Model training method, telecommunication network fraud behavior identification method and device

Abstract

The embodiment of the invention provides a model training method and a telecommunication network fraud behavior recognition method and device, and relates to the technical field of financial science and technology, the technical field of machine learning and the technical field of information security. The model training method comprises the steps of performing feature mining on historical transaction behavior data to obtain a plurality of features; according to each piece of historical transaction behavior data, extracting data corresponding to a plurality of features to obtain an original data set; dividing the original data set into N-fold data, and for the N-fold data, determining a replacement importance score mean value of each feature in the plurality of features by adopting a multi-fold cross calculation mode; selecting important features from the plurality of features based on the replacement importance score mean value of the features, and extracting a target data set corresponding to the important features based on the original data set; and training based on the target data set to obtain a telecommunication network fraud behavior recognition model. The telecommunication network fraud behavior recognition model provided by the invention has relatively high accuracy and relatively strong generalization ability.

Description

Technical Field

[0001] The present application relates to the fields of financial technology, machine learning technology and information security technology, and in particular to a model training method, a telecommunications network fraud behavior identification method and a device. Background Art

[0002] Financial services industries such as banks are facing severe challenges from telecom network fraud crimes. Telecom network fraud methods are becoming increasingly complex and diverse, making it more difficult to identify telecom network fraud behaviors and placing higher demands on the identification methods of telecom network fraud behaviors.

[0003] Therefore, there is an urgent need to provide a highly accurate telecommunications network fraud identification solution. Summary of the invention

[0004] The embodiments of the present application provide a model training method, a telecommunications network fraud behavior identification method and a device, so as to achieve the effect of improving the accuracy of telecommunications network fraud behavior identification.

[0005] In a first aspect, an embodiment of the present application provides a model training method, comprising: performing feature mining on historical transaction behavior data to obtain multiple features;

[0006] According to each piece of historical transaction behavior data, extract the data corresponding to multiple features to obtain the original data set;

[0007] The original data set is divided into N-fold data, and for the N-fold data, a multi-fold cross calculation method is used to determine the mean replacement importance score of each feature in multiple features;

[0008] Based on the mean of the replacement importance score of the features, important features are selected from multiple features, and the target data set corresponding to the important features is extracted based on the original data set;

[0009] Based on the target data set, a telecommunications network fraud behavior recognition model is trained.

[0010] In a second aspect, the present application provides a method for identifying telecommunications network fraud behavior, including:

[0011] Obtain transaction behavior data;

[0012] A telecommunications network fraud behavior identification model is applied to the transaction behavior data to identify telecommunications network fraud behaviors to obtain identification results. The telecommunications network fraud behavior identification model is trained according to the method as described in any one of claims 1 to 6.

[0013] In a third aspect, an embodiment of the present application provides a model training device, comprising:

[0014] The acquisition module is used to perform feature mining on the historical transaction behavior data to obtain multiple features; according to each piece of historical transaction behavior data, the data corresponding to the multiple features is extracted to obtain the original data set;

[0015] A processing module is used to divide the original data set into N-fold data, and for the N-fold data, determine the mean replacement importance score of each feature in multiple features by using a multi-fold cross calculation method; based on the mean replacement importance score of the feature, select important features from the multiple features, and extract the target data set corresponding to the important features based on the original data set;

[0016] The training module is used to train a telecommunications network fraud behavior recognition model based on the target data set.

[0017] In a fourth aspect, the present application provides a telecommunications network fraud behavior identification device, including:

[0018] Acquisition module, used to acquire transaction behavior data;

[0019] An identification module is used to apply a telecommunications network fraud behavior identification model to identify telecommunications network fraud behaviors on transaction behavior data to obtain identification results. The telecommunications network fraud behavior identification model is trained based on the first aspect and / or various possible implementation methods of the first aspect as described above.

[0020] In a fifth aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0021] Memory stores computer-executable instructions;

[0022] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementations of the first aspect, and the second aspect and / or various possible implementations of the second aspect as described above.

[0023] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the first aspect and / or various possible implementation methods of the first aspect, and the second aspect and / or various possible implementation methods of the second aspect.

[0024] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementations of the first aspect, and the second aspect and / or various possible implementations of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0026] Figure 1 A schematic diagram of a replacement importance algorithm flow chart provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram of a scenario of a method for identifying telecommunications network fraud behavior provided in an embodiment of the present application;

[0028] Figure 3 Schematic diagram of the model training method provided in the embodiment of the present application Figure 1 ;

[0029] Figure 4 Schematic diagram of the model training method provided in the embodiment of the present application Figure 2 ;

[0030] Figure 5 A flowchart of a replacement importance algorithm for multi-fold crossover calculation provided in an embodiment of the present application;

[0031] Figure 6 A schematic diagram of the training process of the telecommunications network fraud behavior identification model stacking method provided in the embodiment of the present application;

[0032] Figure 7 A schematic diagram of a method for identifying telecommunications network fraud behavior provided in an embodiment of the present application;

[0033] Figure 8 A schematic diagram of the structure of a model training device provided in an embodiment of the present application;

[0034] Fig. 9 A telecommunications network fraud behavior identification device provided in an embodiment of the present application;

[0035] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0036] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0037] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0038] First, the terms involved in this application are explained:

[0039] Telecom network fraud behavior identification refers to the process of identifying and preventing fraudulent behaviors conducted through telephone, Internet, text messages and other media through specific technical means and methods. When evaluating the accuracy of telecom network fraud behavior identification, the system is required to be able to identify all telecom network fraud targets as much as possible to increase the intensity of combating fraudulent behaviors, and the system is required to minimize misidentification of normal users and avoid unnecessary troubles to non-fraudulent users to ensure the normal development of business.

[0040] Historical transaction behavior data is a collection of data that records and reflects various information and behavior patterns generated by users or entities in transaction activities over a period of time in the past. It is of great significance for understanding user behavior, identifying potential risks, optimizing transaction strategies, and improving service quality. In particular, in the field of telecommunications network fraud identification, historical transaction behavior data is an indispensable and important resource. Historical transaction behavior data includes: transaction information, user information, behavior patterns, and risk information.

[0041] Feature mining is a key step in data analysis and machine learning, and usually includes steps such as feature selection, feature extraction, and feature construction. By mining effective features, we can better understand and utilize data, laying a solid foundation for subsequent model training and application.

[0042] Data preprocessing is a necessary step before training a machine learning model, including data cleaning, data integration, data transformation and data dimensionality reduction. Data cleaning is responsible for processing missing values, outliers and duplicate data in the data to ensure the accuracy and consistency of the data. Data integration can merge data from multiple data sources into a unified data set for subsequent analysis and modeling. Data transformation includes operations such as data smoothing, standardization, and discretization. Data dimensionality reduction can reduce the dimension of the data, reduce the amount of calculation and increase the training speed of the model while maintaining the main information of the data.

[0043] Multi-fold crossover is an idea of ​​splitting data into multiple parts (i.e., multiple folds) for subsequent processing. In machine learning, the multi-fold crossover idea helps reduce evaluation bias caused by improper data division and improves the reliability and accuracy of evaluation results.

[0044] Machine learning is a branch of artificial intelligence that studies how to learn patterns and regularities from data through computer systems, thereby achieving the ability to recognize and make decisions about unknown data without explicit programming instructions. The goal of machine learning is to enable computer systems to automatically improve and learn through experience to perform specific tasks or achieve specific goals.

[0045] Ensemble learning is a machine learning method that aims to improve the accuracy and robustness of overall recognition by combining the recognition results of multiple learners. The basic idea of ​​ensemble learning is to combine multiple models, take advantage of the advantages of each model, make up for the shortcomings of a single model, and obtain better generalization ability and performance.

[0046] Robustness refers to the stability and robustness of the model to outliers, noise or changes in the data. A model with high robustness can maintain good performance and recognition ability in the face of different types of interference or abnormal situations, and will not cause serious deviations in recognition results due to changes in data.

[0047] Generalization ability refers to the ability of a machine learning model to recognize unseen data (i.e. test data or new data in actual applications). Generalization ability measures whether the patterns and rules learned by the model during the training phase can be generalized to new data sets that are different from the training data.

[0048] Overfitting refers to the phenomenon that a machine learning model over-learns the details and noise in the training data, resulting in good performance on the training set but poor performance on unseen test data. Overfitting occurs when the model over-fits the specific noise and random changes in the training data, while ignoring the true patterns and regularities, resulting in poor generalization of the model.

[0049] Decision tree is a machine learning model based on a tree structure, which is used to learn simple decision rules from data. Decision tree gradually divides the data set into different subsets through a series of split operations, and each split point corresponds to a threshold or condition of a feature. During the training process, the decision tree continuously selects the optimal split point according to the characteristics of the data until the predetermined stopping condition is reached (such as the depth of the tree or the threshold of the number of samples in the node). Decision trees are often used for classification and regression tasks. Their advantages include being easy to understand and explain, and being insensitive to missing values, but they are prone to overfitting complex data.

[0050] A neural network is a model composed of multiple layers of neurons, inspired by the neuron structure of the human brain. A neural network consists of an input layer, multiple hidden layers (intermediate layers), and an output layer. Each neuron transmits signals through weighted summation and activation function calculation. During the training process, the neural network learns complex patterns and features in the data by adjusting the connection weights.

[0051] Logistic regression is a linear model for binary classification problems. Logistic regression converts continuous prediction values ​​into probability values ​​of 0 or 1 by passing the output of the linear model through a logistic function, thereby performing classification.

[0052] Base learners refer to individual models that are trained separately, such as decision trees, support vector machines, etc. These individual models serve as basic units in ensemble learning and are combined to improve the overall recognition performance.

[0053] Meta-learners are used to combine the recognition results of multiple base learners to obtain the final recognition result. Common meta-learners include voting, averaging, and weighted averaging. Through reasonable meta-learner design, the advantages of each base learner can be fully utilized to improve the recognition performance and stability of the integrated model.

[0054] The replacement importance algorithm is a feature selection algorithm that measures the degree of association between each feature and the target task by calculating the replacement importance score of each feature in the data set, and screens out important features. Specifically, the replacement importance algorithm replaces the value of the feature one by one and calculates the difference in model performance before and after the replacement. The greater the difference, the greater the impact of the feature on the model, that is, the higher the importance of the feature; the smaller the difference, the smaller the impact of the feature on the model, that is, the lower the importance of the feature. The replacement importance algorithm helps to identify features that have a significant impact on the model recognition results, thereby optimizing the model.

[0055] Figure 1 Figure 1 is a flowchart of a replacement importance algorithm. Figure 1 As shown, the process mainly includes: calculating the ordered feature score e orig , random feature X perm , disordered feature score e perm and replace the calculation of the importance score FI.

[0056] To facilitate understanding of the calculation relationship between different parameters in the replacement importance algorithm, Table 1 is a pseudo code schematic table of a replacement importance algorithm provided in an embodiment of the present application. As shown in Table 1, the replacement importance algorithm obtains a replacement importance score by evaluating the performance of the trained model on a specific data set. The input of the replacement importance algorithm includes: model F, test set feature X test , test set label y testAnd the evaluation index L(y,F).

[0057] Replace the importance algorithm. First, calculate the model F in the test set feature X test The ordered feature score e on orig Among them, the ordered feature score e orig By the evaluation index L(y test ,F(X test ))Calculated.

[0058] Afterwards, traverse X test For each feature j in the dataset, the feature data corresponding to feature j is randomly disrupted, making the feature data corresponding to feature j chaotic and invalid, thus generating a new disordered data set X perm .

[0059] Next, we calculate the model F for the new unordered data set X perm The disordered feature score e on perm Among them, the disorder feature score e perm By the evaluation index L(y test ,F(X perm ))Calculated.

[0060] Table 1 Pseudo code diagram of replacement importance algorithm

[0061]

[0062] Then, get the replacement importance score FI of feature j j =e orig -e perm . Every time you get FI j After that, the algorithm will restore the current shuffled feature j for the next cycle. When all features are traversed, the algorithm will output the final replacement importance score FI. The important features are obtained by replacing the importance score FI. If the evaluation index of model F does not decrease after the features are shuffled (i.e., FI j <0), the feature is judged as a "negative feature" and removed during model training to obtain important features (i.e., FI j ≥0).

[0063] In this case, both the evaluation metric and the replacement importance score depend on X test and test This set of data may be overfitted. The important features obtained by using this replacement importance algorithm may be test Overfitting the data in the model will reduce the generalization ability of the model during model training.

[0064] In the related technologies, since telecommunications network fraud behavior identification involves a large amount of complex data, and the quality of this data varies, it affects the effectiveness and accuracy of the telecommunications network fraud behavior identification model. At the same time, telecommunications network fraud has different characteristics and behavior patterns, and the telecommunications network fraud behavior identification model is difficult to cover all possible characteristics and behavior patterns, resulting in the telecommunications network fraud behavior identification model being unable to effectively identify fraudulent behavior and the model's generalization ability is poor. In summary, there are technical problems such as poor generalization ability and low recognition accuracy of the telecommunications network fraud behavior identification model.

[0065] The model training method provided in this application obtains the original data set containing telecommunications network fraud behavior information by performing feature mining on massive historical transaction behavior data; then, by calculating the replacement importance score of each feature in the original data set, important features are screened out, and the corresponding target data set is obtained based on the important features, the data dimension is reduced, and redundant and irrelevant information is removed, so that the data used to train the telecommunications network fraud behavior recognition model has a higher correlation with the telecommunications network fraud behavior, thereby improving the recognition accuracy and effectiveness of the telecommunications network fraud behavior recognition model. At the same time, the telecommunications network fraud behavior recognition model is trained using an integrated learning method to improve the generalization ability of the model, solving the technical problems of poor recognition generalization ability and low recognition accuracy of the telecommunications network fraud behavior recognition model.

[0066] Figure 2 A schematic diagram of a scenario of a method for identifying telecommunications network fraud behavior provided in an embodiment of the present application, such as Figure 2 As shown, the specific application scenarios of this application include: transaction behavior data 20, telecommunications network fraud behavior identification model 21 and telecommunications network fraud behavior identification results 22. Among them,

[0067] The transaction behavior data 20 is the input part of the telecommunications network fraud behavior identification model 21, covering various data generated by users during transactions. The telecommunications network fraud behavior identification model 21 is the core part of telecommunications network fraud behavior identification. Based on a large number of historical fraud cases and transaction behavior data, it uses machine learning, deep learning and other advanced technologies to train a model that can accurately identify fraudulent behavior. The telecommunications network fraud behavior identification result 22 is the output part of the system. It divides transaction behaviors into normal transactions and fraudulent transactions based on the telecommunications network fraud behavior identification model 21.

[0068] The telecommunications network fraud behavior identification model 21 can receive new transaction behavior data 20 in real time, and accurately analyze it to obtain the telecommunications network fraud behavior identification results 22. For fraudulent transactions in the telecommunications network fraud behavior identification results 22, the system will issue early warnings in a timely manner and take corresponding measures, such as freezing accounts, reporting to the police, etc., to protect the user's financial security.

[0069] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0070] Figure 3 Schematic diagram of the model training method provided in the embodiment of the present application Figure 1 ,like Figure 3 As shown, the method includes:

[0071] S301. Perform feature mining on historical transaction behavior data to obtain multiple features.

[0072] The transaction behavior data obtained from different data sources and covering different time periods are integrated into historical transaction behavior data. The data sources include: financial institutions, e-commerce platforms, communication operators or third-party payment platforms; because the amount of historical transaction behavior data obtained from different data sources is huge, and the features related to telecommunications network fraud are not significant, there is redundant information. If the historical transaction behavior data is directly used to train the telecommunications network fraud behavior recognition model, the recognition time of the telecommunications network fraud behavior recognition model will be long and the recognition accuracy will be low. By performing feature mining on historical transaction data, multiple features that may be correlated with fraudulent behavior are initially extracted, which can reduce the amount of data and facilitate the subsequent search for features related to telecommunications network fraud behavior.

[0073] S302: Extract data corresponding to multiple features based on each piece of historical transaction behavior data to obtain an original data set.

[0074] The original data set is a data set corresponding to multiple features obtained after feature mining of historical transaction behavior data. Compared with historical transaction behavior data, the original data set has less data volume and lower redundancy, which provides a solid data foundation for building a telecommunications network fraud model, helps computers deeply understand the relationship between user behavior and telecommunications network fraud behavior, and optimizes the identification strategy of telecommunications network fraud behavior.

[0075] S303: Divide the original data set into N-fold data, and determine the mean replacement importance score of each feature in the multiple features by using a multi-fold cross calculation method for the N-fold data.

[0076] In order to further obtain features related to telecommunications network fraud, the original data set is divided into N folds (N>2), where the amount of data in each fold is roughly equal, and each fold contains multiple features. The multi-fold cross calculation method is used to calculate the divided N-fold data to obtain the mean replacement importance score of each feature in multiple features. The mean replacement importance score corresponding to a feature is used as a measurement indicator to evaluate the degree of relevance between the feature and telecommunications network fraud.

[0077] By dividing the data into N folds, a more comprehensive and reliable performance evaluation index can be provided. It is more representative than the result obtained by a single division of the data set, can obtain better performance information of the original data set, and enhance the expressiveness of the data.

[0078] S304: Select important features from multiple features based on the mean replacement importance score of the features, and extract a target data set corresponding to the important features based on the original data set.

[0079] Based on the mean replacement importance score of the features, the computer selects and identifies the features among multiple features that are highly relevant to the identification of telecommunications network fraud. Specifically, the mean replacement importance score of the features includes the mean replacement importance score of each feature. For any feature i, according to the corresponding replacement importance score mean F i , determine whether feature i is an important feature. Traverse each feature and the corresponding replacement importance score mean to determine whether the feature is an important feature, and then obtain the corresponding important feature. Extract all data corresponding to the important features in the original data set to form the target data set.

[0080] In one possible implementation, a threshold condition is set to determine whether feature i is an important feature. i If the set threshold condition is met, feature i is an important feature; if the importance score mean F is replaced i If the set threshold condition is not met, feature i is not an important feature. The threshold condition may be greater than 0, greater than or equal to 0, greater than 0.01, or other conditions that meet the importance determination.

[0081] S305. Based on the target data set, a telecommunications network fraud behavior recognition model is trained.

[0082] The features in the target data set are features that are highly correlated with telecommunications network fraud behavior. By using feature data that is highly correlated with telecommunications network fraud behavior to train a telecommunications network fraud behavior recognition model, a telecommunications network fraud behavior recognition model with a high accuracy can be obtained, thereby improving the accuracy of telecommunications network fraud behavior recognition.

[0083] The model training method provided in the embodiment of the present application divides the original data set into N folds, and uses a multi-fold cross calculation method to evaluate the mean replacement importance score of each feature from the overall perspective of the original data set, so that the mean replacement importance score shows a lower degree of fit on the local data of the original data set, and maintains a higher correlation on the overall data. According to the mean replacement importance score, important features with a high degree of correlation with telecommunications network fraud behavior are obtained to form a target data set, and the target data set is used to train a telecommunications network fraud behavior recognition model, so that the model can focus more on important features, reduce the complexity of the model, and improve the performance of the model on new data, thereby achieving the effect of improving the accuracy and generalization ability of the telecommunications network fraud behavior recognition model.

[0084] Figure 4 Schematic diagram of the model training method provided in the embodiment of the present application Figure 2 ,like Figure 4 As shown, in this embodiment Figure 3 Based on the embodiment, the model training method is described in detail, and the method includes:

[0085] S401. Perform feature mining on historical transaction behavior data to obtain multiple features; extract data corresponding to the multiple features based on each piece of historical transaction behavior data to obtain an original data set.

[0086] Step S401, based on the above steps S301-S302, also has a possible implementation method, which performs feature mining on historical transaction behavior data to obtain multiple features, including: performing data preprocessing on the historical transaction behavior data, preprocessing the data, the data preprocessing includes at least one processing method of data cleaning, data integration, data transformation and data dimensionality reduction, when the data preprocessing includes multiple processing methods, the results obtained by the previous processing method are processed in the subsequent processing method in sequence.

[0087] Perform data preprocessing on historical transaction behavior data to improve data quality and facilitate effective training of machine learning models. If multiple methods are required to preprocess historical transaction behavior data, first use the previous data preprocessing method to obtain the historical transaction behavior data after the previous data preprocessing in the order of processing. Then, according to the latter data preprocessing method, the historical transaction behavior data after the previous data preprocessing is processed again. After sequential processing, the preprocessed data is obtained.

[0088] Furthermore, feature mining is performed on the preprocessed data to obtain multiple features.

[0089] After preprocessing the data, the integrity of the data is improved, and the scale of the features also has the same standard. By mining the features of the processed data, multiple features are obtained. Among them, the multiple features include features that may be related to telecommunications network fraud.

[0090] S402, divide the original data set into N folds of data, among which the i-th fold of data is selected as the test set, and the remaining N-1 folds of data are selected as the training set; obtain the i-th model based on the training set, and evaluate the ordered feature score of the i-th model relative to the test set; for the test set, based on the replacement importance algorithm, obtain the unordered feature score of each feature in the multiple features according to the i-th model when the i-th fold of data is the test set; obtain the importance score of each feature when the i-th fold of data is the test set based on the ordered feature score and the unordered feature score.

[0091] In the specific application of the replacement importance algorithm, for the same training model, when the test set data is in an ordered state, the evaluation index is calculated to obtain the ordered feature score of the feature; when the test set data is in a disordered state, the evaluation index is calculated to obtain the disordered feature score of the feature. There is no restriction on the selection of training models. For example, the training models include: decision tree telecommunications network fraud behavior recognition model, neural network telecommunications network fraud behavior recognition model and logistic regression telecommunications network fraud behavior recognition model.

[0092] Specifically, without introducing additional data, for the same model, a multi-fold cross calculation method is used to divide the complete data set into N folds (N>2), and each time the i-th fold data is selected as the test set, and the rest are used as N-1 folds as the training set. The i-th model is obtained by training the training set. This cycle is executed N times to obtain N models. For each model, the evaluation index of the corresponding test set in the ordered state of data is calculated as the ordered evaluation index.

[0093] After that, the data set is put into a disordered state, and the evaluation index of the corresponding test set in the ordered state is calculated as the disordered feature score. The importance score of each feature is obtained based on the difference between the ordered evaluation index and the disordered feature score.

[0094] S403. Obtain a mean replacement importance score of each feature in the plurality of features according to the importance score of each feature when the i-th fold of data is a test set.

[0095] The original data is divided into N folds and importance scores are performed. According to the importance score of each feature when the i-th fold data is the test set, the N importance scores corresponding to each feature in the multiple features in the original data set can be obtained, and then the mean of the replacement importance scores of each feature in the multiple features can be obtained.

[0096] In one possible implementation, the importance score of each feature when the i-th fold of data is a test set is accumulated to obtain the accumulated importance score of each feature in the multiple features on all folds of data; the accumulated importance scores are averaged to obtain the mean of the replacement importance scores of each feature in the multiple features.

[0097] Specifically, the N importance scores corresponding to each feature are added together to obtain the cumulative importance score of each feature on all folds of data. The cumulative importance score of each feature is divided by the number of folds into which the original data is divided to obtain the mean replacement importance score of each feature. The cumulative importance scores corresponding to each feature on the original data set are averaged to obtain the mean replacement importance score of each feature in the multiple features.

[0098] Figure 5 Flow chart of the replacement importance algorithm of the multi-fold cross calculation provided in the embodiment of the present application. Figure 5 As shown, the algorithm flow details the replacement importance algorithm of the multi-fold crossover calculation composed of step S402 and step S403.

[0099] In order to facilitate understanding of the different processes in the replacement importance algorithm of multi-fold cross calculation, Table 2 is a pseudo code of a replacement importance algorithm of multi-fold cross calculation provided in an embodiment of the present application. As shown in Table 2, the input of the replacement importance algorithm of multi-fold cross calculation includes: complete feature data X, data label y, and evaluation index L(y,F). Including:

[0100] Table 2 Pseudo code of a multi-fold crossover replacement importance algorithm

[0101]

[0102] First, the original data set is divided into N-fold data, and the feature data X and data label y are split into N-fold {(X 1, y1),...,(X N, y N )}, each fold contains a part of the data in the original data set. Then, in the N fold data, select the data (X i ,y i ) is the test set (X test ,y test ), the remaining N-1 fold data X-(X i ,y i ) is the training set (X train ,y train ). According to the training set training set (X train ,y train ) Train the model and obtain the i-th model F i, then the i-th model F is calculated i Relative test set (X test ,y test )’s ordered feature score e orig =L(y test ,F(X test )).

[0103] Afterwards, for the test set (X test ,y test ), traverse X in turn test For each feature j in X, randomly shuffle test The data of feature j in the image is made chaotic and invalid, and the disordered data X is obtained. perm , calculate the i-th model F i Relative test set (X perm ,y test )’s disordered feature score e perm =L(y test ,F i (X perm )). Ordered feature score e according to feature j orig and disordered feature score e perm , get the importance score FI of feature j when the i-th fold data is the test set ij According to the importance scores of all features obtained, the importance score FI of each feature when the i-th fold data is the test set is obtained. i .

[0104] According to the importance score FI of each feature when the i-th fold data is the test set i , the importance score FI obtained for each fold i The accumulated importance scores FI are accumulated and averaged to obtain the mean replacement importance score of each feature in the multiple features.

[0105] The importance of features can be effectively evaluated by using a multi-fold cross-calculation replacement importance algorithm. The data set is divided into multiple folds, the replacement importance score of the features in each fold is calculated, and the average of the replacement importance scores is taken as the final result. This avoids the problem of overfitting the test set data when evaluating feature importance. For a test set (such as y test ) The scores of other models on this feature in the replacement importance algorithm of multi-fold cross calculation are also taken into consideration. These abnormal scores that are too high or too low will be averaged to reduce the risk of overfitting and solve the problem of overfitting.

[0106] S404: Select important features from multiple features based on the mean of the replacement importance scores of the features, and extract a target data set corresponding to the important features based on the original data set.

[0107] Step S404 may refer to the above-mentioned step S304, which will not be described in detail here.

[0108] S405: Based on the target data set, train a preset base learner to obtain a trained base learner.

[0109] Based on the obtained target data set, the preset base learners of the ensemble learning are trained separately. The base learners include: decision tree, neural network, logistic regression and other machine learning models. The number of base learners should be greater than 1.

[0110] For example, the replacement importance algorithm of multi-fold crossover calculation is used for data processing. After obtaining the target data set, the decision tree telecommunications network fraud behavior identification base learner, the neural network telecommunications network fraud behavior identification base learner and the logistic regression telecommunications network fraud behavior identification base learner are trained according to the target data set.

[0111] In a possible implementation, a preset base learner is trained by a multi-fold cross-training method to obtain a trained base learner.

[0112] Divide the target dataset into K folds (K>2), with the amount of data in each fold being roughly equal, ensuring that the distribution of data in each fold is as consistent as possible with the target dataset to avoid deviations caused by data division. For each fold of data, use the data in the current fold as the test set, and the data in the remaining K-1 folds as the training set. Train the base learner on the training set, evaluate the performance of the base learner on the test set, and adjust the combination of hyperparameters appropriately. Repeat the training K times until each data is used as a test set, and obtain K base learners trained with the same model.

[0113] S406. According to a preset integration method, the trained base learners are integrated to obtain a telecommunications network fraud behavior recognition model.

[0114] By combining the obtained telecommunication network fraud behavior identification base learners through a preset ensemble learning method, a more accurate telecommunication network fraud behavior identification model with stronger generalization ability can be obtained. Among them, the preset ensemble learning method includes: voting method and stacking method.

[0115] For example, if the preset ensemble learning method is voting, voting is carried out on the principle of minority obeying majority, and the recognition result with the most votes is the recognition result of the model. Suppose three telecommunications network fraud behavior recognition base learners are selected, and the recognition accuracy of each telecommunications network fraud behavior recognition base learner is 70%. Then, the probability that the results of the three telecommunications network fraud behavior recognition base learners are all correct is 0.7×0.7×0.7=0.3429; the probability that the results of two telecommunications network fraud behavior recognition base learners are correct is 0.7×0.7×0.3+0.7×0.3×0.7+0.3×0.7×0.7=0.4409. At this time, the telecommunications network fraud behavior recognition model will recognize and obtain the correct result, that is, the probability that the telecommunications network fraud behavior recognition model recognizes correctly is: 0.3429+0.4409=0.7838>0.7. The recognition accuracy of the telecommunications network fraud behavior recognition model integrating three base learners is greater than the recognition accuracy of a single telecommunications network fraud behavior recognition base learner, which improves the recognition accuracy of telecommunications network fraud to a certain extent. If more base learners are used for integrated learning training, the accuracy will be significantly improved.

[0116] For example, if the preset integrated learning method is the stacking method, the meta-learner will be trained according to the recognition results of the base learner to obtain the corresponding telecommunications network fraud behavior recognition model.

[0117] Figure 6 A schematic diagram of the training process of the stacking method for telecommunications network fraud behavior identification model provided in the embodiment of the present application. Figure 6 As shown, the method includes:

[0118] The meta-learner is trained according to the recognition results of the base learner to obtain the corresponding telecommunications network fraud behavior recognition model.

[0119] Further, Table 3 is a pseudo code table of the stacking method training algorithm for the telecommunications network fraud behavior identification model provided in the embodiment of the present application. Table 3, based on the above embodiment, details the training process of the model when the preset ensemble learning method is the stacking method. As shown in Table 3, the input data of the telecommunications network fraud identification stacking ensemble learning algorithm includes: training set D, base learner and meta learner, where:

[0120] The preset base learner is trained by multi-fold cross-training, and the target data set is divided into K folds (K>2). For the k-th fold data, D = {(x1, y1), (x2, y2), ..., (x K ,y K )}.

[0121] For each base learner, the k-th fold data (x k, y k) as the test set, and the remaining K-1 fold data D ’ =D-(x k, y k ) is used as the training set for training, and the training set D is obtained. ’ The base learner L trained on nk .

[0122] The base learner L completed by training nk , get the identification x k The corresponding recognition result P nk According to the K trained base learners, save the recognition results corresponding to all test sets to obtain P n ; where P n Includes the recognition results of all data in D.

[0123] The recognition results of N base learners are saved to obtain a data set P; wherein the data set P includes the recognition results of the first-layer base learners, the feature data of the data set P is the recognition results of the first-layer base learners, and the label of the data set P is the label of the training set D.

[0124] Afterwards, P is used as the training data set for the second-layer meta-learner L, and the meta-learner L is trained to obtain the corresponding telecommunications network fraud behavior recognition model H.

[0125] Table 3 is the pseudo code of the stacking method training algorithm for the telecommunications network fraud behavior recognition model

[0126]

[0127] The stacked ensemble learning algorithm for telecommunications network fraud identification is used to integrate the recognition results of the base learners. Since different base learners may capture different features of the target data set and obtain recognition results with different data preferences, integrating multiple base learners can smooth the recognition results, reduce the risk of overfitting, and improve the overall stability of the model, thereby obtaining a telecommunications network fraud behavior recognition model H with high accuracy and good generalization ability.

[0128] If the target data T={(x t ,y t )} for identification, then the target data T={(x t ,y t )} as the output of the telecommunications network fraud behavior recognition model H, and obtain the recognition result, wherein the recognition result is the output of the telecommunications network fraud behavior recognition model H. Specifically, first, the telecommunications network fraud behavior recognition model H will calculate each base learner L nk The corresponding base learner prediction result Q nk =L nk (x t). Then, the telecommunications network fraud behavior recognition model H will summarize and add the prediction results of all base learners and take the average to get Q n After that, the telecommunications network fraud behavior recognition model H will Q n As the input of the meta-learner, the output of the meta-learner is obtained. The output of the meta-learner is the recognition result of the telecommunications network fraud behavior recognition model H.

[0129] The model training method provided in the embodiment of the present application performs data cleaning and feature mining on historical transaction behavior data, and uses a multi-fold cross calculation method to obtain the mean of the replacement importance score, identify the important features in the data set, so that the obtained important features can fully reflect the relationship between the data and telecommunications network fraud behavior, reduce data redundancy, and improve the correlation between the target data set and telecommunications network fraud behavior, thereby improving the accuracy of telecommunications network fraud behavior identification. At the same time, the telecommunications network fraud behavior identification model is trained by integrated learning, and by integrating different base learners, the telecommunications network fraud behavior identification model can identify more fraud behaviors and fraud scenarios, thereby achieving the effect of improving the accuracy of telecommunications network fraud behavior identification and generalization ability.

[0130] Figure 7 A schematic diagram of a method for identifying telecommunications network fraud behavior provided in an embodiment of the present application. Figure 7 As shown, in this embodiment Figure 3 Based on the embodiment, a method for identifying telecommunication network fraud behavior is described in detail, and the method includes:

[0131] S701. Obtain transaction behavior data.

[0132] Obtain the transaction behavior data of the current user or entity. Optionally, after obtaining the transaction behavior data of the current user or entity, based on the degree of correlation between the transaction behavior data characteristics and telecommunications network fraud behavior, filter and eliminate the characteristic data with a low degree of correlation, and use the obtained data as new transaction behavior data.

[0133] S702. Apply the telecommunications network fraud behavior identification model to identify telecommunications network fraud behaviors on the transaction behavior data to obtain identification results.

[0134] The telecommunications network fraud behavior identification model is trained according to the above embodiment or any possible implementation method of the above embodiment.

[0135] The transaction behavior data is used as the input of the telecommunications network fraud behavior recognition model, and the output result of the telecommunications network fraud behavior recognition model is the recognition result. According to the recognition result, it is determined whether to make an appropriate response to the current transaction behavior, such as: continue the transaction or issue an alarm.

[0136] The telecommunications network fraud behavior identification method provided in the embodiment of the present application can automatically identify fraudulent behavior and improve the accuracy of telecommunications network fraud behavior identification by acquiring transaction behavior data and identifying it through a trained telecommunications network fraud behavior identification model, thereby achieving the effect of improving the accuracy of telecommunications network fraud behavior identification.

[0137] Figure 8 A schematic diagram of the structure of a model training device provided in an embodiment of the present application. Figure 8 As shown, the model training device 80 provided in this embodiment includes:

[0138] The acquisition module 801 is used to perform feature mining on the historical transaction behavior data to obtain multiple features; according to each piece of historical transaction behavior data, data corresponding to the multiple features is extracted to obtain an original data set;

[0139] The processing module 802 is used to divide the original data set into N-fold data, and determine the mean replacement importance score of each feature in the multiple features by using a multi-fold cross calculation method for the N-fold data; select important features from the multiple features based on the mean replacement importance score of the features, and extract the target data set corresponding to the important features based on the original data set;

[0140] The training module 803 is used to train a telecommunications network fraud behavior recognition model based on a target data set.

[0141] In a possible implementation, the processing module 802 is specifically configured to:

[0142] Among the N-fold data, the i-th fold data is selected as a test set, and the remaining N-1-fold data are selected as training sets; the i-th model is obtained based on the training set training, and the ordered feature score of the i-th model relative to the test set is evaluated; for the test set, based on the replacement importance algorithm, the unordered feature score of each feature of the multiple features when the i-fold data is the test set is obtained according to the i-th model; according to the ordered feature score and the unordered feature score, the importance score of each feature when the i-fold data is the test set is obtained;

[0143] According to the importance score of each feature when the i-th fold data is a test set, a mean replacement importance score of each feature in the multiple features is obtained.

[0144] In a possible implementation manner, the processing module 802 is further configured to:

[0145] Accumulate the importance score of each feature when the i-th fold of data is the test set to obtain the accumulated importance score of each feature in all folds of data;

[0146] The accumulated importance scores are averaged to obtain a mean replacement importance score of each feature in the plurality of features.

[0147] In a possible implementation, the training module 803 is specifically configured to:

[0148] Based on the target data set, training a preset base learner to obtain a trained base learner;

[0149] According to a preset integration method, the trained base learners are integrated to obtain a telecommunications network fraud behavior recognition model.

[0150] In a possible implementation, the step of training a preset base learner based on the target data set to obtain a trained base learner includes:

[0151] The preset base learner is trained by multi-fold cross-training to obtain a trained base learner.

[0152] In a possible implementation, the acquisition module 801 is specifically configured to:

[0153] Performing data preprocessing on the historical transaction behavior data, the preprocessed data, the data preprocessing includes at least one processing method of data cleaning, data integration, data transformation and data dimension reduction, and when the data preprocessing includes multiple processing methods, the results obtained by the previous processing method are processed in the subsequent processing method in sequence;

[0154] Feature mining is performed on the preprocessed data to obtain multiple features.

[0155] The model training device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar, and will not be described in detail in this embodiment.

[0156] Fig. 9 The invention provides a telecommunications network fraud behavior identification device. Fig. 9 As shown, the telecommunication network fraud behavior identification device 90 provided in this embodiment includes:

[0157] Acquisition module 901, used to acquire transaction behavior data;

[0158] The identification module 902 is used to apply the telecommunications network fraud behavior identification model to the transaction behavior data to identify telecommunications network fraud behavior and obtain an identification result. The telecommunications network fraud behavior identification model is trained according to the above method embodiments and / or various possible implementation methods of the above method embodiments.

[0159] The telecommunications network fraud behavior identification device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar, and this embodiment will not be repeated here.

[0160] The telecommunications network fraud behavior identification method provided by the embodiment of the present application has at least the following advantages:

[0161] (1) A multi-fold cross-calculation replacement importance algorithm is proposed and applied to the training of the telecommunications network fraud behavior recognition model, which reduces the amount of data used in the model and improves the performance of the base learner, thereby improving the overall performance of the telecommunications network fraud behavior recognition model.

[0162] (2) Use ensemble learning to train the telecommunications network fraud behavior recognition model to obtain a telecommunications network fraud behavior recognition model with higher accuracy and stronger generalization ability.

[0163] Fig.10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.10 As shown, the electronic device 100 provided in this embodiment includes: at least one processor 1001 and a memory 1002. Optionally, the device 100 further includes a communication component 1003. The processor 1001, the memory 1002 and the communication component 1003 are connected via a bus 804.

[0164] In a specific implementation process, at least one processor 1001 executes the computer-executable instructions stored in the memory 1002, so that at least one processor 1001 executes the above method.

[0165] The specific implementation process of the processor 1001 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0166] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0167] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0168] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0169] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0170] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0171] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0172] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0173] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0174] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0175] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0176] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0177] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0178] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A model training method, characterized in that: include: Perform feature mining on historical transaction behavior data to obtain multiple features; According to each piece of historical transaction behavior data, extract data corresponding to the multiple features to obtain an original data set; Dividing the original data set into N-fold data, and determining the mean replacement importance score of each feature in the multiple features by a multi-fold cross calculation method for the N-fold data; Selecting important features from the multiple features based on the mean of the replacement importance scores of the features, and extracting a target data set corresponding to the important features based on the original data set; Based on the target data set, a telecommunications network fraud behavior recognition model is trained.

2. The model training method according to claim 1, characterized in that: The step of determining the mean replacement importance score of each feature in the plurality of features by using a multi-fold cross calculation method for the N-fold data includes: Among the N-fold data, the i-th fold data is selected as a test set, and the remaining N-1-fold data are selected as training sets; the i-th model is obtained based on the training set training, and the ordered feature score of the i-th model relative to the test set is evaluated; for the test set, based on the replacement importance algorithm, the unordered feature score of each feature of the multiple features when the i-fold data is the test set is obtained according to the i-th model; according to the ordered feature score and the unordered feature score, the importance score of each feature when the i-fold data is the test set is obtained; According to the importance score of each feature when the i-th fold data is a test set, a mean replacement importance score of each feature in the multiple features is obtained.

3. The model training method according to claim 2, characterized in that: The step of obtaining a mean value of the replacement importance score of each feature in the plurality of features according to the importance score of each feature when the i-th fold data is a test set comprises: Accumulate the importance score of each feature when the i-th fold of data is the test set to obtain the accumulated importance score of each feature in all folds of data; The accumulated importance scores are averaged to obtain a mean replacement importance score of each feature in the plurality of features.

4. The model training method according to any one of claims 1 to 3, characterized in that: The telecommunications network fraud behavior recognition model obtained by training based on the target data set includes: Based on the target data set, training a preset base learner to obtain a trained base learner; According to a preset integration method, the trained base learners are integrated to obtain a telecommunications network fraud behavior recognition model.

5. The model training method according to claim 4, characterized in that: The step of training a preset base learner based on the target data set to obtain a trained base learner includes: The preset base learner is trained by multi-fold cross-training to obtain a trained base learner.

6. The model training method according to any one of claims 1 to 3, characterized in that: The feature mining of the historical transaction behavior data obtains multiple features, including: Performing data preprocessing on the historical transaction behavior data, the preprocessed data, the data preprocessing includes at least one processing method of data cleaning, data integration, data transformation and data dimension reduction, and when the data preprocessing includes multiple processing methods, the results obtained by the previous processing method are processed in the subsequent processing method in sequence; Feature mining is performed on the preprocessed data to obtain multiple features.

7. A method for identifying telecommunications network fraud behavior, characterized in that: include: Obtain transaction behavior data; A telecommunications network fraud behavior identification model is applied to the transaction behavior data to identify telecommunications network fraud behaviors to obtain an identification result, wherein the telecommunications network fraud behavior identification model is trained according to the method described in any one of claims 1 to 6.

8. A model training device, characterized in that: include: The acquisition module is used to perform feature mining on historical transaction behavior data to obtain multiple features; According to each piece of historical transaction behavior data, extract the data corresponding to multiple features to obtain the original data set; A processing module, used for dividing the original data set into N-fold data, and for the N-fold data, using a multi-fold cross calculation method to determine the replacement importance score mean of each feature in the multiple features; Based on the mean of the replacement importance score of the features, important features are selected from multiple features, and the target data set corresponding to the important features is extracted based on the original data set; The training module is used to train a telecommunications network fraud behavior recognition model based on the target data set.

9. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the method according to any one of claims 1 to 6, and / or the processor executes the method according to claim 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed, and / or, which are used to implement the method according to claim 7 when executed.

Images