Fraudulent user identification method and device, electronic equipment, medium and program product

Abstract

The invention discloses a fraudulent user identification method and device, electronic equipment, a medium and a program product, and relates to the technical field of anti-fraud, and the fraudulent user identification method comprises the following steps: according to the multi-dimensional feature information of a target user and the multi-dimensional feature information between the target user and a corresponding calling user and called user, identifying a fraudulent user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the called user; constructing a global graph network of the target user; determining a super-dimensional feature load matrix corresponding to the target user according to the call frequency and time change information of the target user, the equipment switching sharing information, the time-space change information and the emotion change information; determining dynamic loading information of the global graph network based on a coupling function among the dimension features in the global graph network; and inputting the global graph network, the super-dimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model to obtain a fraud identification result. According to the technical scheme of the invention, the problem that the current anti-fraud method cannot identify the user who uses the virtual dialing device for fraud is solved.

Description

Technical Field

[0001] The present application relates to the field of anti-fraud technology, and in particular to a fraudulent user identification method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] At present, in order to identify fraudulent users among call users, it is usually necessary to directly block the entry of fraudulent calls by setting up an international fraud call blacklist (including a blacklist of number location, a blacklist of phone numbers, and a blacklist of number segments, etc.). However, since most fraudulent calls and fraudulent text messages are currently dialed and sent through the "GOIP (Global System for Mobile Communications, a virtual dialing device)" commonly known as the "cat pool", and this device can modify the location of the number, remotely operate, two-way talk, and hide the location, for example, although the phone number shows that the location is in China, it is actually a fake call made by the fraudster abroad. Therefore, when the fraudster modifies the location of the number and the number through the "GOIP" device, the current anti-fraud method cannot accurately identify the fraudulent call, which will cause the user's property safety and legal rights and interests to be infringed.

[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present application is to provide a fraudulent user identification method, device, electronic device, computer-readable storage medium and computer program product, aiming to solve the technical problem that current anti-fraud methods cannot identify users who use virtual dialing devices to commit fraud.

[0005] To achieve the above objectives, the present application proposes a fraudulent user identification method, which includes:

[0006] Constructing a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user;

[0007] Determine a hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, spatiotemporal change information, and emotion change information of the target user;

[0008] Determining dynamic loading information of the global graph network based on a coupling function between features of each dimension in the global graph network;

[0009] The global graph network, the hyperdimensional feature load matrix and the dynamic loading information are input into a preset fraud user identification network model, and the fraud identification result corresponding to the target user is predicted by the fraud user identification network model.

[0010] In one embodiment, the multi-dimensional feature information includes at least one of psychological feature information, social feature information, device information, consumer behavior information, biological clock information, time-space interaction information, battery status information, call information, geographic information, and time zone information;

[0011] The step of constructing a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user comprises:

[0012] Generate a multidimensional feature vector of the target user according to the target user's psychological feature information, social feature information, device information, consumption behavior information, biological clock information, spatiotemporal interaction information, and battery status information;

[0013] Generate multi-dimensional attribute information corresponding to the calling user and the called user respectively according to the call information, device information, geographic information and time zone information between the target user and the corresponding calling user and the called user;

[0014] Constructing a call layer, a device layer, a geographic layer, and a time zone layer according to the multidimensional feature vector of the target user, the multidimensional feature vector of the calling user or the called user corresponding to the target user, and the multidimensional attribute information;

[0015] The call layer, the device layer, the geographic layer, and the time zone layer are fused to obtain a global graph network of the target user.

[0016] In one embodiment, the step of determining the hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, spatiotemporal change information, and emotion change information of the target user includes:

[0017] A cross-coupling operation is performed on the call frequency and time change information, device switching sharing information, time-space change information, and emotion change information of the target user to obtain a hyper-dimensional feature load matrix corresponding to the target user.

[0018] In one embodiment, the step of determining the dynamic loading information of the global graph network based on the coupling function between the features of each dimension in the global graph network includes:

[0019] Determine the loading coefficient of each dimensional feature in the global graph network over time and the coupling function between each dimensional feature;

[0020] The product of the loading coefficient and the coupling function is time-integrated to obtain dynamic loading information of the global graph network.

[0021] In one embodiment, the fraudulent user identification network model includes at least a backbone network, a neck network, and a head network;

[0022] The step of inputting the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, and determining the corresponding fraud identification result through the fraud user identification network model comprises:

[0023] After the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are input into the fraud user identification network model, multi-scale fusion features in the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are extracted through the backbone network, and the multi-scale fusion features are sent to the neck network;

[0024] The multi-scale fusion features are sampled and feature fusion processed through the neck network, and the corresponding output results are output to the head network;

[0025] The output result of the neck network is processed by the head network to generate a telecommunications fraud identification result of the target user.

[0026] In one embodiment, the backbone network includes at least a Stem module, a CBS module, an MB module and an SPPF module;

[0027] The step of extracting the multi-scale fusion features in the global graph network, the hyperdimensional feature load matrix and the dynamic loading information through the backbone network comprises:

[0028] Perform enhanced sampling and feature extraction on the global graph network, the hyperdimensional feature load matrix and the dynamic loading information through the Stem module in the backbone network, so as to obtain a first enhanced sampling and a first feature extraction result corresponding to the calling user of the target user, a second enhanced sampling and a second feature extraction result of the called user corresponding to the target user, and a third enhanced sampling and a third feature extraction result of the strength information of the relationship between the calling user and the called user;

[0029] The first enhanced sampling, the first feature extraction result, the second enhanced sampling, the second feature extraction result, the third enhanced sampling, and the third feature extraction result are successively subjected to convolution operation and batch normalization processing through the next CBS module in the backbone network to obtain a corresponding output result;

[0030] Processing the output result by using an activation function preset in the backbone network to obtain the strength and noise of the embedded representation of the call event graph neural network;

[0031] Obtaining key information from the strength and noise of the embedding representation of the call event graph neural network through the next MB module of the backbone network;

[0032] Input the key information into the next CBS module, perform convolution operation and batch normalization processing through the next CBS module, obtain the corresponding output result, and return to the execution step: process the output result through the activation function preset in the backbone network until the last SPPF module of the backbone network receives the output result;

[0033] The SPPF module is used to obtain multi-scale fusion features of the embedded representation of the call event graph neural network.

[0034] In one embodiment, before the step of inputting the global graph network, the hyperdimensional feature load matrix, and the dynamic loading information into a preset fraud user identification network model, the method further includes:

[0035] Initializing the initial network model by random model parameters, wherein the model parameters include at least the weights and learning rates of the network layers;

[0036] Performing supergene encoding on the model parameter sets corresponding to the initial network model to obtain first parameter vectors corresponding to each of the model parameter sets;

[0037] The first parameter vector is updated based on a preset supergene interaction operator to obtain a corresponding second parameter vector;

[0038] Fine-tune the second parameter vector based on a preset parameter change operator to obtain a corresponding third parameter vector;

[0039] Inputting a plurality of preset sets of training user data into the initial network model corresponding to the third parameter vector to obtain a prediction recognition result, wherein the training user data at least includes a global graph network, a hyperdimensional feature load matrix and dynamic loading information corresponding to historical users;

[0040] Based on the predicted recognition result and the actual recognition result of the historical user, evaluating the fitness of the initial network model corresponding to the third parameter vector;

[0041] Based on the fitness corresponding to the initial network model, the model parameters of the initial network model are iteratively optimized until the fitness reaches a maximum value, thereby obtaining a fraudulent user identification network model.

[0042] In one embodiment, the step of evaluating the fitness of the initial network model corresponding to the third parameter vector based on the predicted recognition result and the actual recognition result of the historical user includes:

[0043] Calculate the accuracy, recall, misrecognition rate and model complexity of the initial network model according to the predicted recognition result and the actual recognition result of the historical user;

[0044] The fitness of the initial network model is determined according to the accuracy, recall, false recognition rate and model complexity of the initial network model, wherein the accuracy and the recall are respectively proportional to the fitness, and the false recognition rate and the model complexity are respectively inversely proportional to the fitness.

[0045] In addition, to achieve the above purpose, the present application also proposes a fraudulent user identification device, the fraudulent user identification device comprising:

[0046] A network construction module, used to construct a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user;

[0047] A matrix construction module, used to determine the hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, time-space change information and emotion change information of the target user;

[0048] A relationship capture module, used to determine the dynamic loading information of the global graph network based on the coupling function between the features of each dimension in the global graph network;

[0049] The result prediction module is used to input the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, and obtain the fraud identification result corresponding to the target user through the prediction of the fraud user identification network model.

[0050] In addition, to achieve the above-mentioned purpose, the present application also proposes an electronic device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the fraudulent user identification method as described above.

[0051] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the fraudulent user identification method described above are implemented.

[0052] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the fraudulent user identification method described above are implemented.

[0053] This application proposes a fraudulent user identification method, firstly, based on the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user, a global graph network of the target user is constructed, and then the hyper-dimensional feature load matrix corresponding to the target user is determined based on the call frequency and time change information, device switching sharing information, spatio-temporal change information and emotional change information of the target user, and then the dynamic loading information of the global graph network is determined based on the coupling function between the dimensional features in the global graph network, and finally the global graph network, the hyper-dimensional feature load matrix and the dynamic loading information are input into a preset fraudulent user identification network model, and the fraud identification result corresponding to the target user is obtained by predicting the fraudulent user identification network model. In the technical solution of this application, the corresponding global graph network is obtained by deeply fusing the multi-dimensional feature information of the user, and the global graph network can accurately describe the behavioral characteristics of the user in a multi-level and cross-dimensional manner. Then, when identifying fraudulent users, the technical solution of the present application uses a pre-trained fraudulent user identification network, and combines the global graph network of the target user, the hyperdimensional feature load matrix that can reflect the user's call, device, time and space, and emotional information, and the dynamic loading information of the hyperedge that can reflect the global graph network to identify and obtain the final fraud identification result. Compared with the prior art, on the one hand, the technical solution of the present application does not need to set up a fraud call blacklist, so it can avoid the problem of inaccurate fraud identification caused by slow update of the fraud call blacklist. On the other hand, even if the fraudster modifies the location of his number and the number through the "GOIP" device, since the present solution performs fraud identification from the perspective of the target user's multi-dimensional feature information, calls, devices, time and space, and emotional information, it will not be affected by the modified number location and number, and the final accurate fraud identification result. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0055] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0056] Figure 1 A flowchart of the first embodiment of the method for identifying fraudulent users of the present application is provided;

[0057] Figure 2 A schematic diagram of a process for constructing a global graph network of target users in an embodiment of the present application;

[0058] Figure 3 This is a schematic diagram of the structure of a fraud user identification network according to an embodiment of the present application;

[0059] Figure 4 This is a schematic diagram of the network structure of a Stem Block module in an embodiment of the present application;

[0060] Figure 5 Schematic diagram of the network structure of the MB module in the backbone network in the embodiment of the present application;

[0061] Figure 6 This is a schematic diagram of the structure of a fraudulent user identification device in an embodiment of the present application;

[0062] Figure 7 Schematic diagram of the device structure of the hardware operating environment involved in the fraudulent user identification method in the embodiment of the present application.

[0063] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0064] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0065] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0066] The execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, a server, etc., or an electronic device or a control device capable of realizing the above functions. The following takes the server as an execution subject as an example to illustrate this embodiment and the following embodiments.

[0067] In the current identification scheme for fraudulent users, considering that a large part of the current fraudulent calls come from abroad, it is usually necessary to directly block the entry of fraudulent calls by setting up an international fraudulent call blacklist (including the number location blacklist, phone number blacklist, and number segment blacklist). However, since most fraudulent calls and false text messages are currently dialed and sent through "GOIP" devices, commonly known as "cat pools", and "GOIP" devices can modify the number location, remotely operate, two-way calls, and hide the location. Therefore, when the criminal gangs modify the number location and number through the "GOIP" device, the traditional interception method will not be able to accurately identify the fraudulent calls, which may cause the user's property safety and legal rights and interests to be infringed.

[0068] In order to overcome the technical defects in the above-mentioned fraudulent user identification method, the present application embodiment provides a fraudulent user identification method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the fraudulent user identification method of the present application, the fraudulent user identification method comprising:

[0069] Step S10, constructing a global graph network of the target user based on the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user;

[0070] First of all, in order to overcome the defects of traditional fraudulent user identification schemes in which fraudulent users are identified through the user's place of origin and number segment, the embodiments of the present application mainly focus on the multi-dimensional feature information of the user itself, as well as the multi-dimensional feature information between the target user and its corresponding calling user and called user to construct a global graph network of the target user, so as to characterize the target user's all-round and multi-level feature information.

[0071] The target users refer to those users in a specific operation service that are to be identified as fraudulent users. Relevant users can be selected as target users as needed. The specific operation service may be, for example, a call service and a text message service.

[0072] It should be noted that the global graph network integrates multi-dimensional feature information (such as call frequency, device sharing behavior, geographical location overlap, time zone differences and other information of different dimensions), and deeply overlaps the feature information of each dimension. This fusion is not a simple linear superposition, but by introducing multi-level, cross-dimensional relationship modeling, and combining high-order feature interactions, a global graph network with global embedding representation that can accurately describe user behavior is constructed. The information of each dimension is not only processed independently, but also undergoes complex multi-dimensional information interaction in high-dimensional space, breaking the limitations of traditional single-dimensional modeling and being able to capture deeper behavioral patterns of target users. It can provide a more reliable and accurate data basis for fraudulent user identification, and truly reflect the risk of whether the target is a fraudulent user.

[0073] Step S20, determining the hyperdimensional feature load matrix corresponding to the target user according to the target user's call frequency and time change information, device switching sharing information, spatiotemporal change information, and emotion change information.

[0074] In the embodiment of the present application, a hyperdimensional feature load matrix of the target user is also used to identify fraudulent users. The hyperdimensional feature load matrix integrates the characteristics of the target user's call frequency and time change information, device switching sharing information, time and space change information, and emotional change information. This further enriches the input data in the process of identifying fraudulent users, and describes the user's behavioral characteristics more finely and accurately, so as to obtain more accurate and true fraud identification results.

[0075] Step S30, determining the dynamic loading information of the global graph network based on the coupling function between the features of each dimension in the global graph network;

[0076] In the embodiments of the present application, the complex relationship between nodes in the global graph network is captured according to the coupling function between the features of each dimension in the global graph network, and the dynamic loading information of the hyperedges of the global graph network is obtained, so as to realize enhanced sampling and feature extraction of the target user, so that the input data for fraudulent user identification is richer and can truly and comprehensively reflect the behavioral characteristics of the target user itself.

[0077] Step S40, inputting the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, and obtaining the fraud identification result corresponding to the target user through the prediction of the fraud user identification network model.

[0078] Finally, the global graph network, hyperdimensional feature load matrix and dynamic loading information obtained in the previous steps are input into the pre-trained fraud user identification network model, so as to extract and analyze the input global graph network, hyperdimensional feature load matrix and dynamic loading information through the fraud user identification network model, thereby outputting the fraud identification result corresponding to the target user.

[0079] In the embodiment of the present application, the fraud user identification network model can be trained by pre-prepared historical user data with real labels. The network model includes a multi-layer network module or structure. During the training process, the model parameters of the network model are optimized to finally obtain a fraud user identification network model with relatively stable prediction accuracy and performance that meets the requirements. The fraud identification result can be a binary classification result, for example, a fraud user or a non-fraud user.

[0080] In another feasible embodiment, after determining the fraud identification result of the target user, the target user can be further processed. For example, when the fraud result of the target user is a fraudulent user, the target user's incoming calls or text messages can be intercepted to protect the property safety and legal rights and interests of users (including the corresponding calling users and called users) who have established or are about to establish communication contact with the target user.

[0081] In the technical solution of the embodiment of the present application, the corresponding global graph network is obtained by deeply integrating the multi-dimensional feature information of the user. The global graph network can accurately describe the user's behavioral characteristics in a multi-level, cross-dimensional and accurate manner. Then, when identifying fraudulent users, the technical solution of the embodiment of the present application uses the pre-trained fraudulent user identification network, and combines the global graph network of the target user, the hyperdimensional feature load matrix that can reflect the user's call, device, time and space, and emotional information, and the dynamic loading information of the hyperedge that can reflect the global graph network to identify and obtain the final fraud identification result. Compared with the prior art, on the one hand, the embodiment of the present application does not need to set up a fraud call blacklist, so it can avoid the problem of inaccurate fraud identification caused by slow update of the fraud call blacklist. On the other hand, even if the fraudster modifies the location of his number and the number through the "GOIP" device, since the solution of this embodiment is to identify fraud from the multi-dimensional feature information, call, device, time and space, and emotional information of the target user, it will not be affected by the modified number location and number, and the final accurate fraud identification result.

[0082] Further, in a feasible embodiment, the multi-dimensional feature information includes at least one of psychological feature information, social feature information, device information, consumption behavior information, biological clock information, time-space interaction information, battery status information, call information, geographic information, and time zone information;

[0083] In the embodiment of the present application, psychological characteristic information refers to the user's psychological characteristic P i , social characteristic information refers to the social group change information S i , device information may include device switching frequency D i and battery status B iand multi-user device shared information M i , consumer behavior information C i , biological clock information refers to biological clock rhythm information R i , space-time interaction information T i , call information includes the call frequency information of the target user and its calling and called users F ij , geographic information including geographic location overlap information L ij , time zone information refers to the time zone difference dimension information Z ij .

[0084] like Figure 2 As shown, the step of constructing a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user may include:

[0085] Step S11, generating a multidimensional feature vector of the target user according to the target user's psychological feature information, social feature information, device information, consumption behavior information, biological clock information, spatiotemporal interaction information, and battery status information;

[0086] First, obtain the user psychological characteristics P of the target user i , social group change information S i , Equipment switching frequency D i 、Consumer behavior C i , biological clock rhythm information R i , space-time interaction information T i 、Battery status B i Share information with multiple user devices i And other multi-dimensional information, and generate a multi-dimensional feature vector F based on this information i The calculation expression is: F i =[P i ,S i ,D i ,C i ,R i ,E i ,T i ,B i ,M i ].

[0087] Among them, user psychological characteristics P i Refers to the user's psychological state inferred through call frequency, duration, and sentiment analysis. Social group change information S i It refers to analyzing the changes of users and their social groups to generate a social network graph. Device switching frequency D i Record the user's device switching in different time periods. Consumption behavior C iIndicates the correlation between the user's recharge, consumption pattern and call behavior. Biological clock rhythm information R i It is used to analyze the user's activity patterns in different time periods and generate their biological clock rhythm characteristics. i Analyze the user's spatial and temporal interaction behavior through the user's geographic location and time information. Battery status B i Used to monitor the power status of user devices and determine communication behavior when the power is low. Multi-user device shared information M i Used to analyze whether the device is shared by multiple users and detect the device sharing frequency.

[0088] Step S12, generating multi-dimensional attribute information corresponding to the calling user and the called user respectively according to the call information, device information, geographic information and time zone information between the target user and the corresponding calling user and the called user;

[0089] Based on the call frequency information F of the target user and its calling and called users ij , device sharing information M ij , Geographic location overlap information L ij , time zone difference dimension information Z ij Etc. to generate the multi-dimensional attribute information E of the edges of the global graph network ij The calculation expression is: E ij =[F ij ,M ij ,L ij ,Z ij ].

[0090] If the target user i and its calling user j or called user j have used the same device, then M ij is 1; otherwise, M ij is 0. If the geographical locations of target user i and its calling user j or called user j overlap or their distance is within a certain threshold, then L ij is 1; otherwise, L ij 0. Call frequency information F ij It is the number of calls between target user i and its calling user j or called user j within a period of time t. Time zone difference dimension information Z ij It refers to the time zone difference between the target user i and its calling user j or called user j when making a call.

[0091] Step S13, constructing a call layer, a device layer, a geographic layer, and a time zone layer according to the multidimensional feature vector of the target user, the multidimensional feature vector of the calling user or the called user corresponding to the target user, and the multidimensional attribute information;

[0092] Furthermore, the multidimensional feature vector F of the target user i can be used toi , the multidimensional feature vector F of the calling user j or the called user j j and the multi-dimensional attribute information E of the edges of the global graph network ij Build call frequency layers separately Device Shared Layers Geographic location overlay layer Time zone difference layer

[0093] Among them, F j The determination method and the above F i Similar.

[0094]

[0095] Include call frequency layer Device Shared Layers Geographic location overlay layer Time zone difference layer Including call frequency information F ij Weight Device sharing information ij Weight Geographic location overlap information L ij Weight Time zone difference dimension information Z ij Weight σ is the activation function.

[0096] Step S14, the call layer, the device layer, the geographic layer, and the time zone layer are integrated to obtain a global graph network of the target user.

[0097] Finally, layer by call frequency Device Shared Layers Geographic location overlay layer And the time zone difference layer Fusion is performed to obtain the global graph network H i :

[0098] The global graph network in the embodiment of the present application introduces a modeling method of dynamic spatiotemporal features, which can not only capture the behavioral patterns of target users in different time periods, but also construct dynamic spatiotemporal layers through communication data across time zones, geographical location overlap information, etc. This spatiotemporal network combines dynamic feature tracking and multi-time scale embedding, which enables the fraud user identification network model to handle complex scenarios in multiple time zones and multiple locations, thereby effectively identifying fraudulent calls dialed and sent by virtual dialing devices, and improving the accuracy of identifying fraudulent users.

[0099] In a feasible embodiment, the step of determining the hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, spatiotemporal change information, and emotion change information of the target user may include:

[0100] Step S21, cross-coupling operations are performed on the target user's call frequency and time change information, device switching sharing information, time-space change information, and emotion change information to obtain a hyper-dimensional feature load matrix corresponding to the target user.

[0101] Among them, the call frequency and time change information can be used i call The time change information indicates the difference between the target user's call duration and the normal call duration. A call duration that is too long or too short is abnormal. The device switching sharing information is T i device , reflecting information such as user device switching and device sharing frequency. It is understandable that if a user frequently switches devices or multiple users share the same device, it means that the target user is more likely to be a fraudulent user; the spatiotemporal change information is T i spatio-temp , including the user's geographic location and time series information, reflecting the captured behavior changes in the spatiotemporal dimension; emotional change information is represented by T i emotion Representation,features used to capture changes in user emotions, especially through emotional fluctuations in speech or communication text.

[0102] Exemplarily, the expression of the hyperdimensional characteristic load matrix obtained by cross-coupling the above-mentioned various information is: in, The boxes are used to represent the cross-coupling operations of multi-dimensional features, ensuring the interaction between different feature dimensions to improve the F of the final hyper-dimensional feature loading matrix. i The expressive power to describe user characteristics.

[0103] In a feasible embodiment, the step of determining the dynamic loading information of the global graph network based on the coupling function between the dimensional features in the global graph network may include:

[0104] Step S31, determining the loading coefficient of each dimensional feature in the global graph network over time and the coupling function between each dimensional feature;

[0105] Step S32, time-integrate the product of the loading coefficient and the coupling function to obtain dynamic loading information of the global graph network.

[0106] For example, the loading coefficient of each dimension feature in the global graph network over time can be expressed as Λ d(t), d represents the d-th dimension feature, and t represents time; the coupling function between the features of each dimension can be expressed as φ d (F i ,F j ) indicates that, among which, F i and F j They represent the characteristics of target user i and calling user j (or called user) respectively, and the coupling function is used to describe the feature interaction intensity between different nodes in the global graph network.

[0107] The expression for calculating the dynamic loading information of the global graph network is:

[0108]

[0109] Among them, W ij (t) represents the dynamic loading information of the hyperedges of the global graph network, It is used to represent time integral and to capture the dynamic behavior of edge weights changing over time, ensuring that the dynamic loading information of the global graph network can reflect the real-time node relationships in the global graph network.

[0110] In a feasible embodiment, the fraud user identification network model includes at least a backbone network, a neck network and a head network; Figure 3 As shown, in an embodiment of the present application, a fraud user identification network model composed of a backbone network, a neck network and a head network is provided, wherein the backbone network is used to extract multi-scale fusion features in the input global graph network, the hyperdimensional feature load matrix and the dynamic loading information, and the neck network is used to further sample and perform feature fusion processing on the multi-scale fusion features output by the backbone network, and output the output results to the head network, and the head network is used to generate a fraud identification result based on the output results output by the neck network.

[0111] The step of inputting the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model and determining the corresponding fraud identification result through the fraud user identification network model may include:

[0112] Step S41, after the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are input into the fraud user identification network model, the multi-scale fusion features in the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are extracted through the backbone network, and the multi-scale fusion features are sent to the neck network;

[0113] Among them, the backbone network performs feature extraction and feature fusion after receiving the input global graph network, hyperdimensional feature load matrix, dynamic loading information and other information to obtain multi-scale fusion features, and then sends the processed multi-scale fusion features to the next network in the fraud user identification network model for further processing, namely the neck network.

[0114] Furthermore, the backbone network includes at least a Stem module, a CBS module, an MB module and an SPPF module; the step of extracting multi-scale fusion features in the global graph network, the hyperdimensional feature load matrix and the dynamic loading information through the backbone network may include:

[0115] Step S411, performing enhanced sampling and feature extraction on the global graph network, the hyperdimensional feature load matrix, and the dynamic loading information through the Stem module in the backbone network, to obtain a first enhanced sampling and a first feature extraction result corresponding to the calling user of the target user, a second enhanced sampling and a second feature extraction result of the called user corresponding to the target user, and a third enhanced sampling and a third feature extraction result of the strength information of the relationship between the calling user and the called user;

[0116] Step S412, through the next CBS module in the backbone network, the first enhanced sampling, the first feature extraction result, the second enhanced sampling, the second feature extraction result, the third enhanced sampling, and the third feature extraction result are successively subjected to convolution operation and batch normalization processing to obtain a corresponding output result;

[0117] Step S413, processing the output result by using an activation function preset in the backbone network to obtain the strength and noise of the embedded representation of the call event graph neural network;

[0118] Step S414, obtaining key information from the strength and noise of the embedded representation of the call event graph neural network through the next MB module of the backbone network;

[0119] Step S415, input the key information to the next CBS module, perform convolution operation and batch normalization processing through the next CBS module, obtain the corresponding output result, and return to the execution step: process the output result through the activation function preset in the backbone network until the last SPPF module of the backbone network receives the output result;

[0120] Step S416, obtaining multi-scale fusion features of the embedded representation of the call event graph neural network through the SPPF module.

[0121] like Figure 3As shown, the first layer of the backbone network part is the Stem Block module, which is used to enhance the downsampling and feature extraction of the call event graph neural network. The call event graph neural network is used to characterize the multi-level and comprehensive feature information composed of the global graph network, the hyperdimensional feature load matrix and the dynamic loading information for characterizing the target user during the call time.

[0122] Furthermore, the network structure of the Stem Block module is as follows Figure 4 As shown, the CBS (combination of Conv2d (convolution) + BatchNom2d (batch normalization) + SILU (activation function)) module refers to a collection of convolution, batch normalization and sigmoid (an excitation function), which is used to perform convolution, batch normalization and sigmoid on the notification extracted from the call event graph neural network, wherein the call event graph neural network refers to a neural network related to the call event of the target user formed by the global graph network, the hyperdimensional feature load matrix and the dynamic loading information sigmoid, and the sigmoid can use the SiLU (a nonlinear activation function) activation function. In the embodiment of the present application, the enhanced sampling and feature extraction of the input data such as the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are realized by convolution processing, batch normalization processing and activation function processing, so as to obtain the first enhanced sampling and the first feature extraction result corresponding to the calling user of the target user, the second enhanced sampling and the second feature extraction result of the called user corresponding to the target user, and the third enhanced sampling and the third feature extraction result of the strength information of the relationship between the calling user and the called user. Maxpool2d is the maximum pooling layer, which is used to reduce the dimension of the feature map and reduce the amount of calculation while retaining important feature information.

[0123] The aforementioned enhanced sampling and feature extraction results are further input into the next CBS module of the backbone network. After receiving the above features, the CBS module first performs a convolution operation to filter and connect the features of a single step from the input to the output of the Stem Block module; then the convolution operation results are batch normalized to scale the output results of the convolution layer, thereby ensuring faster training of the telecommunications fraud user identification network and accelerating the learning process; finally, SiLU is used as the activation function and nonlinearity is added to check the strength and noise of the embedded representation of the call event graph neural network, and the output result is obtained, that is, the inspection result of the strength and noise of the embedded representation of the call event graph neural network. After obtaining the inspection results of the strength and noise of the embedded representation of the call event graph neural network, the CBS module sends it to the next MB (MobileNetV2) module. The MB module can obtain the corresponding key information from the strength and noise information of the embedded representation of the call event graph neural network, and then send the key information to the next CBS module. The next CBS module executes the aforementioned steps S412, S413, etc. The next CBS module is below the next MB module, and so on until the output result is delivered to the SPPF (SpatialPyramid Pooling Fast) module.

[0124] like Figure 3 As shown in the figure, the backbone network is distributed with a StemBlock module, two groups of CBS modules and MB modules, two groups of CBS modules and C3 (integrated depthwise separable convolution) modules, and a SPPF module. Among them, the composition of the CBS module and the C3 module is the same as that of the existing YOLOv5s network. You can refer to the processing method of the YOLOv5s network, which will not be repeated here.

[0125] After the SPPF module receives the output result of the C3 module, it obtains the multi-scale fusion features of the embedded representation of the call event graph neural network based on the multi-scale fusion capability of the SPPF module, and sends the multi-scale fusion features to the first CBS module in the neck network (i.e. Figure 3 The first CBS module from bottom to top in the middle neck network is processed, and the upsampling operation is continued after the processing result is obtained.

[0126] Step S42, sampling and feature fusion processing of multi-scale fusion features are performed through the neck network, and the corresponding output results are output to the head network;

[0127] Specifically, after the first CBS module in the neck network performs a sampling operation, the sampling operation result is sent to the first BiFPN convert module (i.e. Figure 3The first BiFPN convert module from bottom to top in the middle neck network), after receiving the upsampling operation result, adopts a more iterative bidirectional fusion strategy and combines the bidirectional cross-scale connection with the fast normalization fusion.

[0128] Among them, the operation process and structure of processing the bidirectional cross-scale connection and fast normalization fusion results obtained based on the first BiFPN convert module can be referred to Figure 4 The network structure finally outputs the output result to the head network. Exemplarily, the neck network also includes an Upsample module (a module for enlarging the size of the input data). The Upsample module is mainly used in the neural network to implement the above sampling operation, and can also improve the resolution of the image or restore the details of the image. In this way, the network can better reconstruct high-resolution images or feature maps, thereby improving the performance and output quality of the model.

[0129] Step S43: Process the output result of the neck network through the head network to generate a fraud identification result of the target user.

[0130] The head network has an output layer that can generate corresponding fraud identification results based on the output results of the neck network. For example, when the fraud identification result is a binary classification result, the head network can determine whether the target user is a fraudulent user or a non-fraudulent user based on the output results of the neck network.

[0131] In another feasible embodiment, the present application embodiment also provides a method for training a fraud user identification network model. Before model training, the network structure of the initial network model needs to be determined. The structure of the initial network model can be as follows: Figure 3 The above mentioned include backbone network, neck network and head network etc.

[0132] It should be noted that if Figure 4 As shown, although the CBS module and the depth-separable convolution in the Stem Block both include Conv2d-BatchNorm-SiLU, there are certain differences between the two. Specifically, the Conv2d in the CBS module performs standard convolution, while the Conv2d in the depth-separable convolution only performs depth and point-by-point convolution. In addition, in the embodiment of the present application, by integrating the depth-separable convolution in the C3 module, the model parameters can be minimized without affecting the accuracy of telecommunications fraud recognition.

[0133] Furthermore, the MB module in the backbone network is as follows Figure 5As shown in the figure, different MB modules with stride=1 and stride=2 are included. The range of each MB module is determined by the number of layers, and the overall network size of the initial network model is determined by the number of MB modules and the input tensor. Among them, Conv1*1 represents the size of the convolutional layer, Linear represents the fully connected layer, Dwise3*3 represents the activation layer, and Relu6 represents the activation function.

[0134] Secondly, in the neck network, the BiFPN convert module adopts a more iterative bidirectional fusion strategy to ensure that both deep and shallow layers benefit from continuous bidirectional data flow. In addition, the BiFPN convert module combines bidirectional cross-scale connections with fast normalized fusion. The PANet network in the traditional YOLOv5s network adopts a top-down approach to guide the extracted feature information from deeper high-level layers to shallower low-level layers.

[0135] Specifically, the fused calculation expression is as follows:

[0136]

[0137] Among them, O represents the fusion output; I i represents the i-th input information; w i Represents the weight of the i-th input information.

[0138] In the technical solution of the embodiment of the present application, when the bidirectional cross-scale connection is combined with the fast normalized fusion through the fusion strategy, the expression of the intermediate feature at the i-th position of the top-down path in the neck network can be described as follows:

[0139]

[0140] Among them, P i td represents the intermediate feature at the i-th position of the top-down path in the neck network; P i in represents the input at the i-th position of the top-down path in the neck network.

[0141] Correspondingly, the output features of the intermediate features at the i-th position of the top-down path in the neck network can be described as follows:

[0142]

[0143] Among them, P i out The output features representing the intermediate features at the ith position of the top-down path in the neck network.

[0144] It should be noted that the multi-dimensional feature information of the target user obtained in the embodiment of the present application is different from the user information used in the traditional technology for identifying telephone fraud users. Therefore, the model parameters of the initial network model need to be re-determined.

[0145] Specifically, before the step of inputting the global graph network, the hyperdimensional feature load matrix, and the dynamic loading information into a preset fraud user identification network model, the method may further include:

[0146] Step A10, initializing the initial network model by random model parameters, wherein the model parameters at least include the weights and learning rates of the network layers;

[0147] Step A20, performing supergene encoding on the model parameter set corresponding to the initial network model to obtain first parameter vectors corresponding to each model parameter set;

[0148] Step A30, updating the first parameter vector based on a preset supergene interaction operator to obtain a corresponding second parameter vector;

[0149] Step A40, fine-tuning the second parameter vector based on a preset parameter change operator to obtain a corresponding third parameter vector;

[0150] Step A50, inputting a plurality of preset sets of training user data into the initial network model corresponding to the third parameter vector to obtain a prediction recognition result, wherein the training user data at least includes a global graph network corresponding to historical users, a hyperdimensional feature load matrix, and dynamic loading information;

[0151] Step A60, evaluating the fitness of the initial network model corresponding to the third parameter vector based on the predicted recognition result and the actual recognition result of the historical user;

[0152] Step A70, based on the fitness corresponding to the initial network model, iteratively optimize the model parameters of the initial network model until the fitness reaches a maximum value, thereby obtaining a fraudulent user identification network model.

[0153] In model training, the initial network model with a preset network structure is first initialized, and one or more sets of model parameters (including the weights and learning rates of each network layer, etc.) are randomly set. Then, the model parameters initialized in the previous step are super-encoded so that each set of parameters is represented as the first parameter vector Θ in vector form, which contains the weights, learning rates, and other parameters that regulate the behavior of the model for each network layer. The specific encoding form is as follows:

[0154] Θ=[L1,L2,...,L n ,η1,η2,...,η m ,Λ1,...,Λd ];

[0155] Among them, L i To control the feature aggregation of network layer i in the telecommunication fraud user identification network; η i represents the learning rate of network layer i in the telecommunications fraud user identification network, which is used to dynamically adjust the update step size of the model parameters; Λ i It is used to control the importance of features of different dimensions, so that the model can adaptively adjust the weights according to different dimensional information (such as call frequency, device switching, etc.).

[0156] Among them, supergene encoding can be understood as a complex set of genes in the genome, which represents the set of various hyperparameters (such as weights, learning rates, etc.) in the machine learning model, and encodes these hyperparameters into a unified vector Θ. This encoding method can integrate all the key parameters in the model (i.e., parameters that affect the model training and reasoning behavior) together, and represent and optimize them through a vector. In the deep learning model, the weights, learning rates, regularization coefficients, momentum, batch sizes, etc. of each layer are hyperparameters, which control the training process and final performance of the model. Here, these hyperparameter sets are represented as a unified vector Θ. This vector Θ is the "genetic information" of the model behavior, similar to the genome in biology, which determines the "phenotype" of the model, that is, the performance and behavior of the final model.

[0157] Furthermore, after obtaining the first parameter vector, the first parameter vector can be updated by a preset supergene interaction operator to obtain a corresponding second parameter vector. Specifically, the expression for adjusting the first parameter vector by the supergene interaction operator can be expressed as:

[0158]

[0159] Among them, Γ represents the interaction operator, which is used to generate a new second parameter vector, τ is the nonlinear control parameter, which determines the equilibrium state of the interaction operator; Θ parent1 ,Θ parent2 They represent two sets of first parameter vectors of the initial network model in the last training. In the process of updating the first parameter vector, the interaction between each set of first parameter vectors is mainly used to derive the corresponding second parameter vector, which is an effective parameter update method.

[0160] Among them, the supergene interaction operator is an operation for parameter update, which realizes the generation and adjustment of new parameter sets by combining the characteristics of different model parameter sets. This operator is essentially a nonlinear transformation, which is used to simulate the "genetic interaction" or "fusion" between model parameters to achieve efficient update and optimization of model parameters.

[0161] After the second parameter vector is obtained, the second parameter vector may be fine-tuned based on a preset parameter change operator to further update the parameter vector and obtain a third parameter vector.

[0162] Exemplarily, the calculation expression for updating the second parameter vector is:

[0163]

[0164] Among them, Ω i Represents the factor strength of the parameter change operator; μ is used to control the amplitude of the model parameter mutation direction of the telecommunications fraud user identification network; N(0,1) represents the standard normal distribution to ensure the randomness of the model parameter change update.

[0165] It should be noted that although both the supergene interaction operator and the parameter change operator adjust the model parameters, their purposes and functions are different. They belong to two different levels of parameter adjustment strategies, which respectively achieve the goals of parameter interaction fusion and individual perturbation optimization. Among them, the supergene interaction operator is a larger-scale parameter adjustment, and the focus is on increasing the model's adaptability to complex data distribution through nonlinear fusion. Therefore, step A30 is more inclined to fuse the two sets of model parameters globally, extract the dominant characteristics of the parent generation and generate a new parameter set, so that the model finds a balance between different characteristics. In step A40, for each specific parameter Θ i Fine-tuning, that is, step A40 is more inclined to "fine-tune" the parameters, which is to further optimize the performance of individual parameters based on the global parameters generated in the previous stage. After the two layers of parameter adjustment, the model parameters can inherit the advantages of the parent generation, and each model parameter can be individually optimized and fine-tuned, making the model update and optimization process more efficient and refined, and can more quickly find the optimal set of parameter combinations to maximize the fitness, and obtain a fraud user identification network model.

[0166] After completing the parameter update of the initial network model, it is necessary to evaluate the performance of the updated model and the model before the update to continuously optimize the performance of the model. When evaluating the performance of the model, it can be based on the pre-collected multiple sets of training user data to input into the model after the model parameters are optimized, and the corresponding predicted recognition results (such as fraudulent users or non-fraudulent users) are predicted. It can be understood that the training user data includes not only the global graph network corresponding to the historical user, the hyperdimensional feature load matrix and the dynamic loading information and other input data, but also the real label (i.e. the real recognition result). The greater the gap between the predicted recognition result output by the initial network model and the real recognition result, the lower the fitness of the initial network model. Therefore, in the process of iterative training of the initial network model, maximizing the fitness is the optimization goal, until the fitness of the initial network model is maximized and converged, the training can be stopped to determine the current initial network model as a fraudulent user recognition network model. The fraudulent user recognition network model can be used to identify whether the target user is a fraudulent user in a scene where fraud identification is required.

[0167] In another feasible embodiment, after the fraud user identification network model is determined, in the subsequent application process, if it is found that its prediction accuracy cannot meet the actual application requirements, the fraud user identification model can be further updated based on the training user data in the current application scenario to optimize the performance and generalization ability of the fraud user identification model.

[0168] Further, in a feasible embodiment, the step of evaluating the fitness of the initial network model corresponding to the third parameter vector based on the predicted recognition result and the real recognition result of the historical user may include:

[0169] Step A61, calculating the accuracy, recall, false recognition rate and model complexity of the initial network model according to the predicted recognition results and the actual recognition results of historical users;

[0170] Step A62, determining the fitness of the initial network model according to the accuracy, recall, false recognition rate and model complexity of the initial network model, wherein the accuracy and recall are respectively proportional to the fitness, and the false recognition rate and model complexity are respectively inversely proportional to the fitness.

[0171] The embodiment of the present application provides a method for specifically calculating the fitness of an optimized initial network model, providing a basis for optimizing the model parameters of the initial network model.

[0172] After obtaining the predicted recognition results and the actual recognition results of historical users, it is possible to determine whether the predicted recognition results of each historical user are consistent with the actual recognition results. If they are consistent, the recognition is correct. Specifically, the accuracy rate refers to the ratio of the number of samples correctly predicted by the model to the total number of samples, the recall rate refers to the ratio of the number of positive samples correctly predicted by the model to the number of actual positive samples, the false recognition rate refers to the ratio of the negative examples that the model mistakenly predicts as positive examples, and the model complexity can refer to the computational complexity, structural complexity, and parameter complexity. The above indicators can evaluate the performance of the model from different angles.

[0173] For example, the expression for calculating fitness based on the above accuracy, recall rate, false recognition rate and model complexity can be:

[0174] f fitmeas =α·A+β·R-γ·FPR-δ·MC;

[0175] Among them, f fitmeas It refers to the fitness of the model. α, β, γ, and δ are the updated weight coefficients corresponding to the network layers in the initial network model, which are used to control the influence of each target in the fitness. A represents the overall accuracy of the telecommunications fraud user identification network; R represents the recall rate of the telecommunications fraud user identification network; FPR represents the false recognition rate of the model; and MC represents the complexity of the model.

[0176] Based on the aforementioned embodiments of the present application, it can be known that the fraud user identification method of the present application mainly constructs the global graph network of the target user and determines the hyperdimensional feature load matrix of the target user based on the multi-dimensional information of the target user, and captures the complex relationship between nodes in the global graph network through the dynamic loading information of the hyperedges of the global graph network. The above data are used as the input data of the fraud user identification network model, and the behavioral characteristics of the target user are more comprehensively and deeply portrayed and characterized, thereby effectively improving the accuracy and precision of fraud user identification. On the other hand, in the process of training the fraud user identification network model, the model parameters of the telecommunications fraud user identification network are trained through supergene interaction operators and parameter change operators, and the model of the fraud user identification network is iteratively optimized, which improves the efficiency of model parameter optimization and reduces the training amount and training time during the model training process.

[0177] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the fraudulent user identification method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0178] The present application also provides a fraud user identification device, referring to Figure 6 , the fraud user identification device comprises:

[0179] A network construction module 10, configured to construct a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user;

[0180] A matrix construction module 20, for determining a hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, spatiotemporal change information, and emotion change information of the target user;

[0181] A relationship capturing module 30, configured to determine dynamic loading information of the global graph network based on a coupling function between features of each dimension in the global graph network;

[0182] The result prediction module 40 is used to input the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, and predict the fraud identification result corresponding to the target user through the fraud user identification network model.

[0183] In one embodiment, the multi-dimensional feature information includes at least one of psychological feature information, social feature information, device information, consumer behavior information, biological clock information, time-space interaction information, battery status information, call information, geographic information, and time zone information;

[0184] The network building module 10 is also used for:

[0185] Generate a multidimensional feature vector of the target user according to the target user's psychological feature information, social feature information, device information, consumption behavior information, biological clock information, spatiotemporal interaction information, and battery status information;

[0186] Generate multi-dimensional attribute information corresponding to the calling user and the called user respectively according to the call information, device information, geographic information and time zone information between the target user and the corresponding calling user and the called user;

[0187] Constructing a call layer, a device layer, a geographic layer, and a time zone layer according to the multidimensional feature vector of the target user, the multidimensional feature vector of the calling user or the called user corresponding to the target user, and the multidimensional attribute information;

[0188] The call layer, the device layer, the geographic layer, and the time zone layer are fused to obtain a global graph network of the target user.

[0189] In one embodiment, the matrix construction module 20 is further configured to:

[0190] A cross-coupling operation is performed on the call frequency and time change information, device switching sharing information, time-space change information, and emotion change information of the target user to obtain a hyper-dimensional feature load matrix corresponding to the target user.

[0191] In one embodiment, the relationship capturing module 30 is further configured to:

[0192] Determine the loading coefficient of each dimensional feature in the global graph network over time and the coupling function between each dimensional feature;

[0193] The product of the loading coefficient and the coupling function is time-integrated to obtain dynamic loading information of the global graph network.

[0194] In one embodiment, the fraudulent user identification network model includes at least a backbone network, a neck network, and a head network;

[0195] The result prediction module 40 is also used for:

[0196] After the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are input into the fraud user identification network model, multi-scale fusion features in the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are extracted through the backbone network, and the multi-scale fusion features are sent to the neck network;

[0197] The multi-scale fusion features are sampled and feature fusion processed through the neck network, and the corresponding output results are output to the head network;

[0198] The output result of the neck network is processed by the head network to generate a telecommunications fraud identification result of the target user.

[0199] In one embodiment, the backbone network includes at least a Stem module, a CBS module, an MB module and an SPPF module;

[0200] The result prediction module 40 is also used for:

[0201] Perform enhanced sampling and feature extraction on the global graph network, the hyperdimensional feature load matrix and the dynamic loading information through the Stem module in the backbone network, so as to obtain a first enhanced sampling and a first feature extraction result corresponding to the calling user of the target user, a second enhanced sampling and a second feature extraction result of the called user corresponding to the target user, and a third enhanced sampling and a third feature extraction result of the strength information of the relationship between the calling user and the called user;

[0202] The first enhanced sampling, the first feature extraction result, the second enhanced sampling, the second feature extraction result, the third enhanced sampling, and the third feature extraction result are successively subjected to convolution operation and batch normalization processing through the next CBS module in the backbone network to obtain a corresponding output result;

[0203] Processing the output result by using an activation function preset in the backbone network to obtain the strength and noise of the embedded representation of the call event graph neural network;

[0204] Obtaining key information from the strength and noise of the embedding representation of the call event graph neural network through the next MB module of the backbone network;

[0205] Input the key information into the next CBS module, perform convolution operation and batch normalization processing through the next CBS module, obtain the corresponding output result, and return to the execution step: process the output result through the activation function preset in the backbone network until the last SPPF module of the backbone network receives the output result;

[0206] The SPPF module is used to obtain multi-scale fusion features of the embedded representation of the call event graph neural network.

[0207] In one embodiment, the fraud user identification device further includes a model training module, and the model training module is used to:

[0208] Initializing the initial network model by random model parameters, wherein the model parameters include at least the weights and learning rates of the network layers;

[0209] Performing supergene encoding on the model parameter sets corresponding to the initial network model to obtain first parameter vectors corresponding to each of the model parameter sets;

[0210] The first parameter vector is updated based on a preset supergene interaction operator to obtain a corresponding second parameter vector;

[0211] Fine-tune the second parameter vector based on a preset parameter change operator to obtain a corresponding third parameter vector;

[0212] Inputting a plurality of preset sets of training user data into the initial network model corresponding to the third parameter vector to obtain a prediction recognition result, wherein the training user data at least includes a global graph network, a hyperdimensional feature load matrix and dynamic loading information corresponding to historical users;

[0213] Based on the predicted recognition result and the actual recognition result of the historical user, evaluating the fitness of the initial network model corresponding to the third parameter vector;

[0214] Based on the fitness corresponding to the initial network model, the model parameters of the initial network model are iteratively optimized until the fitness reaches a maximum value, thereby obtaining a fraudulent user identification network model.

[0215] In one embodiment, the model training module is further used to:

[0216] Calculate the accuracy, recall, misrecognition rate and model complexity of the initial network model according to the predicted recognition result and the actual recognition result of the historical user;

[0217] The fitness of the initial network model is determined according to the accuracy, recall, false recognition rate and model complexity of the initial network model, wherein the accuracy and the recall are respectively proportional to the fitness, and the false recognition rate and the model complexity are respectively inversely proportional to the fitness.

[0218] The fraud user identification device provided by the present application adopts the fraud user identification method in the above embodiment, which can solve the technical problem that the current anti-fraud method cannot identify the user who uses the virtual dialing device to commit fraud. Compared with the prior art, the beneficial effects of the fraud user identification device provided by the present application are the same as the beneficial effects of the fraud user identification method provided by the above embodiment, and the other technical features in the fraud user identification device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0219] The present application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the fraudulent user identification method in the above-mentioned embodiment 1.

[0220] Reference below Figure 7 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic devices in the embodiments of the present application may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0221] like Figure 7As shown, the electronic device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the electronic device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0222] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0223] The electronic device provided by the present application adopts the fraud user identification method in the above embodiment, which can solve the technical problem that the current anti-fraud method cannot identify the user who uses the virtual dialing device to commit fraud. Compared with the prior art, the beneficial effects of the electronic device provided by the present application are the same as the beneficial effects of the fraud user identification method provided by the above embodiment, and other technical features in the electronic device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0224] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0225] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0226] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the fraudulent user identification method in the above-mentioned embodiment.

[0227] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0228] The computer-readable storage medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0229] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by an electronic device, the electronic device: constructs a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user; determines the hyper-dimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, spatio-temporal change information and emotional change information of the target user; determines the dynamic loading information of the global graph network based on the coupling function between the features of each dimension in the global graph network; inputs the global graph network, the hyper-dimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, and obtains the fraud identification result corresponding to the target user through the prediction of the fraud user identification network model.

[0230] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0231] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0232] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0233] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned fraudulent user identification method, and can solve the technical problem that the current anti-fraud method cannot identify users who use virtual dialing devices to commit fraud. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the fraudulent user identification method provided by the above-mentioned embodiment, and will not be repeated here.

[0234] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned fraudulent user identification method when executed by a processor.

[0235] The computer program product provided by the present application can solve the technical problem that the current anti-fraud method cannot identify users who use virtual dial-up devices to commit fraud. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the fraud user identification method provided by the above embodiment, which will not be repeated here.

[0236] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A fraudulent user identification method, characterized in that: The fraud user identification method comprises: Constructing a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user; Determine a hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, spatiotemporal change information, and emotion change information of the target user; Determining dynamic loading information of the global graph network based on a coupling function between features of each dimension in the global graph network; The global graph network, the hyperdimensional feature load matrix and the dynamic loading information are input into a preset fraud user identification network model, and the fraud identification result corresponding to the target user is predicted by the fraud user identification network model.

2. The fraud user identification method according to claim 1, characterized in that: The multi-dimensional feature information includes at least one of psychological feature information, social feature information, device information, consumer behavior information, biological clock information, time-space interaction information, battery status information, call information, geographic information, and time zone information; The step of constructing a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user comprises: Generate a multidimensional feature vector of the target user according to the target user's psychological feature information, social feature information, device information, consumption behavior information, biological clock information, spatiotemporal interaction information, and battery status information; Generate multi-dimensional attribute information corresponding to the calling user and the called user respectively according to the call information, device information, geographic information and time zone information between the target user and the corresponding calling user and the called user; Constructing a call layer, a device layer, a geographic layer, and a time zone layer according to the multidimensional feature vector of the target user, the multidimensional feature vector of the calling user or the called user corresponding to the target user, and the multidimensional attribute information; The call layer, the device layer, the geographic layer, and the time zone layer are fused to obtain a global graph network of the target user.

3. The fraud user identification method according to claim 1, characterized in that: The step of determining the hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, spatiotemporal change information, and emotion change information of the target user comprises: A cross-coupling operation is performed on the call frequency and time change information, device switching sharing information, time-space change information, and emotion change information of the target user to obtain a hyper-dimensional feature load matrix corresponding to the target user.

4. The fraud user identification method according to claim 1, characterized in that: The step of determining the dynamic loading information of the global graph network based on the coupling function between the features of each dimension in the global graph network comprises: Determine the loading coefficient of each dimensional feature in the global graph network over time and the coupling function between each dimensional feature; The product of the loading coefficient and the coupling function is time-integrated to obtain dynamic loading information of the global graph network.

5. The fraud user identification method according to claim 1, characterized in that: The fraudulent user identification network model at least includes a backbone network, a neck network and a head network; The step of inputting the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, and determining the corresponding fraud identification result through the fraud user identification network model comprises: After the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are input into the fraud user identification network model, multi-scale fusion features in the global graph network, the hyperdimensional feature load matrix and the dynamic loading information are extracted through the backbone network, and the multi-scale fusion features are sent to the neck network; The multi-scale fusion features are sampled and feature fusion processed through the neck network, and the corresponding output results are output to the head network; The output result of the neck network is processed by the head network to generate a telecommunications fraud identification result for the target user.

6. The fraud user identification method according to claim 5, characterized in that: The backbone network includes at least a Stem module, a CBS module, an MB module and an SPPF module; The step of extracting the multi-scale fusion features in the global graph network, the hyperdimensional feature load matrix and the dynamic loading information through the backbone network comprises: Perform enhanced sampling and feature extraction on the global graph network, the hyperdimensional feature load matrix and the dynamic loading information through the Stem module in the backbone network, so as to obtain a first enhanced sampling and a first feature extraction result corresponding to the calling user of the target user, a second enhanced sampling and a second feature extraction result of the called user corresponding to the target user, and a third enhanced sampling and a third feature extraction result of the strength information of the relationship between the calling user and the called user; The first enhanced sampling, the first feature extraction result, the second enhanced sampling, the second feature extraction result, the third enhanced sampling, and the third feature extraction result are successively subjected to convolution operation and batch normalization processing through the next CBS module in the backbone network to obtain a corresponding output result; Processing the output result by using an activation function preset in the backbone network to obtain the strength and noise of the embedded representation of the call event graph neural network; Obtaining key information from the strength and noise of the embedding representation of the call event graph neural network through the next MB module of the backbone network; Input the key information into the next CBS module, perform convolution operation and batch normalization processing through the next CBS module, obtain the corresponding output result, and return to the execution step: process the output result through the activation function preset in the backbone network until the last SPPF module of the backbone network receives the output result; The SPPF module is used to obtain multi-scale fusion features of the embedded representation of the call event graph neural network.

7. The fraudulent user identification method according to any one of claims 1 to 6, characterized in that: Before the step of inputting the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, the method further includes: Initializing the initial network model by random model parameters, wherein the model parameters include at least the weights and learning rates of the network layers; Performing supergene encoding on the model parameter sets corresponding to the initial network model to obtain first parameter vectors corresponding to each of the model parameter sets; The first parameter vector is updated based on a preset supergene interaction operator to obtain a corresponding second parameter vector; Fine-tune the second parameter vector based on a preset parameter change operator to obtain a corresponding third parameter vector; Inputting a plurality of preset sets of training user data into the initial network model corresponding to the third parameter vector to obtain a prediction recognition result, wherein the training user data at least includes a global graph network, a hyperdimensional feature load matrix and dynamic loading information corresponding to historical users; Based on the predicted recognition result and the actual recognition result of the historical user, evaluating the fitness of the initial network model corresponding to the third parameter vector; Based on the fitness corresponding to the initial network model, the model parameters of the initial network model are iteratively optimized until the fitness reaches a maximum value, thereby obtaining a fraudulent user identification network model.

8. The fraudulent user identification method according to claim 7, characterized in that: The step of evaluating the fitness of the initial network model corresponding to the third parameter vector based on the predicted recognition result and the real recognition result of the historical user includes: Calculate the accuracy, recall, misrecognition rate and model complexity of the initial network model according to the predicted recognition result and the actual recognition result of the historical user; The fitness of the initial network model is determined according to the accuracy, recall, false recognition rate and model complexity of the initial network model, wherein the accuracy and the recall are respectively proportional to the fitness, and the false recognition rate and the model complexity are respectively inversely proportional to the fitness.

9. A fraud user identification device, characterized in that: The fraud user identification device comprises: A network construction module, used to construct a global graph network of the target user according to the multi-dimensional feature information of the target user and the multi-dimensional feature information between the target user and the corresponding calling user and called user; A matrix construction module, used to determine the hyperdimensional feature load matrix corresponding to the target user according to the call frequency and time change information, device switching sharing information, time-space change information and emotion change information of the target user; A relationship capture module, used to determine the dynamic loading information of the global graph network based on the coupling function between the features of each dimension in the global graph network; The result prediction module is used to input the global graph network, the hyperdimensional feature load matrix and the dynamic loading information into a preset fraud user identification network model, and obtain the fraud identification result corresponding to the target user through the prediction of the fraud user identification network model.

10. An electronic device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the fraudulent user identification method according to any one of claims 1 to 8.

11. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the fraudulent user identification method according to any one of claims 1 to 8 are implemented.

12. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the fraudulent user identification method according to any one of claims 1 to 8 are implemented.

Images