Anti-fraud joint defense early warning method and system

Abstract

The present invention discloses an anti-fraud joint defense early warning method and system, which specifically relates to the field of telecommunication network security technology, and comprises the following steps: for a target anti-fraud area, collecting target user behavior data from multiple channels in real time and integrating and preprocessing the data to ensure the real-time, dynamic, effective and accurate nature of the data, and finally forming a target user data set; extracting features related to fraudulent behavior from the data set, constructing a risk model, and inputting these feature values ​​into the model for real-time risk assessment to generate a risk score value; judging whether to trigger an early warning mechanism according to the risk score value, and dynamically optimizing the risk model based on the feedback after the early warning is triggered, so as to improve the accuracy and anti-fraud ability of the system; the risk model of the present invention can more flexibly identify complex fraud methods, and by continuously collecting feedback after the early warning, can dynamically optimize the risk model so that it can cope with new fraud methods and changing user behavior patterns.

Description

Technical Field

[0001] The present invention relates to the field of telecommunication network security technology, and more specifically, to an anti-fraud joint defense early warning method and system. Background Art

[0002] Existing anti-fraud systems usually use fixed detection cycles and rules, which cannot dynamically adapt to the ever-changing fraud methods and risk behaviors, resulting in insufficient accuracy of the early warning system, and false positives and missed positives occur from time to time. Therefore, an anti-fraud joint defense early warning method and system are proposed. Summary of the invention

[0003] To achieve the above object, the present invention provides the following technical solutions:

[0004] An anti-fraud joint defense early warning method comprises the following steps:

[0005] For the target anti-fraud area, the behavioral data of the target users in the area are collected from different channels in real time and integrated and pre-processed to achieve the real-time, dynamic, effective and accurate nature of the data, and finally obtain the target user data set;

[0006] Extract fraud features related to fraudulent behavior from the target user data set, build a risk model based on these fraud features, input the feature values ​​corresponding to all fraud features into the risk model for real-time risk assessment, and obtain a risk score value;

[0007] Based on the risk score value, decide whether to trigger the early warning mechanism, obtain feedback after the early warning mechanism is triggered, and dynamically optimize the risk model based on the feedback.

[0008] In a preferred embodiment, preprocessing includes data cleaning, deduplication, and filling in missing values ​​to ensure the validity and accuracy of the data, and preliminary screening of the data to identify potential suspicious behavior data.

[0009] In a preferred embodiment, preliminary screening refers to:

[0010] Obtain an initial behavior data combination that is aggregated from the behavior data of the target type, then calculate the average and standard deviation of the initial behavior data combination, calculate the difference between each initial behavior data and the average, and then divide the difference by the standard deviation to obtain a deviation ratio value for the initial behavior data, compare the absolute value of the deviation ratio value with a preset deviation threshold, if the absolute value of the deviation ratio value is greater than or equal to the preset deviation threshold, mark the initial behavior data as potential suspicious behavior data, if the absolute value of the deviation ratio value is less than the preset deviation threshold, mark the initial behavior data as normal behavior data, and finally aggregate all potential suspicious behavior data to obtain a behavior data screening combination for the target type.

[0011] In a preferred embodiment, the target user data set is obtained by screening, combining and aggregating the behavior data of all target types.

[0012] In a preferred embodiment, the logic for obtaining the risk score value is:

[0013] From the fraud features related to fraud in the user behavior dataset, a feature vector X={x1,x2,...,xn} is formed, where n represents the total number of features. A linear fit is performed on the feature vector X:

[0014] ; Indicates the feature value corresponding to the fraud feature numbered i, It represents the influence coefficient corresponding to the fraud feature numbered i, represents the bias term, represents the fitted value, and then the risk score value is calculated using the logistic regression function:

[0015] ; It represents the probability of event y=1 occurring after a given feature set X, and P is the risk probability of the user being defrauded, i.e., the risk score value.

[0016] In a preferred embodiment, determining whether to trigger the early warning mechanism based on the risk score value refers to:

[0017] The risk score value P is compared with the preset warning threshold. If the risk score value P is greater than the preset warning threshold, the warning mechanism is triggered. When the warning mechanism is triggered, a warning signal is generated. If the risk score value P is less than or equal to the preset warning threshold, the warning mechanism is not triggered. When the warning mechanism is not triggered, a continue monitoring signal is generated.

[0018] In a preferred embodiment, dynamically optimizing the risk model refers to dynamically optimizing the accuracy and the inspection cycle.

[0019] In a preferred embodiment, the logic for dynamically optimizing accuracy is:

[0020] Get the feedback of all users who triggered the early warning mechanism in the current inspection cycle and divide the feedback into two types: positive feedback and negative feedback. The feedback score interval of negative feedback is [-1,0], and the feedback score interval of positive feedback is (0,1]. Calculate the average of all feedback scores, and then calculate the impact coefficient corresponding to the fraud feature numbered i. To optimize:

[0021] ; Represents the average feedback score of the current risk model in the current test cycle, Indicates the preset warning threshold. Represents the learning rate, which is used to control the magnitude of adjustment. It indicates the old impact coefficient of the fraud feature numbered i in the current risk model during the current inspection cycle. It indicates the new impact coefficient corresponding to the fraud feature numbered i after the current risk model is adjusted and optimized.

[0022] In a preferred embodiment, the logic of dynamically optimizing the inspection cycle is:

[0023] Based on the warning accuracy rate within the current inspection cycle, if the warning accuracy rate is higher than the preset benchmark accuracy rate threshold, the current risk model is considered stable, and the feedback cycle, i.e., the inspection cycle, is extended. If the warning accuracy rate is not higher than the preset benchmark accuracy rate threshold, the current risk model is considered unstable, and the feedback cycle, i.e., the inspection cycle, is shortened. The feedback cycle adjustment formula is:

[0024] ; Indicates the preset benchmark accuracy threshold, Indicates the warning accuracy of the current risk model in the current inspection cycle, Indicates the current inspection cycle. It indicates the next inspection cycle, and k is the preset adjustment coefficient.

[0025] In a preferred embodiment, an anti-fraud joint prevention early warning system includes:

[0026] A regional division module is used to divide the jurisdiction area according to the service coverage of each operator to obtain multiple anti-fraud areas;

[0027] The data sorting module is used to collect the behavior data of target users in the target anti-fraud area from different channels in real time and integrate and pre-process them to achieve the real-time, dynamic, effective and accurate nature of the data, and finally obtain the target user data set;

[0028] The risk model building application module is used to extract fraud features related to fraudulent behavior from the target user data set, build a risk model based on these fraud features, input the feature values ​​corresponding to all fraud features into the risk model for real-time risk assessment, and obtain a risk score value;

[0029] The early warning module is used to decide whether to trigger the early warning mechanism based on the risk score value;

[0030] The optimization module is used to dynamically optimize the risk model based on the feedback after the early warning mechanism is triggered.

[0031] Technical effects and advantages of the present invention:

[0032] The present invention ensures the comprehensiveness and dynamism of data by collecting data from multiple channels in real time. Data of different dimensions can effectively reflect the user's behavior, help the system to more accurately identify potential fraudulent behavior, and improve the accuracy and timeliness of early warning. The present invention constructs an intelligent risk assessment model by extracting features related to fraudulent behavior from the target user's data set. The model can accurately evaluate data from multiple dimensions such as the user's call behavior, capital flow, social behavior, etc., and output a risk score value. Compared with traditional anti-fraud systems that rely on fixed rules, intelligent risk models can more flexibly identify complex fraud methods, effectively reduce false positives and false negatives, and improve the system's risk identification ability.

[0033] The present invention triggers an early warning mechanism based on risk score values. When high-risk behaviors are discovered, early warning signals can be generated in real time and relevant departments can be notified to take action. At the same time, the system will also send risk notifications to users to help them take preventive measures in time to reduce the risk of being deceived. This preset multi-department linkage strategy ensures that the system can respond quickly when fraud occurs, thereby effectively protecting the property safety of users.

[0034] The present invention can dynamically optimize the risk model by continuously collecting feedback from user behaviors and warnings. The system adjusts the weights and parameters of the model based on positive and negative feedback, gradually improving the accuracy and adaptability of the model. This feedback-based self-optimization mechanism can ensure that the system continues to improve over time, enabling it to respond to new fraud methods and changing user behavior patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0036] Figure 1 The figure is a schematic diagram of an anti-fraud joint defense early warning method in the present invention.

[0037] Figure 2 The schematic diagram of an anti-fraud joint defense early warning system in the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] Reference Figure 1 - Figure 2 The following embodiments are obtained:

[0040] Embodiment 1: An anti-fraud joint defense early warning method comprises the following steps:

[0041] For the target anti-fraud area, the behavioral data of the target users in the area are collected from different channels in real time and integrated and pre-processed to achieve the real-time, dynamic, effective and accurate nature of the data, and finally obtain the target user data set;

[0042] Collection channels: Telecom operator data: collect users' phone call records, text message content, and communication frequency with unknown numbers. This data helps identify abnormal calling behaviors, such as frequently answering unfamiliar calls or sending a large number of text messages.

[0043] Financial institution data: Obtain user fund transfer records, account activity history, and anomalies in large or frequent fund flows. This type of data can reveal unusual fund movements associated with fraud and help analyze whether a user is involved in potential fraud.

[0044] Social media and network data: Collect user interaction behaviors, IP addresses, device information, etc. on social platforms to analyze whether any users are involved in abnormal activities or frequently log in to unfamiliar devices.

[0045] Data from relevant departments: including areas with high incidence of historical fraud cases and database of fraud methods. These data provide key historical fraud references for the model.

[0046] Data integration and preprocessing: Deduplication and data cleaning: Delete redundant or invalid data and remove abnormal noise to ensure data accuracy. Missing value processing: Fill or remove missing data to ensure the integrity of the data set. Format unification: Standardize heterogeneous data from different channels into a unified format to achieve data integration and subsequent processing. Data collected through different channels can reflect user behavior in multiple dimensions, ensuring that the input data of the early warning model is rich and comprehensive. Real-time integration and preprocessing ensure the dynamic, real-time and accuracy of data, and ensure the timeliness of the model's evaluation results.

[0047] Fraud features related to fraudulent behavior are extracted from the target user data set. Based on these fraud features, a risk model is constructed. The feature values ​​corresponding to all fraud features are input into the risk model for real-time risk assessment to obtain a risk score value.

[0048] Extract features related to fraudulent behavior from the target user data set, including: Call behavior features: such as the frequency of calls with multiple unfamiliar numbers in a short period of time, abnormal call behavior in the late night hours, etc. Fund flow features: such as abnormal fund movements such as large fund transfers, frequent small transfers, and cross-regional transactions. Social behavior features: such as frequent interactions with strangers on multiple social platforms, frequent device changes, or logging in to different IP addresses. Historical fraud pattern features: Use common fraud methods in historical cases (such as false winnings, impersonating public security, procuratorial and judicial organs, etc.) to identify whether the user's behavior pattern meets these features. Feature extraction can effectively filter and simplify raw data, find key behavioral features related to fraud, and help risk models more accurately identify fraudulent activities.

[0049] Feature value input: The extracted fraud features (such as call frequency, capital flow, equipment use, etc.) are input as feature values ​​into the risk model for evaluation. Model construction: Common risk model types include: Logistic regression model: By calculating the weights of each feature, the linear combination results are converted into probability values ​​through the logistic regression function. This model is suitable for evaluating risk probability based on fraud features. By building a risk model, it is possible to effectively evaluate the fraud risk level of the target user from multi-dimensional feature data and generate an accurate risk score value.

[0050] Feedback collection: When the early warning mechanism is triggered, the system will collect feedback from users or relevant departments. Feedback information may include the accuracy of the early warning, such as whether fraud has actually occurred. Model optimization: Dynamically adjust the weights and thresholds of the risk model based on feedback information. For positive feedback, the system will increase the weight of related features; for negative feedback, the model will reduce the weight of specific features or re-evaluate the relevance of features. If the feedback score is positive, the weight increases and the model is more inclined to retain the feature; if the feedback score is negative, the weight decreases and the model reduces its reliance on the feature.

[0051] The system determines whether to trigger the early warning mechanism based on the risk score value, obtains feedback after the early warning mechanism is triggered, and dynamically optimizes the risk model based on the feedback. When the system triggers the early warning mechanism, it issues a warning to the user or relevant department. The early warning information may include the user's high-risk behavior, possible fraud types, and protective measures that need to be taken. By setting reasonable thresholds, the system can issue a warning in a timely manner when the risk score exceeds the preset standard, protecting users from potential fraud risks.

[0052] Preprocessing includes data cleaning, deduplication, and filling in missing values ​​to ensure the validity and accuracy of the data, and to conduct preliminary screening of the data to identify potential suspicious behavior data.

[0053] Preliminary screening refers to: obtaining the initial behavior data combination aggregated from the behavior data of the target type, then calculating the average and standard deviation of the initial behavior data combination, calculating the difference between each initial behavior data and the average, and then dividing the difference by the standard deviation to obtain the deviation ratio value of the initial behavior data, comparing the absolute value of the deviation ratio value with the preset deviation threshold, if the absolute value of the deviation ratio value is greater than or equal to the preset deviation threshold, then marking the initial behavior data as potential suspicious behavior data, if the absolute value of the deviation ratio value is less than the preset deviation threshold, then marking the initial behavior data as normal behavior data, and finally aggregating all the potential suspicious behavior data to obtain the behavior data screening combination of the target type. The target user data set is obtained by aggregating all the behavior data screening combinations of the target type.

[0054] The system obtains all behavioral data related to a specific type from the target user's data set, and combines this data into an initial behavioral data set. For example, for telecommunications fraud risk assessment, behavioral data may include call frequency, text message content, transfer behavior, etc. Ensure that users can process and analyze data on the target behavior type, integrate behavioral data of different dimensions into a combination that can be analyzed, and lay the foundation for subsequent analysis. Calculate the average value μ of the initial behavioral data combination to represent the central trend of the behavioral data of the target behavior type; calculate the standard deviation σ to represent the degree of dispersion of these data, reflecting the volatility of the behavioral data relative to the average value. By calculating the average value and standard deviation, we can understand the normal range of the target type behavior and the fluctuation of normal behavior. These statistical indicators will become the benchmark for subsequent identification of suspicious behavior data.

[0055] By calculating the degree of deviation of each data point from the average, the deviation ratio value can reflect the degree of difference between a specific behavior data and the entire data set. By standardizing the behavior data (i.e. converting its difference into a deviation ratio value), it is possible to more intuitively identify which data deviates from the normal behavior data range, thereby marking it as potentially suspicious behavior.

[0056] All initial behavior data that meet the "absolute value of the deviation ratio value ≥ the preset deviation threshold" are aggregated to form a "potential suspicious behavior data set". The final output of this screening process is a data set that has been initially screened, which contains all behaviors that may be abnormal. In this way, the system can focus on processing these problematic data, reduce the amount of calculation and complexity of subsequent analysis, and improve the efficiency of fraud risk assessment. All target types of behavior data are screened and aggregated into a screened data set, and finally a complete target user data set containing suspicious behaviors of different dimensions (such as telecommunications, finance, social behavior, etc.) is formed, which can effectively narrow the scope of data analysis and focus on those behaviors that are most likely to be related to fraud. This screened data set provides accurate and targeted data input for subsequent risk assessment models, thereby improving the efficiency and accuracy of the entire anti-fraud early warning system.

[0057] The logic for obtaining the risk score value is:

[0058] From the fraud features related to fraud in the user behavior data set, a feature vector X={x1,x2,...,xn} is formed, where n represents the total number of features and each xi represents a feature value related to fraud, such as the user's call frequency, fund flow frequency, social media activity, etc. This approach is based on multi-dimensional features for fraud risk analysis, which can comprehensively capture all types of user behavior data. By constructing a multi-dimensional feature vector, various aspects of user behavior can be described more accurately, increasing the system's sensitivity to potential risk behaviors, and enabling the system to conduct fraud risk assessment based on multiple dimensions rather than relying on a single data source.

[0059] Perform a linear fit on the eigenvector X:

[0060] ; Indicates the feature value corresponding to the fraud feature numbered i, It represents the influence coefficient corresponding to the fraud feature numbered i, represents the bias term, Represents the fitted value, and the linear combination method allows the contribution value of each feature to be expressed through its influence coefficient This allows the model to determine the impact of each feature on risk assessment based on its importance. Features with larger weights contribute more to the results, reflecting their importance in the prediction.

[0061] Calculate the risk score value using the logistic regression function: ; It represents the probability of event y=1 occurring after a given feature set X, and P is the risk probability of the user being defrauded, i.e., the risk score. The formula uses the hyperbolic tangent function to nonlinearly map the result of the linear combination, so that the output result is between −1 and 1. Through subsequent transformations, the result is finally mapped to the interval of 0 to 1, which represents the probability of the user being defrauded. Through this nonlinear mapping, the result of the linear combination can be converted into a probability value, which makes the output result of the model more in line with the needs of actual application scenarios. The introduction of the hyperbolic tangent function can also solve the problem that the linear model cannot capture the nonlinear relationship between complex features, making the model more flexible and adaptable. Defining the output result as a probability makes the system easier to understand and use. The risk assessment score is intuitive, which can help decision makers determine whether it is necessary to issue a fraud warning to the user. It also helps to quantify the risk level of different users for further risk management.

[0062] By extracting fraud-related features from multiple dimensions and combining them together, it is possible to comprehensively capture all kinds of data on user behavior. This multi-dimensional data integration enables the model to detect various types of fraudulent behaviors, not just a single type of fraud. A logistic regression model is used for linear weighted sum, and the results are converted into probability values ​​through nonlinear functions. The advantage of this approach is that the model can capture both simple relationships between features through linear combinations and nonlinear relationships between complex behaviors through nonlinear functions, thereby improving the flexibility and predictive power of the model. Since the risk score is calculated based on the user's real-time behavioral data, the model can dynamically update the risk assessment results based on the newly collected data. This dynamic adjustment capability enables the system to track user behavior changes in real time, improving the early warning capability for real-time fraudulent behavior.

[0063] Another important advantage of the logistic regression model is its interpretability. The weight of each feature, i.e., the influence coefficient βi, represents the importance of the feature in risk assessment. Through these weights, we can clearly understand which behavioral features are more likely to be associated with fraudulent behavior, making the output of the model more transparent and facilitating the improvement and optimization of the system. Through this method, the system can timely identify potential fraud risks based on the user's behavior patterns and issue accurate warnings. The risk score value of the logistic regression model can help the system set reasonable thresholds, decide when to issue warnings and what measures to take, which helps reduce false positives and false negatives. Most importantly, subsequent optimization can be carried out more reasonably.

[0064] Deciding whether to trigger the early warning mechanism based on the risk score value means: comparing the risk score value P with the preset early warning threshold. If the risk score value P is greater than the preset early warning threshold, the early warning mechanism is triggered. When the early warning mechanism is triggered, an early warning signal is generated, and the user's behavior is abnormal, indicating a high risk of fraud. If the risk score value P is less than or equal to the preset early warning threshold, the early warning mechanism is not triggered. When the early warning mechanism is not triggered, a continue monitoring signal is generated, and the user's behavior is still within a safe range. The system generates a continue monitoring signal and regularly checks for behavioral changes.

[0065] After the early warning mechanism is triggered, the system will automatically link up with multiple anti-fraud related departments according to the preset strategy to start joint protection. The specific linked departments and their responsibilities are as follows:

[0066] Telecom operators: Block suspicious communications: Once an alert is triggered, telecom operators can take immediate action to block calls to high-risk numbers and prevent further fraud.

[0067] Financial institutions: Freeze suspicious accounts: When a user's fund transfer behavior is determined by the system to be high-risk, the bank can temporarily freeze the account to prevent the flow of large amounts of funds, and send a reminder to the account holder to confirm the legality of the account activity. Tracking the flow of funds: Banks can immediately track the whereabouts of suspicious funds to prevent funds from being quickly transferred to fraud gangs and protect the safety of users' funds.

[0068] User reminders and education: User notifications: The system can send users instant risk notifications to inform them that their accounts or behaviors may have potential fraud risks. The notification content includes specific suspicious behaviors, risk scores, and recommended protective measures (such as suspending transfers, changing passwords, etc.). Anti-fraud education: Through SMS, APP push, etc., users are informed of the latest fraud methods, provided with anti-fraud guides, enhanced their awareness of prevention, and helped them to identify fraudulent information in a timely manner.

[0069] Dynamic optimization of the risk model refers to dynamic optimization of accuracy and dynamic optimization of the inspection cycle. The logic of dynamic optimization of accuracy is: obtain the feedback of all users who trigger the early warning mechanism in the current inspection cycle and divide the feedback of the target fraud feature into two types: positive feedback and negative feedback. The feedback score interval of negative feedback is [-1,0], and the feedback score interval of positive feedback is (0,1]. Calculate the average of all feedback scores, and then calculate the impact coefficient corresponding to the fraud feature numbered i. To optimize:

[0070] ; It represents the average feedback score of the fraud feature numbered i in the current risk model during the current test cycle. Indicates the preset warning threshold. Represents the learning rate, which is used to control the magnitude of adjustment. It indicates the old impact coefficient of the fraud feature numbered i in the current risk model during the current inspection cycle. It indicates the new impact coefficient corresponding to the fraud feature numbered i after the current risk model is adjusted and optimized.

[0071] Dynamic optimization here refers to continuous learning and adjustment of the real-time feedback of the model so that the model can adapt to the ever-changing fraudulent behaviors and user behavior patterns. Accurate targeted optimization: For each user's specific fraudulent behavior characteristics, adjust its weight based on the performance of the feature in the model to make the model more accurate. The core idea of ​​this dynamic optimization is to continuously revise the model through actual feedback data to improve the accuracy of future risk assessments. In particular, for those features that often have false warnings or false alarms, by adjusting the weights of these features, the probability of future false warnings can be reduced.

[0072] Positive feedback: indicates that the system's early warning is accurate, that is, the user's behavior is indeed related to fraudulent behavior. At this time, the user hopes to increase the weights associated with these behavioral features to enhance the model's ability to identify similar fraudulent behaviors. The positive feedback score range is (0,1], indicating that these behavioral features are helpful for risk assessment. Negative feedback: indicates that the system has falsely reported the risk, that is, the user's behavior did not actually commit fraud. At this time, the user needs to reduce the weights associated with these behavioral features to reduce the model's sensitivity to such features. The negative feedback score range is [−1,0), which means that these behavioral features do not play a decisive role in the actual risk. This classification ensures that the model increases the weight of valid features (positive feedback) and weakens the weight of invalid or falsely reported features (negative feedback). This targeted optimization can improve the overall performance of the model.

[0073] This dynamic optimization mechanism can adjust the model based on feedback, allowing the model to adapt to changing user behaviors and fraud patterns. By separating positive and negative feedback, the system can adjust the weights based on the performance of different features, rather than adjusting all features globally. By calculating the average of the feedback scores, extreme situations or errors caused by a single feedback are avoided. The model will not drastically adjust the weights because of a single false warning, but will perform progressive optimization through continuous accumulated feedback. This improves the robustness and long-term performance of the model. For features of false warnings and false positives, the model can reduce its reliance on these features in subsequent evaluations, thereby reducing false positives. For positive feedback, the system will strengthen the role of the feature in the model, so that the model can more accurately identify similar fraudulent behaviors in the future.

[0074] This feedback-based optimization mechanism enables the model to continuously evolve. Over time, the model can learn from feedback and gradually improve its ability to identify complex behavior patterns. This optimization mechanism improves the efficiency and accuracy of the overall anti-fraud early warning system through continuous iteration.

[0075] The logic of dynamic optimization of the inspection cycle is:

[0076] Based on the warning accuracy rate within the current inspection cycle, if the warning accuracy rate is higher than the preset benchmark accuracy rate threshold, the current risk model is considered stable, and the feedback cycle, i.e., the inspection cycle, is extended. If the warning accuracy rate is not higher than the preset benchmark accuracy rate threshold, the current risk model is considered unstable, and the feedback cycle, i.e., the inspection cycle, is shortened. The feedback cycle adjustment formula is:

[0077] ; Indicates the preset benchmark accuracy threshold, Indicates the warning accuracy of the current risk model in the current inspection cycle, Indicates the current inspection cycle. It indicates the next inspection cycle, and k is the preset adjustment coefficient.

[0078] Warning accuracy: refers to the warning hit rate of the system in a certain detection cycle, that is, whether the warning issued by the system accurately reflects the actual fraudulent behavior. By evaluating the warning accuracy in the current detection cycle, the system can determine whether the model performs well in this cycle.

[0079] Benchmark accuracy threshold YZ: This is a preset accuracy target value, which serves as the benchmark for the system to determine whether the model is stable. If the warning accuracy ZQ of the current cycle exceeds this benchmark value, it means that the model performs well and the system can reduce the frequency of model adjustments; otherwise, it means that the model is unstable and needs more frequent adjustments.

[0080] Using the warning accuracy rate as an evaluation indicator directly reflects the performance of the system in actual scenarios. If the system's warnings are frequently false alarms or missed alarms, and the accuracy rate is low, it means that the model needs to be optimized; if the accuracy rate is high, it means that the model is running well and the adjustment cycle can be appropriately extended.

[0081] The detection cycle is adjusted according to the deviation of the warning accuracy, so that the model can be dynamically adjusted according to its own performance. By extending or shortening the detection cycle, the efficiency of model adjustment can be improved and computing resources can be saved.

[0082] In the anti-fraud system, user behavior and fraud methods are constantly changing, so the model needs to be continuously evaluated and optimized. By dynamically adjusting the detection cycle according to the actual warning accuracy, the system can respond to these changes more flexibly. Models with good performance can reduce unnecessary adjustments, and models with poor performance can be adjusted quickly to ensure that they are always running in the best state.

[0083] If the model performs stably and the warning accuracy is high, frequent adjustments are unnecessary and will waste computing resources. By extending the detection cycle, the system can reduce the frequency of model updates and save computing resources. When the model performs poorly, shortening the detection cycle can ensure rapid response and prevent risk accumulation. By dynamically adjusting the detection cycle based on the warning accuracy, the system can ensure that unnecessary adjustments are reduced when the model performs well, and quickly correct the model when it performs poorly. This mechanism can significantly improve the system's warning accuracy and stability. When the system performs stably, extending the detection cycle can save a lot of computing resources and reduce the overhead caused by frequent model optimization. This savings is especially important for anti-fraud systems deployed on a large scale, helping to improve the overall efficiency and scalability of the system.

[0084] Embodiment 2: An anti-fraud joint prevention early warning system, comprising:

[0085] The regional division module is used to divide the jurisdiction area according to the network service provider. For telecom operators or Internet service providers, their service areas may also be used as the basis for division. For example, the area covered by a specific operator can be divided into an anti-fraud area separately, so that related operators can quickly link up and deal with suspicious telecom fraud.

[0086] The data sorting module is used to collect the behavior data of target users in the target anti-fraud area from different channels in real time and integrate and pre-process them to achieve the real-time, dynamic, effective and accurate nature of the data, and finally obtain the target user data set;

[0087] The risk model building application module is used to extract fraud features related to fraudulent behavior from the target user data set, build a risk model based on these fraud features, input the feature values ​​corresponding to all fraud features into the risk model for real-time risk assessment, and obtain a risk score value;

[0088] The early warning module is used to decide whether to trigger the early warning mechanism based on the risk score value;

[0089] The optimization module is used to dynamically optimize the risk model based on the feedback after the early warning mechanism is triggered.

[0090] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0091] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0092] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0093] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0094] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An anti-fraud joint defense early warning method, characterized in that: The following steps are involved: For the target anti-fraud area, the behavioral data of the target users in the area are collected from different channels in real time and integrated and pre-processed to achieve the real-time, dynamic, effective and accurate nature of the data, and finally obtain the target user data set; Extract fraud features related to fraudulent behavior from the target user data set, build a risk model based on these fraud features, input the feature values ​​corresponding to all fraud features into the risk model for real-time risk assessment, and obtain a risk score value; Based on the risk score value, decide whether to trigger the early warning mechanism, obtain feedback after the early warning mechanism is triggered, and dynamically optimize the risk model based on the feedback; the logic for obtaining the risk score value is: From the fraud features related to fraud in the user behavior dataset, a feature vector X={x1,x2,...,xn} is formed, where n represents the total number of features. A linear fit is performed on the feature vector X: ; Indicates the feature value corresponding to the fraud feature numbered i, It represents the influence coefficient corresponding to the fraud feature numbered i, represents the bias term, represents the fitted value, and then the risk score value is calculated using the logistic regression function: ; It represents the probability of event y=1 occurring after a given feature set X, and P is the risk probability of the user being defrauded, i.e., the risk score value. The logic of dynamically optimizing accuracy is: Get the feedback of all users who triggered the early warning mechanism in the current inspection cycle and divide the feedback of the target fraud feature into two types: positive feedback and negative feedback. The feedback score interval of negative feedback is [-1,0], and the feedback score interval of positive feedback is (0,1]. Calculate the average of all feedback scores, and then calculate the impact coefficient corresponding to the fraud feature numbered i. To optimize: ; It represents the average feedback score of the fraud feature numbered i in the current risk model during the current test cycle. Indicates the preset warning threshold. Represents the learning rate, which is used to control the magnitude of adjustment. It indicates the old impact coefficient of the fraud feature numbered i in the current risk model during the current inspection cycle. It indicates the new impact coefficient corresponding to the fraud feature numbered i after the current risk model is adjusted and optimized; The logic of dynamic optimization of the inspection cycle is: Based on the warning accuracy rate within the current inspection cycle, if the warning accuracy rate is higher than the preset benchmark accuracy rate threshold, the current risk model is considered stable, and the feedback cycle, i.e., the inspection cycle, is extended. If the warning accuracy rate is not higher than the preset benchmark accuracy rate threshold, the current risk model is considered unstable, and the feedback cycle, i.e., the inspection cycle, is shortened. The feedback cycle adjustment formula is: ; Indicates the preset benchmark accuracy threshold, Indicates the warning accuracy of the current risk model in the current inspection cycle, Indicates the current inspection cycle. It indicates the next inspection cycle, and k is the preset adjustment coefficient.

2. The anti-fraud joint defense early warning method according to claim 1 is characterized in that: Preprocessing includes data cleaning, deduplication, and filling in missing values ​​to ensure the validity and accuracy of the data, and to conduct preliminary screening of the data to identify potential suspicious behavior data.

3. The anti-fraud joint defense early warning method according to claim 2 is characterized in that: Initial screening refers to: Obtain an initial behavior data combination that is aggregated from the behavior data of the target type, then calculate the average and standard deviation of the initial behavior data combination, calculate the difference between each initial behavior data and the average, and then divide the difference by the standard deviation to obtain a deviation ratio value for the initial behavior data, compare the absolute value of the deviation ratio value with a preset deviation threshold, if the absolute value of the deviation ratio value is greater than or equal to the preset deviation threshold, mark the initial behavior data as potential suspicious behavior data, if the absolute value of the deviation ratio value is less than the preset deviation threshold, mark the initial behavior data as normal behavior data, and finally aggregate all potential suspicious behavior data to obtain a behavior data screening combination for the target type.

4. The anti-fraud joint defense early warning method according to claim 3 is characterized in that: The target user data set is obtained by filtering, combining and aggregating the behavioral data of all target types.

5. The anti-fraud joint defense early warning method according to claim 4 is characterized in that: Determining whether to trigger an early warning mechanism based on risk score values ​​refers to: The risk score value P is compared with the preset warning threshold. If the risk score value P is greater than the preset warning threshold, the warning mechanism is triggered. When the warning mechanism is triggered, a warning signal is generated. If the risk score value P is less than or equal to the preset warning threshold, the warning mechanism is not triggered. When the warning mechanism is not triggered, a continue monitoring signal is generated.

6. The anti-fraud joint defense early warning method according to claim 5 is characterized in that: Dynamic optimization of risk models refers to dynamic optimization of accuracy and dynamic optimization of verification cycles.

7. An anti-fraud joint defense early warning system, implemented based on an anti-fraud joint defense early warning method according to any one of claims 1 to 6, characterized in that: include: A regional division module is used to divide the jurisdiction area according to the service coverage of each operator to obtain multiple anti-fraud areas; The data sorting module is used to collect the behavior data of target users in the target anti-fraud area from different channels in real time and integrate and pre-process them to achieve the real-time, dynamic, effective and accurate nature of the data, and finally obtain the target user data set; The risk model building application module is used to extract fraud features related to fraudulent behavior from the target user data set, build a risk model based on these fraud features, input the feature values ​​corresponding to all fraud features into the risk model for real-time risk assessment, and obtain a risk score value; The early warning module is used to decide whether to trigger the early warning mechanism based on the risk score value; The optimization module is used to dynamically optimize the risk model based on the feedback after the early warning mechanism is triggered.

Images