Method for automatically and intelligently identifying high-risk user

Abstract

The invention discloses a method for automatically and intelligently identifying high-risk users, which relates to the field of intelligent identification and comprises the following steps: collecting no less than 10,000 pieces of call behavior data of non-high-risk users and no less than 10,000 pieces of call behavior data of normal users to form a data set 1 as a material for training a network for the first time; and collecting no less than 5000 pieces of call behavior data of take-out, express delivery, customer service and sales personnel. According to the method for automatically and intelligently identifying the high-risk users, the numbers of part of the high-risk users can be identified, misjudgment of express, take-out, customer service, sales and other calls is avoided, better use experience is brought to the majority of users, the difficulty of identifying the high-risk users is reduced, and by introducing a secondary training method, the user experience is improved. By reducing the non-causal relation between the features and the results, the F1 value of the algorithm is improved, the misjudgment of the algorithm on express calls, take-out calls and the like is reduced, and the practicability and effectiveness of the overall algorithm are improved.

Description

Technical Field

[0001] The present invention relates to the field of intelligent identification technology, and in particular to a method for automatically and intelligently identifying high-risk users. Background Art

[0002] In recent years, telecommunications network fraud has become increasingly serious, causing significant economic losses to society. In response to this severe situation, public security departments, telecommunications operators and many academic researchers are actively exploring effective methods to accurately identify high-risk users in order to minimize the occurrence of fraud.

[0003] Through efforts, some typical methods have been formed, including blacklist system method, reputation system method, content detection method, behavioral feature analysis method and other methods.

[0004] Among them, behavioral feature analysis has the characteristics of strong privacy, so it has become the most common method for identifying high-risk users. It can effectively distinguish high-risk numbers from normal numbers by building user communication behavior features and combining machine learning or deep learning models.

[0005] However, in traditional high-risk user identification algorithms based on behavioral feature analysis, machine learning models or deep learning models rely on training data, and model learning emphasizes the correlation between features and user categories rather than true causal relationships. As a result, although these algorithms can identify some high-risk user numbers to a certain extent, they often misjudge calls from couriers, takeouts, customer service, sales, etc., which not only brings inconvenience to the majority of users, but also increases the difficulty of identifying high-risk users.

[0006] To this end, this paper introduces a secondary training method to reduce the non-causal relationship between features and results, thereby improving the F1 value of the algorithm and reducing the algorithm's misjudgment of calls such as express and takeout. Summary of the invention

[0007] The purpose of the present invention is to provide a method for automatically and intelligently identifying high-risk users, so as to solve the problem proposed in the above background technology that calls from express delivery, take-out, customer service, sales, etc. are often misjudged, which not only brings inconvenience to the majority of users, but also increases the difficulty of identifying high-risk users.

[0008] To achieve the above objectives, the present invention provides the following technical solutions: A method for automatically and intelligently identifying high-risk users, comprising: S1: collecting data

[0009] Collect no less than 10,000 pieces of call behavior data of non-high-risk users and no less than 10,000 pieces of call behavior data of normal users to form Dataset 1, which will be used as the material for the first network training;

[0010] Collect at least 5,000 pieces of call behavior data from food delivery, express delivery, customer service, and sales staff; 5,000 pieces of call behavior data from non-high-risk users, non-food delivery, express delivery, customer service, and sales staff; 10,000 pieces of call behavior data from high-risk users; form Dataset 2, which will be used as the data for the second training of the network;

[0011] S2: Data feature extraction

[0012] From the call behavior data of Dataset 1 and Dataset 2, extract the calling frequency, calling time, calling location, calling frequency, calling duration, proportion of calls in different cities, proportion of calls in different cities (outgoing calls), proportion of calls in different provinces, proportion of calls in different provinces (outgoing calls), proportion of calls with different numbers at the other end (outgoing calls), proportion of calls in different places, number of different numbers at the other end / total number of calls, proportion of calls in different places (outgoing calls), proportion of calls in different places (outgoing calls), and proportion of calls in different places (outgoing calls);

[0013] The features extracted from the i-th data in dataset 1 are recorded as:

[0014]

[0015] Where J is the number of features. If it is a high-risk user number, its label y i = 1, otherwise its label y i =0; taking 10 features as an example, then Respectively represent the calling frequency of the i-th data in the first data set, the proportion of calls in different places (cities), the proportion of calls in different places (cities) (outgoing calls), the proportion of calls in different places (provinces), the proportion of calls in different places (provinces) (outgoing calls), the proportion of calls with different numbers at the other end (outgoing calls), the proportion of calls in different places of origin, the number of calls with different numbers at the other end / total number of calls, the proportion of calls in different places of origin (outgoing calls), and the proportion of calls in different places of visit (outgoing calls);

[0016] The features extracted from the i-th data in dataset 2 are recorded as:

[0017]

[0018] Where J is the number of features. If it is a high-risk user number, its label yy i = 1, otherwise its label is yy i =0; taking 10 features as an example, then Respectively represent the calling frequency of the i-th data in the second data set, the proportion of calls in different places (cities), the proportion of calls in different places (cities) (outgoing calls), the proportion of calls in different places (provinces), the proportion of calls in different places (provinces) (outgoing calls), the proportion of calls with different numbers at the other end (outgoing calls), the proportion of calls in different places of origin, the number of calls with different numbers at the other end / total number of calls, the proportion of calls in different places of origin (outgoing calls), and the proportion of calls in different places of visit (outgoing calls);

[0019] S3: Training the network

[0020] Take all the data features X in dataset 1 as i , i=1...N} as input, and its label y={y i , i=1...N} as output, and the optimal output layer weight W is obtained by minimizing formula (1) o = and offset b o , and the weights of the hidden layers and offset b h , where J is the number of features, M is the number of neurons in the hidden layer, and K is the number of output neurons. Formula (2) represents a feedforward operation of a three-layer neural network architecture. The first layer is the input layer, and the number of neurons is equal to the number of features. According to step 1, since the input features are 10, the second layer is the hidden layer, and the number of neurons is recommended to be between 10 and 15. The third layer is the output layer, and the number of neurons is 1. The neuron activation function of the hidden layer is ReLu, and the activation function of the output layer is the sigmoid function. That is to say, g represents the reLu activation function, and f represents the sigmoid activation function. When minimizing err, any optimization algorithm such as the BP algorithm can be used. N is the number of samples;

[0021]

[0022] S4: Correct the hidden layer weights W in step 3 h ;

[0023] From Dataset 2, select 5,000 non-fraud, non-takeout, express, customer service, and sales staff’s call behavior data and the same amount of high-risk user call behavior data. Through the data feature extraction method in step 2, extract:

[0024] XX1={XX i ,i=1..2L} and yy1={yy i ,i=1..2L}

[0025] Select 5,000 call behavior data of takeout, express, customer service, and sales personnel and the same amount of call behavior data of high-risk users, and extract them through the data feature extraction method in step 2.

[0026] XX2={XX i ,i=1..2S} and yy2={yy i ,i=1..2S};

[0027] The Pearson correlation coefficient is used to calculate the correlation between each feature in XX1 and yy1, and a total of J correlation indices are obtained. By W h XX1+b h Calculate F h , using the Pearson correlation coefficient to calculate F h The correlation between yy1 and yy1 can be M correlation indicators

[0028] Similarly, using XX2 and yy2 as input data, the above method can be used to calculate

[0029] like at the same time Then set W learned in step 3 h In

[0030] thr1 and thr2 are thresholds, obtained through experience;

[0031] Using the updated W h* As the hidden layer weights in the new network.

[0032] Furthermore, the feature extraction method in step 2 has already appeared in relevant literature, and the specific extraction method can refer to literature such as "Research on Fraud Control Technology".

[0033] Furthermore, it also includes S5: judging

[0034] For a new phone number, extract the feature according to the feature extraction method in step 2 to obtain X new , input the features into y new =f(W o g(W h* X new +b h )+b o ), where W o and b o and b h is the matrix or vector obtained by training the network in step 3, W h* is the matrix obtained in step 4. If y new >0.5, the number is considered to be a high-risk user.

[0035] Furthermore, S1 extracts the calling frequency, calling time, calling location, calling frequency, calling duration, proportion of out-of-town (city) calls, proportion of out-of-town (city) calls (outgoing calls), proportion of out-of-town (province) calls, proportion of out-of-town (province) calls (outgoing calls), proportion of calls with different numbers on the other end (outgoing calls), proportion of calls with different locations, number of different numbers on the other end / total number of calls, proportion of calls with different locations (outgoing calls), proportion of calls with different visited locations (outgoing calls) and other features from the calling behavior data of data sets 1 and 2.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] This method of automatic intelligent identification of high-risk users can identify some high-risk user numbers and will not misjudge phone numbers such as couriers, takeouts, customer service, and sales, which brings a better user experience to the majority of users and reduces the difficulty of identifying high-risk users. By introducing a secondary training method, the F1 value of the algorithm is improved by reducing the non-causal relationship between features and results, reducing the algorithm's misjudgment of phone numbers such as couriers and takeouts, and improving the practicality and effectiveness of the overall algorithm.

[0038] Furthermore, from the call behavior data of the dataset, features are extracted, including calling frequency, calling time, calling location, calling frequency, call duration, proportion of calls in different cities, proportion of calls in different cities (outgoing calls), proportion of calls in different provinces, proportion of calls in different provinces (outgoing calls), proportion of calls with different numbers on the other end (outgoing calls), proportion of calls in different locations, number of different numbers on the other end / total number of calls, proportion of calls in different locations (outgoing calls), proportion of calls in different visited locations (outgoing calls), etc., so as to avoid errors to the greatest extent and improve the accuracy of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of the structure of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Example 1: Please refer to Figure 1 The present invention provides the following technical solution: a method for automatically and intelligently identifying high-risk users, comprising the following steps:

[0042] S1: Collect data

[0043] Collect no less than 10,000 pieces of call behavior data of non-high-risk users and no less than 10,000 pieces of call behavior data of normal users to form Dataset 1, which will be used as the material for the first network training;

[0044] Collect at least 5,000 pieces of call behavior data from food delivery, express delivery, customer service, and sales staff; 5,000 pieces of call behavior data from non-high-risk users, non-food delivery, express delivery, customer service, and sales staff; 10,000 pieces of call behavior data from high-risk users; form Dataset 2, which will be used as the data for the second training of the network;

[0045] S2: Data feature extraction

[0046] From the call behavior data of Dataset 1 and Dataset 2, extract the calling frequency, calling time, calling location, calling frequency, calling duration, proportion of calls in different cities, proportion of calls in different cities (outgoing calls), proportion of calls in different provinces, proportion of calls in different provinces (outgoing calls), proportion of calls with different numbers at the other end (outgoing calls), proportion of calls in different places, number of different numbers at the other end / total number of calls, proportion of calls in different places (outgoing calls), proportion of calls in different places (outgoing calls), and proportion of calls in different places (outgoing calls);

[0047] The features extracted from the i-th data in dataset 1 are recorded as:

[0048]

[0049] Where J is the number of features. If it is a high-risk user number, its label y i = 1, otherwise its label y i =0; taking 10 features as an example, then Respectively represent the calling frequency of the i-th data in the first data set, the proportion of calls in different places (cities), the proportion of calls in different places (cities) (outgoing calls), the proportion of calls in different places (provinces), the proportion of calls in different places (provinces) (outgoing calls), the proportion of calls with different numbers at the other end (outgoing calls), the proportion of calls in different places of origin, the number of calls with different numbers at the other end / total number of calls, the proportion of calls in different places of origin (outgoing calls), and the proportion of calls in different places of visit (outgoing calls);

[0050] The features extracted from the i-th data in dataset 2 are recorded as:

[0051]

[0052] Where J is the number of features. If it is a high-risk user number, its label yy i = 1, otherwise its label is yy i =0; taking 10 features as an example, then Respectively represent the calling frequency of the i-th data in the second data set, the proportion of calls in different places (cities), the proportion of calls in different places (cities) (outgoing calls), the proportion of calls in different places (provinces), the proportion of calls in different places (provinces) (outgoing calls), the proportion of calls with different numbers at the other end (outgoing calls), the proportion of calls in different places of origin, the number of calls with different numbers at the other end / total number of calls, the proportion of calls in different places of origin (outgoing calls), and the proportion of calls in different places of visit (outgoing calls);

[0053] The feature extraction method in step 2 has already appeared in relevant literature. For specific extraction methods, please refer to literature such as "Research on Fraud Control Technology".

[0054] S3: Training the network

[0055] Take all the data features X in dataset 1 as i , i=1...N} as input, and its label y={y i , i=1...N} as output, and the optimal output layer weight W is obtained by minimizing formula (1) o = and offset b o , and the weights of the hidden layers and offset b h , where J is the number of features, M is the number of neurons in the hidden layer, and K is the number of output neurons. Formula (2) represents a feedforward operation of a three-layer neural network architecture. The first layer is the input layer, and the number of neurons is equal to the number of features. According to step 1, since the input features are 10, the second layer is the hidden layer, and the number of neurons is recommended to be between 10 and 15. The third layer is the output layer, and the number of neurons is 1. The neuron activation function of the hidden layer is ReLu, and the activation function of the output layer is the sigmoid function. That is to say, g represents the reLu activation function, and f represents the sigmoid activation function. When minimizing err, any optimization algorithm such as the BP algorithm can be used. N is the number of samples;

[0056]

[0057] S4: Correct the hidden layer weights W in step 3 h ;

[0058] From Dataset 2, select 5,000 non-fraud, non-takeout, express, customer service, and sales staff’s call behavior data and the same amount of high-risk user call behavior data. Through the data feature extraction method in step 2, extract:

[0059] XX1={XX i ,i=1..2L} and yy1={yy i ,i=1..2L}

[0060] Select 5,000 call behavior data of takeout, express, customer service, and sales personnel and the same amount of call behavior data of high-risk users, and extract them through the data feature extraction method in step 2.

[0061] XX2={XX i ,i=1..2S} and yy2={yy i ,i=1..2S};

[0062] The Pearson correlation coefficient is used to calculate the correlation between each feature in XX1 and yy1, and a total of J correlation indices are obtained. By W h XX1+b h Calculate F h , using the Pearson correlation coefficient to calculate F h The correlation between yy1 and yy1 can be M correlation indicators

[0063] Similarly, using XX2 and yy2 as input data, the above method can be used to calculate

[0064] like at the same time Then set W learned in step 3 h In

[0065] thr1 and thr2 are thresholds, obtained through experience;

[0066] Using the updated W h* As the hidden layer weights in the new network.

[0067] S5: Judgment

[0068] For a new phone number, extract the feature according to the feature extraction method in step 2 to obtain X new , input the features into y new =f(W o g(W h* X new +b h )+b o ), where W o and b o and b h is the matrix or vector obtained by training the network in step 3, W h* is the matrix obtained in step 4. If y new >0.5, the number is considered to be a high-risk user.

[0069] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "connected" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0070] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for automatically and intelligently identifying high-risk users, characterized in that: The following steps are involved: S1: Collect data Collect no less than 10,000 pieces of call behavior data of non-high-risk users and no less than 10,000 pieces of call behavior data of normal users to form Dataset 1, which will be used as the material for the first network training; Collect no less than 5,000 pieces of call behavior data from food delivery, express delivery, customer service, and sales staff; 5,000 pieces of call behavior data from non-high-risk users, non-food delivery, express delivery, customer service, and sales staff; 10,000 pieces of call behavior data from high-risk users; Form data set 2 as the data for the second training of the network; S2: Data feature extraction From the call behavior data of Dataset 1 and Dataset 2, extract the calling frequency, calling time, calling location, calling frequency, calling duration, proportion of calls in different cities, proportion of calls in different cities (outgoing calls), proportion of calls in different provinces, proportion of calls in different provinces (outgoing calls), proportion of calls with different numbers at the other end (outgoing calls), proportion of calls in different places, number of different numbers at the other end / total number of calls, proportion of calls in different places (outgoing calls), proportion of calls in different places (outgoing calls), and proportion of calls in different places (outgoing calls); The features extracted from the i-th data in dataset 1 are recorded as: Where J is the number of features. If it is a high-risk user number, its label y i = 1, otherwise its label y i =0; taking 10 features as an example, then Respectively represent the calling frequency of the i-th data in the first data set, the proportion of calls in different places (cities), the proportion of calls in different places (cities) (outgoing calls), the proportion of calls in different places (provinces), the proportion of calls in different places (provinces) (outgoing calls), the proportion of calls with different numbers at the other end (outgoing calls), the proportion of calls in different places of origin, the number of calls with different numbers at the other end / total number of calls, the proportion of calls in different places of origin (outgoing calls), and the proportion of calls in different places of visit (outgoing calls); The features extracted from the i-th data in data set 2 are recorded as: Where J is the number of features. If it is a high-risk user number, its label yy i = 1, otherwise its label is yy i =0; taking 10 features as an example, then Respectively represent the calling frequency of the i-th data in the second data set, the proportion of calls in different places (cities), the proportion of calls in different places (cities) (outgoing calls), the proportion of calls in different places (provinces), the proportion of calls in different places (provinces) (outgoing calls), the proportion of calls with different numbers at the other end (outgoing calls), the proportion of calls in different places of origin, the number of calls with different numbers at the other end / total number of calls, the proportion of calls in different places of origin (outgoing calls), and the proportion of calls in different places of visit (outgoing calls); S3: Training the network Take all the data features X in dataset 1 as i , i=1...N} as input, and its label y={y i , i=1...N} as output, and the optimal output layer weight is obtained by minimizing formula (1) and offset b o , and the weights of the hidden layers and offset b h , where J is the number of features, M is the number of neurons in the hidden layer, and K is the number of output neurons. Formula (2) represents a feedforward operation of a three-layer neural network architecture. The first layer is the input layer, and the number of neurons is equal to the number of features. According to step 1, since the input features are 10, the second layer is the hidden layer, and the number of neurons is recommended to be between 10 and 15. The third layer is the output layer, and the number of neurons is 1. The neuron activation function of the hidden layer is ReLu, and the activation function of the output layer is the sigmoid function. That is to say, g represents the reLu activation function, and f represents the sigmoid activation function. When minimizing err, any optimization algorithm such as the BP algorithm can be used. N is the number of samples; S4: Correct the hidden layer weights W in step 3 h ; From Dataset 2, select 5,000 non-fraud, non-takeout, express, customer service, and sales personnel’s call behavior data and the same amount of high-risk user call behavior data. Through the data feature extraction method in step 2, extract: XX1 = {XX i , i = 1..2L} and yy1 = {yy i , i = 1..2L} Select 5,000 call behavior data of takeout, express, customer service, and sales personnel and the same amount of call behavior data of high-risk users, and extract them through the data feature extraction method in step 2. XX2 = {XX i , i = 1..2S} and yy2 = {yy i , i = 1..2S}; The Pearson correlation coefficient is used to calculate the correlation between each feature in XX1 and yy1, and a total of J correlation indices are obtained. By W h XX1+b h Calculate F h , using the Pearson correlation coefficient to calculate F h The correlation between yy1 and yy1 can be M correlation indicators Similarly, using XX2 and yy2 as input data, the above method can be used to calculate like at the same time Then set W learned in step 3 h In thr1 and thr2 are thresholds, obtained through experience; Using the updated W h* As the hidden layer weights in the new network.

2. The method for automatically and intelligently identifying high-risk users according to claim 1, characterized in that: The feature extraction method in step 2 has already appeared in relevant literature. For specific extraction methods, please refer to literature such as "Research on Fraud Control Technology".

3. The method for automatically and intelligently identifying high-risk users according to claim 1, characterized in that: Also includes S5: Judgment For a new phone number, extract the feature according to the feature extraction method in step 2 to obtain X new , input the features into y new =f(W o g(W h* X new +b h )+b o ), where W o and b o and b h is the matrix or vector obtained by training the network in step 3, W h* is the matrix obtained in step 4. If y new >0.5, the number is considered to be a high-risk user.

4. The method for automatically and intelligently identifying high-risk users according to claim 1, characterized in that: In S1, the calling behavior data of data set 1 and data set 2 are extracted to include the calling frequency, calling time, calling location, calling frequency, calling duration, the proportion of calls in different places (cities), the proportion of calls in different places (cities) (outgoing calls), the proportion of calls in different places (provinces), the proportion of calls in different places (provinces) (outgoing calls), the proportion of calls with different numbers on the other end (outgoing calls), the proportion of calls in different places of origin, the number of calls with different numbers on the other end / total number of calls, the proportion of calls in different places of origin (outgoing calls), the proportion of calls in different visited places (outgoing calls), and other features.

Images