Fraud number identification method and system, electronic equipment and storage medium

Abstract

The invention discloses a fraud number identification method and system, an electronic device and a storage medium, and the method comprises the steps: carrying out the preprocessing of first original transaction data and second original transaction data, and obtaining analysis data and historical data; carrying out statistics on the analysis data, and constructing a terminal classification matrix; analyzing the analysis data according to the terminal classification matrix to obtain a prediction result; performing statistics according to the prediction result to obtain a corresponding roaming place data set; analyzing according to the roaming place data set and historical data to obtain a risk number set; analyzing the risk number set according to account opening information of the risk number set to obtain a target fraud risk number; the number-based transaction data is identified, so that the real-time performance of identification is improved; the number is identified according to the transaction data, traffic fraud and non-traffic fraud scenes are covered, and the applicability of the method is improved. The embodiment of the invention can be widely applied to the field of network technology and security.

Description

Technical Field

[0001] The present invention relates to the field of network technology and security, and in particular to a method, system, electronic device and storage medium for identifying fraudulent numbers. Background Art

[0002] With the development of mobile communication technology and Internet technology, telecommunications fraud has also developed into various forms. In order to reduce the losses caused by telecommunications fraud, anti-fraud models are usually used to analyze numbers, identify fraudulent numbers, and intercept them. The existing mainstream anti-fraud models are based on traffic models and analyze the number's current call records or real-time billing records. There is a certain lag, resulting in the number being identified and intercepted only after the fraud is successful. At the same time, it cannot cover and identify and intercept fraud based on Internet social software, and has poor applicability. Summary of the invention

[0003] The main purpose of the embodiments of the present invention is to provide a method, system, electronic device and storage medium for identifying fraudulent numbers, which can improve the real-time nature of identification and improve applicability.

[0004] To achieve the above object, an embodiment of the present invention provides a method for identifying a fraudulent number, the method comprising:

[0005] Acquire first original transaction data and second original transaction data, pre-process the first original transaction data to obtain analysis data; pre-process the second original transaction data to obtain historical data;

[0006] Performing grouping statistics on the analysis data to obtain a terminal classification matrix; and determining a prediction result according to the terminal classification matrix and the analysis data;

[0007] Performing statistical analysis on the prediction results to obtain a roaming location data set; wherein the roaming location data set includes risky roaming location information and terminal information of the risky roaming location;

[0008] Identify based on the roaming location data set and the historical data to determine a risk number set; wherein the risk number set includes roaming location numbers with no trace roaming fraud risk;

[0009] Determine the account opening information set corresponding to the risk number set, and compare the account opening information set with the risk number set to obtain the target fraud risk number.

[0010] In some embodiments, the grouping and statistics of the analysis data to obtain a terminal classification matrix specifically includes:

[0011] The analysis data is counted according to a first preset group to obtain a first data table; wherein the first preset group includes a terminal identifier, a mobile phone number, a roaming location, and a number home location;

[0012] Performing correlation analysis on the analysis data according to the terminal identifier in the first preset group to obtain a second data table; wherein the second data table includes the consistency between the terminal identifier and the associated number;

[0013] Perform statistics according to the terminal identifier, the first data table, and the second data table to obtain a third data table;

[0014] The third data table is dimensionally divided according to the analysis data to obtain the terminal classification matrix.

[0015] In some embodiments, determining the prediction result according to the terminal classification matrix and the analysis data specifically includes:

[0016] Determine a threshold range of a first feature dimension according to the terminal classification matrix, match the analysis data with the threshold range of the first feature dimension, and determine first target data; wherein the first feature dimension represents the number of terminal-associated numbers;

[0017] Determine a classification scenario set according to the terminal classification matrix, match the first target data with the classification scenario set, and determine a first risk scenario set; wherein the classification scenario set includes a plurality of scenario combinations, and the scenario combinations are obtained according to sub-category combinations of feature dimensions in the terminal classification matrix;

[0018] The first risk scenario set is risk-weighted according to the second characteristic dimension of the terminal classification matrix to obtain a target risk scenario set; the corresponding risk terminal set is determined according to the target risk scenario set, and the prediction result is obtained according to the risk terminal set; wherein the second characteristic dimension represents the consistency of the associated number.

[0019] In some embodiments, performing statistical analysis on the prediction results to obtain the roaming location data set specifically includes:

[0020] Determine a fourth data table according to the prediction result and the historical data; wherein the fourth data table includes the prediction result and the corresponding date;

[0021] Performing statistics on the fourth data table according to the first preset parameter to obtain a first quantity set; comparing the first quantity set with a first preset threshold; wherein the first quantity set includes the cumulative number of risk terminals in each roaming location in the fourth data table;

[0022] If a first number in the first number set is greater than the first preset threshold, the roaming locations corresponding to the first number are marked as risky roaming locations, and the roaming location data set is determined according to the risky roaming locations.

[0023] In some embodiments, performing statistical analysis on the prediction results to obtain the roaming location dataset further includes:

[0024] Determine a fourth data table according to the prediction result and the historical data; wherein the fourth data table includes the prediction result and the corresponding date;

[0025] The fourth data table is grouped according to the first preset parameter to obtain a first data set; wherein the first data set includes the number of risk terminals in different dates of each roaming location in the fourth data table;

[0026] The first data set is compared with a second preset threshold value. If the first data in the first data set is greater than the second preset threshold value, the roaming location corresponding to the first data is marked as a risky roaming location, and the roaming location data set is determined according to the risky roaming location.

[0027] In some embodiments, the identifying according to the roaming location data set and the historical data to determine the risk number set specifically includes:

[0028] According to the first risk roaming location data set, the historical data is matched to obtain a risk number data set; wherein the risk number set represents the number information data corresponding to the risk terminal in the first risk roaming location;

[0029] The risk number data set is matched with a preset condition, and the risk number set is determined according to the successfully matched risk number data.

[0030] In some embodiments, the comparing the account opening information set with the risk number set to obtain a target fraud risk number specifically includes:

[0031] According to the account opening information set and the risk number set, the household registration place information is matched to determine; the household registration place information is compared with the roaming place information in the risk number set, and the prediction result of the risk number set is compared with a second preset parameter; wherein the household registration place information represents the household registration place information corresponding to the risk number in the risk number set;

[0032] If the comparison between the registered residence information and the roaming location information fails, and the prediction result satisfies the second preset parameter, the risk number corresponding to the registered residence information is marked as the target fraud risk number.

[0033] To achieve the above object, another aspect of an embodiment of the present invention provides a fraudulent number identification system, comprising:

[0034] The first module is used to obtain first original transaction data and second original transaction data, pre-process the first original transaction data to obtain analysis data; and pre-process the second original transaction data to obtain historical data;

[0035] The second module is used to group and count the analysis data to obtain a terminal classification matrix; and determine a prediction result according to the terminal classification matrix and the analysis data;

[0036] A third module is used to perform statistical analysis on the prediction results to obtain a roaming location data set; wherein the roaming location data set includes risky roaming location information and terminal information of the risky roaming location;

[0037] A fourth module is used to identify according to the roaming location data set and the historical data, and determine a risk number set; wherein the risk number set includes roaming location numbers with no track roaming fraud risk;

[0038] The fifth module is used to determine the account opening information set corresponding to the risk number set, and compare the account opening information set with the risk number set to obtain the target fraud risk number.

[0039] To achieve the above objective, another aspect of an embodiment of the present application provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above-mentioned method when executing the computer program.

[0040] To achieve the above objective, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0041] Implementation of the embodiments of the present invention includes the following beneficial effects: the embodiments provide a method, system, electronic device and storage medium for identifying fraudulent numbers, the scheme obtains analysis data and historical data by preprocessing the first original transaction data and the second original transaction data respectively; performs statistics on the analysis data and constructs a terminal classification matrix; performs scenario analysis on the analysis data according to the terminal classification matrix to obtain prediction results; performs statistics according to the prediction results to obtain a corresponding roaming data set; performs analysis according to the roaming data set and historical data to obtain a risk number set; analyzes and identifies the risk number set according to the account opening information of the risk number set to obtain a target fraud risk number; performs scenario classification by constructing a terminal classification matrix to obtain a prediction result, identifies a risky roaming area according to the prediction result, and then identifies the fraud risk number based on the risky roaming area, analyzes the flow process of the number, identifies the number before it commits fraudulent behavior, realizes forward fraud prevention and control, and improves the real-time nature of identification; models the transaction data generated when the number accesses the network, identifies the number according to the modeling, covers both traffic fraud and non-traffic fraud scenarios, and improves the applicability of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic flow chart of the steps of a method for identifying a fraudulent number provided by an embodiment of the present invention;

[0043] Figure 2 It is a schematic flow chart of the steps of obtaining a terminal classification matrix in a method for identifying a fraudulent number provided by an embodiment of the present invention;

[0044] Figure 3 It is a schematic flow chart of steps for obtaining a prediction result in a method for identifying a fraudulent number provided by an embodiment of the present invention;

[0045] Figure 4 It is a schematic flow chart of steps for obtaining a roaming location data set in a method for identifying a fraudulent number provided by an embodiment of the present invention;

[0046] Figure 5 It is a flowchart diagram of another step of obtaining a roaming location data set in a method for identifying a fraudulent number provided by an embodiment of the present invention;

[0047] Figure 6 It is a schematic flow chart of steps for obtaining a risk number set in a fraud number identification method provided by an embodiment of the present invention;

[0048] Figure 7 It is a schematic flow chart of steps for obtaining a target fraud risk number in a fraud number identification method provided by an embodiment of the present invention;

[0049] Figure 8It is a schematic diagram of a step flow of a specific embodiment provided by an embodiment of the present invention;

[0050] Fig. 9 This is a structural block diagram of a fraud number identification system provided by an embodiment of the present invention;

[0051] Fig.10 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only provided for the convenience of explanation and description, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0053] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0054] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present invention described herein can be implemented in an order other than that illustrated or described herein.

[0055] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present invention have the same meanings as those commonly understood by those skilled in the art of the present invention. The terms used in the embodiments of the present invention are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0056] Before further describing the embodiments of the present invention in detail, the nouns and terms involved in the embodiments of the present invention are described. The nouns and terms involved in the embodiments of the present invention are subject to the following interpretations.

[0057] IMEI, International Mobile Equipment Identity, is used to identify each independent mobile communication device in the mobile phone network in China, also known as terminal identification;

[0058] CDR, Call Detail Record, is a file data transmitted within the communication system, which records the information of each original communication record, including serial number, user ID, calling number, called number, call start time, call end time, call duration, Internet traffic, call nature and other information, describing the entire process of call connection;

[0059] TDR, Transaction Detail Record, is used to record the process of basic conversations, including a series of information such as the collection time of each transaction, mobile phone number, IMIS, terminal identification, terminal model, number location, roaming location, base station cell, transaction type, etc., which describes the entire process of transaction processing; among them, the registration record in the transaction type is a mechanism for managing mobile user location information in a mobile network. When a mobile phone number accesses the network for registration, an initial registration signaling is generated to notify the network of the location and related information of the mobile phone number. When the mobile phone number appears on the network for a certain period of time, the location update cycle is reached, the campus boundary is crossed, or the network needs to update the location information of the mobile phone number for other reasons, the mobile phone number will use re-registration signaling to communicate with the network.

[0060] In the relevant technology, anti-fraud models are used to identify and analyze fraudulent numbers, and further operations such as interception and suspension are performed on the identified fraudulent numbers; the mainstream anti-fraud model adopts a traffic model, which is based on the current original call record information of the number or the real-time billing call record for analysis, and combines call information characteristics such as call number information, call frequency, and number terminal changes to identify fraudulent numbers; however, the identification of fraudulent numbers based on the traffic model requires that the number generate call behavior characteristics during use, and the fraudulent behavior is analyzed and identified based on the generated call behavior characteristics, which inevitably leads to a lag in identification and interception; at the same time, with the development of new technologies such as AI, Internet social software can also commit fraud. The calls of this type of software use IP packets for data encryption transmission, which are non-traditional voice data streams. The mainstream traffic model has a poor effect on intercepting fraud against Internet social software and cannot cover it.

[0061] In view of this, an embodiment of the present invention provides a method, system, electronic device and storage medium for identifying fraudulent numbers. The scheme identifies and analyzes the number based on the transaction data of the number, obtains recent transaction data and historical transaction data of the number to be identified for a long period of time, builds a terminal classification matrix based on the recent transaction data, classifies scenarios according to the terminal classification matrix, and identifies scenario terminals with fraud risks; analyzes based on historical transaction data for a long period of time and identified scenario terminals with fraud risks, identifies risky roaming areas and risky numbers in the risky roaming areas, and identifies fraudulent risk numbers for interception based on the comparison of account opening information of the risky numbers and the risky roaming areas; because the analysis is based on transaction information generated by terminal card insertion, power-on, and number access to the network, rather than based on traffic information generated during the number call process, the fraudulent number can be identified before the call generates fraudulent behavior, thereby improving real-time performance; at the same time, based on the transaction information generated by terminal card insertion, power-on, and number access to the network, effective coverage can be achieved for non-traffic fraud behaviors of Internet social software, thereby improving applicability.

[0062] A method for identifying a fraudulent number provided in an embodiment of the present application relates to the field of information technology. A method for identifying a fraudulent number provided in an embodiment of the present application can be applied to a terminal, can be applied to a server, or can be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or can be configured as a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements a method for identifying a fraudulent number, etc., but is not limited to the above forms.

[0063] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0064] Figure 1 is an optional flow chart of a method for identifying a fraudulent number provided by an embodiment of the present invention. Figure 1 The method may include but is not limited to steps S101 to S105.

[0065] Step S101, obtaining first original transaction data and second original transaction data, preprocessing the first original transaction data to obtain analysis data; preprocessing the second original transaction data to obtain historical data;

[0066] Step S102, grouping and counting the analyzed data to obtain a terminal classification matrix; and determining a prediction result according to the terminal classification matrix and the analyzed data;

[0067] Step S103, statistically analyzing the prediction results to obtain a roaming location data set; wherein the roaming location data set includes risky roaming location information and terminal information of the risky roaming location;

[0068] Step S104, identifying based on the roaming location data set and historical data to determine a risk number set; wherein the risk number set includes roaming location numbers with no trace roaming fraud risk;

[0069] Step S105, determine the account opening information set corresponding to the risk number set, compare the account opening information set with the risk number set, and obtain the target fraud risk number.

[0070] In steps S101 to S105 shown in the embodiment of the present application, by acquiring the original data of transaction records of existing stock numbers, data extraction, classification, statistics and other processing are performed on the acquired original data of transaction records according to the registration records of the stock numbers logging into the network, and feature dimensions are divided based on the characteristics of risk scenarios to establish a terminal classification matrix for terminal usage scenarios; scenario classification is performed on the acquired original data of transaction records of stock numbers according to the established terminal classification matrix to predict the fraud risk scenario results of the terminal; the roaming area of ​​fraud risk is further predicted based on the obtained prediction results, the circulation track of the number is analyzed based on the predicted roaming area and the acquired original data of transaction records of stock numbers, and the numbers that have no track of roaming into the fraud risk roaming area are extracted as target numbers, and matching is performed according to the account opening place of the target number and the current roaming place, and the target numbers that cannot be matched are regarded as fraud risk numbers for further processing. By analyzing the original data of transaction records of existing numbers, a terminal classification matrix of number usage scenarios is established, and identification is performed based on the terminal scenarios and circulation paths of the numbers accessing the network. The current number is identified and intercepted before it commits fraudulent behavior through calls, thereby improving the real-time nature of number identification. In addition, number identification is performed through the transaction record data generated when the number accesses the network, covering the identification of fraud risk numbers in non-call scenarios, thereby improving the applicability of the method.

[0071] In step S101 of some embodiments, the transaction detail record data of the number may be obtained for subsequent number identification. The registration record data generated when the number accesses the network may also be obtained for subsequent number identification, but is not limited thereto.

[0072] See also Figure 2 In some embodiments, step S102 may include but is not limited to steps S201 to S204:

[0073] Step S201, statistics are collected on the analysis data according to the first preset grouping to obtain a first data table; wherein the first preset grouping includes the terminal identification, the mobile phone number, the roaming location and the number home location;

[0074] Step S202, performing correlation analysis on the analysis data according to the terminal identifier in the first preset group to obtain a second data table; wherein the second data table includes consistency between the terminal identifier and the correlation number;

[0075] Step S203, performing statistics according to the terminal identifier, the first data table and the second data table to obtain a third data table;

[0076] Step S204: divide the third data table into dimensions according to the analysis data to obtain a terminal classification matrix.

[0077] In step S201 of some embodiments, the acquired transaction record raw data of the stock number is preliminarily processed, and the IoT card records used for networking of smart terminal devices and irregular records such as roaming area code fields being empty or in English characters are filtered out to obtain analysis data for fraud number identification; then, the four fields of terminal identification, mobile phone number, roaming location, and number home location in the transaction record raw data are grouped, and the analysis data is statistically processed to calculate the number of initial registration records, re-registration records, and cancellation records of the numbers corresponding to each terminal in the analysis data, and a statistical result table is constructed, as shown in Table 1:

[0078] Table 1

[0079]

[0080] In step S202 of some embodiments, according to the obtained statistical result table, the associated numbers corresponding to each number terminal within two consecutive days are counted according to the terminal identification, that is, the mobile phone number of the SIM card that has been inserted into the terminal; if the associated numbers within two consecutive days are consistent, the consistency of the associated number of the terminal corresponding to the terminal identification is marked as 1; otherwise, the consistency of the associated number of the terminal corresponding to the terminal identification is marked as 0, and a terminal associated number comparison result table is constructed according to the terminal identification and the corresponding associated number consistency, as shown in Table 2:

[0081] Table 2

[0082] Terminal identification Association number consistency Terminal 1 35***********61 0 Terminal 2 86***********35 1 Terminal 3 86***********13 1 terminal……

[0083] In step S203 of some embodiments, since the statistical result table and the terminal associated number comparison result table are both established based on the terminal identification, the terminal identification field is used as a group, and the two result tables are associated and counted to obtain characteristic data such as the re-registration ratio, initial registration ratio, number of associated numbers, number of non-provincial numbers, number of roaming cities in the province, number of roaming cities in other provinces, and number of places where numbers in the province are located, corresponding to each terminal identification, and a statistical characteristic result table is constructed based on the characteristic data obtained by statistics, as shown in Table 3:

[0084] Table 3

[0085]

[0086] In step S204 of some embodiments, according to the obtained statistical result table, the terminal associated number comparison result table and the statistical feature result table, the relevant feature data is extracted according to the actual transaction in the transaction data of the number, and divided into feature dimensions of the terminal classification matrix, and the value range of each feature dimension is defined to obtain the terminal classification matrix. In this embodiment, the re-registration ratio is used as the first dimension of the terminal classification matrix, the initial registration ratio is used as the second dimension, the number of non-local numbers, the number of roaming cities in the local province, the number of roaming cities in other provinces and the number of local number locations are used as the third dimension, the consistency of the associated number is used as the fourth dimension, and the number of associated numbers is used as the fifth dimension.

[0087] See also Figure 3 In some embodiments, step S102 may include but is not limited to steps S301 to S303:

[0088] Step S301, determining a threshold range of a first feature dimension according to a terminal classification matrix, matching the analysis data with the threshold range of the first feature dimension, and determining first target data; wherein the first feature dimension represents the number of terminal-associated numbers;

[0089] Step S302, determining a classification scenario set according to the terminal classification matrix, matching the first target data with the classification scenario set, and determining a first risk scenario set; wherein the classification scenario set includes a plurality of scenario combinations, and the scenario combination is obtained according to the sub-category combination of the feature dimension in the terminal classification matrix;

[0090] Step S303, risk-weighting the first risk scenario set according to the second characteristic dimension of the terminal classification matrix to obtain a target risk scenario set; determining a corresponding risk terminal set according to the target risk scenario set, and obtaining a prediction result according to the risk terminal set; wherein the second characteristic dimension represents the consistency of the associated number.

[0091] In step S301 of some embodiments, after constructing the terminal classification matrix, the existing numbers are scene-classified through the terminal classification matrix to facilitate the subsequent identification of fraud risk numbers; first, the terminals of the existing numbers are initially classified according to the terminal classification matrix, and the low-risk terminals and abnormal terminals are filtered out to obtain terminals that require further scene classification; in this embodiment, initial classification is performed according to the dimension of the number of associated numbers of the terminal classification matrix, and low-risk terminals with the number of associated numbers in the range [0,1] and abnormal data with the number of associated numbers in the range [15,+∞] are filtered out, and the abnormal data are labeled with the abnormal data classification code to obtain target terminal data with the number of associated numbers in the range [2,14].

[0092] In step S302 of some embodiments, categories are combined according to feature dimensions related to the number terminal in the terminal classification matrix, invalid categories are eliminated, and approximate categories are merged to obtain different classification scenarios. The target terminal data obtained after the combination is matched to determine the corresponding classification scenario. In this embodiment, different classification scenarios are combined and encoded to obtain different classification IDs.

[0093] In step S303 of some embodiments, after the obtained target terminal data is classified by scenario, the classified scenarios of each terminal are risk-weighted according to the consistency of the associated numbers to obtain the prediction results of the recent fraud risk terminals. In a specific embodiment, the risk terminal classification of the existing numbers is performed through the terminal classification matrix to obtain the following results:

[0094]

[0095] Based on the recent transaction data of the existing numbers, medium and high-risk terminals are screened out for subsequent identification of fraud risk numbers.

[0096] See also Figure 4 In some embodiments, step S103 may include but is not limited to steps S401 to S403:

[0097] Step S401, determining a fourth data table according to the prediction results and historical data; wherein the fourth data table includes the prediction results and corresponding dates;

[0098] Step S402, performing statistics on the fourth data table according to the first preset parameter to obtain a first quantity set; comparing the first quantity set with a first preset threshold; wherein the first quantity set includes the cumulative number of risk terminals in each roaming location in the fourth data table;

[0099] Step S403: If the first number in the first number set is greater than a first preset threshold, mark the roaming locations corresponding to the first number as risky roaming locations, and determine a roaming location data set according to the risky roaming locations.

[0100] In step S401 of some embodiments, the risk roaming location is further predicted based on the screened medium and high risk terminal data, and the circulation track of the number is determined by the roaming location, thereby improving the accuracy of identification. A fraud risk terminal daily table is constructed based on the prediction results and statistical result table of fraud risk terminals, and the prediction results of fraud risk terminals for the stock numbers in the near future are obtained. Based on the data in the fraud risk terminal daily table accumulated by date, a fraud risk terminal history table is created for screening fraud risk roaming locations.

[0101] In step S402 of some embodiments, risky roaming locations are screened out according to the change trend of fraud risk terminals in the roaming locations in the fraud risk terminal history table; wherein the fraud risk terminal history table is shown in Table 4:

[0102] Table 4

[0103]

[0104] In step S403 of some embodiments, based on the data in the fraud risk terminal history table, the roaming location is used as a group to count the cumulative number of fraud risk terminals in the roaming location within a preset time period, such as the cumulative number of fraud risk terminals within 7 days; if the cumulative number exceeds the set threshold, the current roaming location is used as a fraud risk roaming location.

[0105] See also Figure 5 In some embodiments, step S103 may include but is not limited to steps S501 to S503:

[0106] Step S501, determining a fourth data table according to the prediction results and historical data; wherein the fourth data table includes the prediction results and corresponding dates;

[0107] Step S502, grouping the fourth data table according to the first preset parameter to obtain a first data set; wherein the first data set includes the number of risk terminals in different dates in each roaming location in the fourth data table;

[0108] Step S503: compare the first data set with a second preset threshold value. If the first data in the first data set is greater than the second preset threshold value, mark the roaming location corresponding to the first data as a risky roaming location, and determine the roaming location data set according to the risky roaming location.

[0109] In step S501 of some embodiments, the fraud risk roaming area can also be screened by counting the number of fraud risk terminals in the roaming area on a single day; first, the risk roaming area is further predicted based on the screened medium and high risk terminal data, and the circulation track of the number is judged by the roaming area, thereby improving the accuracy of identification. A fraud risk terminal daily table is constructed based on the prediction results and statistical result table of fraud risk terminals, and the prediction results of fraud risk terminals for the stock numbers in the near future are obtained. Based on the data in the fraud risk terminal daily table accumulated by date, a fraud risk terminal history table is created.

[0110] In step S502 of some embodiments, in the obtained fraud risk terminal history table, the number of fraud risk terminals on the corresponding date in each roaming location is counted and grouped by roaming locations to obtain the number of fraud risk terminals in each roaming location every day. The number of fraud risk terminals in each roaming location every day is compared with a preset threshold value, and the fraud risk roaming locations are screened out based on the comparison results.

[0111] In step S503 of some embodiments, if the number of fraud risk terminals in the current roaming location every day exceeds a preset threshold for one or more days, it can be inferred that a large number of fraud risk terminals appear in the current roaming location on that day or several days, and there is a high possibility of fraudulent behavior, and the current roaming location can be regarded as a fraud risk roaming location.

[0112] See also Figure 6 In some embodiments, step S104 may include but is not limited to steps S601 to S602:

[0113] Step S601, matching the first risk roaming location data set with historical data to obtain a risk number data set; wherein the risk number set represents number information data corresponding to risk terminals in the first risk roaming location;

[0114] Step S602, matching the risk number data set with preset conditions, and determining the risk number set according to the successfully matched risk number data.

[0115] In step S601 of some embodiments, after screening out the roaming areas with fraud risks, the number flow tracks within the roaming areas with fraud risks are analyzed, and the mobile phone numbers with normal flow tracks into the current roaming areas are filtered out to obtain the mobile phone numbers with no tracks roaming into the current roaming areas. It can be inferred that such numbers do not use the access network normally, and directly access the network after entering the current roaming area to generate transaction record data, which means there is a risk of committing fraudulent behavior. Such numbers are marked as risky numbers for further identification.

[0116] In step S602 of some embodiments, the historical transaction record data of the screened risk number within a period of time is compared with the preset conditions. If the historical transaction record data meets the preset conditions, such number is marked as a roaming number with no track roaming fraud risk; in the embodiment of the present application, it is determined whether the current risk number has only recent transaction record data within a period of time; the roaming location of the current risk number is the current fraud risk roaming location, and there are no other regions outside the current fraud risk roaming location; the province to which the current risk number belongs is inconsistent with the roaming province; the network access time of the current risk number is earlier than the earliest time recorded in the historical transaction record data; if the current risk number meets the above conditions, the current risk number is marked as a roaming number with no track roaming fraud risk.

[0117] See also Figure 7 In some embodiments, step S105 may include but is not limited to steps S701 to S702:

[0118] Step S701, matching the account opening information set and the risk number set to determine the household registration information; comparing the household registration information with the roaming location information in the risk number set, and comparing the prediction result of the risk number set with a second preset parameter; wherein the household registration information represents the household registration information corresponding to the risk number in the risk number set;

[0119] Step S702: If the comparison between the registered residence information and the roaming location information fails and the prediction result meets the second preset parameter, the risk number corresponding to the registered residence information is marked as a target fraud risk number.

[0120] In step S701 of some embodiments, the account opening information of the roaming location number with no-track roaming fraud risk is obtained, the household registration information of the owner of the number is obtained from the account opening information, and a correlation analysis is performed based on the classification scenario information of the roaming location number with no-track roaming fraud risk, the household registration information of the owner of the number, and the current roaming location of the number, and the fraud risk number is identified based on the analysis results.

[0121] In step S702 of some embodiments, if the classification scenario of the roaming location number with no track roaming fraud risk belongs to a medium-high risk scenario, and the registered permanent residence information of the owner of the number is inconsistent with the current roaming location of the number, the current number is identified as a target fraud risk number; secondary real-person authentication, shutdown and other measures can be performed in advance on the number identified as the target fraud risk number to avoid fraudulent activities in the number and realize the advancement of the prevention and control point of fraudulent numbers.

[0122] The following is a detailed description and explanation of the solution of the embodiment of the present invention in conjunction with a specific application example:

[0123] Please refer to Figure 8, in actual application scenarios, fraud risk number identification is performed, the original transaction record data of the previous day of the existing number is obtained, the IoT card records of the smart terminal device network connection and the records with irregular or empty roaming area code fields are filtered out, and data statistics are performed through SQL language to obtain analysis samples; the terminal identification, mobile phone number, roaming area and number home area fields in the original transaction record data are used as groups, and data statistics are performed through SQL functions to output the number of initial registration records, re-registration records and cancellation records of each group, and use them as the first to third features of the terminal identification respectively; the first to third features are associated with the field group to obtain a table of group aggregation statistics results; then, the associated numbers of the original transaction record data of the existing number in the previous two days are counted according to the terminal identification field. If the mobile phone number in the terminal identification field is consistent within two days, the consistency of the associated number of the terminal identification field is marked as 1, otherwise it is marked as 0, and the terminal associated number comparison result table is obtained; the terminal identification field is used as a group, The first table of grouped aggregated statistical results and the table of terminal associated number comparison results are connected. The re-registration ratio, initial registration ratio, number of associated numbers, number of non-provincial numbers, number of roaming cities in the province, number of roaming cities in other provinces, and number of places of origin of numbers in the province are counted by SQL functions for each terminal identification field group, and they are used as the fifth to eleventh features of the terminal identification, respectively, to obtain the second table of grouped aggregated statistical results. Then, the dimensions and value ranges of each feature in the second table of grouped aggregated statistical results are divided based on the actual transactions corresponding to the original data of the transaction records of the existing numbers, and a terminal classification matrix is ​​constructed. Specifically, the fifth feature is defined as dimension A, and its threshold range is divided into three subcategories: A1[0.6,1], A2(0.2,0.6), and A3[0,0.2], which reflects the power-on duration of the terminal associated number. The lower the ratio, the shorter the duration. The sixth feature is defined as dimension B, and its threshold range is divided into B1[0.7,1], B2(0.2,0.7), and B3[0,0.2] Three subcategories, reflecting the power on and off frequency of the terminal-associated number, the higher the ratio, the more frequent it is; the eighth to eleventh features are defined as dimension C, and the eighth to eleventh features are combined according to whether the value is zero, and divided into 16 different subcategories such as C1~C16; the fourth feature is defined as dimension D, and when the value of the fourth feature is 0, the classification risk level is increased; the seventh feature is defined as dimension E, and its threshold range is divided into three categories: [0,1], [2,14], and [15,+∞]; the terminal identification and the five dimensions defined are used as the row dimensions of the terminal classification matrix, and the classification scenario is used as the column dimension to obtain the terminal classification matrix; the terminal classification is performed through the terminal classification matrix to obtain the fraud risk terminal prediction result; the roaming location is used as the group, and the obtained fraud risk terminal prediction results are counted through the SQL function to obtain the number of fraud risk terminals in the roaming location; if the cumulative number of fraud risk terminals in the roaming location in the previous seven days exceeds the seven-day total threshold, or the number of fraud risk terminals in the previous three days in the roaming location exceeds the seven-day total threshold, If the number of fraud risk terminals that appear for one or more days exceeds the daily threshold, the roaming location is output as the prediction result of the fraud risk roaming location; then obtain the full transaction record data within the preset time period of the prediction result of the fraud risk roaming location, filter out the abnormal data, and analyze the track of the number roaming into the fraud risk roaming location based on the filtered full transaction record data. If the current number meets the condition that there is only transaction record data one day before the current time, the roaming location of the number is only the predicted fraud risk roaming location, the number's province of origin is inconsistent with the roaming province, and the number's network access time is earlier than the earliest time in the full transaction record data, the current number is output as the predicted number of roaming into the fraud risk roaming location without track; compare the predicted number of roaming into the fraud risk roaming location without track with the registered residence and the fraud risk roaming location, and judge the terminal classification scenario, and identify the number with the result of fraud risk terminal and no track roaming into the fraud risk roaming location and the roaming location inconsistent with the registered residence as a fraud risk number. .

[0124] Implementation of the embodiments of the present invention includes the following beneficial effects: the embodiments provide a method, system, electronic device and storage medium for identifying fraudulent numbers, the scheme obtains analysis data and historical data by preprocessing the first original transaction data and the second original transaction data respectively; performs statistics on the analysis data and constructs a terminal classification matrix; performs scenario analysis on the analysis data according to the terminal classification matrix to obtain prediction results; performs statistics according to the prediction results to obtain a corresponding roaming data set; performs analysis according to the roaming data set and historical data to obtain a risk number set; analyzes and identifies the risk number set according to the account opening information of the risk number set to obtain a target fraud risk number; performs scenario classification by constructing a terminal classification matrix to obtain a prediction result, identifies a risky roaming area according to the prediction result, and then identifies the fraud risk number based on the risky roaming area, analyzes the flow process of the number, identifies the number before it commits fraudulent behavior, realizes forward fraud prevention and control, and improves the real-time nature of identification; models the transaction data generated when the number accesses the network, identifies the number according to the modeling, covers both traffic fraud and non-traffic fraud scenarios, and improves the applicability of the method.

[0125] like Fig. 9 As shown, an embodiment of the present invention further provides a fraudulent number identification system, which can implement the above-mentioned fraudulent number identification method, and the system includes:

[0126] The first module is used to obtain first original transaction data and second original transaction data, pre-process the first original transaction data to obtain analysis data; and pre-process the second original transaction data to obtain historical data;

[0127] The second module is used to group and count the analysis data to obtain a terminal classification matrix; and determine a prediction result according to the terminal classification matrix and the analysis data;

[0128] A third module is used to perform statistical analysis on the prediction results to obtain a roaming location data set; wherein the roaming location data set includes risky roaming location information and terminal information of the risky roaming location;

[0129] A fourth module is used to identify according to the roaming location data set and the historical data, and determine a risk number set; wherein the risk number set includes roaming location numbers with no track roaming fraud risk;

[0130] The fifth module is used to determine the account opening information set corresponding to the risk number set, and compare the account opening information set with the risk number set to obtain the target fraud risk number.

[0131] It can be seen that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0132] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned method for identifying a fraudulent number when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0133] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0134] See also Fig.10 , Fig.10 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0135] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0136] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other applications. When the technical solution provided in the embodiments of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes a fraudulent number identification method in the embodiments of this application;

[0137] Input / output interface 1003, used to implement information input and output;

[0138] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0139] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0140] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0141] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned method for identifying a fraudulent number.

[0142] It is understandable that the contents in the above method embodiments are all applicable to the present storage medium embodiment, and the functions specifically implemented by the present storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments. Among them, the memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. The memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage devices. In some embodiments, the memory may optionally include a remote memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0143] In addition, the embodiment of the present application also discloses a computer program product or a computer program, and the computer program product or the computer program is stored in a computer-readable storage medium. The processor of the computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the above method. Similarly, the contents in the above method embodiment are all applicable to the storage medium embodiment, and the functions specifically implemented by the storage medium embodiment are the same as those in the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method embodiment.

[0144] An embodiment of the present invention further provides a computer-readable storage medium, which stores a program executable by a processor. The program executable by the processor is used to implement the above method when executed by the processor.

[0145] The embodiments of the present application provide a method for identifying fraudulent numbers, a system for identifying fraudulent numbers, an electronic device, and a storage medium. The method pre-processes the first original transaction data and the second original transaction data respectively to obtain analysis data and historical data; performs statistics on the analysis data to construct a terminal classification matrix; performs scenario analysis on the analysis data according to the terminal classification matrix to obtain prediction results; performs statistics according to the prediction results to obtain a corresponding roaming data set; performs analysis according to the roaming data set and historical data to obtain a risk number set; analyzes and identifies the risk number set according to the account opening information of the risk number set to obtain a target fraud risk number; performs scenario classification by constructing a terminal classification matrix to obtain a prediction result, identifies a risky roaming area according to the prediction result, and then identifies the fraud risk number based on the risky roaming area, analyzes the flow process of the number, identifies the number before it commits fraudulent behavior, realizes forward fraud prevention and control, and improves the real-time nature of identification; models the transaction data generated by the number accessing the network, identifies the number according to the modeling, covers both traffic fraud and non-traffic fraud scenarios, and improves the applicability of the method.

[0146] It is understood that all or some steps and systems in the disclosed method above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0147] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for identifying fraudulent numbers, characterized in that: The method comprises: Acquire first original transaction data and second original transaction data, pre-process the first original transaction data to obtain analysis data; pre-process the second original transaction data to obtain historical data; Performing grouping statistics on the analysis data to obtain a terminal classification matrix; and determining a prediction result according to the terminal classification matrix and the analysis data; Performing statistical analysis on the prediction results to obtain a roaming location data set; wherein the roaming location data set includes risky roaming location information and terminal information of the risky roaming location; Identify based on the roaming location data set and the historical data to determine a risk number set; wherein the risk number set includes roaming location numbers with no trace roaming fraud risk; Determine the account opening information set corresponding to the risk number set, and compare the account opening information set with the risk number set to obtain the target fraud risk number.

2. The method according to claim 1, characterized in that: The grouping and counting of the analysis data to obtain a terminal classification matrix specifically includes: The analysis data is counted according to a first preset group to obtain a first data table; wherein the first preset group includes a terminal identifier, a mobile phone number, a roaming location, and a number home location; Performing correlation analysis on the analysis data according to the terminal identifier in the first preset group to obtain a second data table; wherein the second data table includes the consistency between the terminal identifier and the correlation number; Perform statistics according to the terminal identifier, the first data table, and the second data table to obtain a third data table; The third data table is dimensionally divided according to the analysis data to obtain the terminal classification matrix.

3. The method according to claim 1, characterized in that The determining of the prediction result according to the terminal classification matrix and the analysis data specifically includes: Determine a threshold range of a first feature dimension according to the terminal classification matrix, match the analysis data with the threshold range of the first feature dimension, and determine first target data; wherein the first feature dimension represents the number of terminal-associated numbers; Determine a classification scenario set according to the terminal classification matrix, match the first target data with the classification scenario set, and determine a first risk scenario set; wherein the classification scenario set includes a plurality of scenario combinations, and the scenario combinations are obtained according to sub-category combinations of feature dimensions in the terminal classification matrix; The first risk scenario set is risk-weighted according to the second characteristic dimension of the terminal classification matrix to obtain a target risk scenario set; the corresponding risk terminal set is determined according to the target risk scenario set, and the prediction result is obtained according to the risk terminal set; wherein the second characteristic dimension represents the consistency of the associated number.

4. The method according to claim 1, characterized in that: The statistical analysis of the prediction results to obtain the roaming data set specifically includes: Determine a fourth data table according to the prediction result and the historical data; wherein the fourth data table includes the prediction result and the corresponding date; The fourth data table is counted according to the first preset parameter to obtain a first quantity set; the first quantity set is compared with a first preset threshold; wherein the first quantity set includes the cumulative number of risk terminals in each roaming location in the fourth data table; If a first number in the first number set is greater than the first preset threshold, the roaming locations corresponding to the first number are marked as risky roaming locations, and the roaming location data set is determined according to the risky roaming locations.

5. The method according to claim 1, characterized in that The performing statistical analysis on the prediction results to obtain the roaming data set also includes: Determine a fourth data table according to the prediction result and the historical data; wherein the fourth data table includes the prediction result and the corresponding date; The fourth data table is grouped according to the first preset parameter to obtain a first data set; wherein the first data set includes the number of risk terminals in different dates of each roaming location in the fourth data table; The first data set is compared with a second preset threshold value. If the first data in the first data set is greater than the second preset threshold value, the roaming location corresponding to the first data is marked as a risky roaming location, and the roaming location data set is determined according to the risky roaming location.

6. The method according to claim 1, characterized in that The identifying according to the roaming location data set and the historical data to determine the risk number set specifically includes: According to the first risk roaming location data set, the historical data is matched to obtain a risk number data set; wherein the risk number set represents the number information data corresponding to the risk terminal in the first risk roaming location; The risk number data set is matched with a preset condition, and the risk number set is determined according to the successfully matched risk number data.

7. The method according to claim 1, characterized in that The obtaining of a target fraud risk number by comparing the account opening information set with the risk number set specifically includes: According to the account opening information set and the risk number set, the household registration place information is matched to determine; the household registration place information is compared with the roaming place information in the risk number set, and the prediction result of the risk number set is compared with a second preset parameter; wherein the household registration place information represents the household registration place information corresponding to the risk number in the risk number set; If the comparison between the registered residence information and the roaming location information fails, and the prediction result satisfies the second preset parameter, the risk number corresponding to the registered residence information is marked as the target fraud risk number.

8. A fraud number identification system, characterized in that: include: A first module is used to obtain first original transaction data and second original transaction data, and pre-process the first original transaction data to obtain analysis data; Preprocessing the second original transaction data to obtain historical data; The second module is used to group and count the analysis data to obtain a terminal classification matrix; Determine a prediction result according to the terminal classification matrix and the analysis data; A third module is used to perform statistical analysis on the prediction results to obtain a roaming location data set; wherein the roaming location data set includes risky roaming location information and terminal information of the risky roaming location; A fourth module is used to identify according to the roaming location data set and the historical data, and determine a risk number set; wherein the risk number set includes roaming location numbers with no track roaming fraud risk; The fifth module is used to determine the account opening information set corresponding to the risk number set, and compare the account opening information set with the risk number set to obtain the target fraud risk number.

9. An electronic device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that: The processor-executable program is used to perform the method according to any one of claims 1 to 7 when executed by the processor.

Images