Abnormal number identification method and device, equipment and medium

Abstract

The invention provides an abnormal number identification method and device, equipment and a medium, and relates to the technical field of communication. The method comprises the following steps: acquiring historical position data and historical call data of a plurality of numbers; in the historical position data and the historical call data of each number, the position feature and the behavior feature of each number are extracted, and the behavior feature is used for representing the call behavior feature of the number; according to the position feature and the behavior feature of each number, performing preliminary screening on the plurality of numbers to obtain a plurality of to-be-detected numbers; acquiring a media stream of each to-be-detected number in the plurality of to-be-detected numbers; and identifying a dual-tone multi-frequency DTMF signal in the media stream of each to-be-detected number, and determining the to-be-detected number in which the DTMF signal is identified as an abnormal number, the abnormal number being a number having an abnormal call behavior. According to the embodiment of the invention, the performance consumption in the recognition process can be reduced, and the abnormal call number which requires the called party to carry out key input in the call process can be effectively detected.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an abnormal number identification method, device, equipment and medium. Background Art

[0002] With the continuous development and popularization of communication networks, users receive various types of calls every day, which may include commercial promotions, customer service, relatives and friends, etc. However, not all calls are needed or expected by users. Some calls from abnormal numbers, such as fraudulent calls, harassment calls and unsolicited sales calls, not only disturb users' daily lives, but also pose a threat to users' property safety and personal privacy.

[0003] By identifying abnormal numbers, users can block calls from these numbers, which can not only effectively reduce users' interference from unnecessary calls, but also significantly improve users' communication experience and sense of security.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a method, device, equipment and medium for identifying abnormal numbers, which at least to a certain extent solve the problem of high cost and low accuracy in identifying abnormal numbers in the related art.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for identifying an abnormal number is provided, comprising:

[0008] Get historical location data and historical call data for multiple numbers;

[0009] Extracting the location features and behavior features of each number from the historical location data and historical call data of each number, wherein the behavior features are used to represent the call behavior features of the number;

[0010] Based on the location characteristics and behavior characteristics of each number, multiple numbers are preliminarily screened to obtain multiple numbers to be tested;

[0011] Obtaining a media stream of each number to be detected among multiple numbers to be detected;

[0012] A dual-tone multi-frequency (DTMF) signal is identified in the media stream of each number to be detected, and the number to be detected with the identified DTMF signal is determined as an abnormal number, where the abnormal number is a number with abnormal call behavior.

[0013] In one embodiment of the present disclosure, identifying a DTMF signal in a media stream of each number to be detected includes:

[0014] For a DTMF signal whose transmission mode is SIPINFO, the DTMF signal is identified through the signal field in the session initiation protocol SIP information packet.

[0015] In one embodiment of the present disclosure, identifying a DTMF signal in a media stream of each number to be detected further includes:

[0016] For DTMF signals transmitted in RFC2833, the data packet is identified through the telephone event TeleponeEvent, and the DTMF signal is identified based on the data packet.

[0017] In one embodiment of the present disclosure, identifying a DTMF signal in a media stream of each number to be detected further includes:

[0018] For the DTMF signal with the transmission mode of INBAND, the RTP data packet is extracted for spectrum analysis to obtain the high-frequency and low-frequency frequencies, and the DTMF signal is identified based on the high-frequency and low-frequency frequencies.

[0019] In one embodiment of the present disclosure, before acquiring the media stream of each of the multiple numbers to be detected, the method further includes:

[0020] For the signaling and media streams of the same call, parse the IP, port, and calling and called number information in the signaling, and parse the IP and port information in the media stream;

[0021] The signaling and media stream are associated according to the IP and port, and the calling and called numbers corresponding to the media stream are determined.

[0022] In one embodiment of the present disclosure, multiple numbers are preliminarily screened according to the location characteristics and behavior characteristics of each number to obtain multiple numbers to be detected, including:

[0023] The location features and behavior features of each number are input into a pre-trained detection model to obtain multiple numbers to be detected, wherein the detection model is trained based on the lightweight gradient boosting machine LightGBM.

[0024] In one embodiment of the present disclosure, the behavior characteristics include one or more of the following characteristics:

[0025] The total number of calls for the day, the number of calls in the first half hour, the average duration of outgoing calls, the average duration of outgoing and connected calls, the proportion of called mobile phone numbers within the province, the dispersion of called numbers, call intensity, connection rate, the proportion of connected calls lasting 1-30 seconds, the proportion of calls lasting 0-30 seconds, and the number of calls in the first hour.

[0026] According to another aspect of the present disclosure, there is provided an abnormal number identification device, comprising:

[0027] A data acquisition module, used to acquire historical location data and historical call data of multiple numbers;

[0028] A feature extraction module is used to extract the location feature and behavior feature of each number from the historical location data and historical call data of each number, and the behavior feature is used to represent the call behavior feature of the number;

[0029] The initial screening module is used to perform preliminary screening on multiple numbers according to the location characteristics and behavior characteristics of each number to obtain multiple numbers to be tested;

[0030] A media stream acquisition module, used to acquire the media stream of each number to be detected among multiple numbers to be detected;

[0031] The abnormal identification module is used to identify the DTMF signal in the media stream of each number to be detected, and determine the number to be detected with the identified DTMF signal as an abnormal number, which is a number with abnormal calling behavior.

[0032] According to another aspect of the present disclosure, an electronic device is provided, including: a memory for storing instructions; and a processor for calling the instructions stored in the memory to implement the above-mentioned abnormal number identification method.

[0033] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which computer instructions are stored, and when the computer instructions are executed by a processor, the above-mentioned abnormal number identification method is implemented.

[0034] According to another aspect of the present disclosure, a computer program product is provided. The computer program product stores instructions, and when the instructions are executed by a computer, the computer implements the above-mentioned abnormal number identification method.

[0035] According to yet another aspect of the present disclosure, there is provided a chip, comprising at least one processor and an interface;

[0036] An interface for providing program instructions or data to at least one processor;

[0037] At least one processor is used to execute program instructions to implement the above-mentioned abnormal number identification method.

[0038] The abnormal number identification method, device, equipment and medium provided in the embodiments of the present disclosure perform preliminary screening of multiple numbers according to the location characteristics and behavior characteristics of each number to obtain multiple numbers to be detected. By adding the preliminary screening process, the workload of subsequent DTMF signal analysis can be effectively reduced, the performance consumption of the abnormal number identification process can be reduced, and abnormal call numbers that require the called party to input keystrokes during the call can be effectively detected.

[0039] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0041] Obviously, the drawings described below are only some embodiments of the present disclosure, and a person skilled in the art can obtain other drawings based on these drawings without any creative work.

[0042] Figure 1 A flow chart of an abnormal number identification method in an embodiment of the present disclosure is shown;

[0043] Figure 2 A schematic diagram of feature engineering in an embodiment of the present disclosure is shown;

[0044] Figure 3 The following is a flowchart of AI modeling in an embodiment of the present disclosure;

[0045] Figure 4 A graph showing the result of feature importance evaluation in an embodiment of the present disclosure is shown;

[0046] Figure 5 A flow chart of a method for filling in numbers on a media receipt in an embodiment of the present disclosure is shown;

[0047] Figure 6 A flow chart of a method for detecting DTMF data in an embodiment of the present disclosure is shown;

[0048] Figure 7 A schematic diagram of an abnormal number identification device in an embodiment of the present disclosure is shown;

[0049] Figure 8 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0051] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0052] Abnormal number calls include fraudulent calls, harassment calls, and unsolicited sales calls. The solution of the disclosed embodiment is mainly used to detect abnormal call numbers that require the called party to input keystrokes during the call. Specifically, for example, international fraud calls, the caller voice of the fraud call is usually an automatic voice of human-computer interaction, and during the call, the called party is usually required to input various numbers by keystrokes or directly transfer to an operator. However, this type of fraud is not necessarily a fake international roaming, nor does it necessarily involve a sudden increase in traffic, which cannot be discovered by existing technologies.

[0053] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0054] First, an abnormal number identification method is provided in an embodiment of the present disclosure, and the method can be executed by any electronic device with computing and processing capabilities.

[0055] Figure 1 A flow chart of an abnormal number identification method in an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the abnormal number identification method provided in the embodiment of the present disclosure includes steps S101-S105.

[0056] In S101, historical location data and historical call data of multiple numbers are obtained;

[0057] In S102, the location feature and behavior feature of each number are extracted from the historical location data and historical call data of each number, and the behavior feature is used to represent the calling behavior feature of the number;

[0058] In S103, a plurality of numbers are preliminarily screened according to the location characteristics and behavior characteristics of each number to obtain a plurality of numbers to be detected;

[0059] In S104, a media stream of each of the multiple numbers to be detected is obtained;

[0060] In S105, a dual tone multi-frequency (DTMF) signal is identified in the media stream of each number to be detected, and the number to be detected with the identified DTMF signal is determined as an abnormal number, which is a number with abnormal calling behavior.

[0061] DTMF (Dual Tone Multi Frequency): Two sine waves of high-frequency and low-frequency sound are combined to represent digital keys (0-9*#AB CD). Specifically, the high-frequency and low-frequency groups each contain 4 frequencies. A high-frequency signal and a low-frequency signal are superimposed to form a combined signal, representing a number. DTMF signals have 16 codes.

[0062] In some embodiments, the preliminary screening process of S103 described above can be implemented by a computer model.

[0063] In some embodiments, S103 performs preliminary screening of multiple numbers based on the location characteristics and behavior characteristics of each number to obtain multiple numbers to be detected, including: inputting the location characteristics and behavior characteristics of each number into a pre-trained detection model to obtain multiple numbers to be detected, wherein the detection model is trained based on a lightweight gradient boosting machine LightGBM.

[0064] In some embodiments, the behavior characteristics include one or more of the following characteristics: the cumulative number of calls on the day, the number of calls in the first half hour, the average duration of outgoing calls, the average duration of outgoing and connected calls, the proportion of mobile phone numbers in the province called, the dispersion of called numbers, call intensity, connection rate, the proportion of connected calls with a duration of 1-30 seconds, the proportion of calls with a duration of 0-30 seconds, and the number of calls in the first hour. It is understandable that the above embodiments of the present disclosure may also include other behavior characteristics, such as the following: Figure 4 behavioral characteristics in .

[0065] The following describes in detail the training process of the model used in the above S103 through an embodiment.

[0066] In the selection of training and test data, the positive samples selected are mainly samples of fraudulent numbers from the telephone verification system, the weekly report of the security center, the police case notification, and the industry clue verification platform. The negative samples are the signaling feature data of the number samples after the work orders are removed in the same period. The total positive and negative sample ratio is about 1:60.

[0067] The features used in model training include location features (1) and behavior features (58). The details are shown in Table 1 below:

[0068] Table 1

[0069] Major categories Field Name Location Features Caller location Behavioral characteristics Total calls for the day Behavioral characteristics Call volume in the first half hour Behavioral characteristics Average call duration - outgoing Behavioral characteristics Average call duration connected - outbound Behavioral characteristics Proportion of called mobile phone numbers within the province Behavioral characteristics Called number dispersion Behavioral characteristics Call Strength Behavioral characteristics Connection rate Behavioral characteristics The proportion of connected calls lasting 1-30 seconds Behavioral characteristics Percentage of call duration 0-30 seconds Behavioral characteristics Call volume in the previous hour

[0070] In some embodiments, the above features also need to go through cleaning and binarization processes, as well as dimensionality reduction processes. Feature engineering such as Figure 2 shown.

[0071] A probability threshold for predicting fraud is set. In some embodiments, numbers with a fraud probability > 0.8 may be considered fraud numbers. It should be noted that in the embodiments of the present disclosure, the fraud numbers initially screened out are referred to as numbers to be detected.

[0072] In some embodiments, LightGBM is selected as the AI ​​modeling algorithm. LightGBM is a gradient boosting framework that uses a decision tree-based learning algorithm. It has the advantages of faster training efficiency, low memory usage, higher accuracy, support for parallel learning, and the ability to process large-scale data. In some embodiments, the AI ​​modeling process can be as follows: Figure 3 shown.

[0073] LightGBM adds many new methods to improve the model, including: using the histogram algorithm to solve the problem of too many split points; using the unilateral gradient sampling algorithm to solve the problem of too many samples; using the mutually exclusive feature bundling algorithm to solve the problem of too many features.

[0074] It is understandable that the features used in the above model training have different importance in the process of identifying abnormal numbers, and the features for training can be selected according to their importance to train the detection model.

[0075] The present disclosure also conducts an experimental evaluation on the importance of the above features. The evaluation results are as follows: Figure 4 shown.

[0076] The embodiment of the present disclosure also counts the recall rate and precision rate of the test results of the preliminary screening, and the specific results are shown in Table 2 below.

[0077] Table 2

[0078]

[0079] Through the above method, a detection model (AI model) with the function of preliminary screening of suspected fraud numbers can be built based on international traffic signaling data, and a batch of fraudulent numbers, i.e. numbers to be detected, can be output. According to the data of the test set, the recall rate and precision rate can reach more than 90%, and the average daily output number is less than 200, which greatly narrows the scope of analysis, helps to carry out subsequent DTMF detection, reduces system performance consumption, and improves resource utilization efficiency.

[0080] The following is an introduction to the DTMF detection process in conjunction with a specific embodiment, as follows:

[0081] The first modeling in the early stage has been able to preliminarily identify international numbers suspected of fraud. However, in order to more accurately identify fraudulent calls using DTMF buttons, the signaling and media collected by the signaling monitoring system can be combined for identification. The specific method is as follows:

[0082] First, since there is no specific number information in the media stream, only IP information, it is necessary to associate the signaling and media of the same call in the IP+port mode and fill in the number information recorded in the media. The method for filling in the number of the media document is as follows: Figure 5 shown.

[0083] In some embodiments, Figure 5 As shown, before the above S104 obtains the media stream of each number to be detected among multiple numbers to be detected, the method also includes: for the signaling and media stream of the same call, parsing to obtain the IP, port and called number information in the signaling, and parsing to obtain the IP and port information in the media stream; associating the signaling and the media stream according to the IP and port, and determining the called number corresponding to the media stream.

[0084] After the number information in the media record is backfilled, the number to be detected that may be suspected of fraud can be identified and output according to the detection model. The corresponding media stream information can be found with the time number as the index to analyze whether there is a DTMF signal in it.

[0085] In some embodiments, the above S105 identifies the DTMF signal in the media stream of each number to be detected, including: for the DTMF signal whose transmission mode is SIP INFO, identifying the DTMF signal through the signal field in the Session Initiation Protocol SIP information packet.

[0086] In some embodiments, the above S105 identifies the DTMF signal in the media stream of each number to be detected, and further includes: for the DTMF signal transmitted in RFC2833, identifying the data packet through the telephone event TeleponeEvent, and identifying the DTMF signal according to the data packet.

[0087] In some embodiments, the above S105 identifies the DTMF signal in the media stream of each number to be detected, and further includes: for the DTMF signal with the transmission mode of INBAND, extracting the RTP data packet to perform spectrum analysis to obtain high frequency and low frequency frequencies, and identifying the DTMF signal based on the high frequency and low frequency frequencies.

[0088] The following is a detailed description of the method for identifying DTMF signals from a media stream.

[0089] DTMF generally has three modes: SIPINFO, RFC2833 and INBAND. The methods for detecting DTMF data in SIP are as follows: Figure 6 shown.

[0090] 1) SIPINFO

[0091] Out-of-band detection method, transmit DTMF data through the SIP signaling channel. There is no unified implementation standard. Currently, Cisco SIPINFO is used as the standard, and DTMF keys are identified through the signal field in the SIPINFO packet. Note that when DTMF is "*", different standards implement the corresponding signal = * or signal = 10. The advantage of SIPINFO is that it does not affect the transmission of RTP data packets, but it may cause asynchrony.

[0092] 2)RFC2833

[0093] In-band detection is carried out through RTP transmission, and the RFC2833 data packet is marked by a special rtpPayloadType, namely TeleponeEvent. The same DTMF button usually corresponds to multiple RTP packets, and the timestamps of these RTP packets are the same, which can be used as a basis for identifying the same button. The end flag of the last RTP packet is set to 1 to indicate the end of the DTMF data. In addition, many SIP UAs including IADs provide TeleponeEvent settings, such as 3CX Phone, Billion-IAD, ZTE-IAD, etc. The default TeleponeEvent is 101, but it can be modified manually. In this case, it is required to obtain the TeleponeEvent parameters negotiated by SDP before performing RFC2833DTMF detection.

[0094] 3) INBAND

[0095] In-band detection mode, and mixed with ordinary RTP voice packets for transmission. The only way to perform INBAND DTMF detection is to extract the RTP data packet for spectrum analysis, obtain the high-frequency and low-frequency frequencies through spectrum analysis, and then look up the table to get the corresponding keys. The algorithm for spectrum analysis is generally Goertzel, which is a relatively mature method. This method can accurately detect DTMF signals in the media.

[0096] Finally, if a DTMF signal is detected, the probability that the calling number is a DTMF transfer fraud is very high, and it can basically be confirmed as suspected fraud. The number can be shared with the international bureau network element and handled by means of international bureau blacklist interception. In addition, when an abnormal number is detected, the user can also be prompted to inform the user that the number he is talking to is an abnormal number and may be suspected of fraud.

[0097] Since DTMF detection needs to include media stream parsing, media and signaling association, media number backfilling, and selection of different identification methods according to the three different DTMF transmission methods, the entire process consumes a lot of system performance, so it is necessary to first narrow the detection scope. By introducing AI algorithms, we first use behavioral feature modeling and analysis to preliminarily screen out numbers that may be suspected of fraud, narrow the DTMF detection scope, and then perform DTMF detection on these numbers to reduce system consumption and improve resource utilization efficiency.

[0098] The disclosed embodiment adopts computer model initial screening + DTMF detection technology, which can accurately identify the type of fraud existing in international fraud calls, which is "playing automatic voice for human-computer interaction, usually requiring the called party to input various numbers by pressing keys or directly transfer to manual call during the call."

[0099] In the embodiments of the present disclosure, the terms “first”, “second” and “third” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0100] The term "and / or" in this disclosure is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0101] Furthermore, although the steps of the method in the present disclosure are described in a particular order in the drawings, this does not require or imply that the steps must be performed in this particular order or that all the steps shown must be performed to achieve the desired results.

[0102] In some embodiments, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0103] Based on the same inventive concept, the present disclosure also provides an abnormal number identification device, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0104] Figure 7 A schematic diagram of an abnormal number identification device in an embodiment of the present disclosure is shown. Figure 7 As shown, the abnormal number identification device 700 includes:

[0105] A data acquisition module 701 is used to acquire historical location data and historical call data of multiple numbers;

[0106] A feature extraction module 702 is used to extract the location feature and behavior feature of each number from the historical location data and historical call data of each number, where the behavior feature is used to represent the call behavior feature of the number;

[0107] The preliminary screening module 703 is used to perform preliminary screening on multiple numbers according to the location characteristics and behavior characteristics of each number to obtain multiple numbers to be tested;

[0108] The media stream acquisition module 704 is used to acquire the media stream of each of the multiple numbers to be detected;

[0109] The abnormal identification module 705 is used to identify the DTMF signal in the media stream of each number to be detected, and determine the number to be detected with the identified DTMF signal as an abnormal number, which is a number with abnormal calling behavior.

[0110] In some embodiments, the abnormality identification module 705 identifies the DTMF signal in the media stream of each number to be detected, including: for the DTMF signal with the transmission mode of SIPINFO, identifying the DTMF signal through the signal field in the session initiation protocol SIP information packet.

[0111] In some embodiments, the abnormal identification module 705 identifies the DTMF signal in the media stream of each number to be detected, and further includes: for the DTMF signal transmitted in RFC2833, identifying the data packet through the telephone event TeleponeEvent, and identifying the DTMF signal according to the data packet.

[0112] In some embodiments, the abnormal identification module 705 identifies the DTMF signal in the media stream of each number to be detected, and also includes: for the DTMF signal with the transmission mode of INBAND, extracting the RTP data packet for spectrum analysis to obtain the high frequency and low frequency frequencies, and identifying the DTMF signal based on the high frequency and low frequency frequencies.

[0113] In some embodiments, the abnormal number identification device 700 further includes a data association module.

[0114] The data association module is used to parse the signaling and media stream of the same call to obtain the IP, port and called number information in the signaling, and the IP and port information in the media stream before obtaining the media stream of each of the multiple numbers to be detected. The signaling and media stream are associated with each other according to the IP and port to determine the called number corresponding to the media stream.

[0115] In some embodiments, the initial screening module 703 is used to input the location characteristics and behavior characteristics of each number into a pre-trained detection model to obtain multiple numbers to be detected, wherein the detection model is trained based on a lightweight gradient boosting machine LightGBM.

[0116] In some embodiments, the behavioral characteristics include one or more of the following characteristics:

[0117] The total number of calls for the day, the number of calls in the first half hour, the average duration of outgoing calls, the average duration of outgoing and connected calls, the proportion of called mobile phone numbers within the province, the dispersion of called numbers, call intensity, connection rate, the proportion of connected calls lasting 1-30 seconds, the proportion of calls lasting 0-30 seconds, and the number of calls in the first hour.

[0118] The concepts of “first”, “second”, etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0119] Regarding the abnormal number identification device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the abnormal number identification method, and will not be elaborated here.

[0120] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory.

[0121] In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0122] Some of the blocks shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0123] Refer to the following Figure 8 To describe the electronic device provided by the embodiment of the present disclosure. Figure 8 The electronic device 800 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0124] Figure 8 FIG. 8 is a schematic diagram showing the architecture of an electronic device 800 provided by an embodiment of the present disclosure. Figure 8 As shown, the electronic device 800 includes but is not limited to: at least one processor 810 and at least one memory 820.

[0125] The memory 820 is used to store instructions.

[0126] In some embodiments, the memory 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0127] In some embodiments, the memory 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0128] In some embodiments, the memory 820 may store an operating system, which may be a real-time operating system (RTX), LINUX, UNIX, WINDOWS, or OS X.

[0129] In some embodiments, data may also be stored in the memory 820 .

[0130] As an example, the processor 810 may read data stored in the memory 820 , where the data may be stored at the same storage address as the instruction, or the data may be stored at a different storage address than the instruction.

[0131] The processor 810 is used to call the instructions stored in the memory 820 to implement the steps of various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processor 810 can execute the steps of the above abnormal number identification method embodiment.

[0132] It should be noted that the processor 810 may be a general-purpose processor or a special-purpose processor. The processor 810 may include one or more processing cores, and the processor 810 executes various functional applications and data processing by running instructions.

[0133] In some embodiments, the processor 810 may include a central processing unit (CPU) and / or a baseband processor.

[0134] In some embodiments, the processor 810 may determine an instruction according to the priority identifier and / or function category information carried in each control instruction.

[0135] In the present disclosure, the processor 810 and the memory 820 may be provided separately or integrated together.

[0136] As an example, the processor 810 and the memory 820 may be integrated on a single board or a system on chip (SOC).

[0137] like Figure 8 As shown, the electronic device 800 is in the form of a general-purpose computing device. The electronic device 800 may further include a bus 830 .

[0138] Bus 830 may be a bus representing one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0139] The electronic device 800 may also communicate with one or more external devices 840 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 800, and / or any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 850.

[0140] Furthermore, the electronic device 800 can also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through the network adapter 860 .

[0141] like Figure 8 As shown, the network adapter 860 communicates with other modules of the electronic device 800 via the bus 830 .

[0142] It should be understood that although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0143] It is understood that the structure shown in the embodiment of the present disclosure does not constitute a specific limitation on the electronic device 800. In other embodiments of the present disclosure, the electronic device 800 may include: Figure 8 More or fewer components may be shown, or some components may be combined or separated, or the components may be arranged differently. Figure 8 The components shown may be implemented in hardware, software or a combination of software and hardware.

[0144] The present disclosure also provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the abnormal number identification method described in the above method embodiment is implemented.

[0145] The computer-readable storage medium in the embodiments of the present disclosure is a computer instruction that can be sent, propagated or transmitted for use by or in conjunction with an instruction execution system, apparatus or device.

[0146] As one example, computer readable storage media are non-volatile storage media.

[0147] In some embodiments, more specific examples of computer-readable storage media in the present disclosure may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, a USB flash drive, a mobile hard disk, or any suitable combination of the foregoing.

[0148] In the embodiments of the present disclosure, the computer-readable storage medium may include a data signal propagated in a baseband or as a part of a carrier wave, in which computer instructions (readable program codes) are carried.

[0149] Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.

[0150] In some examples, computing instructions contained on a computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0151] The embodiment of the present disclosure also provides a computer program product, which stores instructions. When the instructions are executed by a computer, the computer implements the abnormal number identification method described in the above method embodiment.

[0152] The above instructions may be program codes. In specific implementation, the program codes may be written in any combination of one or more programming languages.

[0153] The programming language includes object-oriented programming languages, such as Java, C++, etc., and also includes conventional procedural programming languages, such as "C" language or similar programming languages.

[0154] The program code may execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0155] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0156] The embodiment of the present disclosure also provides a chip, including at least one processor and an interface;

[0157] An interface for providing program instructions or data to at least one processor;

[0158] At least one processor is used to execute program instructions to implement the abnormal number identification method described in the above method embodiment.

[0159] In some embodiments, the chip may further include a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0160] Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments may be implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0161] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein.

[0162] The present disclosure is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not disclosed in the present disclosure. The description and examples are to be regarded as exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for identifying abnormal numbers, characterized in that: include: Get historical location data and historical call data for multiple numbers; Extracting the location feature and the behavior feature of each number from the historical location data and the historical call data of each number, wherein the behavior feature is used to represent the calling behavior feature of the number; Preliminarily screening the multiple numbers according to the location characteristics and the behavior characteristics of each number to obtain multiple numbers to be detected; Acquire a media stream of each number to be detected among the multiple numbers to be detected; A dual-tone multi-frequency (DTMF) signal is identified in the media stream of each number to be detected, and the number to be detected for which the DTMF signal is identified is determined as an abnormal number, wherein the abnormal number is a number with abnormal calling behavior.

2. The method according to claim 1, characterized in that The step of identifying a DTMF signal in a media stream of each number to be detected comprises: For a DTMF signal whose transmission mode is SIPINFO, the DTMF signal is identified through the signal field in the session initiation protocol SIP information packet.

3. The method according to claim 2, characterized in that The method of identifying a DTMF signal in a media stream of each number to be detected further comprises: For DTMF signals transmitted in RFC2833, the data packet is identified through the telephone event TeleponeEvent, and the DTMF signal is identified based on the data packet.

4. The method according to claim 3, characterized in that: The method of identifying a DTMF signal in a media stream of each number to be detected further comprises: For the DTMF signal whose transmission mode is INBAND, the RTP data packet is extracted to perform spectrum analysis to obtain the high frequency and low frequency frequencies, and the DTMF signal is identified based on the high frequency and low frequency frequencies.

5. The method according to claim 1, characterized in that Before obtaining the media stream of each of the multiple numbers to be detected, the method further includes: For the signaling and media stream of the same call, parse and obtain the IP, port and calling and called number information in the signaling, and parse and obtain the IP and port information in the media stream; The signaling is associated with the media stream according to the IP and the port, and the calling and called numbers corresponding to the media stream are determined.

6. The method according to claim 1, characterized in that The method of preliminarily screening the plurality of numbers according to the location characteristics and the behavior characteristics of each number to obtain a plurality of numbers to be detected includes: The position feature and the behavior feature of each number are input into a pre-trained detection model to obtain a plurality of numbers to be detected, wherein the detection model is trained based on a lightweight gradient boosting machine LightGBM.

7. The method according to claim 1, characterized in that The behavioral characteristics include one or more of the following characteristics: The total number of calls for the day, the number of calls in the first half hour, the average duration of outgoing calls, the average duration of outgoing and connected calls, the proportion of called mobile phone numbers within the province, the dispersion of called numbers, call intensity, connection rate, the proportion of connected calls lasting 1-30 seconds, the proportion of calls lasting 0-30 seconds, and the number of calls in the first hour.

8. An abnormal number identification device, characterized in that: include: A data acquisition module, used to acquire historical location data and historical call data of multiple numbers; A feature extraction module, used to extract the location feature and the behavior feature of each number from the historical location data and the historical call data of each number, wherein the behavior feature is used to represent the call behavior feature of the number; A preliminary screening module, used for performing preliminary screening on the plurality of numbers according to the location characteristics and the behavior characteristics of each of the numbers, to obtain a plurality of numbers to be tested; A media stream acquisition module, used to acquire the media stream of each number to be detected among the multiple numbers to be detected; The abnormal identification module is used to identify the DTMF signal in the media stream of each number to be detected, and determine the number to be detected with the identified DTMF signal as an abnormal number, wherein the abnormal number is a number with abnormal calling behavior.

9. An electronic device, characterized in that: include: A memory for storing instructions; A processor is used to call the instructions stored in the memory to implement the abnormal number identification method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the abnormal number identification method described in any one of claims 1 to 7 is implemented.

Images