Anti-fraud practical training method and device in telecommunication network fraud field and medium

Abstract

The invention discloses an anti-fraud practical training method and device in the telecommunication network fraud field and a medium, and the method comprises the steps: carrying out the modeling based on network communication data, and obtaining a plurality of anti-fraud models; evaluating the plurality of anti-fraud models by taking the identification range and the identification precision as standards to obtain a plurality of evaluation scores; and according to the performance index of the network communication data, optimizing the anti-fraud models which do not reach a preset standard in the plurality of evaluation scores to obtain an anti-fraud model set, and carrying out anti-fraud practical training on the user through the anti-fraud model set. According to the anti-fraud practical training method and device in the telecommunication network fraud field and the medium provided by the invention, a plurality of established anti-fraud models are evaluated and optimized by taking the recognition range and the recognition precision as standards, so that the finally obtained model can cover and recognize more fraud types and scenes, the recognition accuracy is ensured, and the fraud training efficiency is improved. The problem that it is difficult to simulate the fraud form according to the actual characteristics of the network fraud and carry out anti-fraud practical training on the user can be solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an anti-fraud training method, device and medium in the field of telecommunication network fraud. Background Art

[0002] In recent years, the situation of telecommunications network fraud is very serious. It has become the type of illegal activity with the most cases, the fastest increase, the widest involvement, and the strongest public response. In order to further improve the ability to prevent and combat telecommunications network fraud, network and data security, give full play to the professional capabilities of technical experts, enhance personnel's anti-fraud awareness and technical defense capabilities, and cultivate anti-fraud professional and technical personnel, it is urgent to carry out the construction of anti-fraud professional training bases. The mainstream security training platforms on the market are mainly concentrated in the fields of network security and information security. These platforms help users improve their practical ability in network security and information security by providing rich training resources and simulating real attack and defense scenarios.

[0003] Since traditional and single classroom lectures and simulation exercises cannot fully meet the needs of anti-fraud training, and the network security and information security training platforms mainly focus on the cultivation of skills such as network system security defense, data security, and penetration testing, they cannot meet the needs of actual anti-fraud work. Currently, there is a gap in anti-fraud professional training. Summary of the invention

[0004] The present invention provides an anti-fraud training method, device and medium in the field of telecommunication network fraud, so as to solve the problem that it is difficult to simulate the fraud form according to the actual characteristics of network fraud and conduct anti-fraud training for users.

[0005] Collect network communication data from the actual network environment;

[0006] Modeling is performed based on the network communication data to obtain several anti-fraud models;

[0007] Based on the recognition range and recognition accuracy, the anti-fraud models are evaluated to obtain a number of evaluation scores;

[0008] According to the performance indicators of the network communication data, the anti-fraud models that do not meet the preset standards among the several evaluation scores are optimized to obtain an anti-fraud model set, and anti-fraud training is performed on users through the anti-fraud model set.

[0009] The anti-fraud model set constructed by the present invention based on real fraud data can simulate fraud scenarios and methods that are close to reality, and provide users with a real anti-fraud experience. This realistic simulation training helps users better understand the characteristics and hazards of fraudulent behavior, and improves their awareness of prevention and response capabilities. By optimizing and improving the anti-fraud models that do not meet the preset standards in the evaluation scores, the recognition accuracy and adaptability of the models can be continuously improved. This continuous optimization mechanism helps to ensure that the anti-fraud model set always maintains a high recognition ability and stability. In addition, this solution emphasizes the continuous collection of fraud data from the actual network environment, and the optimization and iteration of the model based on the new data. This dynamic update capability enables the anti-fraud model to keep up with the changing pace of fraud methods and maintain a high fraud recognition ability.

[0010] Compared with the prior art, the present invention obtains several anti-fraud models based on network communication data modeling, and evaluates and optimizes the models based on recognition range and recognition accuracy. This can ensure that the final anti-fraud model set can cover and identify more fraud types and scenarios, and ensure the accuracy and reliability of recognition when identifying fraudulent behaviors. Therefore, it can solve the problem that it is difficult to simulate fraud forms based on the actual characteristics of network fraud and conduct anti-fraud training for users.

[0011] As a preferred solution, network communication data is collected from the actual network environment, specifically:

[0012] Collecting basic network communication data from the actual network environment;

[0013] Extracting features about fraudulent behavior from the network communication basic data to obtain a feature indicator set;

[0014] Based on the characteristic indicator set, the communication behaviors of different fraud types are simulated through a preset anti-fraud training platform to generate signaling data;

[0015] The anti-fraud training platform is controlled to perform fraud simulation training on the user according to the signaling data to obtain the network communication data.

[0016] This preferred solution simulates different types of fraud behaviors as needed through the anti-fraud training platform. It has strong flexibility and scalability, which helps to adapt to the ever-changing fraud methods and scenarios.

[0017] As a preferred solution, modeling is performed based on the network communication data to obtain several anti-fraud models, specifically:

[0018] Extracting user behavior features from the network communication data to obtain a user feature set;

[0019] According to the user feature set, a visualization model is configured based on preset rules, and the warning numbers are uniformly output to the model warning number library for modeling to obtain the several anti-fraud models; wherein the several anti-fraud models include voice anti-fraud models, SMS anti-fraud models and Internet anti-fraud models.

[0020] The anti-fraud model constructed based on the user feature set in this preferred solution can fully consider the characteristics and differences of different user groups, realize personalized modeling, and help improve the model's recognition ability and early warning effect for specific user groups. In addition, the voice anti-fraud model, SMS anti-fraud model, and Internet anti-fraud model are constructed at the same time, which can cover different types of fraud scenarios and channels. This diversified model layout can more comprehensively respond to various forms of fraud and improve overall anti-fraud capabilities.

[0021] As a preferred solution, the preset rules are specifically:

[0022] The rules are created by combining different rule expressions, and the logical relationship between the rules is defined by using logical symbols to obtain the model rules; wherein the rule expression refers to the judgment logic of the number of communication calls, and the model rules are established according to the judgment logic of the call volume, the number of called parties, and the number of international mobile equipment identity codes;

[0023] The preset rules are established according to the model rules and the preset statistical granularity.

[0024] This preferred solution can flexibly build an anti-fraud model that adapts to various complex scenarios by combining different rule expressions. This flexibility enables the model to quickly adapt to changes in fraud methods and improve recognition capabilities; and when new fraud features are discovered, the model can be expanded by adding new rule expressions or adjusting existing rules, ensuring the long-term effectiveness and foresight of the model. The judgment logic based on key indicators such as call volume, number of called parties, and number of international mobile equipment identity codes can achieve accurate analysis of communication behavior, help reduce false positives and false negatives, and improve the accuracy of the model.

[0025] As a preferred solution, the several anti-fraud models include a voice anti-fraud model, a text message anti-fraud model and an Internet anti-fraud model, specifically:

[0026] Establishing the several anti-fraud models according to the voice anti-fraud model, the SMS anti-fraud model and the Internet anti-fraud model;

[0027] Among them, the voice anti-fraud model is established based on the signaling feature indicators and call bill feature indicators in the user feature set, the SMS anti-fraud model is established based on the SMS signaling feature indicators, SMS call bill feature indicators and SMS text keywords in the user feature set, and the Internet anti-fraud model is established based on the DPI feature indicators in the user feature set.

[0028] In this preferred solution, the voice anti-fraud model focuses on identifying and preventing fraudulent activities conducted over the phone, the SMS anti-fraud model focuses on SMS fraud, and the Internet anti-fraud model targets fraudulent activities on the Internet. This targeting enables each model to more accurately identify and respond to its corresponding type of fraud.

[0029] As a preferred solution, the anti-fraud models are evaluated based on the recognition range and recognition accuracy to obtain several evaluation scores, specifically:

[0030] Based on the several anti-fraud models, the proportion of all target information successfully found and identified is calculated to obtain the recall rate; the accuracy when the target information is identified is calculated to obtain the precision rate; the proportion of target information that can be correctly predicted, identified or hit before communication is established is calculated to obtain the pre-communication hit rate;

[0031] Taking the recognition range and the recognition accuracy as the standards, the recall rate, the precision rate and the pre-contact hit rate are respectively assigned preset weights for calculation to obtain the several evaluation scores.

[0032] In this preferred solution, the recall rate reflects the proportion of all target information that the model successfully finds and identifies. A high recall rate means that the model can cover more potential fraud behaviors and reduce missed reports; the precision rate measures the accuracy of the model in identifying the target information. A high precision rate can reduce false alarms and improve the pertinence and effectiveness of anti-fraud work. The pre-contact hit rate evaluates the proportion of target information predicted, identified or hit by the model before communication is established. This indicator reflects the model's foresight and preventive capabilities, and helps to intervene and deal with fraud in a timely manner before it occurs. The recall rate, precision rate, and pre-contact hit rate comprehensively consider the performance of the anti-fraud model from three dimensions: recognition range, recognition accuracy, and predictive ability. This multi-dimensional evaluation method can more comprehensively reflect the actual effect of the model.

[0033] As a preferred solution, according to the performance indicators of the network communication data, the anti-fraud models that do not meet the preset standards among the several evaluation scores are optimized to obtain an anti-fraud model set, specifically:

[0034] Obtaining the anti-fraud models that do not meet the preset standard from the plurality of evaluation scores to obtain a set of non-standard models; wherein the set of non-standard models includes a recall rate non-standard model, a precision rate non-standard model, and a pre-contact hit rate non-standard model;

[0035] According to the unconventional fraud characteristics of the fraud numbers in the network communication data, the recall rate of the fraud numbers of the model that does not meet the recall rate standard is improved to obtain a recall rate optimization model;

[0036] According to the unconventional fraud characteristics of the complaint numbers in the network communication data, the fraud number precision of the model that does not meet the precision standard is improved to obtain a precision optimization model;

[0037] According to the fraud characteristics of the numbers that cannot be identified in advance in the network communication data, the pre-contact hit rate of the model with the pre-contact hit rate not meeting the standard is improved to obtain a pre-contact hit rate optimization model;

[0038] The anti-fraud model set is composed of the recall optimization model, the precision optimization model, the pre-contact hit rate optimization model and the anti-fraud models that meet the preset standard among the several evaluation scores.

[0039] This preferred solution identifies anti-fraud models that do not meet the preset standards through evaluation scores, and accurately optimizes their shortcomings respectively. This targeted optimization can significantly improve the performance of the model; and, the unconventional fraud features of fraudulent numbers, complaint numbers, and numbers that cannot be identified in advance in network communication data are often key identifiers of fraudulent behavior, and these features can effectively improve the recognition ability of the model.

[0040] The present application also provides a method for constructing an anti-fraud training platform in the field of telecommunications network fraud, wherein the anti-fraud training platform includes a data collection and control layer, a data storage layer, a capability layer, and an application layer;

[0041] Wherein, the data collection and control layer is used to collect network communication data from the actual network environment;

[0042] The data storage layer is used to store the network communication data;

[0043] The capability layer is used to establish the performance index for counting the network communication data;

[0044] The application layer is used to perform modeling based on the network communication data to obtain several anti-fraud models;

[0045] The application layer is further used to evaluate the anti-fraud models based on the recognition range and recognition accuracy to obtain a number of evaluation scores;

[0046] The application layer is also used to optimize the anti-fraud models that do not meet the preset standards among the several evaluation scores according to the performance indicators of the network communication data, obtain an anti-fraud model set, and conduct anti-fraud training for users through the anti-fraud model set.

[0047] The present application also provides an anti-fraud training device in the field of telecommunications network fraud, including a collection module, a modeling module, an evaluation module and an optimization module;

[0048] Wherein, the acquisition module is used to collect network communication data from the actual network environment;

[0049] The modeling module is used to perform modeling based on the network communication data to obtain several anti-fraud models;

[0050] The evaluation module is used to evaluate the anti-fraud models based on the recognition range and recognition accuracy to obtain a number of evaluation scores;

[0051] The optimization module is used to optimize the anti-fraud models that do not meet the preset standards among the several evaluation scores according to the performance indicators of the network communication data, obtain an anti-fraud model set, and conduct anti-fraud training for users through the anti-fraud model set.

[0052] As a preferred solution, the acquisition module includes a data unit, a feature unit, a signaling unit and a simulation unit;

[0053] Wherein, the data unit is used to collect basic network communication data from the actual network environment;

[0054] The feature unit is used to extract features about fraudulent behavior from the network communication basic data to obtain a feature indicator set;

[0055] The signaling unit is used to simulate communication behaviors of different fraud types through a preset anti-fraud training platform based on the characteristic indicator set to generate signaling data;

[0056] The simulation unit is used to control the anti-fraud training platform to perform fraud simulation training on the user according to the signaling data to obtain the network communication data.

[0057] As a preferred solution, the modeling module includes an extraction unit and a configuration unit;

[0058] Wherein, the extraction unit is used to extract user behavior features from the network communication data to obtain a user feature set;

[0059] The configuration unit is used to configure a visualization model based on preset rules according to the user feature set, and uniformly output the warning numbers to the model warning number library for modeling to obtain the several anti-fraud models; wherein the several anti-fraud models include voice anti-fraud models, SMS anti-fraud models and Internet anti-fraud models.

[0060] As a preferred solution, the preset rules are specifically:

[0061] The rules are created by combining different rule expressions, and the logical relationship between the rules is defined by using logical symbols to obtain the model rules; wherein the rule expression refers to the judgment logic of the number of communication calls, and the model rules are established according to the judgment logic of the call volume, the number of called parties, and the number of international mobile equipment identity codes;

[0062] The preset rules are established according to the model rules and the preset statistical granularity.

[0063] As a preferred solution, the several anti-fraud models include a voice anti-fraud model, a text message anti-fraud model and an Internet anti-fraud model, specifically:

[0064] Establishing the several anti-fraud models according to the voice anti-fraud model, the SMS anti-fraud model and the Internet anti-fraud model;

[0065] Among them, the voice anti-fraud model is established based on the signaling feature indicators and call bill feature indicators in the user feature set, the SMS anti-fraud model is established based on the SMS signaling feature indicators, SMS call bill feature indicators and SMS text keywords in the user feature set, and the Internet anti-fraud model is established based on the DPI feature indicators in the user feature set.

[0066] As a preferred solution, the evaluation module includes a calculation unit and a score unit;

[0067] The calculation unit is used to calculate the proportion of all target information successfully found and identified based on the several anti-fraud models to obtain the recall rate; calculate the accuracy when the target information is identified to obtain the precision rate; calculate the proportion of target information that can be correctly predicted, identified or hit before communication is established to obtain the pre-communication hit rate;

[0068] The score unit is used to calculate the recall rate, the precision rate and the pre-contact hit rate by assigning preset weights to the recall rate, the precision rate and the pre-contact hit rate based on the recognition range and the recognition accuracy, so as to obtain the plurality of evaluation scores.

[0069] As a preferred solution, the optimization module includes an acquisition unit, a full check unit, a precision check unit, a hit unit and a comprehensive unit;

[0070] The acquisition unit is used to acquire the anti-fraud models that do not meet the preset standard among the several evaluation scores, and obtain a non-standard model set; wherein the non-standard model set includes a recall rate non-standard model, a precision rate non-standard model, and a pre-contact hit rate non-standard model;

[0071] The recall unit is used to improve the recall rate of fraudulent numbers of the recall rate failure model according to the unconventional fraud characteristics of the fraudulent numbers in the network communication data, and obtain a recall rate optimization model;

[0072] The precision checking unit is used to improve the fraudulent number precision checking of the model with low precision checking rate according to the unconventional fraud characteristics of the complaint number in the network communication data, so as to obtain a precision checking rate optimization model;

[0073] The hit unit is used to improve the pre-contact hit rate of the pre-contact hit rate failure model according to the fraud characteristics of the numbers that cannot be identified in advance in the network communication data, and obtain a pre-contact hit rate optimization model;

[0074] The integration unit is used to form the anti-fraud model set by the recall optimization model, the precision optimization model, the pre-contact hit rate optimization model and the anti-fraud models that meet the preset standard among the several evaluation scores.

[0075] The present application also provides a storage medium, on which a computer program is stored. The computer program is called and executed by a computer to implement the anti-fraud training method in the field of telecommunications network fraud as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 It is a flow chart of an anti-fraud training method in the field of telecommunication network fraud provided by an embodiment of the present application;

[0077] Figure 2 This is a structural block diagram of an anti-fraud training platform in the field of telecommunications network fraud provided by an embodiment of the present application;

[0078] Figure 3 It is an environment and data preparation diagram provided by an embodiment of the present application;

[0079] Figure 4 It is the anti-fraud training process and platform function diagram provided by the embodiment of the present application;

[0080] Figure 5 It is a schematic diagram of constructing a simulation program provided in an embodiment of the present application;

[0081] Figure 6 This is a schematic diagram of a fraud scenario simulation provided by an embodiment of the present application;

[0082] Figure 7 It is a schematic diagram of constructing a user feature set provided in an embodiment of the present application;

[0083] Figure 8 It is the overall architecture diagram provided by the embodiment of the present application;

[0084] Fig. 9 It is a structural schematic diagram of an anti-fraud training device in the field of telecommunications network fraud provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0086] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "several" means two or more.

[0087] An anti-fraud training method in the field of telecommunications network fraud provided in the embodiment of the present application is mainly used in situations where it is necessary to build a simulation environment based on the actual characteristics of the fraud, update new fraud methods and techniques discovered on the front line at any time, and conduct anti-fraud training for users.

[0088] Embodiment 1:

[0089] See also Figure 1 The embodiment of the present application provides an anti-fraud training method in the field of telecommunications network fraud, including S1 to S4, and the specific implementation steps are as follows:

[0090] S1. Collect network communication data from the actual network environment.

[0091] The steps of the embodiment of the present application include S1.1 to S1.2; wherein S1.1 is the process of establishing an anti-fraud training platform, and S1.2 is the process of collecting network communication data through the anti-fraud training platform, specifically:

[0092] S1.1. By connecting with the existing network production environment system, collect the call bills, signaling, DPI (Deep Packet Inspection) data and basic information data of positive and negative samples to obtain the prepared data; among which, the positive sample numbers in the call bills of positive and negative samples are taken from the case-related numbers of the preset institutions, and the negative sample numbers in the call bills of positive and negative samples are taken from the complaint number No. 10000; and the prepared data is the data authorized by the user;

[0093] Based on the collected preparation data and starting from the characteristics of fraudulent behavior, characteristic indicators including call characteristics, SMS characteristics, Internet characteristics and other dimensional characteristics are constructed, and the characteristic indicators are stored in the characteristic library;

[0094] By building an anti-fraud training platform environment on an X86 hardware server, and establishing an anti-fraud training platform in the field of telecommunications network fraud (hereinafter referred to as the "anti-fraud training platform") based on prepared data and characteristic indicators.

[0095] In this embodiment S1.1, the collection of positive and negative samples helps to comprehensively cover different types of fraudulent behaviors and normal communication behaviors, making the constructed feature indicators more comprehensive and robust;

[0096] S1.2. Collect basic network communication data from the actual network environment provided by the operator; the basic network communication data includes the operator's B-domain user data and O-domain signaling data. The operator's B-domain user data includes the billing system's billing bill data, the user's basic network access, package and certificate data of the big data center and CRM (Customer Relationship Management), and the O-domain signaling data includes the voice signaling data of the voice anti-fraud platform, the DPI Internet access data of the Internet anti-fraud platform, and the SMS data of the SMS anti-fraud platform. In addition, the basic network communication data is the data authorized by the user;

[0097] Store the collected basic network communication data, including signaling, call bills, fraud number / complaint number data, DPI data, and basic customer data;

[0098] Extract the characteristics of fraudulent behavior from the basic network communication data, obtain the characteristic index set, store the characteristic index set in the characteristic library, and establish various model performance evaluation indicators;

[0099] Based on the characteristic indicator set, the anti-fraud training platform simulates the communication behaviors of different fraud types and generates signaling / call bill data for various fraud scenarios; signaling / call bill data includes various signaling, call bills, SMS and DPI data (mobile network, fixed network);

[0100] The anti-fraud training platform is controlled to automatically search for historical fraud numbers that meet the conditions based on signaling / call data, and automatically generate simulation data based on real data to conduct fraud simulation training for users, and obtain network communication data related to user training; users can start simulation tasks for various fraud scenarios (including voice fraud, SMS fraud, and Internet fraud) on the anti-fraud training platform page, and configure various fraud scenario parameters (such as the number of calls, the number of called numbers, the called number discreteness, and the calling and called numbers, etc.);

[0101] In addition, the purpose of fraud simulation training is to make users familiar with the characteristics of signaling / call bills / DPI data generated under various fraud scenarios and have an intuitive understanding of the information contained in the signaling / call bills / DPI data.

[0102] In this embodiment S1.2, the collection of basic network communication data helps to comprehensively cover different types of fraudulent behaviors and normal communication behaviors, making the constructed characteristic indicators more comprehensive and robust; through the anti-fraud training platform, different types of fraudulent behaviors can be simulated as needed, which has strong flexibility and scalability, and helps to adapt to the ever-changing fraud methods and scenarios.

[0103] S2. Modeling is performed based on network communication data to obtain several anti-fraud models.

[0104] Step S2 of the embodiment of the present application is specifically as follows:

[0105] According to the data analysis capability of the anti-fraud training platform, user behavior features are extracted from network communication data to obtain user feature sets; the anti-fraud training platform supports feature library analysis of multiple data sources, feature indicator analysis of positive and negative sample numbers, screening of case-related work order numbers in different scenarios according to specific conditions, and group statistics (similar to the EXCEL pivot table capability);

[0106] According to the user feature set, the visual model is configured by dragging and dropping in the interface of the anti-fraud training platform based on preset rules, and the warning numbers are uniformly output to the model warning number library for modeling, or through AI modeling, several anti-fraud models are obtained; among them, several anti-fraud models include voice anti-fraud models, SMS anti-fraud models and Internet anti-fraud models.

[0107] The user feature set includes user profile features, call features, terminal features, location features, social features, Internet features, and SMS features, including:

[0108] User characteristics: including package name, package value, whether it is a converged user, whether it is a premium number, whether it is a prepaid user and age...;

[0109] Terminal characteristics: whether it is a black terminal, whether to change the terminal, the number of times the terminal is changed and the replacement cycle...;

[0110] Call characteristics: call volume, call frequency, call forwarding, call forwarding time, call duration, caller ratio, called party dispersion and machine dialing characteristics...;

[0111] SMS features: WeChat SP SMS records, QQ SP SMS records, Alipay SP SMS records and Douyin SP SMS records...;

[0112] Social features: social circle, proportion of new called parties, calling and called party dialing characteristics, called number overlap rate, etc.;

[0113] Internet access characteristics: Internet traffic, and whether VOIP / remote control software is used...

[0114] The anti-fraud model constructed based on the user feature set in this embodiment S2 can fully consider the characteristics and differences of different user groups, realize personalized modeling, and help improve the model's recognition ability and early warning effect for specific user groups. In addition, by simultaneously constructing voice anti-fraud models, SMS anti-fraud models, and Internet anti-fraud models, different types of fraud scenarios and channels can be covered. This diversified model layout can more comprehensively respond to various forms of fraud and improve overall anti-fraud capabilities.

[0115] Among them, the AI ​​modeling method is:

[0116] Select a sample time range on the interface of the anti-fraud training platform, and control the anti-fraud training platform to automatically use the fraud numbers involved in the selected time range as positive samples and the complaint numbers as negative samples, and build models based on the corresponding feature library to obtain several anti-fraud models; the interface of the anti-fraud training platform supports the selection of different AI algorithms for modeling, and supports the configuration of the identification results of numbers with a fraud probability of n or a probability greater than n as fraud numbers;

[0117] In addition, the model uses the default parameters of the AI ​​algorithm by default. After selecting the corresponding feature library, all feature indicators of the feature library are used by default, and important features are automatically selected as parameters according to feature importance during model training.

[0118] This embodiment S2 supports users to use AI algorithms to build models through AI visual modeling components, and can learn cutting-edge AI anti-fraud models.

[0119] The preset rules are established as follows:

[0120] Create rules by combining different rule expressions and use logical symbols to define the logical relationship between rules to obtain model rules;

[0121] Establish preset rules based on model rules and preset statistical granularity.

[0122] Among them, the rule expression refers to the judgment logic of the number of communication calls, such as the number of calls is greater than 10; the feature indicators in the rule expression are all from the feature pool. This embodiment provides a series of feature pools, and the feature pool contains multiple feature libraries, each of which contains multiple feature indicators. Taking voice anti-fraud as an example, it includes a 10-minute signaling feature library, a 24-hour signaling feature library, a 10-minute call bill feature library, and a 24-hour call bill feature library. Each feature library contains more than 200 feature indicators. For example, the number of calls is one of the feature indicators. Similar feature indicators also include whether roaming in other provinces, whether the terminal is changed, the number of cities to which the called number belongs, and the call intensity.

[0123] Model rules refer to anti-fraud model rules, which are judgment logic established based on the number of calls, the number of called parties, and the number of IMEI (International Mobile Equipment Identity), that is, judgment is made based on characteristic indicators, and the number that meets the rules can be output in the end. For example, the statistical rules for signaling data based on a 10-minute statistical granularity are: the cumulative number of calls on the day is greater than 15, the cumulative number of called parties on the day is greater than 10, the cumulative call intensity on the day is greater than 10, and the number of IMEI from the previous 365 days to the present is greater than or equal to 2;

[0124] Logical symbols refer to mathematical logic judgment symbols such as "and, or, brackets";

[0125] The statistical granularity can be achieved by selecting the data on the left. The anti-fraud training platform supports statistical granularity of 10 minutes and 24 hours. Among them, 10-minute granularity means that the characteristic indicators from 0 o'clock to the present are counted once every 10 minutes, and 24-hour granularity means that the characteristic indicators of the day are counted once a day.

[0126] By combining different regular expressions, this embodiment S2 can flexibly construct an anti-fraud model that adapts to various complex scenarios. This flexibility enables the model to quickly adapt to changes in fraud methods and improve recognition capabilities; and when new fraud features are discovered, the model can be expanded by adding new regular expressions or adjusting existing rules, ensuring the long-term effectiveness and foresight of the model. Based on the judgment logic of key indicators such as call volume, number of called parties, and number of international mobile equipment identity codes, accurate analysis of communication behavior can be achieved, which helps to reduce false positives and false negatives and improve the accuracy of the model.

[0127] It should be noted that the specific differences between the voice anti-fraud model, SMS anti-fraud model and Internet anti-fraud model are:

[0128] 1) The data used by the voice anti-fraud model is mainly the voice signaling / call detail record data in the user feature set. The keyword field information it contains includes time, calling number, called number, terminal IMEI, base station information, roaming province and city, etc. Through feature construction, signaling / call detail record feature indicators can be calculated, including the number of calls, the number of called numbers, the dispersion of called numbers, roaming province, call intensity, the number of terminal replacements, terminal IMEI, and historical active days, etc. Finally, the rules of the voice anti-fraud model are constituted by these feature indicators.

[0129] 2) The short message anti-fraud model is divided into two categories. One category is based on the short message signaling / call detail record data in the user feature set. The keyword field information it contains includes time, short message sending number, short message receiving number, terminal IMEI, base station information, roaming province and city, etc. Through feature construction, short message signaling / call detail record feature indicators can be calculated, including the number of short message sends, the number of short message receiving numbers, the dispersion of short message receiving numbers, roaming province, short message sending intensity, the number of terminal replacements, terminal IMEI, and historical active days, etc. Finally, the rules of the short message anti-fraud model are constituted by these feature indicators;

[0130] The other category is based on the short message text content data in the user feature set. The information it contains is the text content of the short message. The model is constructed by keyword combination matching. For example, taking the rules of the Douyin brush order and rebate short message fraud model as an example, the rules include the following aspects:

[0131] ① Platform keywords: such as "Douyin" or its variants (such as "Keyin", "Douyin alternative", "Yin", and "Touyin"), these words indicate the platforms or business types that the fraud short messages may involve;

[0132] ② Inductive behavior keywords: such as "like", "accumulate", or "Dianzan", these words are usually used to describe the behaviors that induce users in fraud short messages;

[0133] ③ Contact information keywords: such as "+", "add", "jia", and various representations of WeChat (such as "WeChat", "V", "v", "Mixin", homophones of "weixin", "wx", and "WX"), these words indicate the contact information that may be included in the fraud short messages and are used to defraud users of money later.

[0134] 3) The data used by the Internet anti-fraud model is mainly DPI Internet log data in the user feature set, which includes key field information such as time, number, terminal IMEI, base station information, roaming province, city, website address visited, APP used and specific functional modules in the APP used (such as sending text, voice and pictures, etc.). Through feature construction, DPI feature indicators can be calculated, including the number of visits to the backend management address of the fraud-related website, the number of times the remote control software is used, the number of times the secret chat software is used, the number of facetime calls, facetime call intensity, facetime call called dispersion, roaming province, number of terminal changes, terminal IMEI and historical active days; ultimately, these feature indicators constitute the rules of the Internet anti-fraud model.

[0135] In this embodiment S2, the voice anti-fraud model focuses on identifying and preventing fraudulent activities conducted over the phone, the SMS anti-fraud model focuses on SMS fraud, and the Internet anti-fraud model targets fraudulent activities on the Internet. This targeting enables each model to more accurately identify and respond to its corresponding fraud type.

[0136] S3. Based on the recognition range and recognition accuracy, several anti-fraud models are evaluated to obtain several evaluation scores.

[0137] Step S3 of the embodiment of the present application is specifically as follows:

[0138] Based on several anti-fraud models, the proportion of all target information successfully found and identified is calculated to obtain the recall rate; the accuracy of identifying the target information is calculated to obtain the precision rate; the proportion of target information that can be correctly predicted, identified or hit before communication is established is calculated to obtain the pre-communication hit rate; specifically, the recall rate = the number of work order numbers involved in the case identified by the model / the number of all work order numbers involved in the case, the precision rate = the number of numbers identified by the model after eliminating negative sample numbers / the number of all numbers output by the model, the pre-communication hit rate = the number of numbers identified by the model before the work order involved in the case is communicated / the number of work order numbers involved in the case identified by the model; and the recall rate, precision rate and pre-communication hit rate are model performance evaluation indicators stored in the feature library;

[0139] Based on the recognition range and recognition accuracy, preset weights are assigned to the recall rate, precision rate and pre-contact hit rate for calculation, respectively, to obtain a first evaluation score and a second evaluation score; and a number of evaluation scores corresponding to a number of anti-fraud models are calculated based on the first evaluation score and the second evaluation score.

[0140] The first evaluation score and the second evaluation score are calculated as follows:

[0141] 1) Taking the aggressive mode as the standard, the recall rate, precision rate and pre-contact hit rate are assigned preset weights for calculation to obtain the first evaluation score; the aggressive mode aims to identify more fraudulent numbers and can accept a certain degree of false positives; and the aggressive mode is suitable for provinces with severe fraud situations, with the purpose of identifying fraudulent numbers as much as possible;

[0142] For example, if we assign a weight of 0.7 to the recall rate and the pre-contact hit rate, and a weight of 0.3 to the precision rate, we have:

[0143] Recall impact factor score = recall rate * 100;

[0144] Pre-contact hit rate impact factor score = Pre-contact hit rate * 100;

[0145] Precision impact factor score = precision * 100;

[0146] First evaluation score = recall impact factor score * 0.7 + pre-contact hit rate impact factor score * 0.7 +

[0147] Precision impact factor score*0.3.

[0148] If the recall rate exceeds 80%, the pre-contact hit rate exceeds 80%, and the precision rate exceeds 70%, the model can be judged as an excellent model; the score line of the excellent model is:

[0149] 80*0.7+80*0.7+80*0.3=56+56+24=136;

[0150] It can be seen that the models with a score greater than 135 in the aggressive mode are excellent models.

[0151] 2) Using the conservative model as the standard, the recall rate, precision rate and pre-contact hit rate are assigned preset weights for calculation to obtain a second evaluation score; the conservative model aims to more accurately identify fraudulent numbers to avoid too many accidental injuries; and the conservative model is suitable for provinces where the fraud situation is not too severe, and aims to accurately hit fraudulent numbers by building an accurate model to avoid causing too many accidental injuries.

[0152] For example, if we assign a weight of 0.3 to the recall rate and the pre-contact hit rate, and a weight of 0.7 to the precision rate, we have:

[0153] Final evaluation score = recall impact factor score * 0.3 + pre-contact hit rate impact factor score * 0.3 + precision impact factor score * 0.7;

[0154] Similarly, if the recall rate exceeds 80%, the pre-contact hit rate exceeds 80%, and the precision rate exceeds 70%, it can be judged as an excellent model; the score line of the excellent model is:

[0155] 80*0.3+80*0.3+80*0.7=24+24+56=104;

[0156] It can be seen that the models with a score greater than 104 in the conservative mode are excellent models.

[0157] In Example S3, the recall rate reflects the proportion of all target information that the model successfully finds and identifies. A high recall rate means that the model can cover more potential fraud behaviors and reduce missed reports; the precision rate measures the accuracy of the model in identifying the target information. A high precision rate can reduce false positives and improve the pertinence and effectiveness of anti-fraud work. The pre-contact hit rate evaluates the proportion of target information predicted, identified or hit by the model before communication is established. This indicator reflects the model's foresight and preventive capabilities, and helps to intervene and deal with fraud in a timely manner before it occurs. The recall rate, precision rate, and pre-contact hit rate comprehensively consider the performance of the anti-fraud model from three dimensions: recognition range, recognition accuracy, and prediction ability. This multi-dimensional evaluation method can more comprehensively reflect the actual effect of the model.

[0158] S4. According to the performance indicators of the network communication data, the anti-fraud models whose evaluation scores do not meet the preset standards are optimized to obtain an anti-fraud model set, and the anti-fraud training is carried out on users through the anti-fraud model set.

[0159] Step S4 of the embodiment of the present application includes S4.1 to S4.2; wherein S4.1 is the process of establishing an anti-fraud model set, and S4.2 is the process of training using the anti-fraud model set, specifically:

[0160] S4.1. Obtaining several anti-fraud models that do not meet the preset standards among the evaluation scores, and obtaining a set of non-standard models; wherein the set of non-standard models includes non-standard recall models whose recall rates are lower than expected (e.g., less than 80%), non-standard precision models whose precision rates are lower than expected (e.g., less than 80%), and non-standard pre-contact hit rate models whose pre-contact hit rate is lower than expected (e.g., less than 80%);

[0161] Check the specific number information of the work orders that the model missed through the anti-fraud training platform, and obtain the unconventional fraud characteristics of the fraud numbers in the network communication data; and improve the recall rate of the fraud numbers of the model that does not meet the recall rate standard according to the unconventional fraud characteristics of the fraud numbers, in order to cover the numbers and obtain the recall rate optimization model;

[0162] Through the anti-fraud training platform, the specific number information of the non-fraud (complaint number) hit by the model is checked to obtain the unconventional fraud characteristics of the complaint number in the network communication data; and based on the unconventional fraud characteristics of the complaint number, the fraud number precision of the model that does not meet the precision standard is improved, in order to filter out the number and obtain the precision optimization model;

[0163] Through the anti-fraud training platform, the specific number information that failed to be hit in advance is checked to obtain the fraud characteristics of the numbers that failed to be identified in advance in the network communication data; and based on the fraud characteristics of the numbers that failed to be identified in advance, the pre-contact hit rate of the model that did not meet the pre-contact hit rate standard is improved, in order to obtain a pre-contact hit rate optimization model for the numbers that were identified before the call;

[0164] The anti-fraud model set is composed of a recall optimization model, a precision optimization model, a pre-contact hit rate optimization model, and several anti-fraud models that meet the preset standards among the evaluation scores.

[0165] In this embodiment S4.1, the anti-fraud model that does not meet the preset standard is identified through the evaluation score, and its deficiencies are precisely optimized respectively. This targeted optimization can significantly improve the performance of the model; and the unconventional fraud features of fraud numbers, complaint numbers, and numbers that cannot be identified in advance in network communication data are often key identifiers of fraudulent behavior. These features can effectively improve the recognition ability of the model;

[0166] In addition, when the recall rate is lower than expected, the goal of model optimization is to find ways to improve the recall rate, that is, to cover more fraudulent numbers; when the precision rate is lower than expected, the goal of model optimization is to find ways to improve the precision rate, that is, to avoid accidentally hitting more numbers; when the hit rate before contact is lower than expected, the goal of model optimization is to find ways to improve the hit rate before contact, that is, to identify the numbers before the work order involved is contacted as much as possible. Therefore, adopting corresponding feature optimization methods can improve the overall performance of the model.

[0167] S4.2. Conduct anti-fraud training for users through the anti-fraud model set.

[0168] Overall, this embodiment has the following beneficial effects:

[0169] The anti-fraud model set constructed by this application based on real fraud data can simulate fraud scenarios and methods that are close to reality, providing users with a real anti-fraud experience. This realistic simulation training helps users better understand the characteristics and dangers of fraudulent behavior, and improve their awareness of prevention and response capabilities. By optimizing and improving the anti-fraud models that do not meet the preset standards in the evaluation scores, the recognition accuracy and adaptability of the models can be continuously improved. This continuous optimization mechanism helps to ensure that the anti-fraud model set always maintains a high level of recognition capability and stability. In addition, this solution emphasizes the continuous collection of fraud data from the actual network environment, and the optimization and iteration of the model based on the new data. This dynamic update capability enables the anti-fraud model to keep up with the changes in fraud methods and maintain a high level of fraud recognition capabilities;

[0170] In addition, this application, by simulating real fraudulent behavior, supports users to configure fraud scenario input parameters and output various types of data, so that users can become familiar with various types of data generated by fraudulent behavior, improve their understanding of data, and lay a solid foundation for users' learning in the field of anti-fraud. Therefore, this application can train users' counter-thinking and anti-fraud modeling capabilities against telecommunications network fraud, cultivate anti-fraud professional and technical personnel, and improve the ability to prevent and combat telecommunications network fraud, and can be quickly and comprehensively promoted in the communications industry.

[0171] Embodiment 2:

[0172] See also Figure 2 , the embodiment of the present application provides a method for constructing an anti-fraud training platform in the field of telecommunications network fraud, the anti-fraud training platform includes a data collection and control layer, a data storage layer, a capability layer and an application layer;

[0173] Among them, the data collection and control layer is used to collect network communication data from the actual network environment;

[0174] Data storage layer, used to store network communication data;

[0175] The capability layer is used to establish performance indicators for statistical network communication data;

[0176] The application layer is used to build models based on network communication data to obtain several anti-fraud models;

[0177] The application layer is also used to evaluate several anti-fraud models based on the recognition range and recognition accuracy to obtain several evaluation scores;

[0178] The application layer is also used to optimize the anti-fraud models that do not meet the preset standards in several evaluation scores according to the performance indicators of network communication data, obtain the anti-fraud model set, and conduct anti-fraud training for users through the anti-fraud model set.

[0179] In one embodiment, the anti-fraud training platform is established in the following manner:

[0180] By connecting with the existing network production environment system, the call bills, signaling, DPI (Deep Packet Inspection) data and basic information data of positive and negative samples are collected to obtain the prepared data; among them, the positive sample numbers in the call bills of positive and negative samples are taken from the case-related numbers of the preset institutions, and the negative sample numbers in the call bills of positive and negative samples are taken from the complaint number No. 10000; and the prepared data is the data authorized by the user;

[0181] Based on the collected preparation data and starting from the characteristics of fraudulent behavior, characteristic indicators including call characteristics, SMS characteristics, Internet characteristics and other dimensional characteristics are constructed, and the characteristic indicators are stored in the characteristic library;

[0182] By building an anti-fraud training platform environment on an X86 hardware server, and establishing an anti-fraud training platform based on prepared data and characteristic indicators.

[0183] To apply the embodiments of this application, please refer to Figure 3 , Figure 3 It is an environment and data preparation diagram provided in an embodiment of the present application, which shows the general process of collecting and processing data from the existing network production environment system in order to establish an anti-fraud training platform.

[0184] To apply the embodiments of this application, please refer to Figure 4 , Figure 4 It is an anti-fraud training process and platform function diagram provided in the embodiment of the present application, which shows the use process of the anti-fraud training platform and the general functions of the anti-fraud training platform.

[0185] In this embodiment, the collection of positive and negative samples helps to comprehensively cover different types of fraudulent behaviors and normal communication behaviors, making the constructed feature indicators more comprehensive and robust.

[0186] In one embodiment, the data collection and control layer is used to collect basic network communication data from the actual network environment provided by the operator; wherein the basic network communication data includes operator B domain user data and O domain signaling data, operator B domain user data: billing call record data of the billing system, user basic network access, package and certificate data of the big data center and CRM (Customer Relationship Management), O domain signaling data: voice signaling data of the voice anti-fraud platform, DPI Internet access data of the Internet anti-fraud platform and SMS data of the SMS anti-fraud platform, etc.; and the basic network communication data is data authorized by the user.

[0187] In one embodiment, the data storage layer is used to store the collected basic network communication data; wherein the storage content includes signaling, call records, fraud number / complaint number data, DPI data and customer basic data, etc.

[0188] In one embodiment, the capability layer is used to extract features about fraudulent behavior from basic network communication data, obtain a feature indicator set, store the feature indicator set in a feature library, and establish various model performance evaluation indicators.

[0189] In one embodiment, the application layer includes a scenario simulation module, a feature analysis module, a visual modeling module, a model evaluation module, a model optimization module, and an anti-fraud training module;

[0190] Among them, the scenario simulation module is used to simulate the communication behaviors of different fraud types through an anti-fraud training platform in the field of telecommunications network fraud (hereinafter referred to as the "anti-fraud training platform") based on the characteristic indicator set, and generate signaling / call bill data under various fraud scenarios; wherein the signaling / call bill data includes various types of signaling, call bills, short and multimedia messages and DPI data (mobile network, fixed network);

[0191] The scenario simulation module is also used to control the anti-fraud training platform to automatically search for historical fraud numbers that meet the conditions according to the signaling / call data, and automatically generate simulation data based on the real data to conduct fraud simulation training for users and obtain network communication data related to user training; among them, users can start simulation tasks of various fraud scenarios (including voice fraud, SMS fraud and Internet fraud) on the page of the anti-fraud training platform, and configure various fraud scenario parameters (such as the number of calls, the number of called numbers, the discreteness of called numbers and the calling and called numbers, etc.);

[0192] In addition, the purpose of fraud simulation training is to make users familiar with the characteristics of signaling / call bills / DPI data generated under various fraud scenarios and have an intuitive understanding of the information contained in the signaling / call bills / DPI data.

[0193] To apply the embodiments of this application, please refer to Figure 5 , Figure 5 It is a schematic diagram of constructing a simulation program provided in an embodiment of the present application, which shows the general process of constructing a simulation program based on an anti-fraud training platform.

[0194] To apply the embodiments of this application, please refer to Figure 6 , Figure 6 It is a schematic diagram of fraud scenario simulation provided in an embodiment of the present application, which shows the general process of simulating fraud scenarios from different angles based on the anti-fraud training platform.

[0195] In the scenario simulation module of this embodiment, the collection of basic network communication data helps to comprehensively cover different types of fraudulent behaviors and normal communication behaviors, making the constructed characteristic indicators more comprehensive and robust; through the anti-fraud training platform, different types of fraudulent behaviors can be simulated as needed, which has strong flexibility and scalability, and helps to adapt to the ever-changing fraud methods and scenarios.

[0196] The feature analysis module is used to extract user behavior features from network communication data based on the data analysis capabilities of the anti-fraud training platform to obtain a user feature set; the anti-fraud training platform supports feature library analysis of multiple data sources, feature indicator analysis of positive and negative sample numbers, screening of case-related work order numbers in different scenarios according to specific conditions, and group statistics (similar to the EXCEL pivot table capability);

[0197] The visual modeling module is used to configure the visual model by dragging and dropping in the interface of the anti-fraud training platform according to the user feature set and preset rules, and output the warning numbers to the model warning number library for modeling, or obtain several anti-fraud models through AI modeling; among them, several anti-fraud models include voice anti-fraud models, SMS anti-fraud models and Internet anti-fraud models.

[0198] The user feature set includes user profile features, call features, terminal features, location features, social features, Internet features, and SMS features, including:

[0199] User characteristics: including package name, package value, whether it is a converged user, whether it is a premium number, whether it is a prepaid user and age...;

[0200] Terminal characteristics: whether it is a black terminal, whether to change the terminal, the number of times the terminal is changed and the replacement cycle...;

[0201] Call characteristics: call volume, call frequency, call forwarding, call forwarding time, call duration, caller ratio, called party dispersion and machine dialing characteristics...;

[0202] SMS features: WeChat SP SMS records, QQ SP SMS records, Alipay SP SMS records and Douyin SP SMS records...;

[0203] Social features: social circle, proportion of new called parties, calling and called party dialing characteristics, called number overlap rate, etc.;

[0204] Internet access characteristics: Internet traffic, and whether VOIP / remote control software is used...

[0205] To apply the embodiments of this application, please refer to Figure 7 , Figure 7 It is a schematic diagram of constructing a user feature set provided in an embodiment of the present application, which shows the general process of constructing a user feature set.

[0206] The anti-fraud model constructed by the feature analysis module and the visual modeling module in this embodiment based on the user feature set can fully consider the characteristics and differences of different user groups, realize personalized modeling, and help improve the model's recognition ability and early warning effect for specific user groups. In addition, by simultaneously constructing voice anti-fraud models, SMS anti-fraud models, and Internet anti-fraud models, different types of fraud scenarios and channels can be covered. This diversified model layout can more comprehensively respond to various forms of fraud and improve overall anti-fraud capabilities.

[0207] Among them, the AI ​​modeling method is:

[0208] Select a sample time range on the interface of the anti-fraud training platform, and control the anti-fraud training platform to automatically use the fraud numbers involved in the selected time range as positive samples and the complaint numbers as negative samples, and build models based on the corresponding feature library to obtain several anti-fraud models; the interface of the anti-fraud training platform supports the selection of different AI algorithms for modeling, and supports the configuration of the identification results of numbers with a fraud probability of n or a probability greater than n as fraud numbers;

[0209] In addition, the model uses the default parameters of the AI ​​algorithm by default. After selecting the corresponding feature library, all feature indicators of the feature library are used by default, and important features are automatically selected as parameters according to feature importance during model training.

[0210] The feature analysis module and visual modeling module of this embodiment support users to use AI algorithms to build models through AI visual modeling components, and can learn cutting-edge AI anti-fraud models.

[0211] The preset rules are established as follows:

[0212] Create rules by combining different rule expressions and use logical symbols to define the logical relationship between rules to obtain model rules;

[0213] Establish preset rules based on model rules and preset statistical granularity.

[0214] Among them, the rule expression refers to the judgment logic of the number of communication calls, such as the number of calls is greater than 10; the feature indicators in the rule expression are all from the feature pool. This embodiment provides a series of feature pools, and the feature pool contains multiple feature libraries, each of which contains multiple feature indicators. Taking voice anti-fraud as an example, it includes a 10-minute signaling feature library, a 24-hour signaling feature library, a 10-minute call bill feature library, and a 24-hour call bill feature library. Each feature library contains more than 200 feature indicators. For example, the number of calls is one of the feature indicators. Similar feature indicators also include whether roaming in other provinces, whether the terminal is changed, the number of cities to which the called number belongs, and the call intensity.

[0215] Model rules refer to anti-fraud model rules, which are judgment logic established based on the number of calls, the number of called parties, and the number of IMEI (International Mobile Equipment Identity), that is, judgment is made based on characteristic indicators, and the number that meets the rules can be output in the end. For example, the statistical rules for signaling data based on a 10-minute statistical granularity are: the cumulative number of calls on the day is greater than 15, the cumulative number of called parties on the day is greater than 10, the cumulative call intensity on the day is greater than 10, and the number of IMEI from the previous 365 days to the present is greater than or equal to 2;

[0216] Logical symbols refer to mathematical logic judgment symbols such as "and, or, brackets";

[0217] The statistical granularity can be achieved by selecting the data on the left. The anti-fraud training platform supports statistical granularity of 10 minutes and 24 hours. Among them, 10-minute granularity means that the characteristic indicators from 0 o'clock to the present are counted once every 10 minutes, and 24-hour granularity means that the characteristic indicators of the day are counted once a day.

[0218] The feature analysis module and visual modeling module of this embodiment can flexibly construct anti-fraud models that adapt to various complex scenarios by combining different rule expressions. This flexibility enables the model to quickly adapt to changes in fraud methods and improve recognition capabilities; and when new fraud features are discovered, the model can be expanded by adding new rule expressions or adjusting existing rules, ensuring the long-term effectiveness and foresight of the model. The judgment logic based on key indicators such as call volume, number of called parties, and number of international mobile equipment identity codes can achieve accurate analysis of communication behavior, help reduce false positives and false negatives, and improve the accuracy of the model.

[0219] It should be noted that the specific differences between the voice anti-fraud model, SMS anti-fraud model and Internet anti-fraud model are:

[0220] 1) The data used by the voice anti-fraud model is mainly voice signaling / call bill data in the user feature set, which includes key field information such as time, calling number, called number, terminal IMEI, base station information, and roaming province, city, etc. Through feature construction, signaling / call bill feature indicators can be calculated, including the number of calls, the number of called numbers, the dispersion of called numbers, the roaming province, call intensity, the number of terminal changes, the terminal IMEI, and the number of historical active days; ultimately, these feature indicators constitute the rules of the voice anti-fraud model.

[0221] 2) SMS anti-fraud models are divided into two categories. One category is based on SMS signaling / call data in the user feature set, which includes key field information such as time, SMS sending number, SMS receiving number, terminal IMEI, base station information, and roaming province, city, etc. Through feature construction, SMS signaling / call feature indicators can be calculated, including the number of SMS sending, the number of SMS receiving numbers, the dispersion of SMS receiving numbers, the roaming province, SMS sending intensity, the number of terminal changes, the terminal IMEI, and the number of historical active days. Finally, these feature indicators constitute the rules of the SMS anti-fraud model;

[0222] The other type is based on SMS text content data in the user feature set. The information contained is the text content of the SMS. The model is built by matching keywords. For example, taking the Douyin order-brushing rebate SMS fraud model rules as an example, the rules include the following aspects:

[0223] ① Platform keywords: such as "Douyin" or its variants (such as "Keyin", "Douyin misspelling", "Yin", and "Taoyin"), these words indicate the platforms or business types that the fraudulent text messages may involve;

[0224] ② Inductive behavior keywords: such as "like", "accumulate likes", or "like in a misspelled way", these words are usually used to describe the behaviors induced by users in fraudulent text messages;

[0225] ③ Contact information keywords: such as "+", "add", "jia", and various representations of WeChat (such as "WeChat", "V", "v", "Secret Message", homophones of "weixin", "wx", and "WX"), these words indicate the contact information that may be included in the fraudulent text messages, which is used to defraud users of money subsequently.

[0226] 3) The data used by the Internet anti-fraud model is mainly the DPI Internet access log data in the user feature set. The keyword field information included is time, number, terminal IMEI, base station information, roaming province and city, accessed website address, used APP, and specific function modules in the used APP (such as sending text, sending voice, and sending pictures, etc.). Through feature construction, DPI feature indicators can be calculated, including the number of times of accessing the background management address of the fraud-related website, the number of times of using remote control software, the number of times of using secret chat software, the number of facetime calls, the facetime call intensity, the facetime call called dispersion, roaming province, the number of times of replacing the terminal, terminal IMEI, and historical active days, etc.; finally, these feature indicators constitute the rules of the Internet anti-fraud model.

[0227] In the feature analysis module and visualization modeling module of this embodiment, the voice anti-fraud model focuses on identifying and preventing fraud behaviors through phone calls, the text message anti-fraud model focuses on text message fraud, and the Internet anti-fraud model targets fraud activities on the Internet. This pertinence enables each model to more accurately identify and respond to its corresponding fraud type.

[0228] The model evaluation module is used to calculate the proportion of successfully finding and identifying all target information based on several anti-fraud models to obtain the recall rate; calculate the accuracy when identifying the target information to obtain the precision rate; calculate the proportion of correctly predicting, identifying, or hitting the target information before the communication is established to obtain the hit rate before communication; specifically, recall rate = the number of case-related work order numbers identified by the model / all case-related work order numbers, precision rate = the number of numbers after removing the negative sample numbers among the numbers identified by the model / all the numbers output by the model, hit rate before communication = the number of numbers identified by the model before the case-related work order is connected / the number of case-related work order numbers identified by the model; and, the recall rate, precision rate, and hit rate before communication are model performance evaluation indicators stored in the feature library;

[0229] The model evaluation module is also used to calculate the recall rate, precision rate and pre-contact hit rate with preset weights based on the recognition range and recognition accuracy, and obtain a first evaluation score and a second evaluation score; and calculate a number of evaluation scores corresponding to a number of anti-fraud models based on the first evaluation score and the second evaluation score.

[0230] The first evaluation score and the second evaluation score are calculated as follows:

[0231] 1) Taking the aggressive mode as the standard, the recall rate, precision rate and pre-contact hit rate are assigned preset weights for calculation to obtain the first evaluation score; the aggressive mode aims to identify more fraudulent numbers and can accept a certain degree of false positives; and the aggressive mode is suitable for provinces with severe fraud situations, with the purpose of identifying fraudulent numbers as much as possible;

[0232] For example, if we assign a weight of 0.7 to the recall rate and the pre-contact hit rate, and a weight of 0.3 to the precision rate, we have:

[0233] Recall impact factor score = recall rate * 100;

[0234] Pre-contact hit rate impact factor score = Pre-contact hit rate * 100;

[0235] Precision impact factor score = precision * 100;

[0236] First evaluation score = recall impact factor score * 0.7 + pre-contact hit rate impact factor score * 0.7 +

[0237] Precision impact factor score*0.3.

[0238] If the recall rate exceeds 80%, the pre-contact hit rate exceeds 80%, and the precision rate exceeds 70%, the model can be judged as an excellent model; the score line of the excellent model is:

[0239] 80*0.7+80*0.7+80*0.3=56+56+24=136;

[0240] It can be seen that the models with a score greater than 135 in the aggressive mode are excellent models.

[0241] 2) Using the conservative model as the standard, the recall rate, precision rate and pre-contact hit rate are assigned preset weights for calculation to obtain a second evaluation score; the conservative model aims to more accurately identify fraudulent numbers to avoid too many accidental injuries; and the conservative model is suitable for provinces where the fraud situation is not too severe, and aims to accurately hit fraudulent numbers by building an accurate model to avoid causing too many accidental injuries.

[0242] For example, if we assign a weight of 0.3 to the recall rate and the pre-contact hit rate, and a weight of 0.7 to the precision rate, we have:

[0243] Final evaluation score = recall impact factor score * 0.3 + pre-contact hit rate impact factor score * 0.3 + precision impact factor score * 0.7;

[0244] Similarly, if the recall rate exceeds 80%, the pre-contact hit rate exceeds 80%, and the precision rate exceeds 70%, it can be judged as an excellent model; the score line of the excellent model is:

[0245] 80*0.3+80*0.3+80*0.7=24+24+56=104;

[0246] It can be seen that the models with a score greater than 104 in the conservative mode are excellent models.

[0247] In the model evaluation module of this embodiment, the recall rate reflects the proportion of all target information that the model successfully finds and identifies. A high recall rate means that the model can cover more potential fraud behaviors and reduce missed reports; the precision rate measures the accuracy of the model in identifying the target information. A high precision rate can reduce false alarms and improve the pertinence and effectiveness of anti-fraud work. The pre-communication hit rate evaluates the proportion of target information predicted, identified or hit by the model before communication is established. This indicator reflects the foresight and prevention capabilities of the model, and helps to intervene and deal with fraud in a timely manner before it occurs. The recall rate, precision rate and pre-communication hit rate comprehensively consider the performance of the anti-fraud model from three dimensions: recognition range, recognition accuracy and prediction ability. This multi-dimensional evaluation method can more comprehensively reflect the actual effect of the model.

[0248] A model optimization module is used to obtain anti-fraud models that do not meet the preset standards among several evaluation scores, and obtain a set of non-standard models; wherein the non-standard model set includes non-standard recall models whose recall rates are lower than expected (e.g., less than 80%), non-standard precision models whose precision rates are lower than expected (e.g., less than 80%), and non-standard pre-contact hit rate models whose pre-contact hit rate is lower than expected (e.g., less than 80%);

[0249] The model optimization module is also used to view the specific number information of the work order that the model did not hit through the anti-fraud training platform, and obtain the unconventional fraud characteristics of the fraud numbers in the network communication data; and improve the fraud number recall rate of the model that does not meet the recall rate standard according to the unconventional fraud characteristics of the fraud numbers, in order to cover the number and obtain the recall rate optimization model;

[0250] The model optimization module is also used to view the specific number information of non-fraudulent numbers (i.e., complaint numbers) hit by the model through the anti-fraud training platform, and obtain the unconventional fraud characteristics of the complaint numbers in the network communication data; and improve the fraudulent number precision of the model whose precision rate does not meet the standard according to the unconventional fraud characteristics of the complaint numbers, in order to filter out the numbers and obtain the precision rate optimization model;

[0251] The model optimization module is also used to check the specific number information that has not been hit in advance through the anti-fraud training platform, and obtain the fraud characteristics of the numbers that have not been identified in advance in the network communication data; and improve the pre-contact hit rate of the model that does not meet the pre-contact hit rate based on the fraud characteristics of the numbers that have not been identified in advance, so as to obtain a pre-contact hit rate optimization model for the numbers that are identified before the call;

[0252] The model optimization module is also used to form an anti-fraud model set consisting of a recall optimization model, a precision optimization model, a pre-contact hit rate optimization model, and several anti-fraud models that meet preset standards among the evaluation scores.

[0253] The model optimization module in this embodiment identifies the anti-fraud models that do not meet the preset standards through evaluation scores, and optimizes their deficiencies accurately. This targeted optimization can significantly improve the performance of the model. In addition, the unconventional fraud features of fraud numbers, complaint numbers, and numbers that have not been identified in advance in network communication data are often key identifiers of fraudulent behavior. These features can effectively improve the recognition ability of the model.

[0254] In addition, when the recall rate is lower than expected, the goal of model optimization is to find ways to improve the recall rate, that is, to cover more fraudulent numbers; when the precision rate is lower than expected, the goal of model optimization is to find ways to improve the precision rate, that is, to avoid accidentally hitting more numbers; when the hit rate before contact is lower than expected, the goal of model optimization is to find ways to improve the hit rate before contact, that is, to identify the numbers before the work order involved is contacted as much as possible. Therefore, adopting corresponding feature optimization methods can improve the overall performance of the model.

[0255] The anti-fraud training module is used to provide anti-fraud training to users through an anti-fraud model set.

[0256] To apply the embodiments of this application, please refer to Figure 8 , Figure 8 It is the overall architecture diagram provided in the embodiment of the present application, which shows the general framework of the anti-fraud training platform.

[0257] Overall, this embodiment has the following beneficial effects:

[0258] The anti-fraud model set constructed by this application based on real fraud data can simulate fraud scenarios and methods that are close to reality, providing users with a real anti-fraud experience. This realistic simulation training helps users better understand the characteristics and dangers of fraudulent behavior, and improve their awareness of prevention and response capabilities. By optimizing and improving the anti-fraud models that do not meet the preset standards in the evaluation scores, the recognition accuracy and adaptability of the models can be continuously improved. This continuous optimization mechanism helps to ensure that the anti-fraud model set always maintains a high level of recognition capability and stability. In addition, this solution emphasizes the continuous collection of fraud data from the actual network environment, and the optimization and iteration of the model based on the new data. This dynamic update capability enables the anti-fraud model to keep up with the changes in fraud methods and maintain a high level of fraud recognition capabilities;

[0259] In addition, this application simulates real fraud behaviors, supports users to configure fraud scenario input parameters, outputs various types of data, and allows users to become familiar with various types of data generated by fraud behaviors, improve their understanding of data, and lay a solid foundation for users to learn in the field of anti-fraud. Therefore, this application can train users' counter-thinking and anti-fraud modeling capabilities against telecommunications network fraud, cultivate anti-fraud professional and technical personnel, and improve the ability to prevent and combat telecommunications network fraud. It can be quickly and comprehensively promoted in the communications industry.

[0260] In addition, compared with the construction method of traditional network security training platforms, this application has constructed a comprehensive anti-fraud training platform through scenario simulation modules, feature analysis modules, visual modeling modules, model evaluation modules, etc., which can effectively train users' counter-thinking and anti-fraud modeling capabilities, cultivate anti-fraud professional and technical personnel, and enhance the ability to prevent and combat telecommunications network fraud.

[0261] Embodiment three:

[0262] See also Fig. 9 , the embodiment of the present application provides an anti-fraud training device in the field of telecommunication network fraud, including a collection module 10, a modeling module 20, an evaluation module 30 and an optimization module 40;

[0263] Wherein, the collection module 10 is used to collect network communication data from the actual network environment;

[0264] A modeling module 20, used to perform modeling based on network communication data to obtain a number of anti-fraud models;

[0265] An evaluation module 30, used to evaluate a number of anti-fraud models based on recognition range and recognition accuracy to obtain a number of evaluation scores;

[0266] The optimization module 40 is used to optimize the anti-fraud models whose evaluation scores do not meet the preset standards according to the performance indicators of the network communication data, obtain the anti-fraud model set, and conduct anti-fraud training for users through the anti-fraud model set.

[0267] In one embodiment, the acquisition module 10 includes a platform construction unit, a data unit, a feature unit, a signaling unit, and a simulation unit; wherein the platform construction unit is a process of establishing an anti-fraud training platform, and the data unit, the feature unit, the signaling unit, and the simulation unit are a process of collecting network communication data through the anti-fraud training platform, specifically:

[0268] The platform construction unit is used to connect with the existing network production environment system to collect positive and negative sample call records, signaling, DPI (Deep Packet Inspection) data and basic information data to obtain the prepared data; wherein, the positive sample number in the positive and negative sample call records is taken from the case number of the preset organization, and the negative sample number in the positive and negative sample call records is taken from the complaint number 10000; and the prepared data is the data authorized by the user;

[0269] The platform construction unit is also used to construct characteristic indicators including various dimensional characteristics such as call characteristics, SMS characteristics and Internet characteristics based on the collected preparation data and starting from the characteristics of fraudulent behavior, and store the characteristic indicators in the characteristic library;

[0270] The platform construction unit is also used to build an anti-fraud training platform environment on an X86 hardware server, and to establish an anti-fraud training platform in the field of telecommunications network fraud (hereinafter referred to as the "anti-fraud training platform") based on prepared data and characteristic indicators.

[0271] In the platform construction unit of this embodiment, the collection of positive and negative samples helps to fully cover different types of fraudulent behaviors and normal communication behaviors, making the constructed feature indicators more comprehensive and robust;

[0272] Data unit, used to collect basic network communication data from the actual network environment provided by the operator; wherein, the basic network communication data includes the operator's B-domain user data and O-domain signaling data, the operator's B-domain user data: the billing call data of the billing system, the user basic network access, package and certificate data of the big data center and CRM (Customer Relationship Management), O-domain signaling data: the voice signaling data of the voice anti-fraud platform, the DPI Internet access data of the Internet anti-fraud platform and the SMS data of the SMS anti-fraud platform, etc.; and the basic network communication data is the data authorized by the user;

[0273] The data unit is also used to store the collected basic network communication data; the stored content includes signaling, call bills, fraud number / complaint number data, DPI data and customer basic data, etc.

[0274] The feature unit is used to extract the features of fraudulent behavior from the basic network communication data, obtain the feature index set, store the feature index set in the feature library, and establish various model performance evaluation indicators;

[0275] The signaling unit is used to simulate the communication behaviors of different fraud types through the anti-fraud training platform based on the characteristic indicator set, and generate signaling / call bill data under various fraud scenarios; wherein the signaling / call bill data includes various types of signaling, call bills, short and multimedia messages, and DPI data (mobile network, fixed network);

[0276] The simulation unit is used to control the anti-fraud training platform to automatically search for historical fraud numbers that meet the conditions according to the signaling / call data, and automatically generate simulation data based on the real data to conduct fraud simulation training for users and obtain network communication data related to user training; users can start simulation tasks of various fraud scenarios (including voice fraud, SMS fraud and Internet fraud) on the anti-fraud training platform page, and configure various fraud scenario parameters (such as the number of calls, the number of called numbers, the called number discreteness and the calling and called numbers, etc.);

[0277] In addition, the purpose of fraud simulation training is to make users familiar with the characteristics of signaling / call bills / DPI data generated under various fraud scenarios and have an intuitive understanding of the information contained in the signaling / call bills / DPI data.

[0278] In the data unit, feature unit, signaling unit and simulation unit of the present embodiment, the collection of basic network communication data helps to comprehensively cover different types of fraudulent behaviors and normal communication behaviors, making the constructed feature indicators more comprehensive and robust; different types of fraudulent behaviors can be simulated as needed through the anti-fraud training platform, which has strong flexibility and scalability, and helps to adapt to the ever-changing fraud methods and scenarios.

[0279] In one embodiment, the modeling module 20 includes an extraction unit and a configuration unit;

[0280] Among them, the extraction unit is used to extract user behavior features from network communication data according to the data analysis capability of the anti-fraud training platform to obtain a user feature set; among them, the anti-fraud training platform supports feature library analysis of multiple data sources, supports feature indicator analysis of positive and negative sample numbers, supports screening of work order numbers involved in different scenarios according to specific conditions, and supports group statistics function (similar to the EXCEL pivot table capability);

[0281] The configuration unit is used to configure the visual model by dragging and dropping in the interface of the anti-fraud training platform according to the user feature set and preset rules, and uniformly output the warning numbers to the model warning number library for modeling, or obtain several anti-fraud models through AI modeling; among them, several anti-fraud models include voice anti-fraud models, SMS anti-fraud models and Internet anti-fraud models.

[0282] The user feature set includes user profile features, call features, terminal features, location features, social features, Internet features, and SMS features, including:

[0283] User characteristics: including package name, package value, whether it is a converged user, whether it is a premium number, whether it is a prepaid user and age...;

[0284] Terminal characteristics: whether it is a black terminal, whether to change the terminal, the number of times the terminal is changed and the replacement cycle...;

[0285] Call characteristics: call volume, call frequency, call forwarding, call forwarding time, call duration, caller ratio, called party dispersion and machine dialing characteristics...;

[0286] SMS features: WeChat SP SMS records, QQ SP SMS records, Alipay SP SMS records and Douyin SP SMS records...;

[0287] Social features: social circle, proportion of new called parties, calling and called party dialing characteristics, called number overlap rate, etc.;

[0288] Internet access characteristics: Internet traffic, and whether VOIP / remote control software is used...

[0289] The anti-fraud model constructed by the modeling module 20 of this embodiment based on the user feature set can fully consider the characteristics and differences of different user groups, realize personalized modeling, and help improve the model's recognition ability and early warning effect for specific user groups. In addition, by simultaneously constructing voice anti-fraud models, SMS anti-fraud models, and Internet anti-fraud models, different types of fraud scenarios and channels can be covered. This diversified model layout can more comprehensively respond to various forms of fraud and improve overall anti-fraud capabilities.

[0290] Among them, the AI ​​modeling method is:

[0291] Select a sample time range on the interface of the anti-fraud training platform, and control the anti-fraud training platform to automatically use the fraud numbers involved in the selected time range as positive samples and the complaint numbers as negative samples, and build models based on the corresponding feature library to obtain several anti-fraud models; the interface of the anti-fraud training platform supports the selection of different AI algorithms for modeling, and supports the configuration of the identification results of numbers with a fraud probability of n or a probability greater than n as fraud numbers;

[0292] In addition, the model uses the default parameters of the AI ​​algorithm by default. After selecting the corresponding feature library, all feature indicators of the feature library are used by default, and important features are automatically selected as parameters according to feature importance during model training.

[0293] The modeling module 20 of this embodiment supports users to use AI algorithms to build models through AI visual modeling components, and can learn cutting-edge AI anti-fraud models.

[0294] The preset rules are established as follows:

[0295] Create rules by combining different rule expressions and use logical symbols to define the logical relationship between rules to obtain model rules;

[0296] Establish preset rules based on model rules and preset statistical granularity.

[0297] Among them, the rule expression refers to the judgment logic of the number of communication calls, such as the number of calls is greater than 10; the feature indicators in the rule expression are all from the feature pool. This embodiment provides a series of feature pools, and the feature pool contains multiple feature libraries, each of which contains multiple feature indicators. Taking voice anti-fraud as an example, it includes a 10-minute signaling feature library, a 24-hour signaling feature library, a 10-minute call bill feature library, and a 24-hour call bill feature library. Each feature library contains more than 200 feature indicators. For example, the number of calls is one of the feature indicators. Similar feature indicators also include whether roaming in other provinces, whether the terminal is changed, the number of cities to which the called number belongs, and the call intensity.

[0298] Model rules refer to anti-fraud model rules, which are judgment logic established based on the number of calls, the number of called parties, and the number of IMEI (International Mobile Equipment Identity), that is, judgment is made based on characteristic indicators, and the number that meets the rules can be output in the end. For example, the statistical rules for signaling data based on a 10-minute statistical granularity are: the cumulative number of calls on the day is greater than 15, the cumulative number of called parties on the day is greater than 10, the cumulative call intensity on the day is greater than 10, and the number of IMEI from the previous 365 days to the present is greater than or equal to 2;

[0299] Logical symbols refer to mathematical logic judgment symbols such as "and, or, brackets";

[0300] The statistical granularity can be achieved by selecting the data on the left. The anti-fraud training platform supports statistical granularity of 10 minutes and 24 hours. Among them, 10-minute granularity means that the characteristic indicators from 0 o'clock to the present are counted once every 10 minutes, and 24-hour granularity means that the characteristic indicators of the day are counted once a day.

[0301] In this embodiment, the modeling module 20 can flexibly construct anti-fraud models suitable for various complex scenarios by combining different regular expressions. This flexibility enables the model to quickly adapt to changes in fraud methods and improve the recognition ability. Moreover, when new fraud features are discovered, the model can be extended by adding new regular expressions or adjusting existing rules, ensuring the long-term effectiveness and forward-looking nature of the model. Based on the judgment logic of key indicators such as call volume, number of called parties, and number of International Mobile Equipment Identity (IMEI) codes, precise analysis of communication behaviors can be achieved, which helps reduce false positives and false negatives and improve the accuracy of the model.

[0302] It should be noted that the specific differences between the voice anti-fraud model, the SMS anti-fraud model, and the Internet anti-fraud model are as follows:

[0303] 1) The data used by the voice anti-fraud model is mainly voice signaling / call detail record (CDR) data in the user feature set, and the key field information it contains includes time, calling number, called number, terminal IMEI, base station information, and roaming province and city, etc. Through feature construction, signaling / CDR feature indicators can be calculated, including the number of calls, the number of called numbers, the dispersion of called numbers, roaming province, call intensity, the number of terminal replacements, terminal IMEI, and historical active days, etc. Finally, the rules of the voice anti-fraud model are constituted by these feature indicators.

[0304] 2) The SMS anti-fraud model is divided into two categories. One category is based on SMS signaling / CDR data in the user feature set, and the key field information it contains includes time, SMS sending number, SMS receiving number, terminal IMEI, base station information, and roaming province and city, etc. Through feature construction, SMS signaling / CDR feature indicators can be calculated, including the number of SMS sent, the number of SMS receiving numbers, the dispersion of SMS receiving numbers, roaming province, SMS sending intensity, the number of terminal replacements, terminal IMEI, and historical active days, etc. Finally, the rules of the SMS anti-fraud model are constituted by these feature indicators;

[0305] The other category is based on the SMS text content data in the user feature set, and the information it contains is the text content of the SMS. The model is constructed by combining keyword matching. For example, taking the rules of the Douyin brush order and rebate SMS fraud model as an example, the rules include the following aspects:

[0306] ① Platform keywords: such as "Douyin" or its variants (such as "Keyin", "Douyin (misspelled)", "Yin", and "Touyin"), these words indicate the platforms or business types that the fraud SMS may involve;

[0307] ② Inductive behavior keywords: such as "like", "accumulate", or "like (misspelled)", these words are usually used to describe the behaviors induced by users in the fraud SMS;

[0308] ③Contact method keywords: such as "+", "plus", "jia", and various representations of WeChat (such as "WeChat", "V", "v", "Secret Message", homophones of "weixin", "wx", and "WX"). These words indicate the contact methods that may be included in the fraud text messages and are used to defraud users of money subsequently.

[0309] 3) The data used by the Internet anti-fraud model is mainly the DPI Internet access log data in the user feature set. The keyword field information included is time, number, terminal IMEI, base station information, roaming province and city, website address visited, APP used, and specific function modules in the APP (such as sending text, voice, and pictures, etc.). Through feature construction, DPI feature indicators can be calculated, including the number of times of accessing the background management address of the fraud-related website, the number of times of using remote control software, the number of times of using encrypted chat software, the number of facetime calls, the facetime call intensity, the facetime call called dispersion, the roaming province, the number of times of changing the terminal, the terminal IMEI, and the historical active days, etc.; finally, the rules of the Internet anti-fraud model are composed of these feature indicators.

[0310] In the modeling module 20 of this embodiment, the voice anti-fraud model focuses on identifying and preventing fraud behaviors through phone calls, the text message anti-fraud model focuses on text message fraud, and the Internet anti-fraud model targets fraud activities on the Internet. This pertinence enables each model to more accurately identify and respond to its corresponding fraud type.

[0311] In one embodiment, the evaluation module 30 includes a calculation unit and a score unit;

[0312] Among them, the calculation unit is used to calculate the proportion of successfully finding and identifying all target information based on several anti-fraud models to obtain the recall rate; calculate the accuracy when identifying the target information to obtain the precision rate; calculate the proportion of correctly predicting, identifying, or hitting the target information before communication is established to obtain the hit rate before communication; specifically, recall rate = the number of case-related work order numbers identified by the model / all case-related work order numbers, precision rate = the number of numbers after removing negative sample numbers among the numbers identified by the model / all numbers output by the model, hit rate before communication = the number of numbers identified by the model before the case-related work order is connected / the number of case-related work order numbers identified by the model; and the recall rate, precision rate, and hit rate before communication are model performance evaluation indicators stored in the feature library;

[0313] The score unit is used to calculate by assigning preset weights to the recall rate, precision rate, and hit rate before communication respectively based on the identification range and identification accuracy to obtain the first evaluation score and the second evaluation score; calculate the several evaluation scores corresponding to several anti-fraud models according to the first evaluation score and the second evaluation score.

[0314] The first evaluation score and the second evaluation score are calculated as follows:

[0315] 1) Taking the aggressive mode as the standard, the recall rate, precision rate and pre-contact hit rate are assigned preset weights for calculation to obtain the first evaluation score; the aggressive mode aims to identify more fraudulent numbers and can accept a certain degree of false positives; and the aggressive mode is suitable for provinces with severe fraud situations, with the purpose of identifying fraudulent numbers as much as possible;

[0316] For example, if we assign a weight of 0.7 to the recall rate and the pre-contact hit rate, and a weight of 0.3 to the precision rate, we have:

[0317] Recall impact factor score = recall rate * 100;

[0318] Pre-contact hit rate impact factor score = Pre-contact hit rate * 100;

[0319] Precision impact factor score = precision * 100;

[0320] First evaluation score = recall impact factor score * 0.7 + pre-contact hit rate impact factor score * 0.7 +

[0321] Precision impact factor score*0.3.

[0322] If the recall rate exceeds 80%, the pre-contact hit rate exceeds 80%, and the precision rate exceeds 70%, the model can be judged as an excellent model; the score line of the excellent model is:

[0323] 80*0.7+80*0.7+80*0.3=56+56+24=136;

[0324] It can be seen that the models with a score greater than 135 in the aggressive mode are excellent models.

[0325] 2) Using the conservative model as the standard, the recall rate, precision rate and pre-contact hit rate are assigned preset weights for calculation to obtain a second evaluation score; the conservative model aims to more accurately identify fraudulent numbers to avoid too many accidental injuries; and the conservative model is suitable for provinces where the fraud situation is not too severe, and aims to accurately hit fraudulent numbers by building an accurate model to avoid causing too many accidental injuries.

[0326] For example, if we assign a weight of 0.3 to the recall rate and the pre-contact hit rate, and a weight of 0.7 to the precision rate, we have:

[0327] Final evaluation score = recall impact factor score * 0.3 + pre-contact hit rate impact factor score * 0.3 + precision impact factor score * 0.7;

[0328] Similarly, if the recall rate exceeds 80%, the pre-contact hit rate exceeds 80%, and the precision rate exceeds 70%, it can be judged as an excellent model; the score line of the excellent model is:

[0329] 80*0.3+80*0.3+80*0.7=24+24+56=104;

[0330] It can be seen that the models with a score greater than 104 in the conservative mode are excellent models.

[0331] In the evaluation module 30 of the embodiment, the recall rate reflects the proportion of all target information that the model successfully finds and identifies. A high recall rate means that the model can cover more potential fraud behaviors and reduce missed reports; the precision rate measures the accuracy of the model in identifying the target information. A high precision rate can reduce false positives and improve the pertinence and effectiveness of anti-fraud work. The pre-contact hit rate evaluates the proportion of the model that predicts, identifies or hits the target information before the communication is established. This indicator reflects the foresight and prevention capabilities of the model, and helps to intervene and deal with fraud in a timely manner before it occurs. The recall rate, precision rate and pre-contact hit rate comprehensively consider the performance of the anti-fraud model from three dimensions: recognition range, recognition accuracy and prediction ability. This multi-dimensional evaluation method can more comprehensively reflect the actual effect of the model.

[0332] In one embodiment, the optimization module 40 includes an acquisition unit, a full check unit, a precision check unit, a hit unit, a comprehensive unit and a training unit; wherein the acquisition unit, the full check unit, the precision check unit, the hit unit and the comprehensive unit are the processes of establishing an anti-fraud model set, and the training unit is the process of training through the anti-fraud model set, specifically:

[0333] An acquisition unit is used to acquire anti-fraud models that do not meet the preset standard among several evaluation scores, and obtain a set of non-standard models; wherein the set of non-standard models includes a non-standard recall model whose recall rate is lower than expected (e.g., less than 80%), a non-standard precision model whose precision rate is lower than expected (e.g., less than 80%), and a non-standard pre-contact hit rate model whose pre-contact hit rate is lower than expected (e.g., less than 80%);

[0334] The recall unit is used to check the specific number information of the work orders that the model missed through the anti-fraud training platform, and obtain the unconventional fraud characteristics of the fraud numbers in the network communication data; and improve the recall rate of the fraud numbers of the model that does not meet the recall rate standard according to the unconventional fraud characteristics of the fraud numbers, in order to cover the numbers and obtain the recall rate optimization model;

[0335] The precision unit is used to check the specific number information of the non-fraudulent numbers (i.e., complaint numbers) hit by the model through the anti-fraud training platform, and obtain the unconventional fraud characteristics of the complaint numbers in the network communication data; and improve the precision of the fraudulent numbers of the model whose precision rate does not meet the standard according to the unconventional fraud characteristics of the complaint numbers, in order to filter out the numbers and obtain the precision rate optimization model;

[0336] The hit unit is used to check the specific number information that has not been hit in advance through the anti-fraud training platform, and obtain the fraud characteristics of the numbers that have not been identified in advance in the network communication data; and improve the pre-contact hit rate of the pre-contact hit rate model that does not meet the standard according to the fraud characteristics of the numbers that have not been identified in advance, so as to obtain a pre-contact hit rate optimization model for the numbers identified before the contact;

[0337] The comprehensive unit is used to form an anti-fraud model set consisting of a recall optimization model, a precision optimization model, a pre-contact hit rate optimization model, and several anti-fraud models that meet preset standards among the evaluation scores.

[0338] The acquisition unit, full search unit, precision search unit, hit unit and comprehensive unit of this embodiment identify the anti-fraud model that does not meet the preset standard through evaluation scores, and accurately optimize its deficiencies respectively. This targeted optimization can significantly improve the performance of the model; and the unconventional fraud features of fraud numbers, complaint numbers and numbers that cannot be identified in advance in network communication data are often key identifiers of fraudulent behavior. These features can effectively improve the recognition ability of the model;

[0339] In addition, when the recall rate is lower than expected, the goal of model optimization is to find ways to improve the recall rate, that is, to cover more fraudulent numbers; when the precision rate is lower than expected, the goal of model optimization is to find ways to improve the precision rate, that is, to avoid accidentally hitting more numbers; when the hit rate before contact is lower than expected, the goal of model optimization is to find ways to improve the hit rate before contact, that is, to identify the numbers before the work order involved is contacted as much as possible. Therefore, adopting corresponding feature optimization methods can improve the overall performance of the model.

[0340] The training unit is used to conduct anti-fraud training for users through the anti-fraud model set.

[0341] Overall, this embodiment has the following beneficial effects:

[0342] The anti-fraud model set constructed by this application based on real fraud data can simulate fraud scenarios and methods that are close to reality, providing users with a real anti-fraud experience. This realistic simulation training helps users better understand the characteristics and dangers of fraudulent behavior, and improve their awareness of prevention and response capabilities. By optimizing and improving the anti-fraud models that do not meet the preset standards in the evaluation scores, the recognition accuracy and adaptability of the models can be continuously improved. This continuous optimization mechanism helps to ensure that the anti-fraud model set always maintains a high level of recognition capability and stability. In addition, this solution emphasizes the continuous collection of fraud data from the actual network environment, and the optimization and iteration of the model based on the new data. This dynamic update capability enables the anti-fraud model to keep up with the changes in fraud methods and maintain a high level of fraud recognition capabilities;

[0343] In addition, this application, by simulating real fraudulent behavior, supports users to configure fraud scenario input parameters and output various types of data, so that users can become familiar with various types of data generated by fraudulent behavior, improve their understanding of data, and lay a solid foundation for users' learning in the field of anti-fraud. Therefore, this application can train users' counter-thinking and anti-fraud modeling capabilities against telecommunications network fraud, cultivate anti-fraud professional and technical personnel, and improve the ability to prevent and combat telecommunications network fraud, and can be quickly and comprehensively promoted in the communications industry.

[0344] Embodiment 4:

[0345] The embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the anti-fraud training method in the field of telecommunications network fraud;

[0346] Among them, the anti-fraud training method in the field of telecommunications network fraud, if implemented in the form of a software functional unit and used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0347] The above are preferred embodiments of the present invention. It should be noted that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. An anti-fraud training method in the field of telecommunications network fraud, characterized in that: include: Collect network communication data from the actual network environment; Modeling is performed based on the network communication data to obtain several anti-fraud models; Based on the recognition range and recognition accuracy, the anti-fraud models are evaluated to obtain a number of evaluation scores; According to the performance indicators of the network communication data, the anti-fraud models that do not meet the preset standards among the several evaluation scores are optimized to obtain an anti-fraud model set, and anti-fraud training is performed on users through the anti-fraud model set.

2. The anti-fraud training method in the field of telecommunications network fraud as claimed in claim 1, characterized in that: Collect network communication data from the actual network environment, specifically: Collecting basic network communication data from the actual network environment; Extracting features about fraudulent behavior from the network communication basic data to obtain a feature indicator set; Based on the characteristic indicator set, the communication behaviors of different fraud types are simulated through a preset anti-fraud training platform to generate signaling data; The anti-fraud training platform is controlled to perform fraud simulation training on the user according to the signaling data to obtain the network communication data.

3. The anti-fraud training method in the field of telecommunications network fraud as claimed in claim 1, characterized in that: Based on the network communication data, several anti-fraud models are obtained, specifically: Extracting user behavior features from the network communication data to obtain a user feature set; According to the user feature set, a visualization model is configured based on preset rules, and the warning numbers are uniformly output to the model warning number library for modeling to obtain the several anti-fraud models; wherein the several anti-fraud models include voice anti-fraud models, SMS anti-fraud models and Internet anti-fraud models.

4. The anti-fraud training method in the field of telecommunications network fraud as claimed in claim 3, characterized in that: The preset rules are specifically: The rules are created by combining different rule expressions, and the logical relationship between the rules is defined by using logical symbols to obtain the model rules; wherein the rule expression refers to the judgment logic of the number of communication calls, and the model rules are established according to the judgment logic of the call volume, the number of called parties, and the number of international mobile equipment identity codes; The preset rules are established according to the model rules and the preset statistical granularity.

5. The anti-fraud training method in the field of telecommunications network fraud as claimed in claim 3, characterized in that: The several anti-fraud models include voice anti-fraud model, SMS anti-fraud model and Internet anti-fraud model, specifically: Establishing the several anti-fraud models according to the voice anti-fraud model, the SMS anti-fraud model and the Internet anti-fraud model; Among them, the voice anti-fraud model is established based on the signaling feature indicators and call bill feature indicators in the user feature set, the SMS anti-fraud model is established based on the SMS signaling feature indicators, SMS call bill feature indicators and SMS text keywords in the user feature set, and the Internet anti-fraud model is established based on the DPI feature indicators in the user feature set.

6. The anti-fraud training method in the field of telecommunications network fraud as claimed in claim 1, characterized in that: Based on the recognition range and recognition accuracy, the anti-fraud models are evaluated to obtain several evaluation scores, specifically: Based on the several anti-fraud models, the proportion of all target information successfully found and identified is calculated to obtain the recall rate; the accuracy when the target information is identified is calculated to obtain the precision rate; the proportion of target information that can be correctly predicted, identified or hit before communication is established is calculated to obtain the pre-communication hit rate; Taking the recognition range and the recognition accuracy as the standards, the recall rate, the precision rate and the pre-contact hit rate are respectively assigned preset weights for calculation to obtain the several evaluation scores.

7. The anti-fraud training method in the field of telecommunications network fraud as claimed in claim 1, characterized in that: According to the performance indicators of the network communication data, the anti-fraud models that do not meet the preset standards among the several evaluation scores are optimized to obtain an anti-fraud model set, which is specifically: Obtaining the anti-fraud models that do not meet the preset standard from the plurality of evaluation scores to obtain a set of non-standard models; wherein the set of non-standard models includes a recall rate non-standard model, a precision rate non-standard model, and a pre-contact hit rate non-standard model; According to the unconventional fraud characteristics of the fraud numbers in the network communication data, the recall rate of the fraud numbers of the model that does not meet the recall rate standard is improved to obtain a recall rate optimization model; According to the unconventional fraud characteristics of the complaint numbers in the network communication data, the fraud number precision of the model that does not meet the precision standard is improved to obtain a precision optimization model; According to the fraud characteristics of the numbers that cannot be identified in advance in the network communication data, the pre-contact hit rate of the model with the pre-contact hit rate not meeting the standard is improved to obtain a pre-contact hit rate optimization model; The anti-fraud model set is composed of the recall optimization model, the precision optimization model, the pre-contact hit rate optimization model and the anti-fraud models that meet the preset standard among the several evaluation scores.

8. A method for constructing an anti-fraud training platform in the field of telecommunications network fraud, characterized in that: The anti-fraud training platform includes a data collection and control layer, a data storage layer, a capability layer and an application layer; Wherein, the data collection and control layer is used to collect network communication data from the actual network environment; The data storage layer is used to store the network communication data; The capability layer is used to establish the performance index for counting the network communication data; The application layer is used to perform modeling based on the network communication data to obtain several anti-fraud models; The application layer is further used to evaluate the anti-fraud models based on the recognition range and recognition accuracy to obtain a number of evaluation scores; The application layer is also used to optimize the anti-fraud models that do not meet the preset standards among the several evaluation scores according to the performance indicators of the network communication data, obtain an anti-fraud model set, and conduct anti-fraud training for users through the anti-fraud model set.

9. An anti-fraud training device in the field of telecommunications network fraud, characterized in that: It includes acquisition module, modeling module, evaluation module and optimization module; Wherein, the acquisition module is used to collect network communication data from the actual network environment; The modeling module is used to perform modeling based on the network communication data to obtain several anti-fraud models; The evaluation module is used to evaluate the anti-fraud models based on the recognition range and recognition accuracy to obtain a number of evaluation scores; The optimization module is used to optimize the anti-fraud models that do not meet the preset standards among the several evaluation scores according to the performance indicators of the network communication data, obtain an anti-fraud model set, and conduct anti-fraud training for users through the anti-fraud model set.

10. The anti-fraud training device in the field of telecommunication network fraud according to claim 9, characterized in that: The acquisition module includes a data unit, a feature unit, a signaling unit and a simulation unit; Wherein, the data unit is used to collect basic network communication data from the actual network environment; The feature unit is used to extract features about fraudulent behavior from the network communication basic data to obtain a feature indicator set; The signaling unit is used to simulate communication behaviors of different fraud types through a preset anti-fraud training platform based on the characteristic indicator set to generate signaling data; The simulation unit is used to control the anti-fraud training platform to perform fraud simulation training on the user according to the signaling data to obtain the network communication data.

11. The anti-fraud training device in the field of telecommunication network fraud according to claim 9, characterized in that: The modeling module includes an extraction unit and a configuration unit; Wherein, the extraction unit is used to extract user behavior features from the network communication data to obtain a user feature set; The configuration unit is used to configure a visualization model based on preset rules according to the user feature set, and uniformly output the warning numbers to the model warning number library for modeling to obtain the several anti-fraud models; wherein the several anti-fraud models include voice anti-fraud models, SMS anti-fraud models and Internet anti-fraud models.

12. The anti-fraud training device in the field of telecommunication network fraud according to claim 11, characterized in that: The preset rules are specifically: The rules are created by combining different rule expressions, and the logical relationship between the rules is defined by using logical symbols to obtain the model rules; wherein the rule expression refers to the judgment logic of the number of communication calls, and the model rules are established according to the judgment logic of the call volume, the number of called parties, and the number of international mobile equipment identity codes; The preset rules are established according to the model rules and the preset statistical granularity.

13. The anti-fraud training device in the field of telecommunication network fraud according to claim 11, characterized in that: The several anti-fraud models include voice anti-fraud model, SMS anti-fraud model and Internet anti-fraud model, specifically: Establishing the several anti-fraud models according to the voice anti-fraud model, the SMS anti-fraud model and the Internet anti-fraud model; Among them, the voice anti-fraud model is established based on the signaling feature indicators and call bill feature indicators in the user feature set, the SMS anti-fraud model is established based on the SMS signaling feature indicators, SMS call bill feature indicators and SMS text keywords in the user feature set, and the Internet anti-fraud model is established based on the DPI feature indicators in the user feature set.

14. The anti-fraud training device in the field of telecommunication network fraud according to claim 9, characterized in that: The evaluation module includes a calculation unit and a score unit; The calculation unit is used to calculate the proportion of all target information successfully found and identified based on the several anti-fraud models to obtain the recall rate; calculate the accuracy when the target information is identified to obtain the precision rate; calculate the proportion of target information that can be correctly predicted, identified or hit before communication is established to obtain the pre-communication hit rate; The score unit is used to calculate the recall rate, the precision rate and the pre-contact hit rate by assigning preset weights to the recall rate, the precision rate and the pre-contact hit rate based on the recognition range and the recognition accuracy, so as to obtain the plurality of evaluation scores.

15. The anti-fraud training device in the field of telecommunication network fraud according to claim 9, characterized in that: The optimization module includes an acquisition unit, a full check unit, a precision check unit, a hit unit and a comprehensive unit; The acquisition unit is used to acquire the anti-fraud models that do not meet the preset standard among the several evaluation scores, and obtain a non-standard model set; wherein the non-standard model set includes a recall rate non-standard model, a precision rate non-standard model, and a pre-contact hit rate non-standard model; The recall unit is used to improve the recall rate of fraudulent numbers of the recall rate failure model according to the unconventional fraud characteristics of the fraudulent numbers in the network communication data, and obtain a recall rate optimization model; The precision checking unit is used to improve the fraudulent number precision checking of the model with low precision checking rate according to the unconventional fraud characteristics of the complaint number in the network communication data, so as to obtain a precision checking rate optimization model; The hit unit is used to improve the pre-contact hit rate of the pre-contact hit rate failure model according to the fraud characteristics of the numbers that cannot be identified in advance in the network communication data, and obtain a pre-contact hit rate optimization model; The integration unit is used to form the anti-fraud model set by the recall optimization model, the precision optimization model, the pre-contact hit rate optimization model and the anti-fraud models that meet the preset standard among the several evaluation scores.

16. A storage medium, characterized in that: The storage medium stores a computer program, which is called and executed by a computer to implement an anti-fraud training method in the field of telecommunications network fraud as described in any one of claims 1 to 7 above.

Images