Fraudulent behavior identification method and device, storage medium and computer equipment

Abstract

The invention relates to the technical field of computers and finance, and particularly discloses a fraudulent behavior identification method and device, a storage medium and computer equipment, and the method comprises the steps: obtaining a plurality of to-be-identified complete call records, segmenting each complete call record, and obtaining a plurality of record segments; for a plurality of recording segments, identifying the recording segment with the dialogue role as the user from the recording segments, determining a target recording segment based on the recording segment with the dialogue role as the user, performing voiceprint feature extraction on the target recording segment, obtaining voiceprint feature vectors based on an extraction result, and performing clustering processing on each voiceprint feature vector; determining suspected fraudulent call records from all the complete call records according to a clustering result; and for each suspected fraudulent call record, converting the suspected fraudulent call record into text data, determining a fraudulent probability score corresponding to the text data through the large model, and judging whether the suspected fraudulent call record comprises a fraudulent behavior based on the fraudulent probability score.

Description

Technical Field

[0001] The present application relates to the fields of computer and financial technology, and in particular to a method and device for identifying fraudulent behavior, a storage medium, and a computer device. Background Art

[0002] In the financial industry, customer service and transaction processing are the core of the business. With the advancement of digital transformation, a large number of customer interactions are conducted through telephone channels. However, this channel has also become a hotbed for fraudulent activities. For example, in the insurance industry, behaviors such as agent cancellations and malicious complaints not only damage the interests of insurance companies, but also affect customer experience and market order. In banking business, behaviors such as false account opening and loan fraud have also brought huge economic losses and reputation risks to financial institutions. With the continuous evolution and complexity of fraud methods, traditional risk identification methods can no longer meet current needs.

[0003] Traditional risk identification methods, such as rule-based systems and manual review, can identify and prevent potential fraud to a certain extent, but their inherent limitations are becoming increasingly prominent. Among them, rule-based systems mainly rely on historical data and preset empirical rules to identify fraud. However, this method is less flexible and difficult to adapt to rapidly changing fraud methods. As fraudsters continue to adopt new technologies and strategies, traditional rule systems often cannot be updated in a timely manner, resulting in a decline in recognition capabilities. Manual review is a more direct but less efficient method. It is not only time-consuming and labor-intensive, but also easily affected by the subjective judgment of auditors, making it difficult to ensure the accuracy and consistency of recognition results. Especially when dealing with large-scale data, the efficiency and effectiveness of manual review are greatly reduced. In addition, traditional technical means are often unable to extract and analyze key information in voice data. This is not only because voice data itself is complex and diverse, but also because existing technologies lack effective processing and analysis methods for voice data. Summary of the invention

[0004] In view of this, the present application provides a method and device for identifying fraudulent behavior, a storage medium, and a computer device. Through automated voiceprint recognition and fraud analysis, the need for manual review is greatly reduced, and the efficiency and response speed of risk management are improved; by utilizing voiceprint features and large model analysis, fraudulent behaviors that are difficult to detect by traditional methods can be identified, significantly improving the accuracy of risk identification; fast and accurate risk identification reduces unnecessary customer review processes, thereby improving the customer service experience.

[0005] According to one aspect of the present application, a method for identifying fraudulent behavior is provided, comprising:

[0006] Acquire multiple complete call recordings to be identified from a target platform, segment each complete call recording, and obtain multiple recording segments corresponding to the complete call recording, wherein each recording segment corresponds to a dialogue role, and the dialogue role is a customer service representative or a user;

[0007] For each of the multiple recording segments corresponding to the complete call recording, identify the recording segment in which the dialogue role is the user from the multiple recording segments, and determine at least one target recording segment based on the recording segment in which the dialogue role is the user, perform voiceprint feature extraction on each target recording segment, obtain a voiceprint feature vector corresponding to the target recording segment based on the extraction result, perform clustering processing on the voiceprint feature vectors corresponding to each of the complete call recordings, and determine a suspected fraudulent call recording from each of the complete call recordings according to the clustering result;

[0008] For each suspected fraudulent call recording, the suspected fraudulent call recording is converted into text data, and a fraud probability score corresponding to the text data is determined through a large model. Based on the fraud probability score, it is determined whether the suspected fraudulent call recording includes fraudulent behavior.

[0009] According to another aspect of the present application, a fraudulent behavior identification device is provided, comprising:

[0010] A recording segmentation module is used to obtain multiple complete call recordings to be identified from a target platform, segment each complete call recording, and obtain multiple recording segments corresponding to the complete call recording, wherein each recording segment corresponds to a dialogue role, and the dialogue role is a customer service or a user;

[0011] a clustering module for identifying, for each of the multiple recording segments corresponding to the complete call recording, a recording segment in which the dialogue role is the user from the multiple recording segments, and determining at least one target recording segment based on the recording segment in which the dialogue role is the user, performing voiceprint feature extraction on each target recording segment, obtaining a voiceprint feature vector corresponding to the target recording segment based on the extraction result, and performing clustering processing on the voiceprint feature vectors corresponding to each complete call recording, and determining a suspected fraudulent call recording from each complete call recording according to the clustering result;

[0012] The fraud behavior identification module is used to convert each suspected fraud call recording into text data, and determine the fraud probability score corresponding to the text data through a large model, and based on the fraud probability score, determine whether the suspected fraud call recording includes fraud behavior.

[0013] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned method for identifying fraudulent behavior is implemented.

[0014] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned fraudulent behavior identification method when executing the program.

[0015] By means of the above technical solution, the present application provides a method and device for identifying fraudulent behavior, a storage medium, and a computer device. First, multiple complete call recordings to be identified stored on the target platform can be obtained. After that, each complete call recording can be segmented to obtain multiple recording segments. It should be noted that each segmented recording segment corresponds to only one dialogue role, that is, each time only a segment corresponding to one person speaking. Then, the recording segment in which the dialogue role is the user can be identified from the multiple recording segments obtained after segmentation. Further, the target recording segment can be determined from the recording segment in which the dialogue role is the user. After determining the target recording segment, the voiceprint feature can be extracted from the target recording segment, and the extracted voiceprint feature can be numerically converted to obtain a voiceprint feature vector. Subsequently, the voiceprint feature vectors corresponding to all complete call recordings can be aggregated together, and then these voiceprint feature vectors can be clustered and analyzed using a clustering algorithm to obtain multiple cluster clusters. Then, if the target recording segment in a cluster cluster comes from different users, the complete call recording in which the target recording segment in the cluster cluster is located can be determined as a suspected fraud call recording. Furthermore, each suspected fraud call recording can be converted into text data, and the text data can be input into a pre-trained large model. The large model can analyze the text data to identify whether there are any violations, and determine the fraud probability score corresponding to the text data based on the existing violations. Finally, it can be determined whether each suspected fraud call recording includes fraud based on the fraud probability score. The embodiment of the present application greatly reduces the need for manual review through automated voiceprint recognition and fraud analysis, and improves the efficiency and response speed of risk management; using voiceprint features and large model analysis, it can identify fraud that is difficult to detect with traditional methods, significantly improving the accuracy of risk identification; fast and accurate risk identification reduces unnecessary customer review processes, thereby improving the customer service experience.

[0016] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 A schematic diagram of a process for identifying fraudulent behavior provided in an embodiment of the present application is shown;

[0019] Figure 2 A schematic diagram showing a flow chart of another method for identifying fraudulent behavior provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the structure of a fraud identification device provided in an embodiment of the present application is shown;

[0021] Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0022] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0023] In this embodiment, a method for identifying fraudulent behavior is provided, such as Figure 1 As shown, the method includes:

[0024] Step 101, obtain multiple complete call recordings to be identified from the target platform, segment each complete call recording, and obtain multiple recording segments corresponding to the complete call recording, wherein each recording segment corresponds to a dialogue role, and the dialogue role is a customer service or a user.

[0025] In the embodiment of the present application, the target platform may be an insurance service platform, a banking service platform, etc. A complete call recording may be obtained by recording the entire call between the user and the customer service after the user initiates a voice call request to the customer service on the target platform based on the voice call channel. A complete call recording includes both the recording segment corresponding to the user's speech and the recording segment corresponding to the customer service's speech.

[0026] When performing fraudulent behavior identification, first, multiple complete call recordings to be identified stored on the target platform can be obtained. Here, the multiple complete call recordings to be identified can be complete call recordings within a specified time period, for example, within one month, half a month, or one week of the current time. Among them, the specified time period can be obtained based on statistical analysis data. For example, for fraud personnel under banking business, the longest fraud behavior cycle of the same fraud personnel is statistically analyzed based on the call recording data of banking business, and the specified time period is determined based on the longest fraud behavior cycle and the current time as the benchmark. For example, if the longest fraud behavior cycle is one month, then the specified time period can be within one month before the current time. After obtaining the complete call recording to be identified, each complete call recording can be segmented to obtain multiple recording segments. In one embodiment, the segmentation process can be implemented by a vad (Voice Activity Detection) model. Specifically, the vad model can automatically detect pauses in speaking to segment the recording segments. It should be noted that each segmented recording segment only corresponds to one dialogue role, that is, only one segment corresponding to one person speaking each time.

[0027] Step 102, for each of the multiple recording segments corresponding to the complete call recording, identify the recording segment in which the dialogue role is the user from the multiple recording segments, and based on the recording segment in which the dialogue role is the user, determine at least one target recording segment, perform voiceprint feature extraction on each target recording segment, obtain the voiceprint feature vector corresponding to the target recording segment based on the extraction result, cluster the voiceprint feature vectors corresponding to each complete call recording, and determine suspected fraudulent call recordings from each complete call recording according to the clustering result.

[0028] In this embodiment, then, the recording segment in which the dialogue role is the user can be identified from the multiple recording segments obtained after segmentation. Specifically, the identification can be performed using machine learning models, context analysis, and the like, which are not limited here. Further, the target recording segment can be determined from the recording segments in which the dialogue role is the user. Here, for each complete call recording, all the recording segments in which the dialogue role is the user corresponding to the complete call recording can be judged as the target recording, or the longest recording segment can be found from all the recording segments in which the dialogue role is the user as the target recording segment, or the recording segment with a duration exceeding a preset duration can be determined from all the recording segments in which the dialogue role is the user, and one of these recording segments can be randomly determined as the target recording segment.

[0029] After the target recording segment is determined, the voiceprint feature extraction can be performed on the target recording segment, and the extracted voiceprint features can be numerically converted to obtain a voiceprint feature vector. Specifically, if there are multiple target recording segments, the voiceprint feature extraction is performed on each target recording segment to obtain a voiceprint feature vector corresponding to each target recording segment; if there is only one target recording segment, the voiceprint feature extraction is performed on the target recording segment to obtain a voiceprint feature vector corresponding to the target recording segment.

[0030] Subsequently, the voiceprint feature vectors corresponding to all complete call recordings can be aggregated together, and then cluster analysis can be performed on these voiceprint feature vectors using a clustering algorithm. Here, the clustering algorithm can be K-means, hierarchical clustering, etc., which are not limited here. After cluster analysis, multiple clusters can be obtained. If the target recording segments in a cluster come from different users, it means that different users are handled by the same person. At this time, it is very likely that the fraudsters have forged multiple user information by means of forgery, and then used different user information to handle business. Therefore, it can be determined that the complete call recording where the target recording segment in the cluster is located is a suspected fraud call recording.

[0031] Step 103, for each suspected fraud call recording, convert the suspected fraud call recording into text data, and determine the fraud probability score corresponding to the text data through a large model, and based on the fraud probability score, determine whether the suspected fraud call recording includes fraudulent behavior.

[0032] In this embodiment, further, each suspected fraud call recording can be converted into text data, and the text data can be input into the pre-trained large model. The large model can analyze the text data to identify whether there are any violations therein, and determine the fraud probability score corresponding to the text data based on the existing violations. Specifically, the more violations there are, the larger the fraud probability score can be; conversely, if there are fewer violations, the smaller the fraud probability score can be. Finally, it can be determined whether each suspected fraud call recording includes fraud based on the fraud probability score. For example, if the fraud probability score is greater than the preset score, it can be said that there is a high probability of fraud in the suspected fraud call recording; if the fraud probability score is less than or equal to the preset score, it is considered that the violations can be ignored, indicating that there is almost no fraud in the suspected fraud call recording.

[0033] By applying the technical solution of this embodiment, first, multiple complete call recordings to be identified stored on the target platform can be obtained. After that, each complete call recording can be segmented to obtain multiple recording segments. It should be noted that each segmented recording segment corresponds to only one dialogue role, that is, each time only a segment corresponding to one person speaking. Then, the recording segment in which the dialogue role is the user can be identified from the multiple recording segments obtained after segmentation. Further, the target recording segment can be determined from the recording segment in which the dialogue role is the user. After determining the target recording segment, the voiceprint feature of the target recording segment can be extracted, and the extracted voiceprint feature can be numerically converted to obtain a voiceprint feature vector. Subsequently, the voiceprint feature vectors corresponding to all complete call recordings can be aggregated together, and then these voiceprint feature vectors can be clustered and analyzed using a clustering algorithm to obtain multiple cluster clusters. After that, if the target recording segment in a certain cluster cluster comes from different users, it can be determined that the complete call recording in which the target recording segment in the cluster cluster is located is a suspected fraud call recording. Furthermore, each suspected fraud call recording can be converted into text data, and the text data can be input into a pre-trained large model. The large model can analyze the text data to identify whether there are any violations, and determine the fraud probability score corresponding to the text data based on the existing violations. Finally, it can be determined whether each suspected fraud call recording includes fraud based on the fraud probability score. The embodiment of the present application greatly reduces the need for manual review through automated voiceprint recognition and fraud analysis, and improves the efficiency and response speed of risk management; using voiceprint features and large model analysis, it can identify fraud that is difficult to detect with traditional methods, significantly improving the accuracy of risk identification; fast and accurate risk identification reduces unnecessary customer review processes, thereby improving the customer service experience.

[0034] In the embodiment of the present application, optionally, after step 102, the method further includes: for each suspected fraud call recording, determining a user identifier corresponding to the suspected fraud call recording, and determining a current time, determining a preset number of historical time intervals based on the current time, and obtaining historical behavior data corresponding to the target user indicated by the user identifier in each historical time interval, wherein the historical behavior data includes interaction behavior data between the target user and the target platform; for the historical behavior data corresponding to each historical time interval, based on a plurality of preset evaluation indicators, determining evaluation data corresponding to each evaluation indicator from the historical behavior data, and determining the evaluation data corresponding to each evaluation indicator based on the preset evaluation indicators corresponding to each evaluation indicator. The judgment rules and the judgment data are used to calculate the sub-scores corresponding to the judgment indicators, and according to the sub-scores, the historical behavior scores corresponding to the historical time intervals are calculated; based on the preset weights corresponding to the historical time intervals, the historical behavior scores are weighted, and the user behavior scores of the target users are obtained according to the weighted results; accordingly, the "based on the fraud probability score, determining whether the suspected fraud call recording includes fraudulent behavior" in step 103 includes: based on the fraud probability score and the user behavior score, calculating the total score corresponding to the suspected fraud call recording; when the total score is greater than the preset score, determining that the suspected fraud call recording includes fraudulent behavior.

[0035] In this embodiment, for each suspected fraud call recording, the corresponding user identification is first determined. The user identification can be a unique identification corresponding to the user, such as a phone number, a user name, etc. At the same time, the current time is recorded, and multiple historical time intervals are determined according to the current time and the preset number. Here, the preset number and the duration corresponding to each time interval are pre-set. For example, the preset number is 5, the duration corresponding to each time interval is 1 month, and the current time is November 10, then the historical time intervals can be 6.11-7.10, 7.11-8.10, 8.11-9.10, 9.11-10.10, 10.11-11.10. Then, the historical behavior data of the target user indicated by the user identification within the determined multiple historical time intervals can be obtained. These historical behavior data include the interaction between the target user and the aforementioned target platform (such as an e-commerce platform, a financial platform, etc.), such as purchase records, login logs, transaction behaviors, etc. Through these data, it can be known whether the user has abnormal behavior during this period, such as repeated login and modification of personal information, frequent transactions, etc., thereby increasing the accuracy of fraud identification. In addition, historical behavior data may also include other data related to the user.

[0036] Before analyzing the historical behavior data, multiple evaluation indicators can be pre-set, which involve the user's behavior pattern, transaction frequency, abnormal behavior detection, etc. For the historical behavior data corresponding to each historical time interval, the evaluation data corresponding to each evaluation indicator is extracted from the historical behavior data according to the preset evaluation rules. Subsequently, the sub-score corresponding to each evaluation indicator can be calculated according to the evaluation data and the preset evaluation rules. These sub-scores reflect the performance of the user in the corresponding evaluation indicator in the time interval. Finally, the historical behavior score corresponding to each historical time interval can be calculated according to each sub-score. For example, if the evaluation indicators include 3, then the sub-scores corresponding to the 3 evaluation indicators are weighted and added to obtain the historical behavior score corresponding to the historical time interval. Then, based on the preset weights corresponding to each historical time interval, the historical behavior score is weighted, and the result of the weighted processing is the user behavior score of the target user, which reflects the overall behavior performance of the user in the past period of time. It should be noted that the preset weights corresponding to different historical time intervals can be determined according to the rule of time from far to near and weight from small to large.

[0037] After obtaining the user behavior score, the fraud probability score and the user behavior score can be combined to calculate the total score corresponding to the suspected fraud call recording. When the total score is greater than the preset score, it is considered that the suspected fraud call recording contains fraudulent behavior. This preset score can be set based on historical data and business needs to distinguish between fraudulent behavior and normal behavior. The embodiment of the present application determines whether the call recording contains fraudulent behavior by comprehensively analyzing the user's historical behavior data and the fraud probability score of the call recording, which can significantly improve the accuracy of fraud identification.

[0038] In an embodiment of the present application, optionally, after "determining that the suspected fraud call recording includes fraudulent behavior", the method also includes: for each suspected fraud call recording determined to contain fraudulent behavior, based on the suspected fraud call recording, and the clustering cluster, fraud probability score, user behavior score and total score corresponding to the suspected fraud call recording, generating a risk assessment report for the suspected fraud call recording, and based on the total score, risk ranking the risk assessment report, marking the risk assessment report according to the risk ranking result, and sending the marked risk assessment report to a preset review terminal, so that the staff of the preset review terminal determines the review order based on the mark.

[0039] In this embodiment, after determining that the suspected fraud call recording includes fraudulent behavior, further, a detailed risk assessment report can be generated using each suspected fraud call recording that includes fraudulent behavior, as well as the clustering cluster where the suspected fraud call recording is located, the corresponding fraud probability score, the user behavior score and the total score. Afterwards, all risk assessment reports can be sorted according to the total score, and the report with a higher total score represents a higher fraud risk. According to the risk sorting result, the risk assessment report is further marked, usually in the form of color, numbers or letters to indicate its risk level. The marked risk assessment report can be sent to a preset review terminal, which can be used to further review and process the risk assessment report. Specifically, the staff of the preset review terminal can determine the order of review according to the mark (i.e., risk level) of the risk assessment report, and the report with the highest risk level is given priority. The embodiment of the present application can ensure that high-risk calls are handled in a timely manner, and at the same time, the workload of the review personnel can be reduced through cluster screening, thereby improving overall work efficiency.

[0040] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another method for identifying fraudulent behavior is provided, such as Figure 2 As shown, the method includes:

[0041] Step 201, obtain multiple complete call recordings to be identified from the target platform, segment each complete call recording, and obtain multiple recording segments corresponding to the complete call recording, wherein each recording segment corresponds to a dialogue role, and the dialogue role is a customer service or a user.

[0042] Step 202: for each of the multiple recording segments corresponding to the complete call recording, identify the recording segments in which the dialogue role is the user from the multiple recording segments, and determine at least one target recording segment based on the recording segments in which the dialogue role is the user.

[0043] Step 203, extracting voiceprint features from the target recording segment to obtain an extraction result, wherein the voiceprint features include at least one of fundamental frequency, formant frequency, intonation, rhythm, and sound intensity; performing numerical conversion on sub-results corresponding to each voiceprint feature in the extraction result according to a preset conversion rule, and sequentially concatenating the numerical values ​​corresponding to the sub-results to obtain a voiceprint feature vector corresponding to the target recording segment.

[0044] In this embodiment, the voiceprint features may include fundamental frequency, formant frequency, intonation, rhythm, sound intensity, etc. Among them, fundamental frequency: the basic frequency of the sound, reflecting the pitch of the speaker; formant frequency: the frequency corresponding to the resonance phenomenon of the sound in the vocal tract, which is related to the shape of the speaker's vocal tract and affects the timbre of the sound; intonation: the rise and fall of the sound, reflecting the speaker's emotional state or emphasis content; rhythm: the speed and pause pattern of speaking, reflecting the individual's speaking habits; sound intensity: the loudness or amplitude of the sound, which is related to the speaker's vocal strength. These features together constitute the main components of the voiceprint features, which can more comprehensively reflect the characteristics of the speaker's voice. In addition, the voiceprint features may also include other aspects of the sound. When extracting voiceprint features from the target recording segment, signal processing technology and machine learning algorithms may be used to extract these voiceprint features. For example, the spectrum characteristics of the audio signal are analyzed by Fourier transform to obtain the fundamental frequency and formant frequency; the envelope changes of the audio signal are analyzed by statistical methods to obtain the intonation and rhythm; the sound intensity is obtained by measuring the amplitude of the audio signal. After voiceprint feature extraction is performed using the above method, an extraction result can be obtained, which includes a sub-result corresponding to each voiceprint feature.

[0045] Afterwards, according to the preset conversion rules, the sub-results corresponding to each extracted voiceprint feature are digitized. For example, the extraction result of each voiceprint feature is mapped to a certain numerical range. This can simplify subsequent processing and reduce the amount of calculation. Subsequently, the numerical values ​​corresponding to each sub-result are sequentially spliced ​​into a vector. Each element of this vector represents the performance of the target recording segment on a certain voiceprint feature. Through splicing, multiple voiceprint features can be merged into a unified representation form, which is convenient for subsequent analysis and processing. For example, the voiceprint features include fundamental frequency, formant frequency, intonation, rhythm, and sound intensity, where the value of the sub-result corresponding to the fundamental frequency of a target recording segment is A, the value of the sub-result corresponding to the formant frequency is B, the value of the sub-result corresponding to the intonation is C, the value of the sub-result corresponding to the rhythm is D, and the value of the sub-result corresponding to the sound intensity is E, then the spliced ​​voiceprint feature vector is (A, B, C, D, E). The embodiment of the present application can comprehensively extract the voiceprint features of the target recording segment, and convert it into an easy-to-process vector form through numerical conversion and splicing, which is convenient for subsequent processing.

[0046] Step 204, clustering the voiceprint feature vectors corresponding to each complete call recording, for each cluster in the clustering result, determining the user identifier corresponding to each target recording segment under the cluster, and judging the number of different user identifiers corresponding to each target recording segment, when the number of identifiers is greater than 1, determining each target recording segment under the cluster as a suspected fraudulent recording segment; determining the suspected fraudulent call recording based on the complete call recording to which the suspected fraudulent recording segment belongs.

[0047] In this embodiment, the voiceprint feature vector of each complete call recording may be one or more, which is consistent with the number of target recording segments of the complete call recording. After determining the voiceprint feature vector corresponding to each complete call recording, the voiceprint feature vectors corresponding to all complete call recordings can be put together, and then all voiceprint feature vectors can be clustered using a clustering algorithm (such as K-means, DBSCAN, etc.). The purpose of clustering is to group recording segments with similar voiceprint features into one category, so that multiple clusters can be obtained. Among them, when each complete call recording includes multiple voiceprint feature vectors, these voiceprint feature vectors are ultimately in the same cluster.

[0048] For each cluster, determine the user identifier corresponding to each target recording segment under the cluster. Specifically, the user identifier can be the one marked on the recording segment when the complete call recording is segmented. Then determine the number of user identifiers corresponding to each target recording segment under the cluster. Specifically, if the user identifiers corresponding to all target recording segments are the same, then the number of identifiers is 1, indicating that all target recording segments are from the same user; if the user identifiers corresponding to all target recording segments are not the same, then the number of identifiers is not 1. At this time, the number of identifiers is consistent with the number of user identifiers, indicating that all target recording segments are not from the same user. At this time, it is very likely that the same person (a person with the same voice) is impersonating different users to conduct business or transactions. For example, a black intermediary impersonates the identities of multiple customers to make calls, which is suspected of being involved in organized crime. Therefore, in this case, these target recording segments under the cluster can be determined as suspected fraudulent recording segments.

[0049] Finally, the suspected fraud call recording is determined based on the complete call recording to which the suspected fraud recording segment belongs. It should be noted that if each complete call recording corresponds to multiple target recording segments, then the suspected fraud call recording corresponding to these target recording segments is the same. Therefore, in this case, after obtaining the suspected fraud call recording corresponding to each target recording segment, these suspected fraud call recordings can be deduplicated, and the deduplicated suspected fraud call recordings can be used as the final suspected fraud call recording. The embodiment of the present application can efficiently identify suspected fraud call recordings through clustering of voiceprint feature vectors combined with the judgment of user identification.

[0050] Step 205: for each suspected fraudulent call recording, convert the suspected fraudulent call recording into text data.

[0051] Step 206: input the text data into the big model, use the big model to respectively identify abnormal words, contradictory statements and suspicious requests contained in the text data, and obtain a first score based on the abnormal word identification result, a second score based on the contradictory statement identification result, and a third score based on the suspicious request identification result, and calculate the fraud probability score corresponding to the text data based on the first score, the second score, the third score and the weight corresponding to each score.

[0052] In this embodiment, each time the text data corresponding to a suspected fraudulent call recording is input into a pre-trained large model (deep learning or machine learning model), the large model can analyze the text data from three aspects: abnormal words, contradictory statements, and suspicious requests. Specifically, when analyzing abnormal words, words that are uncommon, inconsistent with the context, or related to known fraud patterns can be identified. These words are called "abnormal words". Based on the recognition results of abnormal words, the large model can derive a first score. This score reflects the frequency and severity of abnormal words in the text. When analyzing contradictory statements, it can be checked whether the statements in the text are self-contradictory. For example, a user claims that he has never made a transaction somewhere, but other parts of the text provide the opposite information. Based on the recognition results of contradictory statements, the large model can derive a second score. This score reflects the number and significance of contradictory statements in the text. When analyzing suspicious requests, it can be analyzed whether there are suspicious requests in the text, such as requests to transfer money to a specific account, provide sensitive information, etc. These requests may be signs of fraud. Based on the recognition results of suspicious requests, the large model can derive a third score. This score reflects the urgency and potential risk of the suspicious request in the text.

[0053] After obtaining the first score, the second score, and the third score, the large model calculates the final fraud probability score based on the weights corresponding to each score. Here, the weights can be determined based on historical data, expert judgment, or optimization during model training, reflecting the importance of each score in judging fraudulent behavior. The final fraud probability score is a numerical value that combines multiple factors and reflects the possibility of fraud in the text data.

[0054] The embodiment of the present application utilizes the advantages of large-scale models in processing and analyzing large amounts of text data, and evaluates the fraud risk of text data by identifying key features such as abnormal wording, contradictory statements, and suspicious requests, thereby further improving the accuracy of fraud risk identification.

[0055] Step 207: Based on the fraud probability score, determine whether the suspected fraud call recording includes fraudulent behavior.

[0056] In an embodiment of the present application, optionally, before the step 201 of "segmenting each complete call recording", the method further includes: inputting each complete call recording into a denoising model respectively, segmenting the complete call recording according to a target preset time period through a noise recognition module of the denoising model, and performing Fourier transform on each segmentation result respectively to obtain a spectral feature corresponding to each segmentation result, and comparing the spectral features corresponding to different segmentation results to determine the clean speech and noise corresponding to the complete call recording; based on the clean speech and the noise, separating the complete clean speech from the complete call recording through a speech separation module of the denoising model, and reconstructing the speech features of the clean speech based on the separated complete clean speech, and synthesizing the target complete call speech according to the speech features.

[0057] In this embodiment, in a high noise environment, the extraction and recognition of voiceprint features are easily disturbed, affecting the reliability of the recognition results. Therefore, before segmenting each complete call recording, the complete call recording can be denoised using a denoising model to separate pure speech from the noisy call recording, which can greatly improve the accuracy of subsequent clustering results.

[0058] First, each complete call recording is provided as input data to the denoising model. Next, the noise recognition module in the denoising model can segment the complete call recording according to a preset time period (such as every second, every half second, etc.). This preset time period is to divide the recording into smaller, easier to process segments. The purpose of segmentation is to process and analyze each segment independently in order to more accurately identify noise and pure speech.

[0059] Afterwards, for each segmentation result, the denoising model can perform a Fourier transform. The Fourier transform is a mathematical tool used to convert time domain signals (such as sound) into frequency domain signals (i.e., spectrum). Through the Fourier transform, the spectral features corresponding to each segmentation result can be obtained, which reflect the intensity of different frequency components in the segmentation result. Next, the denoising model can compare the spectral features corresponding to different segmentation results to identify which spectral features correspond to pure speech and which correspond to noise. The comparison process can specifically involve analyzing the similarities and differences of spectral features, as well as matching using a known noise feature library. Through the comparison process, the denoising model can determine which parts of the complete call recording are pure speech and which parts are noise.

[0060] After determining the clean speech and noise, the speech separation module in the denoising model can use this information to separate the clean speech from the complete call recording. Speech separation can be a complex signal processing algorithm, such as filtering, enhancement, etc., to preserve the integrity and clarity of the clean speech as much as possible. After separating the complete clean speech, the denoising model can further reconstruct the speech features of the clean speech. These features may include pitch, timbre, speaking speed, etc., which are crucial for synthesizing the target complete call speech. Finally, the target complete call speech is synthesized based on the reconstructed speech features. Specifically, speech synthesis algorithms such as waveform splicing and parameter synthesis can be used. The synthesized target complete call speech can be as close to the clean speech part of the original call as possible, while removing noise and interference sounds. The embodiment of the present application separates clean speech from the noisy call recording, and reconstructs and synthesizes the target complete call speech based on the clean speech, which can greatly improve the accuracy of subsequent voiceprint feature extraction.

[0061] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a device for identifying fraudulent behavior, such as Figure 3 As shown, the device comprises:

[0062] A recording segmentation module is used to obtain multiple complete call recordings to be identified from a target platform, segment each complete call recording, and obtain multiple recording segments corresponding to the complete call recording, wherein each recording segment corresponds to a dialogue role, and the dialogue role is a customer service or a user;

[0063] a clustering module for identifying, for each of the multiple recording segments corresponding to the complete call recording, a recording segment in which the dialogue role is the user from the multiple recording segments, and determining at least one target recording segment based on the recording segment in which the dialogue role is the user, performing voiceprint feature extraction on each target recording segment, obtaining a voiceprint feature vector corresponding to the target recording segment based on the extraction result, and performing clustering processing on the voiceprint feature vectors corresponding to each complete call recording, and determining a suspected fraudulent call recording from each complete call recording according to the clustering result;

[0064] The fraud behavior identification module is used to convert each suspected fraud call recording into text data, and determine the fraud probability score corresponding to the text data through a large model, and based on the fraud probability score, determine whether the suspected fraud call recording includes fraud behavior.

[0065] Optionally, the clustering module is used to:

[0066] For each cluster in the clustering result, determine the user identifier corresponding to each target audio segment under the cluster, and determine the number of different user identifiers corresponding to each target audio segment. When the number of identifiers is greater than 1, determine that each target audio segment under the cluster is a suspected fraudulent audio segment;

[0067] The suspected fraudulent call recording is determined based on the complete call recording to which the suspected fraudulent recording segment belongs.

[0068] Optionally, the clustering module is further used to:

[0069] Extracting voiceprint features from the target recording segment to obtain an extraction result, wherein the voiceprint features include at least one of fundamental frequency, formant frequency, intonation, rhythm, and sound intensity;

[0070] According to a preset conversion rule, numerical conversion is performed on the sub-results corresponding to each voiceprint feature in the extraction result, and the numerical values ​​corresponding to the sub-results are concatenated in sequence to obtain a voiceprint feature vector corresponding to the target recording segment.

[0071] Optionally, the device further comprises a denoising module; the denoising module is configured to:

[0072] Before segmenting each complete call recording, each complete call recording is input into a denoising model, and the complete call recording is segmented according to a target preset time period by a noise recognition module of the denoising model, and each segmentation result is subjected to Fourier transform to obtain a frequency spectrum feature corresponding to each segmentation result, and the frequency spectrum features corresponding to different segmentation results are compared to determine the pure speech and noise corresponding to the complete call recording;

[0073] Based on the clean speech and the noise, the speech separation module of the denoising model is used to separate the complete clean speech from the complete call recording, and based on the separated complete clean speech, the speech features of the clean speech are reconstructed, and based on the speech features, the target complete call speech is synthesized.

[0074] Optionally, the fraudulent behavior identification module is used to:

[0075] The text data is input into a large model, and abnormal words, contradictory statements, and suspicious requests contained in the text data are respectively identified by the large model, and a first score is obtained according to the abnormal word identification result, a second score is obtained according to the contradictory statement identification result, and a third score is obtained according to the suspicious request identification result, and a fraud probability score corresponding to the text data is calculated based on the first score, the second score, the third score and the weight corresponding to each score.

[0076] Optionally, the device further comprises a user behavior score calculation module; the user behavior score calculation module is used to:

[0077] After determining the suspected fraudulent call recordings from each complete call recording according to the clustering result, for each suspected fraudulent call recording, determining the user identifier corresponding to the suspected fraudulent call recording, and determining the current time, determining a preset number of historical time intervals based on the current time, and obtaining historical behavior data corresponding to each historical time interval of the target user indicated by the user identifier, wherein the historical behavior data includes interaction behavior data between the target user and the target platform;

[0078] For the historical behavior data corresponding to each historical time interval, based on a plurality of preset evaluation indicators, determining the evaluation data corresponding to each evaluation indicator from the historical behavior data, and calculating the sub-score corresponding to each evaluation indicator based on the preset evaluation rule corresponding to each evaluation indicator and the evaluation data, and calculating the historical behavior score corresponding to the historical time interval according to each sub-score;

[0079] Based on the preset weights corresponding to the historical time intervals, weighted processing is performed on the historical behavior scores, and a user behavior score of the target user is obtained according to the weighted result;

[0080] Accordingly, the fraudulent behavior identification module is also used to:

[0081] Calculate a total score corresponding to the suspected fraud call recording based on the fraud probability score and the user behavior score;

[0082] When the total score is greater than a preset score, it is determined that the suspected fraud call recording includes fraudulent behavior.

[0083] Optionally, the device further comprises a report generating module; the report generating module is used to:

[0084] After determining that the suspected fraud call recording includes fraudulent behavior, for each suspected fraud call recording determined to contain fraudulent behavior, a risk assessment report of the suspected fraud call recording is generated based on the suspected fraud call recording, and the cluster cluster, fraud probability score, user behavior score and total score corresponding to the suspected fraud call recording, and the risk assessment report is risk ranked based on the total score, the risk assessment report is marked according to the risk ranking result, and the marked risk assessment report is sent to a preset review terminal, so that the staff of the preset review terminal determines the review order based on the mark.

[0085] It should be noted that for other corresponding descriptions of the functional units involved in the fraud identification device provided in the embodiment of the present application, reference can be made to Figure 1 to Figure 2 The corresponding description in the method will not be repeated here.

[0086] The present application also provides a computer device, which may be a personal computer, a server, a network device, etc. Figure 4 As shown, the computer device includes a bus, a processor, a memory and a communication interface, and may also include an input and output interface and a display device. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store location information. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in each method embodiment are implemented.

[0087] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0088] In one embodiment, a computer-readable storage medium is provided. The computer-readable storage medium may be non-volatile or volatile, and stores a computer program thereon. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0089] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0090] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0091] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0092] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0093] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying fraudulent behavior, characterized in that: include: Acquire multiple complete call recordings to be identified from a target platform, segment each complete call recording, and obtain multiple recording segments corresponding to the complete call recording, wherein each recording segment corresponds to a dialogue role, and the dialogue role is a customer service representative or a user; For each of the multiple recording segments corresponding to the complete call recording, identify the recording segment in which the dialogue role is the user from the multiple recording segments, and determine at least one target recording segment based on the recording segment in which the dialogue role is the user, perform voiceprint feature extraction on each target recording segment, obtain a voiceprint feature vector corresponding to the target recording segment based on the extraction result, perform clustering processing on the voiceprint feature vectors corresponding to each of the complete call recordings, and determine a suspected fraudulent call recording from each of the complete call recordings according to the clustering result; For each suspected fraudulent call recording, the suspected fraudulent call recording is converted into text data, and a fraud probability score corresponding to the text data is determined through a large model. Based on the fraud probability score, it is determined whether the suspected fraudulent call recording includes fraudulent behavior.

2. The method according to claim 1, characterized in that Determining suspected fraudulent call recordings from each complete call recording according to the clustering result includes: For each cluster in the clustering result, determine the user identifier corresponding to each target audio segment under the cluster, and determine the number of different user identifiers corresponding to each target audio segment. When the number of identifiers is greater than 1, determine that each target audio segment under the cluster is a suspected fraudulent audio segment; The suspected fraudulent call recording is determined based on the complete call recording to which the suspected fraudulent recording segment belongs.

3. The method according to claim 1 or 2, characterized in that: The step of extracting voiceprint features from each target recording segment and obtaining a voiceprint feature vector corresponding to the target recording segment based on the extraction result includes: Extracting voiceprint features from the target recording segment to obtain an extraction result, wherein the voiceprint features include at least one of fundamental frequency, formant frequency, intonation, rhythm, and sound intensity; According to a preset conversion rule, a numerical conversion is performed on the sub-result corresponding to each voiceprint feature in the extraction result, and the numerical values ​​corresponding to each sub-result are concatenated in sequence to obtain a voiceprint feature vector corresponding to the target recording segment.

4. The method according to claim 1, characterized in that: Before segmenting each complete call recording, the method further includes: Input each complete call recording into the denoising model respectively, segment the complete call recording according to the target preset time period through the noise recognition module of the denoising model, and perform Fourier transform on each segmentation result to obtain the spectrum feature corresponding to each segmentation result, compare the spectrum features corresponding to different segmentation results, and determine the pure speech and noise corresponding to the complete call recording; Based on the clean speech and the noise, the speech separation module of the denoising model is used to separate the complete clean speech from the complete call recording, and based on the separated complete clean speech, the speech features of the clean speech are reconstructed, and based on the speech features, the target complete call speech is synthesized.

5. The method according to claim 1, characterized in that Determining the fraud probability score corresponding to the text data by using the big model includes: The text data is input into a large model, and abnormal words, contradictory statements, and suspicious requests contained in the text data are respectively identified by the large model, and a first score is obtained according to the abnormal word identification result, a second score is obtained according to the contradictory statement identification result, and a third score is obtained according to the suspicious request identification result, and a fraud probability score corresponding to the text data is calculated based on the first score, the second score, the third score and the weight corresponding to each score.

6. The method according to claim 5, characterized in that After determining the suspected fraudulent call recording from each complete call recording according to the clustering result, the method further includes: For each suspected fraudulent call recording, determine the user identifier corresponding to the suspected fraudulent call recording, determine the current time, determine a preset number of historical time intervals based on the current time, and obtain historical behavior data corresponding to each historical time interval of the target user indicated by the user identifier, wherein the historical behavior data includes interaction behavior data between the target user and the target platform; For the historical behavior data corresponding to each historical time interval, based on a plurality of preset evaluation indicators, determining the evaluation data corresponding to each evaluation indicator from the historical behavior data, and calculating the sub-score corresponding to each evaluation indicator based on the preset evaluation rule corresponding to each evaluation indicator and the evaluation data, and calculating the historical behavior score corresponding to the historical time interval according to each sub-score; Based on the preset weights corresponding to the historical time intervals, weighted processing is performed on the historical behavior scores, and a user behavior score of the target user is obtained according to the weighted result; Accordingly, judging whether the suspected fraud call recording includes fraudulent behavior based on the fraud probability score includes: Calculate a total score corresponding to the suspected fraud call recording based on the fraud probability score and the user behavior score; When the total score is greater than a preset score, it is determined that the suspected fraud call recording includes fraudulent behavior.

7. The method according to claim 6, characterized in that After determining that the suspected fraud call recording includes fraudulent behavior, the method further includes: For each suspected fraud call recording determined to contain fraudulent behavior, a risk assessment report for the suspected fraud call recording is generated based on the suspected fraud call recording, and the clustering cluster, fraud probability score, user behavior score and total score corresponding to the suspected fraud call recording, and the risk assessment report is risk ranked based on the total score. The risk assessment report is marked according to the risk ranking result, and the marked risk assessment report is sent to a preset review terminal so that the staff of the preset review terminal determines the review order based on the mark.

8. A fraudulent behavior identification device, characterized in that: include: A recording segmentation module is used to obtain multiple complete call recordings to be identified from a target platform, segment each complete call recording, and obtain multiple recording segments corresponding to the complete call recording, wherein each recording segment corresponds to a dialogue role, and the dialogue role is a customer service or a user; a clustering module for identifying, for each of the multiple recording segments corresponding to the complete call recording, a recording segment in which the dialogue role is the user from the multiple recording segments, and determining at least one target recording segment based on the recording segment in which the dialogue role is the user, performing voiceprint feature extraction on each target recording segment, obtaining a voiceprint feature vector corresponding to the target recording segment based on the extraction result, and performing clustering processing on the voiceprint feature vectors corresponding to each complete call recording, and determining a suspected fraudulent call recording from each complete call recording according to the clustering result; The fraud behavior identification module is used to convert each suspected fraud call recording into text data, and determine the fraud probability score corresponding to the text data through a large model, and based on the fraud probability score, determine whether the suspected fraud call recording includes fraud behavior.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images