harassment type, the matching processing strategy includes call restriction. In this case, if the abnormal type of the first user number is a harassment number and the risk level is high risk, the following risk control is performed on the first user number: restrict calls to the first user number, and send a message or a robot call to explain that the first user number is handled due to abnormal use. The message is accompanied by a real-name authentication link entrance, allowing the user to enter the real-name authentication platform for authentication; if the authentication is successful, the call function of the first user number is restored; if the authentication fails or is not authenticated, the call restriction status is maintained, and the user is required to bring relevant documents to the business hall for on-site processing and restoration.

[0110] For the medium risk level under the harassment type, the matching processing strategies include call restriction and early warning reminders. In this case, if the abnormal type of the first user number is a fraud number and the risk level is medium risk, the following risk control is performed on the first user number: call restriction on the first user number, and send a message or robot call to explain that the first user number is handled due to abnormal use. The message does not include a real-name authentication link entrance, and the user needs to bring relevant documents to the business hall for on-site processing and recovery.

[0111] It can be understood that the above method can realize the classification and grading of abnormal first user numbers and improve the adaptability of risk control. This not only ensures the effectiveness of handling fraudulent numbers and harassment numbers, but also reduces the impact of erroneous handling on user experience.

[0112] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0113] Based on the same inventive concept, the present application also provides a user number identification device. Figure 6 , is a schematic diagram of a user number identification device provided by an embodiment of the present application. Figure 6 As shown, in a software implementation, the user number identification device 600 includes: a transformation module 610 and a prediction module 620.

[0114] The transformation module 610 is used to perform frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number when there is an abnormality in the first user number.

[0115] The prediction module 620 is used to predict the abnormal type of the first user number based on the frequency domain feature image of the first user number through a classification model, and the classification model is trained based on the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number.

[0116] In another embodiment, the global communication data of the first period includes global communication data of a plurality of consecutive time units;

[0117] The transformation module is used for:

[0118] Performing frequency domain transformation on the global communication data of the plurality of time units to obtain a frequency domain feature image of each time unit;

[0119] The frequency domain feature images of a plurality of the time units are stacked to obtain the frequency domain feature image of the first user number.

[0120] In another embodiment, when the transformation module performs frequency domain transformation on the global communication data of the plurality of time units to obtain the frequency domain feature image of each time unit, the transformation module performs the following steps:

[0121] Clustering the global communication data of the plurality of consecutive time units to obtain a cluster center;

[0122] Determine the distance between the cluster center and the global communication data of each time unit respectively;

[0123] From the global communication data of the plurality of consecutive time units, select the global communication data of P time units closest to the cluster center, where P is an integer greater than 1;

[0124] The global communication data of each of the selected P time units is transformed in the frequency domain to obtain a frequency domain feature image of each of the selected time units.

[0125] In another embodiment, the second user number includes a fraud number and a harassment number;

[0126] The classification model is trained in the following way:

[0127] Marking the fraudulent number with an abnormal type label representing a positive sample, and marking the harassing number with an abnormal type label representing a negative sample;

[0128] The frequency domain feature image of the fraudulent number is convolved by the convolutional neural network of the classification model to obtain a first convolution result, and the first convolution result is mapped based on the fully connected layer of the classification model to obtain abnormal type information of the fraudulent number;

[0129] By means of the convolutional neural network, convolution processing is performed on the frequency domain feature image of the harassing number to obtain a second convolution result, and mapping processing is performed on the second convolution result based on the fully connected layer to obtain abnormal type information of the harassing number;

[0130] Based on the abnormal type label and abnormal type information of the fraud number, the abnormal type label and abnormal type information of the harassment number, the parameters of the convolutional neural network and the parameters of the fully connected layer are adjusted.

[0131] In another embodiment, the user identification device 600 further includes:

[0132] a determination module, configured to determine communication characteristics of the first user number in multiple dimensions based on the global communication data of the first user number in the first time period;

[0133] The identification module is used to determine whether the first user number has an abnormality based on the abnormality identification strategy of each dimension and the communication characteristics of the first user number in each dimension.

[0134] In another embodiment, the anomaly identification strategy for each dimension includes an abnormal communication feature for each dimension;

[0135] The anomaly identification strategy for each dimension is obtained as follows:

[0136] Acquire global communication data of a second user number with an abnormality in a second time period;

[0137] For each dimension, determining a communication feature of the second user in the dimension based on the global communication data of the second time period;

[0138] Based on the communication characteristics of the second user in the dimension, an abnormal communication characteristic in the dimension is determined.

[0139] Obviously, the user number identification device 600 provided in the embodiment of the present application can be used as the above Figure 1The execution body of the user number identification method shown in the figure can thus realize the voiceprint recognition device in Figure 1 The functions realized are as follows. Since the principles are the same, they will not be described in detail.

[0140] Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 7 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0141] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0142] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0143] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a user number identification device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

[0144] In the case that there is an abnormality in the first user number, performing frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number;

[0145] The abnormal type information of the first user number is predicted based on the frequency domain feature image of the first user number through a classification model, and the classification model is trained based on the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number.

[0146] The above application Figure 1 The method performed by the user number identification device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0147] The electronic device may also perform Figure 1 The method and the user number identification device are implemented in Figures 1 to 5 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0148] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0149] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by a portable electronic device including a plurality of application programs, enable the portable electronic device to execute Figure 1 The method of the embodiment shown is specifically used to perform the following operations:

[0150] In the case that there is an abnormality in the first user number, performing frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number;

[0151] The abnormal type information of the first user number is predicted based on the frequency domain feature image of the first user number through a classification model, and the classification model is trained based on the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number.

[0152] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps in the user number identification method provided in the embodiment of the present application.

[0153] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0154] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0155] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0156] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0157] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A method for identifying a user number, characterized in that: include: In the case that the first user number is abnormal, performing frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number; The abnormal type information of the first user number is predicted based on the frequency domain feature image of the first user number through a classification model, and the classification model is trained based on the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number.

2. The method according to claim 1, characterized in that The global communication data of the first period includes global communication data of a plurality of consecutive time units; The performing frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number includes: Performing frequency domain transformation on the global communication data of the plurality of time units to obtain a frequency domain feature image of each time unit; The frequency domain feature images of a plurality of the time units are stacked to obtain the frequency domain feature image of the first user number.

3. The method according to claim 2, characterized in that The performing frequency domain transformation on the global communication data of the plurality of time units to obtain a frequency domain feature image of each time unit includes: Clustering the global communication data of the plurality of consecutive time units to obtain a cluster center; Determine the distance between the cluster center and the global communication data of each time unit respectively; From the global communication data of the plurality of consecutive time units, select the global communication data of P time units closest to the cluster center, where P is an integer greater than 1; The global communication data of each of the selected P time units is transformed in the frequency domain to obtain a frequency domain feature image of each of the selected time units.

4. The method according to claim 1, characterized in that: The second user number includes a fraud number and a harassment number; The classification model is trained in the following way: Marking the fraudulent number with an abnormal type label representing a positive sample, and marking the harassing number with an abnormal type label representing a negative sample; The frequency domain feature image of the fraudulent number is convolved by the convolutional neural network of the classification model to obtain a first convolution result, and the first convolution result is mapped based on the fully connected layer of the classification model to obtain abnormal type information of the fraudulent number; By means of the convolutional neural network, convolution processing is performed on the frequency domain feature image of the harassing number to obtain a second convolution result, and mapping processing is performed on the second convolution result based on the fully connected layer to obtain abnormal type information of the harassing number; Based on the abnormal type label and abnormal type information of the fraud number, the abnormal type label and abnormal type information of the harassment number, the parameters of the convolutional neural network and the parameters of the fully connected layer are adjusted.

5. The method according to claim 1, characterized in that In the case where the first user number is abnormal, before performing frequency domain transformation on the global communication data of the first user number in the first time period to obtain the frequency domain feature image of the first user number, the method further includes: Determining communication characteristics of the first user number in multiple dimensions based on the global communication data of the first user number in the first time period; Based on the abnormality identification strategy of each dimension and the communication characteristics of the first user number in each dimension, it is determined whether the first user number has an abnormality.

6. The method according to claim 5, characterized in that The anomaly identification strategy for each dimension includes the abnormal communication characteristics of each dimension; The anomaly identification strategy for each dimension is obtained as follows: Acquire global communication data of a second user number with an abnormality in a second time period; For each dimension, determining a communication feature of the second user in the dimension based on the global communication data of the second time period; Based on the communication characteristics of the second user in the dimension, an abnormal communication characteristic in the dimension is determined.

7. A user number identification device, characterized in that: include: a transformation module, configured to perform frequency domain transformation on the global communication data of the first user number in the first time period to obtain a frequency domain feature image of the first user number when there is an abnormality in the first user number; A prediction module is used to predict the abnormal type of the first user number based on the frequency domain feature image of the first user number through a classification model, and the classification model is trained based on the frequency domain feature image of the second user number with an abnormality and the abnormal type label of the second user number.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the user number identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the user number identification method as claimed in any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute part or all of the steps in the user number identification method according to any one of claims 1 to 6.

Images