Method and device for identifying communication fraud number group
By extracting and clustering the communication data of the communication signal code, the communication signal code used by multiple people in the fraud gang is identified, which solves the problem of poor identification lag and effectiveness in the prior art, and achieves more efficient fraud number group identification.
Patent Information
- Application Number
- CN202411520892.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-29
- Publication Date
- 2025-02-28
AI Technical Summary
The prior art has lag in identifying communication fraud numbers, and it is difficult to instantly and effectively identify the new communication signal code replaced by the fraudster, which has hidden risks of fraud and poor recognition effectiveness.
By obtaining the communication data of multiple communication signal codes to be identified, feature extraction is performed, communication behavior characteristics and voiceprint characteristics are obtained, and clustering is performed based on these characteristics to determine whether the cluster is a fraud number group.
The scope of identification of fraud numbers has been effectively expanded, and multiple signal codes used by multiple people and the same person in the same fraud gang are clustered into clusters, improving the validity and integrity of the identification of fraud number groups.
Smart Images
Figure CN119544864A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communication anti-fraud, and in particular to a method and device for identifying communication fraud number groups. Background Art
[0002] In the field of communication anti-fraud, it is possible to identify which communication numbers are fraudulent numbers based on the feedback marks of communication users. For communication numbers marked as fraudulent numbers, targeted communication monitoring can be carried out to achieve the effect of communication anti-fraud.
[0003] In actual application, this technical solution for identifying fraudulent numbers based on feedback marks has a lag. After a communication number is marked as a fraudulent number, the fraudster may change a new communication number to continue the communication fraud. For the communication number changed by the fraudster, the identification method based on feedback marks is difficult to immediately and effectively identify the fraud risk of the communication number, which has the potential for fraud and poor identification effectiveness.
[0004] How to improve the effectiveness of identifying communication fraud numbers is the technical problem to be solved by this application. Summary of the invention
[0005] The purpose of the embodiments of the present application is to provide a method and device for identifying a group of communication fraud numbers, so as to improve the effectiveness of identifying communication fraud numbers.
[0006] In a first aspect, a method for identifying a communication fraud number group is provided, comprising: Acquire communication data of multiple communication numbers to be identified, the communication data including communication behavior records, voice data and communication tags, the communication tags indicating whether the corresponding communication number is a known fraud number; Performing feature extraction on the communication data of the multiple communication numbers respectively to obtain communication behavior features corresponding to the communication behavior records of each communication number and voiceprint features corresponding to the voice data of each communication number; Clustering is performed on multiple communication numbers to be identified based on communication behavior features and voiceprint features to obtain multiple clusters; Whether each cluster is a fraudulent number group is determined according to the size of each cluster in the multiple clusters and the number of known fraudulent numbers contained in each cluster.
[0007] In a second aspect, a device for identifying a communication fraud number group is provided, comprising: An acquisition module, which acquires communication data of multiple communication numbers to be identified, wherein the communication data includes communication behavior records, voice data, and communication tags, and the communication tags indicate whether the corresponding communication number is a known fraud number; An extraction module is used to perform feature extraction on the communication data of the plurality of communication numbers respectively, so as to obtain communication behavior features corresponding to the communication behavior records of each communication number and voiceprint features corresponding to the voice data of each communication number; A clustering module, which performs clustering on multiple communication numbers to be identified based on communication behavior features and voiceprint features to obtain multiple clusters; The determination module determines whether each cluster is a fraudulent number group according to the size of each cluster in the multiple clusters and the number of known fraudulent numbers contained in each cluster.
[0008] According to a third aspect, an electronic device is provided. The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the method according to the first aspect are implemented.
[0009] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method according to the first aspect are implemented.
[0010] In a fifth aspect, a computer program product is provided, the computer program product comprising a non-transitory computer-readable storage medium storing a computer program, the computer program being operable to cause a computer to execute part or all of the steps of the method of the first aspect.
[0011] In an embodiment of the present application, first, the communication data of multiple communication numbers to be identified are obtained, and the communication data include communication behavior records, voice data and communication tags, and the communication tags characterize whether the corresponding communication number is a known fraud number. Then, feature extraction is performed on the communication data of multiple communication numbers respectively, and the communication behavior features corresponding to the communication behavior records of each communication number and the voiceprint features corresponding to the voice data of each communication number are obtained. Next, clustering is performed on the multiple communication numbers to be identified based on the communication behavior features and the voiceprint features to obtain multiple clusters; finally, whether each cluster is a fraud number group is determined according to the size of each cluster in the multiple clusters and the number of known fraud numbers contained in each cluster. Among them, the voiceprint feature can effectively identify the person who uses the communication number for voice, and the voiceprint feature can be used to identify the same person who uses multiple communication numbers. Since the fraud patterns of multiple people in the same fraud gang are often similar, multiple communication numbers with similar fraud patterns can be identified through the communication behavior features. Furthermore, this solution uses voiceprint features and communication behavior features to perform clustering, which can effectively expand the identification scope of fraudulent numbers and effectively cluster multiple communication numbers used by multiple people in the same fraud gang and the same person into clusters. Furthermore, according to the size of each cluster after clustering and the number of known fraudulent numbers contained in each cluster, it is determined whether the cluster is a fraudulent number group, which can improve the effectiveness and integrity of fraudulent number group identification. BRIEF DESCRIPTION OF THE DRAWINGS
[0012] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 This is one of the flow charts of a method for identifying a communication fraud number group in an embodiment of the present application; Figure 2 This is a flowchart of a method for identifying a communication fraud number group according to an embodiment of the present application; Figure 3 This is a flowchart of a method for identifying a communication fraud number group according to an embodiment of the present application; Figure 4a This is a flowchart of a method for identifying a communication fraud number group according to an embodiment of the present application; Figure 4b This is one of the schematic diagrams of a characteristic diagram in a method for identifying a communication fraud number group in an embodiment of the present application; Figure 4c This is a second schematic diagram of a characteristic diagram in a method for identifying a communication fraud number group in an embodiment of the present application; Figure 4d This is a third schematic diagram of a characteristic diagram in a method for identifying a communication fraud number group in an embodiment of the present application; Figure 4e This is a fourth schematic diagram of a characteristic diagram in a method for identifying a communication fraud number group in an embodiment of the present application; Figure 5a This is a schematic diagram of the network framework structure of CAM++ in a method for identifying a communication fraud number group in an embodiment of the present application; Figure 5b This is a cosine similarity calculation example in a method for identifying a communication fraud number group in an embodiment of the present application; Figure 5c This is a fifth schematic diagram of a characteristic diagram in a method for identifying a communication fraud number group in an embodiment of the present application; Figure 6 This is a flowchart of a method for identifying a communication fraud number group according to an embodiment of the present application; Figure 7 This is a flowchart of a method for identifying a communication fraud number group according to an embodiment of the present application; Figure 8a This is a flowchart of a method for identifying a communication fraud number group according to an embodiment of the present application, No. 7; Figure 8bThis is a schematic diagram of clustering results in a method for identifying communication fraud number groups in an embodiment of the present application; Fig. 9 It is a structural diagram of a device for identifying communication fraud number groups in one embodiment of the present application. DETAILED DESCRIPTION
[0013] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. The numbering of the drawings in this application is only used to distinguish the various steps in the scheme, and is not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.
[0014] In the field of telecommunications anti-fraud, fraud gangs may frequently change their communication numbers to avoid being marked as fraudulent numbers and subject to anti-fraud supervision. For new communication numbers used by fraud gangs, there is often no historical record of their behavior, making it difficult to effectively determine whether a new communication number is a fraudulent number based on communication behavior.
[0015] In order to solve the problems existing in the related art, the embodiment of the present application provides a method for identifying a communication fraud number group, such as Figure 1 As shown, including: S11: Acquire communication data of multiple communication numbers to be identified, wherein the communication data includes communication behavior records, voice data and communication tags, and the communication tags indicate whether the corresponding communication number is a known fraud number.
[0016] The communication behavior records contained in the above communication data represent the communication behavior of the corresponding communication number during the historical period. The communication behavior can be actively initiated or passively initiated, and the communication behavior can include calls, text messages, rich media messages, online conferences and other forms.
[0017] Optionally, the communication data also includes basic user data of the communication number, and the basic user data includes at least one of account opening user information and account opening time information.
[0018] In this example, the above communication data has a corresponding relationship with the communication number, and the communication number itself may have basic user information, such as user number, account opening time, account opening location, etc. In addition, the above communication mark indicates whether the corresponding communication number is a fraudulent number, and can also be recorded in the user information corresponding to the communication number for flexible call. The following table shows an example of user information content of a communication number: Table 1 User information table
[0019] Optionally, the communication behavior record includes a call detail record, and the call detail record includes at least one of a calling call record, a called call record, a call time record, and roaming location information.
[0020] In this example, the communication behavior record may specifically include call detail records (CDR), which can also be called CDR bill data. CDR bills may include information such as the caller, the called party, the call time, the call duration, and the roaming location in the call record. The following table shows an example of CDR bill content: Table 2 CDR
[0021] Voice data may include voice data generated during communication activities, such as call voice, voice during a network conference, voice sent via rich media messages, etc.
[0022] The communication tag can be a communication tag that is automatically identified and marked according to the communication behavior of the communication number, or it can be a communication tag that is fed back and marked by the communication number that passively receives the communication behavior after the communication number actively initiates the communication behavior to other communication numbers. In this example, the communication tag indicates whether the corresponding communication number is a fraudulent number.
[0023] It should be noted that the communication data of the communication number obtained in the embodiment of the present application is authorized by the user of the communication number to be obtained and used. Alternatively, the communication data of the above communication number is the one that the execution subject of the embodiment of the present application has the right to obtain.
[0024] S12: performing feature extraction on the communication data of the plurality of communication numbers respectively, and obtaining communication behavior features corresponding to the communication behavior records of each communication number and voiceprint features corresponding to the voice data of each communication number.
[0025] In this step, feature extraction is performed on the communication data of each communication number to obtain the communication behavior features and voiceprint features corresponding to each communication number.
[0026] Among them, the communication behavior features are extracted based on the communication behavior records and can characterize the communication behavior patterns of the corresponding communication numbers. In actual applications, multiple communication numbers used by a fraud gang often use the same fraud model. In this step, by extracting the communication behavior features, the communication behavior patterns of the communication numbers can be effectively identified, providing a data basis for the subsequent identification of fraud numbers.
[0027] Among them, voiceprint feature is a kind of biometric feature. Voiceprint is a sound wave spectrum that carries speech information displayed by electroacoustic instruments. For the same person, no matter if his voice, tone, intonation or volume is changed, the voiceprint remains unchanged. In the scenario where one person in a fraud gang uses multiple communication numbers, this solution can identify the commonalities between multiple communication numbers through voiceprint features, that is, through voiceprint features, it can be identified that multiple communication numbers are used by the same person, thereby providing a data basis for subsequent identification of fraudulent numbers.
[0028] S13: Clustering is performed on the multiple communication numbers to be identified based on the communication behavior features and the voiceprint features to obtain multiple clusters.
[0029] In this step, clustering is performed on multiple communication numbers based on the communication behavior features and voiceprint features in the above steps. Among them, multiple communication numbers with similar communication behavior features have similar historical communication behavior patterns, and multiple communication numbers with similar voiceprint features are likely to be used by the same person. Therefore, clustering is performed on multiple communication numbers based on the communication behavior features and voiceprint features for identification, and the communication numbers used by multiple people with similar communication behavior patterns can be clustered into a cluster, which includes multiple communication numbers used by one person. The cluster obtained by clustering can be regarded as a group of communication numbers with similar behaviors and high correlation.
[0030] S14: Determine whether each cluster is a fraudulent number group according to the size of each cluster in the multiple clusters and the number of known fraudulent numbers contained in each cluster.
[0031] In this step, whether each cluster after clustering is a fraudulent number group is identified based on the size of each cluster after clustering and the number of known fraudulent numbers. For ease of explanation, the cluster after clustering is referred to as a community in this example. Among them, the community size can be divided according to the number of communication numbers contained in the community, and the division rules can be flexibly set based on actual needs. For any community size, a fraud determination threshold can be set in advance. If the number of known fraudulent numbers in the community is greater than the corresponding set determination threshold, the community is determined to be a fraudulent number group. The following table shows an example of the content of a community size and the corresponding fraud determination threshold: Table 3 Judgment rules
[0032] Since the fraud patterns of multiple people in the same fraud gang are often similar, multiple communication numbers with similar fraud patterns can be identified through communication behavior features. Furthermore, the use of voiceprint features and communication behavior features to perform clustering in this solution can effectively expand the identification range of fraud numbers and effectively cluster multiple communication numbers used by multiple people in the same fraud gang and the same person into clusters. Furthermore, determining whether the cluster is a fraud number group based on the cluster size and the number of known fraud numbers contained in the cluster can improve the effectiveness and integrity of fraud number group identification.
[0033] In the communication anti-fraud scenario, fraud gangs have many SIM cards and change them frequently. Most of the fraudulent numbers have only been in contact with no more than two fraudulent numbers. Therefore, if fraud numbers are identified only based on communication behavior characteristics, most fraud numbers will be isolated points or small groups (for example, groups with less than 5 people), which will cause the identification results to be greatly different from the actual situation, resulting in low accuracy in identifying fraud gangs.
[0034] The solution provided in the embodiment of the present application is based on the operator's voice call data and call voice data, and uses technical means such as graph network analysis and voiceprint analysis to identify telecommunications fraud gangs, effectively solving the defects of small-scale identification of fraud number groups and inaccurate gang identification in related technologies.
[0035] Based on the solution provided in the above embodiment, optionally, Figure 2 As shown, in the above step S13, clustering is performed on the multiple communication numbers to be identified based on the communication behavior characteristics and the voiceprint characteristics to obtain multiple clusters, including: S21: constructing a feature graph based on the communication behavior features and voiceprint features of multiple communication numbers, wherein the feature graph includes nodes corresponding to each communication number and feature edges between nodes.
[0036] In this step, a feature graph is constructed based on the communication behavior features and voiceprint features of the communication number. The feature graph includes nodes representing the communication number and feature edges connecting the nodes.
[0037] Among them, the characteristic edge can be generated according to the above-mentioned communication behavior characteristics and voiceprint characteristics, and the characteristic edge can be a directed line or an undirected line.
[0038] There may be multiple feature edges connecting a pair of nodes, for example, one edge is used to represent the similarity of the behavioral features of the connected nodes, and the other edge is used to represent the similarity of the voiceprint features of the connected nodes.
[0039] The above nodes may store multiple attribute information, such as basic information corresponding to the communication number, communication tags, etc. The above feature edges may also store multiple attribute information, such as communication behavior information, voice data, communication behavior features, voiceprint features, etc.
[0040] S22: Clustering each node using a graph clustering algorithm based on the feature edges between nodes in the feature graph to obtain multiple clusters.
[0041] In this step, the nodes in the feature graph are clustered based on the feature edges between the nodes by using a graph clustering algorithm, wherein the graph clustering algorithm may be, for example, the Louvain algorithm, and other types of algorithms may also be used to implement clustering in practical applications.
[0042] Through the solution provided by the embodiment of the present application, the communication behavior features and voiceprint features corresponding to multiple communication numbers are expressed in the form of a feature graph, and then the nodes in the graph are clustered by a graph clustering algorithm, so that the communication numbers are clustered into clusters according to the features. The communication numbers in the clusters after clustering have similar communication behaviors and / or voiceprints, so that the communication numbers in the clusters after clustering have strong correlation.
[0043] Based on the solution provided in the above embodiment, optionally, Figure 3 As shown, in the above step S21, a feature graph is constructed based on the communication behavior features and voiceprint features of multiple communication numbers, including: S31: Generate nodes corresponding to respective communication numbers.
[0044] In this step, corresponding nodes (Vertex) are first generated according to multiple communication numbers, wherein one communication number corresponds to one node.
[0045] S32: Generate communication feature edges between nodes based on the communication behavior records of multiple communication numbers, where the communication feature edges represent the communication relationship between connected nodes.
[0046] In this step, based on the communication behavior record of the communication number, a communication feature edge is generated between nodes, and the communication feature edge is used to represent the behavior existing between the nodes.
[0047] Specifically, a feature graph can be constructed based on the user basic data of the communication number and the CDR data. The feature graph can also be called a communication network. The points in the communication network represent user numbers, and the feature edges represent the call relationship between users. Optionally, the feature edges can be directed lines.
[0048] Based on the solution provided in the above embodiment, optionally, Figure 4a As shown, in the above step S32, communication feature edges are generated between nodes based on the communication behavior records of multiple communication numbers, and the communication feature edges represent the communication relationship between the connected nodes, including: S41: Generate directed edges between nodes based on the communication behavior records of multiple communication numbers, where the directed edges between nodes represent directed communication relationships between connected nodes.
[0049] Figure 4b A characteristic graph in a method for identifying a communication fraud number group in an embodiment of the present application is shown, and the characteristic graph includes three communication numbers, namely "111", "222" and "333". The characteristic graph can indicate that "111" has initiated calls to "222" and "333" respectively, and "222" and "333" have initiated calls with each other.
[0050] Among them, there is a directed edge between the nodes corresponding to the communication numbers, and the directed edge points from the number initiating the communication behavior to the number receiving the communication behavior. The communication behavior is not limited to calls, but can also be other types of communication behaviors, for example, from the user number initiating the information to the user number receiving the information.
[0051] S42: Perform feature aggregation on the directed edges connected between the same pair of nodes to generate the communication feature edges.
[0052] Figure 4c and Figure 4d This is a schematic diagram of a feature graph in a method for identifying a communication fraud number group in an embodiment of the present application, wherein information in a user information table can exist as an attribute on a point, and information in a CDR call record can exist as an attribute on an edge. Figure 4c This is an example of attribute data of the "111" node after attribute information is added. Figure 4d This is an example of attribute data of a feature edge pointing from node "111" to node "222" after attribute information is added.
[0053] In practical applications, since there may be multiple calls between a pair of user numbers, the number of directed edges between two users can be any natural number. In order to improve the efficiency of subsequent clustering, in the solution provided in the embodiment of the present application, the directed edges between a pair of user numbers can be further integrated, and the communication behavior relationship between a pair of users can be represented by a characteristic edge, which can also be called a communication edge.
[0054] For example, in terms of communication feature selection, the embodiment of the present application uses five communication features to represent the communication relationship between a pair of user numbers, as shown in the following table: Table 4 Communication characteristics list
[0055] Among them, N can be flexibly set according to actual needs to represent the communication feature statistical period.
[0056] Based on the five communication features in this example, we can further Figure 4bThe characteristic edges are integrated and summarized, and the communication relationship between a pair of connected nodes is represented by a characteristic edge. The attribute information stored in the characteristic edge is the parameters of the above five communication characteristics, such as Figure 4e shown.
[0057] S33: generating voiceprint feature edges between nodes based on the voice data of multiple communication numbers, wherein the voiceprint feature edges represent the similarity of voiceprint features between connected nodes.
[0058] In this step, voiceprint extraction is performed based on speech data, and the voiceprint feature similarity between connected nodes is represented by voiceprint feature edges. The voiceprint features can be extracted through a deep learning algorithm, and the similarity of the voiceprint features of a pair of nodes is calculated, and the voiceprint feature edge between the pair of nodes can be constructed based on the similarity results.
[0059] It should be noted that in this step, multiple communication numbers can be traversed, and the voiceprint feature similarity between any two communication numbers can be determined, and then the voiceprint feature edge between the two nodes can be constructed. There may be no communication feature edge between the two nodes connected by the voiceprint feature edge, that is, there may be no direct communication behavior between the communication numbers corresponding to the two nodes, but the voiceprint features are similar.
[0060] In terms of voiceprint extraction, the solution provided in the embodiment of the present application can first calculate the voiceprint feature vector of the user represented by the voice data through modeling. For example, the voiceprint feature vector of the voice data of a communication number can be calculated through CAM++. Among them, the core advantage of CAM++ is that it can realize the learning of voiceprint feature vectors based on user voice, ensuring high accuracy and high computing efficiency, and is particularly suitable for voiceprint feature extraction and feature similarity comparison of massive voices in the scenario of identifying telecommunications fraud gangs.
[0061] CAM++ network framework, for example Figure 5a As shown in the figure, the CAM++ backbone uses a densely connected time-delay network (D-TDNN). The input of each layer is concatenated from the outputs of all previous layers, which can significantly improve the computational efficiency of the network. At the same time, each layer of the D-TDNN is embedded with a CAM module, which extracts contextual information of different scales through global and segment-level pooling operations.
[0062] During the model training phase, CAM++ can be trained using the Chinese dataset CN-Celeb, which has rich voice data, including movies, speeches, recitations, and other scenes, and can effectively train the voiceprint extraction model.
[0063] During the model inference stage, the call voices between communication numbers can be used to build a voice library. For example, a 15-second voice is collected from multiple communication numbers as the registration voice to extract the voiceprint features corresponding to this communication number. The voiceprint features of the above registration voice are extracted using the trained voiceprint extraction model to generate a voiceprint feature vector. In this way, a voiceprint library containing voiceprint features corresponding to multiple communication numbers can be constructed. The voiceprint library can be generated in full at one time, and then fully updated according to the preset period. New users can also be added to the voiceprint library through incremental updates. The following table shows an example of the content of a voiceprint library: Table 5 Voiceprint library example
[0064] Based on the voiceprint feature vectors in the constructed voiceprint database, the voiceprint similarity between the communication numbers is calculated. In terms of similarity function selection, cosine similarity can be used, and other similarity functions such as Jaccard correlation coefficient and Pearson correlation coefficient can also be used. Figure 5b An example of calculating the cosine similarity is shown. The voiceprint similarity comparison is performed on the voice data (audio 1) of one communication number and the voice data (audio 2) of another communication number to obtain a similarity result. The numerical value of the similarity result can indicate the similarity of the voiceprints of the two communication numbers, and can be used to determine whether the two communication numbers are used by the same person.
[0065] In this step, the voiceprint feature similarity between "111", "222" and "333" in the above example is calculated, and the voiceprint similarity between two communication numbers can be obtained as shown in the following table: Table 6 User voiceprint similarity table
[0066] Furthermore, based on the above voiceprint similarity, voiceprint feature edges are generated between nodes. Figure 4e Taking the feature graph containing communication feature edges as an example, we further generate voiceprint feature edges between nodes. Figure 5c As shown in the figure, the inner circle lines between nodes are voiceprint feature edges, and the attribute value of the voiceprint feature edge is the voiceprint feature similarity of the connected nodes.
[0067] S34: Perform feature fusion on the communication feature edge and the voiceprint feature edge to obtain an inter-node feature edge.
[0068] In this step, the communication feature edge and the voiceprint feature edge are feature fused, and the generated node feature edge can integrate the two dimensions of voiceprint and communication feature behavior to represent the feature similarity between the two nodes.
[0069] For example, the communication edge contains five features: call duration, number of calls, proportion of short calls, average call duration, and number of roaming cities. In this step, these five features are represented as , , , , The voiceprint similarity edge contains one feature, voiceprint similarity, which is represented in this step as For the above 6 eigenvalues, the following formula can be used to perform fusion. The fused eigenvalues are used to generate feature edges between nodes. The above fusion formula is:
[0070] The solution provided in the embodiment of the present application performs feature extraction and feature fusion in the two aspects of communication behavior feature dimension and voiceprint feature dimension, which can comprehensively and effectively represent the total similarity between the communication numbers corresponding to the two nodes, and can provide an effective data basis for subsequent further clustering of nodes.
[0071] Based on the solution provided in the above embodiment, optionally, Figure 6 As shown, in the above step S22, clustering is performed on each node based on the characteristic edges between nodes in the feature graph by using a graph clustering algorithm to obtain multiple clusters, including: S61: traverse each node in the feature graph to determine the cluster to which each node belongs.
[0072] The solution provided in the embodiment of the present application adopts a graph clustering algorithm to perform clustering, and the Louvain algorithm is used as an example for explanation below.
[0073] In this step, the nodes in the feature graph are clustered based on the feature edges connecting each node in the feature graph. For example, the feature values of the feature edges between nodes obtained by fusion of voiceprint features and communication behavior features in the above example are As the clustering basis, the Represents the weight of the feature edge between node i and node j.
[0074] Based on the solution provided in the above embodiment, optionally, Figure 7 As shown, in the above step S61, traversing each node in the feature graph to determine the cluster to which each node belongs includes: S71: Allocate the nodes to be clustered in the feature graph to candidate clusters where neighboring nodes are located based on feature edge connections between nodes.
[0075] First, each node in the feature graph is regarded as an independent community, that is, an independent cluster, and each cluster contains only one node.
[0076] Then, based on the connection relationship between the characteristic edges between nodes, try to assign node i to the community where each of its neighbor nodes is located.
[0077] S72: Determine the modularity of the candidate cluster based on the characteristic edges between nodes connecting the nodes in the candidate cluster.
[0078] For the community to which node i is assigned, calculate the modularity change of the community after assignment , and record The largest neighbor node. The calculation formula of modularity is:
[0079] in, represents the sum of the weights of all edges connected to node i; represents the community to which the node belongs, Represents the sum of the weights of all edges.
[0080] in, The calculation method is as follows:
[0081] S73: If the modularity meets a preset modularity standard, determining that the node to be clustered belongs to the candidate cluster.
[0082] The default modularity standard is , if satisfied, assign node i to The community where the largest neighbor node is located, otherwise point i is not allocated, and continue to look for other adjacent nodes to calculate the modularity.
[0083] S62: Update multiple nodes belonging to the same communication number group in the feature graph into one node corresponding to the communication number group.
[0084] For the clustering results of the feature graph that has met the preset modularity standard, the nodes belonging to the same community are compressed into a new node, thereby performing node compression on the entire feature graph.
[0085] S63: If the updated feature map meets the preset clustering standard, output a plurality of clusters based on the updated feature map.
[0086] If the communities to which all nodes in the feature graph belong no longer change, it is determined that the preset clustering criteria are met, and multiple clusters that have completed clustering are output.
[0087] Through the solution provided in the embodiment of the present application, the Louvain algorithm is used to realize cluster identification of fraud gangs. The Louvain algorithm is a classic clustering algorithm in the field of graph computing. Modularity is used to measure whether the division of a community is good, which can effectively ensure the quality of clustering results and effectively identify fraudulent number groups.
[0088] Below, the solution provided in the embodiment of the present application is further explained with reference to an example.
[0089] like Figure 8a As shown, in the solution provided by the embodiment of the present application, the communication data of multiple communication numbers are first obtained, and feature extraction is performed on the communication data to construct nodes corresponding to the multiple communication numbers. The nodes can be connected with directed communication edges representing the communication behavior relationship.
[0090] Then, for multiple directed communication edges between nodes, communication feature aggregation is performed, and the communication relationship between two connected nodes is represented by a communication edge.
[0091] Subsequently, the voiceprint similarity calculation is performed between each pair of nodes, and the voiceprint similarity between the two nodes is represented by the voiceprint feature edge.
[0092] Next, each node is clustered by Louvain according to the above communication edges and voiceprint feature edges to achieve communication number clustering, and obtain a cluster containing multiple communication numbers with high correlation.
[0093] Finally, based on the size of each cluster and the number of known fraudulent numbers contained in each cluster, it is determined whether each cluster is a fraudulent number group to identify the fraud gang.
[0094] based on Figure 5c In the example shown, two clusters are generated after Louvain algorithm partitioning, such as Figure 8b As shown, community 1 contains two phone numbers, "111" and "222", and "111" is a known fraudulent phone number. Based on the fraud determination rules, community 1 is determined to be a fraudulent number group, that is, a fraud gang. Community 2 contains one phone number, and number 333 is not a known fraudulent phone number, so community 2 is determined to be a non-fraudulent number group, that is, a non-fraud gang.
[0095] In the solution provided by the embodiment of the present application, the communication behavior characteristics and voiceprint characteristics of the communication number are integrated to jointly identify the fraud number group. Multi-feature integration is achieved through feature network construction, and clustering is then achieved through the Louvain algorithm, and effective identification of communication fraud gangs is achieved based on judgment rules. The recognition results of this solution are comprehensive and accurate, and can achieve efficient identification.
[0096] In order to solve the problems existing in the related art, the embodiment of the present application also provides a device 90 for identifying a communication fraud number group, such as Fig. 9 As shown, including: An acquisition module 91 acquires communication data of multiple communication numbers to be identified, wherein the communication data includes communication behavior records, voice data, and communication tags, and the communication tags indicate whether the corresponding communication number is a known fraud number; An extraction module 92 performs feature extraction on the communication data of the plurality of communication numbers respectively to obtain communication behavior features corresponding to the communication behavior records of each communication number and voiceprint features corresponding to the voice data of each communication number; A clustering module 93 performs clustering on the multiple communication numbers to be identified based on the communication behavior characteristics and the voiceprint characteristics to obtain multiple clusters; The determination module 94 determines whether each cluster is a fraudulent number group according to the size of each cluster in the multiple clusters and the number of known fraudulent numbers contained in each cluster.
[0097] Through the device provided by the embodiment of the present application, first, the communication data of multiple communication numbers to be identified are obtained, and the communication data include communication behavior records, voice data and communication tags, and the communication tags represent whether the corresponding communication number is a known fraud number. Then, feature extraction is performed on the communication data of multiple communication numbers respectively to obtain communication behavior features corresponding to the communication behavior records of each communication number and voiceprint features corresponding to the voice data of each communication number. Next, clustering is performed on the multiple communication numbers to be identified based on the communication behavior features and voiceprint features to obtain multiple clusters; finally, whether the cluster is a fraud number group is determined according to the size of each cluster after clustering and the number of known fraud numbers contained in each cluster. Among them, the voiceprint feature can effectively identify the person who uses the communication number for voice, and the voiceprint feature can be used to identify the same person using multiple communication numbers. Since the fraud patterns of multiple people in the same fraud gang are often similar, multiple communication numbers with similar fraud patterns can be identified through communication behavior features. Furthermore, this solution uses voiceprint features and communication behavior features to perform clustering, which can effectively expand the identification scope of fraudulent numbers and effectively cluster multiple communication numbers used by multiple people in the same fraud gang and the same person into clusters. Furthermore, according to the size of each cluster after clustering and the number of known fraudulent numbers contained in each cluster, it is determined whether the cluster is a fraudulent number group, which can improve the effectiveness and integrity of fraudulent number group identification.
[0098] Among them, the above modules in the device provided by the embodiment of the present application can also implement the method steps provided by the above method embodiment. Alternatively, the device provided by the embodiment of the present application can also include other modules in addition to the above modules to implement the method steps provided by the above method embodiment. And the device provided by the embodiment of the present application can achieve the technical effects that can be achieved by the above method embodiment.
[0099] Preferably, an embodiment of the present application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment for identifying a group of communication fraud numbers are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.
[0100] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned method for identifying a group of communication fraud numbers is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0101] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to execute part or all of the steps of the above-mentioned method embodiment for identifying communication fraud number groups, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0102] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
[0103] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0104] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0105] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0106] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0107] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.
[0108] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.
[0109] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0110] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
[0111] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims
1. A method for identifying a communication fraud number group, characterized in that: include: Acquire communication data of multiple communication numbers to be identified, the communication data including communication behavior records, voice data and communication tags, the communication tags indicating whether the corresponding communication number is a known fraud number; Perform feature extraction on the communication data of the multiple communication numbers respectively to obtain communication behavior features corresponding to the communication behavior records of each communication number and voiceprint features corresponding to the voice data of each communication number; Clustering is performed on multiple communication numbers to be identified based on communication behavior features and voiceprint features to obtain multiple clusters; Whether each cluster is a fraudulent number group is determined according to the size of each cluster in the multiple clusters and the number of known fraudulent numbers contained in each cluster.
2. The method according to claim 1, characterized in that Based on the communication behavior features and voiceprint features, multiple communication numbers to be identified are clustered to obtain multiple clusters, including: Constructing a feature graph based on the communication behavior features and voiceprint features of the plurality of communication numbers, wherein the feature graph includes nodes corresponding to the respective communication numbers and feature edges between the nodes; Clustering is performed on each node based on the characteristic edges between nodes in the characteristic graph by using a graph clustering algorithm to obtain multiple clusters.
3. The method according to claim 2, characterized in that A feature graph is constructed based on the communication behavior characteristics and voiceprint characteristics of multiple communication numbers, including: Generate nodes corresponding to each communication number; Generate communication feature edges between nodes based on the communication behavior records of multiple communication numbers, wherein the communication feature edges represent the communication relationship between the connected nodes; Generating voiceprint feature edges between nodes based on the voice data of multiple communication numbers, wherein the voiceprint feature edges represent the similarity of voiceprint features between connected nodes; Feature fusion is performed on the communication feature edge and the voiceprint feature edge to obtain an inter-node feature edge.
4. The method according to claim 3, characterized in that Generate communication feature edges between nodes based on the communication behavior records of multiple communication numbers, wherein the communication feature edges represent the communication relationship between the connected nodes, including: Generate directed edges between nodes based on the communication behavior records of multiple communication numbers, wherein the directed edges between nodes represent directed communication relationships between connected nodes; Feature aggregation is performed on directed edges connected between the same pair of nodes to generate the communication feature edges.
5. The method according to any one of claims 2 to 4, characterized in that: Clustering each node using a graph clustering algorithm based on the feature edges between nodes in the feature graph to obtain multiple clusters, including: Traversing each node in the feature graph to determine the cluster to which each node belongs; Updating multiple nodes in the feature graph belonging to the same communication number group into one node corresponding to the communication number group; If the updated feature map meets the preset clustering criteria, multiple clusters are output based on the updated feature map.
6. The method according to claim 5, characterized in that Traversing each node in the feature graph to determine the cluster to which each node belongs includes: Assigning the nodes to be clustered in the feature graph to candidate clusters where neighboring nodes connected based on feature edges between nodes are located; Determine the modularity of the candidate cluster based on the characteristic edges between nodes connected to each node in the candidate cluster; If the modularity meets a preset modularity standard, it is determined that the node to be clustered belongs to the candidate cluster.
7. A device for identifying communication fraud number groups, characterized in that: include: An acquisition module, which acquires communication data of multiple communication numbers to be identified, wherein the communication data includes communication behavior records, voice data, and communication tags, and the communication tags indicate whether the corresponding communication number is a known fraud number; An extraction module is used to perform feature extraction on the communication data of the plurality of communication numbers respectively, so as to obtain communication behavior features corresponding to the communication behavior records of each communication number and voiceprint features corresponding to the voice data of each communication number; A clustering module, which performs clustering on multiple communication numbers to be identified based on communication behavior features and voiceprint features to obtain multiple clusters; The determination module determines whether each cluster is a fraudulent number group according to the size of each cluster in the multiple clusters and the number of known fraudulent numbers contained in each cluster.
8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the method according to any one of claims 1 to 6 when executed by the processor.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
10. A computer program product, characterized in that The computer program product comprises a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute part or all of the steps of the method according to any one of claims 1 to 6.