Decision tree construction method and device, equipment, medium and program product
By using historical usage information and cross information in the decision tree construction method, the decision tree is generated and adjusted, and the problem of low accuracy in identifying communication identification types in the existing technology is solved, and higher classification accuracy and decision tree are achieved. Balance.
Patent Information
- Application Number
- CN202411557216.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-01
- Publication Date
- 2025-02-18
- Estimated Expiration
- 2044-11-01
AI Technical Summary
The prior art has the problem of low accuracy in identifying the type of communication identifiers, which is mainly due to the reliance on simple data characteristics and analysis rules, and the complex relationship between communication behavior cannot be effectively captured.
By obtaining the historical usage information generated by the target communication identifier when used by different service types from the database, the proportional relationship between these information is calculated to obtain historical cross information, and the decision tree is generated and adjusted based on this information to ensure that the loss value of the decision tree is low at a preset threshold and positively correlated with the number of nodes and weights.
The classification accuracy of the decision tree is improved, overfitting and underfitting problems are avoided, and the type of communication identification can be more accurately identified.
Smart Images

Figure CN119484058A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of communication technology, and in particular, relates to a decision tree construction method, device, equipment, medium and program product. Background Art
[0002] In the current communication environment, fraud is becoming increasingly rampant, causing serious property losses to the majority of users.
[0003] Existing anti-fraud technologies usually only focus on basic communication behaviors, such as call duration, number of text messages, etc., and generate blacklists or whitelists based on communication behaviors, and then rely on blacklists or whitelists to analyze communication identification types. Because existing technologies only rely on simple data features and analysis rules, they have certain limitations, resulting in low classification accuracy.
[0004] Therefore, the prior art has the problem of low accuracy when identifying the type of communication identification. Summary of the invention
[0005] The embodiments of the present application provide a decision tree construction method, apparatus, device, medium and program product, which can solve the problem of low accuracy in related technologies when identifying the type of communication identifier.
[0006] In a first aspect, an embodiment of the present application provides a method for constructing a decision tree, the decision tree being used to determine a communication identification type, the method comprising:
[0007] Acquire, in a database, first historical usage information generated when the target communication identifier uses different service types within a first preset time period;
[0008] Calculating the proportional relationship between the first historical usage information to obtain the first historical cross information;
[0009] Generate information of an initial decision tree based on the first historical usage information and the first historical cross information, wherein the information of the initial decision tree includes initial nodes and their corresponding initial numbers and initial weights;
[0010] Adjust the initial quantity and the initial weight to obtain information of the first decision tree, wherein the information of the first decision tree includes the first node and its corresponding first quantity and first weight, and the first loss value corresponding to the first decision tree is less than the preset loss threshold, and the first loss value is positively correlated with the first quantity and the first weight, respectively.
[0011] In a possible embodiment of the first aspect, acquiring, in a database, first historical usage information generated when a target communication identifier uses different service types includes:
[0012] In the database, first historical call information generated when the target communication identifier uses the call service, first historical text message information generated when the target communication identifier uses the text message service, and first historical traffic information generated when the target communication identifier uses the traffic service are obtained;
[0013] The proportional relationship between the first historical usage information is calculated to obtain the first historical cross information, including:
[0014] The first historical cross information is determined according to a proportional relationship among the first historical call information, the first historical text message information, and the first historical traffic information.
[0015] In a possible embodiment of the first aspect, the first historical call information includes the number of first calls; the first historical text message information includes the number of first text messages; the first historical traffic information includes the number of application usage; the first historical cross information includes first sub-historical cross information, second sub-historical cross information and third sub-historical cross information; and determining the first historical cross information according to a proportional relationship among the first historical call information, the first historical text message information and the first historical traffic information includes:
[0016] Divide the first number of calls by the first number of text messages to obtain first sub-history cross information;
[0017] Divide the first call count by the application usage count to obtain second sub-history cross information;
[0018] The number of first short messages is divided by the number of application usages to obtain third sub-history cross information.
[0019] In a possible embodiment of the first aspect, the first historical call information further includes at least one of the following: number of active call days, call frequency, call duration, call device identifier, number of call locations, number of call contact users, proportion of call times, proportion of calling users, proportion of call duration intervals, and regularity information of call time points;
[0020] The first historical SMS information also includes at least one of the following: SMS active days, SMS frequency, number of users contacted by SMS, average number of users contacted by SMS per day, SMS type, and SMS time point regularity information;
[0021] The first historical traffic information also includes at least one of the traffic active days and the total traffic.
[0022] In a possible embodiment of the first aspect, generating information of an initial decision tree based on the first historical usage information and the first historical cross information includes:
[0023] Adding the number of the first historical usage information and the first historical cross information to obtain the initial number of initial nodes in the initial decision tree, wherein the initial nodes correspond one to one with the first historical usage information and the first historical cross information;
[0024] From the correspondence between preset historical usage information, historical cross information and preset weights, the target preset weights corresponding to the first historical usage information and the first historical cross information are obtained, and the target preset weights are used as the initial weights of the corresponding initial nodes.
[0025] In a possible embodiment of the first aspect, the first loss value is positively correlated with the first quantity and the first weight, respectively, including:
[0026]
[0027] Wherein, LOSS is the first loss value, a and b are preset constants, N is the first number of the first node, W i is the first weight of the first node.
[0028] In a possible embodiment of the first aspect, the present invention further includes:
[0029] In the database, second historical usage information generated when the target communication identifier uses different service types within a second preset time period and the historical real type to which the target communication identifier belongs are obtained;
[0030] Calculating the proportional relationship between the second historical usage information to obtain the second historical cross information;
[0031] Inputting the second historical usage information and the second historical cross information into the corresponding first nodes in the first decision tree respectively to obtain a plurality of historical sub-results;
[0032] Multiply the historical sub-results by the corresponding first weights and add them together to obtain the historical results;
[0033] Compare the historical results with the historical true types to obtain the error value;
[0034] When the error value is greater than a preset error threshold, the first quantity and the first weight are adjusted to obtain information of the second decision tree, wherein the information of the second decision tree includes the second node and its corresponding second quantity and second weight, and the second loss value corresponding to the second decision tree is less than the preset loss threshold, and the second loss value is positively correlated with the second quantity and the second weight, respectively.
[0035] In a possible embodiment of the first aspect, the present invention further includes:
[0036] Acquiring, in a database, third historical usage information generated when the target communication identifier uses different service types within a third preset time period;
[0037] Calculate the proportional relationship between the third historical usage information to obtain the third historical cross information;
[0038] Inputting the third historical usage information and the third historical cross information into corresponding second nodes in the second decision tree respectively to obtain a plurality of sub-results;
[0039] The target result is obtained by multiplying the multiple sub-results by the corresponding second weights respectively and then adding them together.
[0040] Based on the same inventive concept, in a second aspect, an embodiment of the present application further provides a device for constructing a decision tree, the decision tree being used to determine a communication identification type, the device comprising:
[0041] An acquisition module, configured to acquire, from a database, first historical usage information generated when a target communication identifier uses different service types within a first preset time period;
[0042] A calculation module, used for calculating the proportional relationship between the first historical usage information to obtain the first historical cross information;
[0043] A generating module, configured to generate information of an initial decision tree based on the first historical usage information and the first historical cross information, wherein the information of the initial decision tree includes an initial number of initial nodes and an initial weight of each initial node;
[0044] An adjustment module is used to adjust the initial quantity and the initial weight to obtain information of the first decision tree, wherein the information of the first decision tree includes a first node and its corresponding first quantity and first weight, and the first loss value corresponding to the first decision tree is less than a preset loss threshold, and the first loss value is positively correlated with the first quantity and the first weight, respectively.
[0045] Based on the same inventive concept, in the third aspect, an embodiment of the present application also provides a decision tree construction device, which includes a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the first aspect, or the decision tree construction method in any embodiment of the first aspect.
[0046] Based on the same inventive concept, in the fourth aspect, an embodiment of the present application further provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method for constructing a decision tree in the first aspect or any embodiment of the first aspect is implemented.
[0047] Based on the same inventive concept, in the fifth aspect, an embodiment of the present application also provides a computer program product. When the instructions in the computer program product are executed by the processor of the device, the device can execute the decision tree construction method in the first aspect or any embodiment of the first aspect.
[0048] The decision tree construction method, device, equipment, medium and program product of the embodiment of the present application obtains detailed first historical usage information generated when the target communication identifier uses various services within a first preset period of time from a database, and then can finely calculate the proportional relationship between these information to obtain the first historical cross information, wherein the first historical cross information reflects the intrinsic connection between different communication behaviors, helps to more accurately describe the user's communication behavior characteristics, and provides a rich data foundation for the construction of the decision tree. Then, based on the first historical usage information and the first historical cross information, the information of the initial decision tree can be generated, such as the information of the initial nodes in the initial decision tree, the initial number of initial nodes, and the initial weight of the initial nodes. Next, by carefully adjusting the initial number and initial weight of the initial nodes, the decision tree structure is continuously optimized until the loss value corresponding to the decision tree is lower than the preset loss threshold, that is, the first loss value corresponding to the generated first decision tree is lower than the preset loss threshold, and since the first loss value is positively correlated with the first number of first nodes in the first decision tree and the first weight of the first node, respectively, it is possible to avoid overfitting problems caused by excessive complexity (too many nodes) and underfitting problems caused by oversimplification (too few nodes and too concentrated weights), thereby finding the best balance point, improving the classification accuracy of the decision tree, and accurately identifying the type of communication identification. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] Other features, objects and advantages of the present application will become more apparent by reading the following detailed description of non-limiting embodiments with reference to the accompanying drawings, in which the same or similar reference numerals represent the same or similar features and the accompanying drawings are not drawn to scale.
[0050] Figure 1 It is a flow chart of a method for constructing a decision tree provided in an embodiment of the present application;
[0051] Figure 2 It is another flow chart of the method for constructing a decision tree provided in the embodiment of the present application;
[0052] Figure 3 It is another flowchart of the method for constructing a decision tree provided in an embodiment of the present application;
[0053] Figure 4 It is another flow chart of the method for constructing a decision tree provided in the embodiment of the present application;
[0054] Figure 5 It is a flow chart of optimizing the first decision tree in the decision tree construction method provided in the embodiment of the present application;
[0055] Figure 6 It is a flow chart of using a second decision tree to determine a communication identification type in a decision tree construction method provided in an embodiment of the present application;
[0056] Figure 7 It is a structural schematic diagram of a decision tree construction device provided in an embodiment of the present application;
[0057] Figure 8 It is a structural schematic diagram of a decision tree construction device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0058] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.
[0059] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0060] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.
[0061] It is obvious to those skilled in the art that various modifications and changes can be made in the present application without departing from the spirit or scope of the present application. Therefore, the present application is intended to cover modifications and changes of the present application that fall within the scope of the corresponding claims (technical solutions for protection) and their equivalents. It should be noted that the implementation methods provided in the embodiments of the present application can be combined with each other without contradiction.
[0062] Before describing the technical solutions provided by the embodiments of the present application, in order to facilitate the understanding of the embodiments of the present application, the present application first specifically describes the problems existing in the related art:
[0063] Related anti-fraud technologies usually only focus on basic communication behaviors, such as call duration, number of text messages, etc., while ignoring the complex relationships between communication behaviors. They then generate blacklists or whitelists based on communication behaviors and rely on blacklists or whitelists to analyze communication identification types. Since they only rely on simple data features and analysis rules, there are certain limitations, resulting in low classification accuracy.
[0064] Therefore, the related technology has the problem of low accuracy when identifying the type of communication identification.
[0065] Based on this, the embodiments of the present application provide a decision tree construction method, device, equipment, medium and program product, which can create a decision tree for identifying the type of communication identification based on basic communication behaviors and the intrinsic connections between different communication behaviors. Since the loss value of the first decision tree created is positively correlated with the number of nodes, the overfitting problem caused by too many nodes can be avoided. At the same time, since the loss value of the first decision tree created is positively correlated with the weight of the node, the underfitting problem caused by overly concentrated weight distribution is further prevented, thereby finding the best balance point, improving the classification accuracy of the decision tree, and accurately identifying the type of communication identification.
[0066] The following is a detailed description of the method for constructing a decision tree provided in the embodiments of the present application in conjunction with the accompanying drawings.
[0067] Figure 1 is a flow chart of a method for constructing a decision tree provided in an embodiment of the present application. The decision tree is used to determine the type of communication identification, such as Figure 1 As shown, the method may include steps S110 to S140.
[0068] S110, obtaining, from a database, first historical usage information generated when a target communication identifier uses different service types within a first preset time period.
[0069] Among them, the communication identifier is a unique identifier used by the user for communication, such as a telephone number, a user account identifier of a communication software, etc.
[0070] The target communication identifier is a communication identifier whose true type of communication identifier within the first preset time period is known, and is mainly used for training a decision tree.
[0071] The decision tree can determine whether the target communication identification type is normal or abnormal. The decision tree consists of nodes (including root nodes, internal nodes, and leaf nodes) and branches, which are used to describe a series of possible decision paths and their results. Each internal node in the decision tree represents a feature attribute or judgment condition.
[0072] The first preset time period is a pre-set time period. The type of communication identification can be determined based on the data within this time period. The first preset time period can be set according to demand, and the embodiment of the present application does not limit this, such as one month, one quarter, etc.
[0073] Service types are different types of services or products provided. In a communication system, service types can include voice calls, text messages, data services, etc. Different service types will have different billing methods or user behavior patterns.
[0074] The first historical usage information is the data records generated when the target communication identifier uses different service types within the first preset period, such as data records generated when using voice call services, data records generated when using SMS services, and data records generated when using traffic services.
[0075] Specifically, historical usage information of the target communication identifier using different service types (such as voice calls, text messages, traffic services, etc.) within a first preset time period is obtained in the database. The historical usage information can be referred to as first historical usage information.
[0076] S120, calculating the proportional relationship between the first historical usage information to obtain first historical cross information.
[0077] Specifically, by analyzing the relative size or ratio of historical usage information between different service types, new data that can reflect the correlation between these historical usage information can be obtained, and the new data can be called the first historical cross information. By mining voice call, text message, and traffic information to construct user behavior characteristics to identify fraudulent numbers, and on this basis, further mining the cross-characteristics of calls, text messages, and traffic, the behavioral characteristics of fraudulent numbers can be mined from multiple dimensions.
[0078] S130, generating information of an initial decision tree based on the first historical usage information and the first historical cross information, wherein the information of the initial decision tree includes initial nodes and their corresponding initial numbers and initial weights.
[0079] Among them, the information of the initial decision tree may include nodes in the initial decision tree, which nodes may be called initial nodes; may also include the total number of initial nodes, which may be called the initial number; and may also include the weight corresponding to each initial node, which may be called the initial weight.
[0080] The initial weight can be used to evaluate the importance of the initial node. For example, it can be obtained by supervised training based on the actual types (such as normal types or abnormal types) of the communication identifiers of multiple different target communication identifiers within the first preset time period.
[0081] Specifically, based on the first historical usage information and the first historical cross information, an initial decision tree may be constructed, thereby generating information of the initial decision tree, including initial nodes and their corresponding initial numbers and initial weights.
[0082] S140, adjust the initial quantity and the initial weight to obtain information of the first decision tree, wherein the information of the first decision tree includes the first node and its corresponding first quantity and first weight, and the first loss value corresponding to the first decision tree is less than the preset loss threshold, and the first loss value is positively correlated with the first quantity and the first weight, respectively.
[0083] The preset loss threshold is a preset value used to determine whether the performance of the decision tree meets the requirements. If the first loss value is less than the preset loss threshold, the performance of the first decision tree is qualified.
[0084] The first loss value is positively correlated with the first quantity and the first weight, that is, as the first quantity or the first weight increases, the first loss value will also increase. When the first loss value is less than the preset loss threshold, it means that a balance point can be found so that the decision tree is neither too simple (leading to underfitting) nor too complex (leading to overfitting).
[0085] Specifically, by adjusting the total number of nodes and node weights in the decision tree construction process, the loss value of the decision tree can be made lower than the preset loss threshold. Since the loss value is positively correlated with the total number of nodes, it can prevent the decision tree from having too many nodes and being too complex, thus avoiding overfitting. At the same time, since the loss value is positively correlated with the node weights, it can prevent the number of nodes from being too few and the weights from being too concentrated, thus avoiding underfitting.
[0086] It should be noted that when adjusting the number of nodes, that is, when performing feature selection, the divergence of the feature and its correlation with the target variable can be considered. Feature divergence refers to the difference between samples on the feature, which is generally measured by whether the variance is almost zero. When a feature does not diverge, it can be considered that the feature does not contribute to the distinction of samples and can generally be deleted. For the correlation between the feature and the target variable, some specific evaluation indicators can be set to determine whether they are related, thereby deciding whether the feature should be deleted.
[0087] According to the decision tree construction method provided by the embodiment of the present application, by obtaining from the database the detailed first historical usage information generated when the target communication identifier uses various services within the first preset period, the proportional relationship between these information can be precisely calculated to obtain the first historical cross information, wherein the first historical cross information reflects the intrinsic connection between different communication behaviors, helps to more accurately describe the user's communication behavior characteristics, and provides a rich data foundation for the construction of the decision tree. Then, based on the first historical usage information and the first historical cross information, the information of the initial decision tree can be generated, such as the information of the initial nodes in the initial decision tree, the initial number of initial nodes, and the initial weight of the initial nodes. Next, by carefully adjusting the initial number and initial weight of the initial nodes, the decision tree structure is continuously optimized until the loss value corresponding to the decision tree is lower than the preset loss threshold, that is, the first loss value corresponding to the generated first decision tree is lower than the preset loss threshold, and since the first loss value is positively correlated with the first number of first nodes in the first decision tree and the first weight of the first node, respectively, it is possible to avoid overfitting problems caused by excessive complexity (too many nodes) and underfitting problems caused by oversimplification (too few nodes and too concentrated weights), thereby finding the best balance point, improving the classification accuracy of the decision tree, and accurately identifying the type of communication identification.
[0088] Figure 2 This is another flow chart of the decision tree construction method provided in the embodiment of the present application.
[0089] In some embodiments, Figure 2 As shown, step S110 obtains first historical usage information generated when the target communication identifier uses different service types in the database, which may include step S111.
[0090] S111, obtaining in a database the first historical call information generated when the target communication identifier uses the call service, the first historical text message information generated when the target communication identifier uses the text message service, and the first historical traffic information generated when the target communication identifier uses the traffic service.
[0091] Specifically, in the database, historical record information associated with the target communication identifier (for example, a specific phone number or user account) can be obtained. The historical record information covers the call records of the target communication identifier when using call services, which can be called the first historical call information, and also covers the SMS sending and receiving records when using SMS services, which can be called the first historical SMS information, as well as the data traffic usage records when using traffic services, which can be called the first historical traffic information.
[0092] Step S120 calculates the proportional relationship between the first historical usage information to obtain the first historical cross information, which may include step S121.
[0093] S121, determining first historical cross information according to a proportional relationship among the first historical call information, the first historical text message information, and the first historical traffic information.
[0094] Specifically, based on the relative proportion or relationship between the first historical call information, the first historical SMS information and the first historical traffic information generated by the target communication identifier when using call service, SMS service and traffic service, a comprehensive first historical cross-information can be determined, which reflects the intrinsic connection between different service types.
[0095] The embodiment of the present application obtains historical information of the target communication identifier when using call, text message and traffic services from a database, and calculates the proportional relationship between this information, so as to obtain a comprehensive first historical cross-information, which can reveal the intrinsic connection between different service types and provide a rich data basis for the construction of a decision tree.
[0096] Figure 3 This is another flow chart of the decision tree construction method provided in the embodiment of the present application.
[0097] In some embodiments, Figure 3 As shown, the first historical call information includes the number of first calls; the first historical text message information includes the number of first text messages; the first historical traffic information includes the number of application usage; the first historical cross-information includes the first sub-historical cross-information, the second sub-historical cross-information and the third sub-historical cross-information; step S121 determines the first historical cross-information based on the proportional relationship between the first historical call information, the first historical text message information and the first historical traffic information, and may include steps S1211 to S1213.
[0098] S1211: Divide the number of first call items by the number of first text messages to obtain first sub-history cross information.
[0099] Among them, the first number of calls is the total number of calls generated when the target communication identifier uses the call service within the first preset time period. The total number of calls can be called the first number of calls.
[0100] The first number of text messages is the total number of text messages generated when the target communication identifier uses the text message service within the first preset time period. The total number of text messages can be called the first number of text messages.
[0101] Specifically, by dividing the number of first calls generated when the target communication identifier uses the call service within a first preset time period by the number of first text messages generated when the target communication identifier uses the text message service, a specific ratio information can be obtained. The ratio information can be called the first sub-historical cross-information. The first sub-historical cross-information reflects the usage preference or pattern of the target communication identifier between call and text message services.
[0102] For example, the first sub-historical cross-information of a normal type of telephone number takes values within a preset normal range; while the first sub-historical cross-information of an abnormal type of telephone number may be too large or too small, such as the number of first calls is much larger than the number of first text messages, making the first sub-cross-information greater than the maximum value of the preset normal range, or the number of first text messages is much larger than the number of first communications, making the first sub-cross-information less than the minimum value of the preset normal range.
[0103] S1212: Divide the number of first call records by the number of application usage to obtain second sub-history cross information.
[0104] Specifically, by dividing the number of first calls generated when the target communication identifier uses the call service within the first preset time period by the number of application usages generated when the target communication identifier uses the traffic service, a specific ratio information can be obtained, and the ratio information can be called the second sub-history cross information. The second history cross information reflects the usage preference or pattern of the target communication identifier between the call and traffic services.
[0105] For example, the second sub-history cross-information of a normal type of phone number takes values within a preset normal range; while the second sub-history cross-information of an abnormal type of phone number may be too large, such as when the number of first calls is much larger than the number of applications used, causing the second sub-cross-information to be greater than the maximum value of the preset normal range.
[0106] S1213: Divide the number of first short messages by the number of application program usage to obtain third sub-history cross information.
[0107] Specifically, by dividing the number of first text messages generated when the target communication identifier uses the text message service within the first preset period by the number of application usages generated when the target communication identifier uses the data service, a specific ratio information can be obtained, and the ratio information can be called the third sub-history cross information. The third history cross information reflects the usage preference or mode of the target communication identifier between text messages and data services.
[0108] For example, the third sub-historical cross-information of a normal type of phone number takes values within a preset normal range; while the third sub-historical cross-information of an abnormal type of phone number may be too large, such as the number of first text messages is far greater than the number of applications used, making the third sub-cross-information greater than the maximum value of the preset normal range.
[0109] It should be noted that the purpose of cross-information is to present the differences in communication behaviors in different dimensions. Among the three dimensions of calls, text messages, and traffic, fraudulent numbers often have main behaviors in only one dimension, so the ratio characteristics between the dimensions also have meaning. Use the ratio of the first number of calls to the first number of text messages to cross the call characteristics and text message characteristics. If this feature is too large or too small, it is more likely to become a fraud number; in addition, use the ratio of the first number of calls to the number of applications used to cross the call characteristics and traffic characteristics, and use the first number of text messages to the number of applications used to cross the text message characteristics and traffic characteristics. The value of the fraudulent number will be much greater than that of the normal number.
[0110] The embodiment of the present application calculates the proportional relationship between the information (such as the number of calls, the number of text messages and the number of applications used) generated by the target communication identifier between calls, text messages and traffic services, that is, the first, second and third sub-history cross-information, which can accurately reveal the usage preference or pattern of the target communication identifier, which is conducive to accurately identifying the type of the target communication identifier.
[0111] In some embodiments, the first historical call information also includes at least one of the following: active call days, call frequency, call duration, call device identification, number of call locations, number of call contact users, percentage of call times, percentage of calling users, percentage of call duration intervals, and regularity of call time points.
[0112] The number of active call days is used to record how many days the user holding the target communication representation has made calls within the first preset period. The number of active call days can be simply understood as the number of days with call records within the first preset period.
[0113] It should be noted that the call behavior of normal users is average and consistent throughout the entire time span of the first preset period, so the number of active days of normal target communication identifiers is relatively large. However, the call records of fraudulent numbers are usually concentrated and may be intermittent, that is, the number of active days is relatively small. Therefore, the number of days when the user's call records appear within the time span can be defined as the number of active call days.
[0114] The call frequency is equal to the number of first calls divided by the number of active call days, and is used to record the average number of calls made by the user holding the target communication identifier during the number of active call days, as well as the distribution of the number of calls. The call frequency of normal numbers is low, and the call frequency of abnormal numbers is high.
[0115] It should be noted that since fraud numbers have no target contacts, their main feature is that the number of calls is much higher than that of normal numbers. However, the number of calls is often affected by the number of active days, so the analysis target can be locked to each active day to obtain the call frequency characteristics calculated on a daily basis. The total number of calls (number of first calls) can be divided by the total number of active days (number of active call days) to obtain the average number of calls per day, that is, the call frequency.
[0116] In one example, some distribution features can be used to dig out some deeper information, and the first historical call information also includes the distribution feature information of the calls. Since for each number, the number of calls on each active day can be combined to form a distribution within the time span. Therefore, the median of the number of calls on the active day can be used to represent the call frequency excluding the influence of extreme values; the maximum or minimum number of calls on the active day can be used to represent extreme cases; the variance and standard deviation of the number of calls on the active day can be used to represent the discrete trend and fluctuation of the number of calls per day; the skewness of the number of calls on the active day can be used to represent the skewness of the data distribution, etc. By adding the distribution features of the number of calls within the time span, such as the median, maximum, minimum, variance, standard deviation and skewness, it is possible to deeply dig out the deep-level information of the user's call behavior and more comprehensively reflect the user's call frequency, extreme cases, discrete trends, fluctuations and the skewness of the data distribution.
[0117] The call duration is equal to the total call duration divided by the number of first calls, and is used to record the average duration of each call of the user and the distribution of the call duration. The call duration of normal numbers is longer, and the call duration of abnormal numbers is shorter.
[0118] In one example, for the distribution of call duration, we can calculate the average call duration of each number, the central tendency (median) of call duration excluding extreme cases, the extreme cases (maximum and minimum) of call duration, and the fluctuation and dispersion (variance and standard deviation) of call duration. By calculating the distribution characteristics such as the average, median, maximum, minimum, variance and standard deviation of call duration, we can have a more comprehensive understanding of the central tendency, extreme cases and fluctuation dispersion of call duration, providing strong support for in-depth analysis of call behavior.
[0119] It should be noted that the embodiment of the present application eliminates the influence of the time span by averaging the total features (such as the number of first calls, the number of active call days, and the total call duration) to days or months to obtain mean features (such as call frequency and call duration), which can make the call features more distinguishable for numbers of different categories.
[0120] The device ID and the number of locations used to make calls are used to record how many different devices a user uses and where they make calls. Fraudulent numbers may frequently change devices or locations.
[0121] The number of users contacted by the call is used to record how many different people the user has called. Normal numbers often have a fixed social circle, and the number of users contacted by the call is limited; since fraud numbers have no target contacts, they call almost every contact, and there are few duplicates, so the number of users contacted by the call will also be very high.
[0122] In one example, the social relationships of each number were taken into account, and the fluctuations in the average number of calls per month and the average duration of each call were used to indicate the closeness of the relationship with the contact. Due to the lack of social relationships, fraud numbers would perform differently from normal numbers on these two variables.
[0123] It should be noted that since fraudulent calls are often proactive, the number and duration of calls can be considered when constructing caller characteristics.
[0124] The proportion of outbound calls is equal to the total number of outbound calls divided by the number of first calls. Fraudulent calls are often active calls, so the proportion of outbound calls is higher.
[0125] The proportion of calling users is equal to the number of users who actively call divided by the number of users contacted by the call. Fraudulent calls are often active calls, so the proportion of calling users is higher.
[0126] The call duration interval ratio records the segmented ratio characteristics of the call duration of the caller. For example, the call duration can be divided into six intervals [0-10), [10-30), [30-60), [60-300), [300-1800), [1800-+∞), representing six different levels of calls (extremely short calls, relatively short calls, short calls, long calls, relatively long calls and extremely long calls). By classifying all call records of each target communication identifier into the above six intervals according to the call duration, the frequency of each interval can be obtained, and then divided by the total number of calls to obtain the call duration interval ratio of each interval. For example, in the first preset time period, 50 call records are generated, 45 of which are in the interval [0-10) min and 5 in the interval [10-30) min. Therefore, the call duration of each call record is divided into the corresponding intervals, and the call duration interval ratio of each interval can be obtained as 0.9, 0.1, 0, 0, 0.
[0127] Call time regularity information is used to record the user's call status in different time periods, such as the difference in calls on weekdays and weekends.
[0128] It should be noted that fraudulent calls are more common during weekdays, but the incidence is significantly lower during weekends, which is a very obvious distinction, while normal numbers generally do not have such a comparison. Therefore, the entire call record is divided into weekday call records and weekend call records according to the call date.
[0129] In one example, call types are differentiated to obtain four call record tables: weekday calling, weekday called, weekend calling, and weekend called, which can make feature construction more efficient.
[0130] The first historical SMS information also includes at least one of the following: SMS active days, SMS frequency, number of users contacted by SMS, average number of users contacted by SMS per day, SMS type, and SMS time point regularity information.
[0131] The number of days in which SMS messages are active refers to the number of days in which SMS messages are recorded within the first preset period of time.
[0132] The SMS frequency is equal to the number of first SMS messages divided by the number of SMS active days. It should be noted that in the SMS frequency feature, considering that fraudulent SMS messages are likely to be sent in bulk, there will be many zeros in the time interval between two SMS messages, and the method of expressing the frequency by the time interval will be invalid. Therefore, in the SMS frequency feature analysis, the time interval feature will be deleted, and it is more accurate to calculate the SMS frequency by dividing the number of first SMS messages by the number of SMS active days.
[0133] The number of SMS contacts is used to record how many different people a user has text messages with.
[0134] The average number of users contacted by SMS per day is equal to the number of users contacted by SMS divided by the number of days SMS is active.
[0135] The SMS types include sending type and receiving type.
[0136] SMS time point regularity information is used to record the SMS communication of users in different time periods, such as the difference in SMS messages on weekdays and weekends.
[0137] In one example, the first historical SMS information also includes the distribution characteristics of SMS. By analyzing the average monthly number of SMS messages of each contact number, distribution characteristics such as mean, median, maximum, minimum, variance, standard deviation and skewness are constructed. This allows a more comprehensive understanding of the central trend, extreme cases and degree of fluctuation dispersion of SMS, providing strong support for in-depth analysis of SMS behavior.
[0138] The first historical traffic information also includes at least one of the traffic active days and the total traffic.
[0139] Among them, the number of days with active traffic is the number of days with traffic usage records in the first preset time period.
[0140] The total flow is the total amount of flow used in the first preset time period.
[0141] In one example, the first historical traffic information also includes traffic distribution feature information. For each number, the average monthly traffic usage of all its applications constitutes a distribution, based on which distribution features such as mean, median, maximum, minimum, variance, standard deviation, skewness, etc. can be calculated. Since fraudulent numbers usually do not generate much entertainment traffic, their distribution features can be distinguished from normal numbers.
[0142] The embodiment of the present application collects the first historical call information (including the number of active call days, call frequency, call duration, call device identification, number of call locations, number of call contact users, proportion of call times, proportion of calling users, proportion of call duration intervals, regular information on call time points, etc.) and the first historical SMS information and traffic information (covering the number of active SMS days, SMS frequency, number of SMS contact users, average number of SMS contact users per day, SMS type, regular information on SMS time points, number of active traffic days, total traffic, etc.), which can effectively identify the differences in behavior patterns between normal users and abnormal (such as fraudulent) numbers, and can accurately reveal the usage preferences or patterns of the target communication identification, providing a rich data foundation for the construction of a decision tree.
[0143] In one example, when constructing call and SMS features, the relevant features of the contact user are added, and the average number of calls or call duration per contact user in the record of the charge number is used to reflect the closeness of the social relationship between each contact user and the user holding the target communication identifier. Therefore, the type of the target communication identifier's social relationship can be determined based on its type.
[0144] Figure 4 This is another flow chart of the decision tree construction method provided in the embodiment of the present application.
[0145] In some embodiments, Figure 4 As shown, step S130 generates information of an initial decision tree based on the first historical usage information and the first historical cross information, and may include steps S131 and S132.
[0146] S131, adding the quantity of the first historical usage information and the quantity of the first historical cross information to obtain the initial quantity of the initial nodes in the initial decision tree, wherein the initial nodes correspond one to one with the first historical usage information and the first historical cross information.
[0147] Specifically, since the initial node corresponds one-to-one to the first historical usage information and the first historical cross-information, that is, each type of first historical usage information corresponds to an initial node, and each type of first historical cross-information corresponds to an initial node, the number of first historical usage information and first historical cross-information is added together to obtain the total number of initial nodes in the initial decision tree, that is, the initial number.
[0148] For example, the first historical call information includes the number of first calls within the first preset time period, the number of active call days, call frequency, call duration, call device identification, number of call locations, number of call contact users, proportion of call times, proportion of calling users, proportion of call duration range, and regularity information of call time points, then 11 initial nodes can be created.
[0149] S132, from the correspondence between preset historical usage information, historical cross information and preset weights, obtain the target preset weights corresponding to the first historical usage information and the first historical cross information respectively, and use the target preset weights as the initial weights of the corresponding initial nodes.
[0150] Among them, the preset weight can be set according to the degree of influence on the target communication identification as an abnormal type. For example, the corresponding preset weight can be set according to the first number of calls, active call days, call frequency, call duration, call device identification, number of call locations, number of call contact users, proportion of call times, proportion of call users, proportion of call duration intervals, and regular information of call time points in the first preset time period. For another example, the corresponding preset weight can be set according to the first sub-history cross-information, the second sub-history cross-information, and the third sub-history cross-information in the first preset time period.
[0151] Specifically, in the correspondence between the preset historical usage information, historical cross information and preset weights, the target preset weights matching the first historical usage information and the first historical cross information can be found, and these target preset weights can be set as the initial weights of the corresponding initial nodes in the decision tree.
[0152] The embodiment of the present application can generate an initial decision tree by combining the first historical usage information and the first historical cross-information, wherein the initial nodes of the initial decision tree correspond one-to-one to the first historical usage information and the first historical cross-information, and initial weights can be assigned to these initial nodes according to the target preset weights corresponding to the first historical usage information and the first historical cross-information (the preset weights are set based on the degree of their influence on the target communication identifier being judged as an abnormal type), thereby achieving efficient and accurate decision tree initialization based on historical data, and providing a solid foundation for subsequent communication identifier type classification tasks.
[0153] In some embodiments, the first loss value is positively correlated with the first quantity and the first weight, respectively, including loss function (1):
[0154]
[0155] Among them, LOSS is the loss value of the decision tree (such as the first loss value), a and b are preset constants, N is the number of nodes (such as the first number of first nodes), and Wi is the node weight (such as the first weight of the first node).
[0156] It should be noted that the more features and nodes there are, the longer it takes to train the decision tree. In addition, as the number of features increases, the constructed decision tree will become more complex, which will lead to a decrease in its generalization ability. Therefore, the loss function (1) can be used to find the most suitable feature subset among all the features in the data set to improve the training efficiency of the decision tree.
[0157] Specifically, the loss value LOSS represents the difference between the predicted result and the true result.
[0158] a is a preset constant used to adjust the contribution of structural complexity to the total loss.
[0159] b is a preset constant used to adjust the contribution of node weight to the total loss, and b is a positive number.
[0160] N is the number of nodes in the decision tree, which directly reflects the complexity of the decision tree. The more nodes there are, the more complex the tree structure is, which may lead to a higher risk of overfitting. By incorporating the number of nodes into the loss function (1), the decision tree can be constructed to maintain simplicity and avoid unnecessary branches.
[0161] The loss function (1) aims to find a balance point so that the decision tree is neither too complex (leading to overfitting) nor too simple (leading to underfitting).
[0162] Wi is the node weight of the decision tree. If the weights of some nodes in the decision tree are higher (indicating that these nodes have a greater impact or contribution to the prediction results), then ||w|| 2 The value of will increase, which may lead to an increase in the LOSS value. Therefore, when building a decision tree, it is possible to avoid generating too many high-weight nodes to prevent overfitting.
[0163] In the embodiment of the present application, when calculating the first loss value, by adding a penalty term for the complexity of the decision tree, the risk of overfitting can be considered when constructing the decision tree, thereby tending to select a simpler but sufficiently accurate decision tree. At the same time, when constructing the decision tree, it is possible to further avoid generating too many high-weight nodes, thereby preventing underfitting. By incorporating the complexity of the decision tree and the node weight into the loss function, the model complexity and accuracy can be effectively balanced when constructing the decision tree, overfitting and underfitting can be avoided, and a simpler and sufficiently accurate decision tree can be constructed.
[0164] It should be noted that after the first decision tree is constructed, the historical data within the second preset time period can be used to continue to be optimized to further enhance the classification accuracy of the decision tree.
[0165] Figure 5 It is a flow chart of optimizing the first decision tree in the decision tree construction method provided in the embodiment of the present application.
[0166] In some embodiments, Figure 5 As shown, the decision tree construction method may further include steps S151 to S156.
[0167] S151, obtaining, from a database, second historical usage information generated when a target communication identifier uses different service types within a second preset period of time and a historical real type to which the target communication identifier belongs.
[0168] Specifically, the historical usage information of the target communication identifier using different service types (such as voice calls, text messages, traffic services, etc.) within the second preset time period can be obtained in the database. This historical usage information can be called the second historical usage information. The historical real type of the target communication identifier within the second preset time period can also be obtained, such as an abnormal type.
[0169] S152, calculating the proportional relationship between the second historical usage information to obtain second historical cross information.
[0170] Specifically, by analyzing the relative sizes or ratios between the second historical usage information of different service types, new data that can reflect the association relationship between the historical usage information can be obtained, and the new data can be called second historical cross information.
[0171] S153, inputting the second historical usage information and the second historical intersection information into corresponding first nodes in the first decision tree respectively to obtain a plurality of historical sub-results.
[0172] Specifically, the second historical usage information and the second historical cross information may be respectively input into each node of the corresponding first decision tree to obtain a prediction result output by each node, and the prediction result may be referred to as a historical sub-result.
[0173] In one example, the second historical usage information and the second historical cross information are respectively processed by One-hot encoding, and the new variables after processing have only two values 0 and 1. In this way, after the qualitative feature variables are processed by One-hot encoding, the calculation of the distance between the feature variables will be more reasonable.
[0174] S154, multiplying the historical sub-results by the corresponding first weights respectively and then adding them together to obtain the historical results.
[0175] Specifically, the historical sub-results output by each node of the first decision tree are multiplied by the corresponding node weights and then added together to obtain the prediction result of the first decision tree, which can be called the historical result.
[0176] S155, comparing the historical result with the historical true type to obtain an error value.
[0177] Specifically, the historical result of the target communication identifier predicted by the first decision tree within the second preset period is compared with the historical true type of the target communication identifier within the second preset period, and the prediction error value of the first decision tree can be obtained. For example, when the historical true type is an abnormal type, the probability that the historical result belongs to the abnormal type is 0.9, and the prediction error value is 0.1. For another example, when the historical true type is an abnormal type, the probability that the historical result belongs to the abnormal type is 0.7, and the prediction error value is 0.3.
[0178] S156, when the error value is greater than the preset error threshold, adjust the first quantity and the first weight to obtain information of the second decision tree, wherein the information of the second decision tree includes the second node and its corresponding second quantity and second weight, and the second loss value corresponding to the second decision tree is less than the preset loss threshold, and the second loss value is positively correlated with the second quantity and the second weight, respectively.
[0179] Specifically, when the prediction error value of the first decision tree is greater than a preset error threshold (such as greater than 0.4), the number of nodes and the node weights of the first decision tree can be adjusted, and the loss function (1) still needs to be satisfied during the adjustment, so that the second loss value of the adjusted second decision tree is less than the preset loss threshold, and when the second decision tree predicts the type of the target communication identifier within the second preset time period, the corresponding prediction error value is less than the preset error threshold.
[0180] The embodiment of the present application can significantly improve the accuracy of the decision tree in classifying the target communication identification type and reduce the prediction error value by continuously optimizing the decision tree, using historical data within the second preset time period to calculate the cross information and adjust the nodes and weights of the first decision tree.
[0181] Figure 6 It is a flow chart of using a second decision tree to determine a communication identification type in a decision tree construction method provided in an embodiment of the present application.
[0182] In some embodiments, Figure 6 As shown, the decision tree construction method may further include steps S161 to S164.
[0183] S161, obtaining, in a database, third historical usage information generated when a target communication identifier uses different service types within a third preset time period.
[0184] Specifically, historical usage information of the target communication identifier using different service types (such as voice calls, text messages, traffic services, etc.) within a third preset time period can be obtained in the database, and this historical usage information can be called third historical usage information.
[0185] S162, calculating the proportional relationship between the third historical usage information to obtain third historical intersection information.
[0186] Specifically, by analyzing the relative sizes or ratios between the third historical usage information of different service types, new data that can reflect the association relationship between the third historical usage information can be obtained, and the new data can be called third historical cross information.
[0187] S163: Input the third historical usage information and the third historical intersection information into corresponding second nodes in the second decision tree respectively to obtain a plurality of sub-results.
[0188] Specifically, the third historical usage information and the third historical cross information may be respectively input into each node of the corresponding second decision tree to obtain a prediction result output by each node, which may be referred to as a sub-result.
[0189] S164, multiplying the multiple sub-results by the corresponding second weights respectively and then adding them together to obtain the target result.
[0190] The target result is the communication identification type to which the target communication identification determined by the second decision tree belongs within the third preset time period.
[0191] Specifically, the sub-results output by each node of the second decision tree are multiplied by the corresponding node weights and then added together to obtain the prediction result of the second decision tree, which can be called the target result.
[0192] In the embodiment of the present application, the third historical usage information of the target communication identifier within the third preset time period and the calculated third historical cross information are input into each node of the second decision tree, and then the target result can be obtained by combining the predicted sub-results of each node with the node weight. The usage of different service types and their correlation are comprehensively considered, and the optimized second decision tree is used to more accurately predict the type of the target communication identifier and improve the reliability of the prediction result.
[0193] In an example, the top five important features obtained using the comparison results of LOSS as the judgment criteria are voc_num_per_day (indicating the average number of call contacts per day), voc_call_num_per_day (indicating the average number of calling contacts per day), sms_cover_day_month (indicating the average number of SMS active days per month), sms_cover_day_count_sem (indicating the fluctuation of the number of SMS messages on each active day), and voc_imei_num (indicating the number of different call devices used), which are in line with common sense logic. voc_call_num_per_day (indicates the average number of calling contacts per day), the larger the value of this feature, the greater its positive effect on the predicted probability, that is, the more calling contacts there are on average per day, the more likely it is to be a fraud number; sms_cover_day_month (indicates the average number of SMS active days per month), the larger the value of this feature, the easier it is to lower the predicted probability of the positive sample, indicating that the longer the average monthly active days of SMS, the greater the possibility of it being a normal number; voc_imei_num (indicates the number of different calling devices used), the larger the value of this feature, the greater its positive effect on the predicted probability, that is, the more calling devices a number uses, the more likely it is to be a fraud number.
[0194] In another example, when tuning the first decision tree, the corresponding predicted probability is output on the test set, denoted as P1, and then it is sorted and divided into 10 probability intervals of equal length, such as [0, 0.1], [0.1, 0.2], ..., [0.9, 1]. Then the new sample is predicted based on the first decision tree, and the predicted probability is denoted as p1, and p1 is also divided in the same way. The actual sample proportion is the sample proportion of p1 in each interval. The expected sample proportion is the sample proportion of P1 in each interval. If the first decision tree is relatively stable, the sample proportions of different batches of data in each interval will not differ greatly, so as to determine the optimal decision tree.
[0195] In another example, by introducing the user fraud risk level indicator: in the prediction results of the second decision tree, the fraud probability of the fraud user is further divided into 5 groups with values of 0-0.2, 0.2-0.4, 0.4-0.6, 0.6-0.8, 0.8-1, etc., and assigned levels of 1 to 5 respectively. The larger the fraud risk level, the greater the probability that the user holding the target communication identifier is a fraud user, and the fraud user can be further accurately judged.
[0196] Based on the same inventive concept, in a second aspect, the embodiment of the present application further provides a device for constructing a decision tree, wherein the decision tree is used to determine the type of communication identification, such as Figure 7As shown, the device 700 may include an acquisition module 710 , a calculation module 720 , a generation module 730 and an adjustment module 740 .
[0197] An acquisition module 710 is used to acquire, from a database, first historical usage information generated when a target communication identifier uses different service types within a first preset period of time;
[0198] A calculation module 720, configured to calculate a proportional relationship between the first historical usage information to obtain first historical cross information;
[0199] A generating module 730, configured to generate information of an initial decision tree based on the first historical usage information and the first historical cross information, wherein the information of the initial decision tree includes an initial number of initial nodes and an initial weight of each initial node;
[0200] The adjustment module 740 is used to adjust the initial quantity and the initial weight to obtain the information of the first decision tree, wherein the information of the first decision tree includes the first node and its corresponding first quantity and first weight, and the first loss value corresponding to the first decision tree is less than the preset loss threshold, and the first loss value is positively correlated with the first quantity and the first weight, respectively.
[0201] According to the decision tree construction device provided by the embodiment of the present application, the device obtains detailed first historical usage information generated when the target communication identifier uses various services within a first preset period from the database, and then can finely calculate the proportional relationship between these information to obtain the first historical cross information, wherein the first historical cross information reflects the intrinsic connection between different communication behaviors, helps to more accurately describe the user's communication behavior characteristics, and provides a rich data foundation for the construction of the decision tree. Then, based on the first historical usage information and the first historical cross information, the information of the initial decision tree can be generated, such as the information of the initial nodes in the initial decision tree, the initial number of initial nodes, and the initial weight of the initial nodes. Next, by carefully adjusting the initial number and initial weight of the initial nodes, the decision tree structure is continuously optimized until the loss value corresponding to the decision tree is lower than the preset loss threshold, that is, the first loss value corresponding to the generated first decision tree is lower than the preset loss threshold, and since the first loss value is positively correlated with the first number of first nodes in the first decision tree and the first weight of the first node, respectively, it is possible to avoid overfitting problems caused by excessive complexity (too many nodes) and underfitting problems caused by oversimplification (too few nodes and too concentrated weights), thereby finding the best balance point, improving the classification accuracy of the decision tree, and accurately identifying the type of communication identification.
[0202] In some embodiments, the acquisition module is used to acquire, from a database, first historical usage information generated when the target communication identifier uses different service types, which can be specifically used to:
[0203] In the database, first historical call information generated when the target communication identifier uses the call service, first historical text message information generated when the target communication identifier uses the text message service, and first historical traffic information generated when the target communication identifier uses the traffic service are obtained;
[0204] The proportional relationship between the first historical usage information is calculated to obtain the first historical cross information, including:
[0205] The first historical cross information is determined according to a proportional relationship among the first historical call information, the first historical text message information, and the first historical traffic information.
[0206] In some embodiments, the first historical call information includes the number of first calls; the first historical text message information includes the number of first text messages; the first historical traffic information includes the number of application usage; the first historical cross information includes the first sub-historical cross information, the second sub-historical cross information and the third sub-historical cross information; the acquisition module is used to determine the first historical cross information according to the proportional relationship between the first historical call information, the first historical text message information and the first historical traffic information, which can be specifically used to:
[0207] Divide the first number of calls by the first number of text messages to obtain first sub-history cross information;
[0208] Divide the first call count by the application usage count to obtain second sub-history cross information;
[0209] The number of first short messages is divided by the number of application usages to obtain third sub-history cross information.
[0210] In some embodiments, the first historical call information further includes at least one of the following: number of active call days, call frequency, call duration, call device identifier, number of call locations, number of call contact users, proportion of call times, proportion of calling users, proportion of call duration intervals, and regularity information of call time points;
[0211] The first historical SMS information also includes at least one of the following: SMS active days, SMS frequency, number of users contacted by SMS, average number of users contacted by SMS per day, SMS type, and SMS time point regularity information;
[0212] The first historical traffic information also includes at least one of the traffic active days and the total traffic.
[0213] In some embodiments, the generating module is used to generate information of the initial decision tree based on the first historical usage information and the first historical cross information, which can be specifically used to:
[0214] Adding the number of the first historical usage information and the first historical cross information to obtain the initial number of initial nodes in the initial decision tree, wherein the initial nodes correspond one to one with the first historical usage information and the first historical cross information;
[0215] From the correspondence between preset historical usage information, historical cross information and preset weights, the target preset weights corresponding to the first historical usage information and the first historical cross information are obtained, and the target preset weights are used as the initial weights of the corresponding initial nodes.
[0216] In some embodiments, the first loss value is positively correlated with the first quantity and the first weight, respectively, including:
[0217]
[0218] Wherein, LOSS is the first loss value, a and b are preset constants, N is the first number of the first node, W i is the first weight of the first node.
[0219] In some embodiments, the apparatus further comprises a comparison module:
[0220] The acquisition module is further used to acquire, from a database, second historical usage information generated when the target communication identifier uses different service types within a second preset period of time and the historical real type to which the target communication identifier belongs;
[0221] The calculation module is further used to calculate the proportional relationship between the second historical usage information to obtain the second historical cross information;
[0222] The calculation module is further used to input the second historical usage information and the second historical cross information into the corresponding first nodes in the first decision tree respectively to obtain multiple historical sub-results;
[0223] The calculation module is further used to multiply the historical sub-results by the corresponding first weights and then add them together to obtain the historical results;
[0224] A comparison module is used to compare the historical results with the historical true types to obtain the error value;
[0225] When the error value is greater than a preset error threshold, the first quantity and the first weight are adjusted to obtain information of the second decision tree, wherein the information of the second decision tree includes the second node and its corresponding second quantity and second weight, and the second loss value corresponding to the second decision tree is less than the preset loss threshold, and the second loss value is positively correlated with the second quantity and the second weight, respectively.
[0226] In some embodiments, it also includes:
[0227] The acquisition module is further used to acquire, in the database, third historical usage information generated when the target communication identifier uses different service types within a third preset time period;
[0228] The calculation module is further used to calculate the proportional relationship between the third historical usage information to obtain the third historical cross information;
[0229] The calculation module is further used to input the third historical usage information and the third historical cross information into corresponding second nodes in the second decision tree respectively to obtain multiple sub-results;
[0230] The calculation module is also used to multiply the multiple sub-results by the corresponding second weights and then add them together to obtain the target result.
[0231] Each module in the decision tree construction device provided in the embodiment of the present application can realize Figures 1 to 6 The functions of each step of the provided decision tree construction method and its ability to achieve corresponding technical effects are described briefly and will not be repeated here.
[0232] Figure 8 A schematic diagram of the hardware structure of a decision tree construction device provided in an embodiment of the present application is shown.
[0233] The decision tree construction device may include a processor 801 and a memory 802 storing computer program instructions.
[0234] Specifically, the processor 801 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.
[0235] The memory 802 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 802 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 802 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 802 may be inside or outside the construction device of the decision tree. In a particular embodiment, the memory 802 is a non-volatile solid-state memory.
[0236] The memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present disclosure.
[0237] The processor 801 implements any one of the decision tree construction methods in the above embodiments by reading and executing the computer program instructions stored in the memory 802 .
[0238] In one example, the decision tree construction device may further include a communication interface 803 and a bus 804. Figure 8 As shown, the processor 801, the memory 802, and the communication interface 803 are connected via a bus 804 and communicate with each other.
[0239] The communication interface 803 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.
[0240] The bus 804 includes hardware, software or both, and couples the components of the construction device of the decision tree to each other. For example, but not limitation, the bus may include an accelerated graphics port (Accelerated Graphics Port, AGP) or other graphics bus, an enhanced industry standard architecture (Extended Industry Standard Architecture, EISA) bus, a front side bus (Front Side Bus, FSB), a hypertransport (Hyper Transport, HT) interconnection, an industry standard architecture (Industry Standard Architecture, ISA) bus, an infinite bandwidth interconnection, a low pin count (Linear Predictive Coding, LPC) bus, a memory bus, a micro channel architecture (MicroChannel Architecture, MCA) bus, a peripheral component interconnect (Peripheral Component Interconnect, PCI) bus, a PCI-Express (Peripheral Component Interconnect-X, PCI-X) bus, a serial advanced technology attachment (Serial Advanced Technology Attachment, SATA) bus, a video electronics standard association local (VESA Local Bus, VLB) bus or other suitable buses or a combination of two or more of these. Where appropriate, the bus 804 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.
[0241] The device can execute the decision tree construction method in the embodiment of the present application based on each unit / component in the decision tree construction device, thereby realizing the combination Figures 1 to 6 Describe the decision tree construction method.
[0242] In addition, in combination with the decision tree construction method in the above embodiments, the present application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any decision tree construction method in the above embodiments is implemented.
[0243] The present application also provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes each process of implementing any one of the above-mentioned decision tree construction method embodiments.
[0244] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.
[0245] The functional blocks shown in the structural block diagram described above can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), appropriate firmware, plug-in, function card, etc. When implemented in software, the elements of the present application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or communication link by a data signal carried in a carrier. "Machine-readable medium" may include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (Read-Only Memory, ROM), flash memory, erasable read-only memory (Erasable Read Only Memory, EROM), floppy disks, compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical discs, hard disks, optical fiber media, radio frequency (Radio Frequency, RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.
[0246] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.
[0247] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.
[0248] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.
Claims
1. A method for constructing a decision tree, characterized in that: The decision tree is used to determine the communication identification type, and the method includes: In a database, first historical usage information generated when the target communication identifier uses different service types within a first preset time period is obtained; Calculating a proportional relationship between the first historical usage information to obtain first historical cross information; Generate information of an initial decision tree based on the first historical usage information and the first historical cross information, wherein the information of the initial decision tree includes initial nodes and their corresponding initial numbers and initial weights; Adjust the initial quantity and the initial weight to obtain information of a first decision tree, wherein the information of the first decision tree includes a first node and its corresponding first quantity and first weight, and a first loss value corresponding to the first decision tree is less than a preset loss threshold, and the first loss value is positively correlated with the first quantity and the first weight, respectively.
2. The method according to claim 1, characterized in that: The step of obtaining, in the database, first historical usage information generated when the target communication identifier uses different service types includes: In the database, first historical call information generated when the target communication identifier uses the call service, first historical text message information generated when the target communication identifier uses the text message service, and first historical traffic information generated when the target communication identifier uses the traffic service are obtained; The calculating the proportional relationship between the first historical usage information to obtain the first historical cross information includes: The first historical cross information is determined according to a proportional relationship among the first historical call information, the first historical text message information, and the first historical traffic information.
3. The method according to claim 2, characterized in that The first historical call information includes the number of first calls; the first historical text message information includes the number of first text messages; the first historical traffic information includes the number of application usage; the first historical cross information includes first sub-historical cross information, second sub-historical cross information and third sub-historical cross information; the first historical cross information is determined according to the proportional relationship between the first historical call information, the first historical text message information and the first historical traffic information, including: Divide the first number of call messages by the first number of text messages to obtain the first sub-history cross information; Divide the first call count by the application usage count to obtain the second sub-history cross information; The third sub-history cross information is obtained by dividing the first number of short messages by the number of applications used.
4. The method according to claim 3, characterized in that The first historical call information also includes at least one of the following: number of active call days, call frequency, call duration, call device identifier, number of call locations, number of call contact users, proportion of call times, proportion of calling users, proportion of call duration intervals, and regularity of call time points; The first historical SMS information also includes at least one of the following: SMS active days, SMS frequency, number of users contacted by SMS, average number of users contacted by SMS per day, SMS type, and SMS time point regularity information; The first historical traffic information also includes at least one of the number of active traffic days and the total traffic.
5. The method according to claim 1, characterized in that The information of generating an initial decision tree based on the first historical usage information and the first historical cross information includes: Adding the number of the first historical usage information and the first historical intersection information to obtain an initial number of initial nodes in the initial decision tree, wherein the initial nodes correspond one to one with the first historical usage information and the first historical intersection information; From the correspondence between preset historical usage information, historical cross information and preset weights, the target preset weights corresponding to the first historical usage information and the first historical cross information are obtained, and the target preset weights are used as the initial weights of the corresponding initial nodes.
6. The method according to claim 1, characterized in that The first loss value is positively correlated with the first quantity and the first weight, respectively, including: Wherein, LOSS is the first loss value, a and b are preset constants, N is the first number of the first nodes, and W i is the first weight of the first node.
7. The method according to claim 1, characterized in that Also includes: In the database, second historical usage information generated when the target communication identifier uses different service types within a second preset time period and the historical real type to which the target communication identifier belongs are obtained; Calculating the proportional relationship between the second historical usage information to obtain second historical cross information; Inputting the second historical usage information and the second historical cross information into the corresponding first nodes in the first decision tree respectively to obtain a plurality of historical sub-results; Multiplying the historical sub-results by the corresponding first weights respectively and then adding them together to obtain a historical result; Compare the historical result with the historical true type to obtain an error value; When the error value is greater than a preset error threshold, the first quantity and the first weight are adjusted to obtain information of a second decision tree, wherein the information of the second decision tree includes second nodes and their corresponding second quantities and second weights, and the second loss value corresponding to the second decision tree is less than the preset loss threshold, and the second loss value is positively correlated with the second quantity and the second weight, respectively.
8. The method according to claim 7, characterized in that Also includes: In the database, third historical usage information generated when the target communication identifier uses different service types within a third preset time period is obtained; Calculating the proportional relationship between the third historical usage information to obtain third historical cross information; Inputting the third historical usage information and the third historical intersection information into the corresponding second nodes in the second decision tree respectively to obtain a plurality of sub-results; The multiple sub-results are multiplied by the corresponding second weights respectively and then added to obtain a target result.
9. A decision tree construction device, characterized in that: The decision tree is used to determine the type of communication identification, and the device includes: An acquisition module, configured to acquire, from a database, first historical usage information generated when a target communication identifier uses different service types within a first preset time period; A calculation module, used for calculating the proportional relationship between the first historical usage information to obtain first historical cross information; A generating module, configured to generate information of an initial decision tree based on the first historical usage information and the first historical cross information, wherein the information of the initial decision tree includes an initial number of initial nodes and an initial weight of each initial node; An adjustment module is used to adjust the initial quantity and the initial weight to obtain information of a first decision tree, wherein the information of the first decision tree includes a first node and its corresponding first quantity and first weight, and a first loss value corresponding to the first decision tree is less than the preset loss threshold, and the first loss value is positively correlated with the first quantity and the first weight, respectively.
10. A decision tree construction device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the decision tree construction method according to any one of claims 1 to 8 is implemented.
11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method for constructing a decision tree according to any one of claims 1 to 8 is implemented.
12. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of a device, the device is enabled to execute the decision tree construction method according to any one of claims 1 to 8.
Citation Information
Patent Citations
Call data processing method and device based on decision tree, equipment and storage medium
CN112329843A
Abnormal behavior recognition and risk model library establishment method and device and electronic equipment
CN113076451A
Telecommunication fraud event identification method and device, and computer readable storage medium
CN114331473A
Harassment fraud call identification method and device, equipment and storage medium
CN115767551A
Fraud identification method and device, electronic equipment and storage medium
CN118674465A