Network security protection method, system and equipment based on big data calling analysis and medium

Abstract

The invention discloses a network security protection method, system and device based on big data calling analysis and a medium, and belongs to the technical field of big data communication. Judging whether scenes to which the call record history table and the application program history table belong are closely related scenes or not according to a distance relationship between the call record history table and the application program history table, if so, collecting a call record behavior set, and according to the operation information of the mobile terminal, storing the call record behavior set; analyzing downloading time or installation time of the application programs in the call record behavior set; after the time of downloading the application program or the time of installing the application program, matching the call record user with the application program user, and matching the application program user with the application program; and initiating security early warning according to a matching result of the application program user and the application program. According to the method, potential fraud persons can be analyzed according to the dependency of the new application program and the call number.

Description

Technical Field

[0001] The present invention belongs to the field of big data communication technology, and specifically relates to a network security protection method, system, equipment and medium based on big data retrieval and analysis. Background Art

[0002] There are more and more methods of telephone fraud, making it difficult for people to guard against them, especially the elderly. In reality, fraud situations are complex and varied, and a single anti-fraud method cannot cope with them. Existing technologies generally use big data and machine learning technology to analyze the extracted application layer data packets, and conduct big data analysis and judgment on behaviors including APP downloads, Internet access, call behavior, and transfer payment behavior, and obtain near-real-time fraud warning information including downloading fraud APPs, visiting fraud websites, answering fraud calls, and transferring money to fraud accounts, marking the fraud type and fraud risk level.

[0003] However, the existing technology has the following shortcomings and deficiencies: the false alarm rate and resource waste rate of anti-fraud behavior are relatively high. Many users will refuse on their own during the call without the need for anti-fraud warning. Secondly, the existing anti-fraud behavior is mainly based on a combination of multiple behaviors, such as call + application download. Only through the detection of application download or call alone, it is impossible to accurately locate the occurrence of fraud. Thirdly, for some newly emerging applications and call numbers, it is impossible to identify whether they belong to potential fraudsters. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a network security protection method, system, device and medium based on big data retrieval and analysis, so as to better integrate multi-source fraud scenarios and optimize anti-fraud warning resources.

[0005] To achieve the above object, the present invention adopts the following technical solutions: A network security protection method based on big data retrieval and analysis includes the following steps: Collect mobile terminal operation information; Determine whether the scenarios to which the call record history table and the application history table belong are closely related scenarios according to the distance relationship between the call record history table and the application history table. If so, collect a call record behavior set, wherein the call record behavior set stores call record user information, application user information, application user download time, and application installation time; According to the mobile terminal operation information, the download time or installation time of the application in the call record behavior set is analyzed; after the time of downloading the application or installing the application, the call record user is matched with the application user, and the application user is matched with the application; Initiate a security warning based on the matching results between application users and applications.

[0006] To optimize the above technical solutions, the specific measures taken also include: Further, the mobile terminal operation information includes a matching condition and a parsing condition; the analysis of the download time or installation time of the application in the call record behavior set according to the mobile terminal operation information is specifically: If the type of at least one matching condition is a call record type, analyzing the download time or installation time of the application in the call record behavior set; If the types of all matching conditions included in the mobile terminal operation information are application types, the download time or installation time of the application in the call record behavior set is analyzed.

[0007] Furthermore, the distance relationship is a distance relationship between the call record time and duration in the call record history table and the installation time interval of the application in the application history table.

[0008] Furthermore, the call record collection behavior set is specifically: The mobile terminal operation information also includes a filtering condition, collecting an application download and installation behavior set, wherein the call record users stored in all history tables in the application download and installation behavior set constitute a call record history table, and the application users stored in all history tables in the application download and installation behavior set constitute an application history table; The history table satisfying the filtering condition is obtained by filtering the application download and installation behavior set to form the call record behavior set.

[0009] Furthermore, the collection of application download and installation behavior sets includes: Determine a third history table set according to a frequent user strategy of the call record history table, wherein each history table in the third history table set stores a call record user, and the call record users stored in all history tables in the third history table set constitute a call record history table; Determine a fourth history table set according to a frequent user strategy of the application history table, wherein each history table in the fourth history table set stores application users, and the application users stored in all history tables in the fourth history table set constitute the application history table; If the third history table set is the same as the fourth history table set, the third history table set is determined as the application download and installation behavior set.

[0010] Furthermore, the frequent user strategy specifically includes: obtaining an association relationship between the user and the call record or application usage record based on the frequency of the user's operation.

[0011] Furthermore, the matching of the call record user with the application user and the matching of the application user with the application is specifically as follows: The matching conditions include call record matching conditions and application matching conditions; According to the call record matching conditions, the matching results of the call record user and the application user are processed, and according to the application matching conditions, the matching results of the application user and the application are processed.

[0012] The present invention also proposes a network security protection system based on big data retrieval and analysis, comprising: Operation recording module, used to collect mobile terminal operation information; A scene judgment module is used to judge whether the scenes to which the call record history table and the application history table belong are closely related scenes according to the distance relationship between the call record history table and the application history table. If so, a call record behavior set is collected, and the call record behavior set stores call record user information, application user information, application user download time and application installation time; A matching determination module, used to analyze the download time or installation time of the application in the call record behavior set according to the mobile terminal operation information; A matching output module, for matching the call record user with the application user and the application user with the application after the time of downloading the application or installing the application; The early warning module is used to initiate a security early warning based on the matching result between the application user and the application.

[0013] The present invention also proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the network security protection method based on big data retrieval and analysis as described above is implemented.

[0014] The present invention also proposes a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the network security protection method based on big data retrieval and analysis as described above.

[0015] The beneficial effects of the present invention are: the present invention better integrates multi-source fraud scenarios to accurately locate the occurrence of fraud, optimizes anti-fraud warning resources, and analyzes potential fraudsters based on newly emerging applications and call number dependencies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a workflow diagram of a network security protection method based on big data retrieval and analysis proposed by the present invention; Figure 2 A flowchart for collecting application download and installation behavior sets; Figure 3 This is a structural module diagram of a network security protection system based on big data retrieval and analysis proposed by the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] Embodiment 1

[0019] The present invention proposes a network security protection method based on big data retrieval and analysis, such as Figure 1 As shown, the following steps are included: Collect mobile terminal operation information; Determine whether the scenarios to which the call record history table and the application history table belong are closely related scenarios according to the distance relationship between the call record history table and the application history table. If so, collect a call record behavior set, which stores call record user information, application user information, application user download time, and application installation time; According to the mobile terminal operation information, the download time or installation time of the application in the call record behavior set is analyzed; after the time of downloading the application or installing the application, the call record user is matched with the application user, and the application user is matched with the application; Initiate a security warning based on the matching results between application users and applications.

[0020] The mobile terminal operation information includes a matching condition and a parsing condition; the matching condition includes a call record matching condition and an application matching condition. According to the mobile terminal operation information, the download time or installation time of the application to be executed in each history table in the call record behavior set is analyzed, including: If the type of at least one matching condition is a call record type, analyzing the download time or installation time of the application to be executed in each history table in the call record behavior set, the application download time or installation time belonging to the parsing condition and part or all of the matching conditions in at least one matching condition; If the types of all matching conditions contained in the mobile terminal operation information are application types, the download time or installation time of the application to be executed in each history table in the call record behavior set is analyzed, and the application download time or installation time belongs to the parsing condition.

[0021] In this embodiment, determining that the call record history table and the application history table belong to scenarios that are closely related based on the distance relationship specifically includes: The distance relationship is the distance relationship between the call record time and duration in the call record history table and the installation time interval of the application in the application history table; Obtaining distance relationships between multiple mobile terminal users; The scenarios include at least: closely related scenarios, generally related scenarios, and related scenarios to be confirmed; The distance relationship is used to indicate whether the scenarios to which the call record history table and the application history table belong are closely related scenarios, generally related scenarios, or related scenarios to be confirmed.

[0022] The distance relationship includes the frequent user strategy of the call record history table and the frequent user strategy of the application history table; If it is determined based on the distance relationship that the scenarios to which the call record history table and the application history table belong are closely related, then the call record behavior set is collected, including: If the frequent user policy of the call record history table is closely related to the frequent user policy of the application history table, it is determined that the scenarios to which the call record history table and the application history table belong are closely related; Collect call record behavior sets.

[0023] The frequent user policy indicates the association between users and call records or application usage records based on the frequency of user operations.

[0024] The application matching results are obtained based on the collected call record matching results, including: According to the call record matching condition in the mobile terminal operation information, the call record matching result is processed to obtain the application matching result, wherein the matching condition included in the application download time or installation time is the application matching condition, and the call record matching condition is the matching condition other than the application matching condition among all the matching conditions included in the mobile terminal operation information; The mobile terminal operation information includes filtering conditions and a collection of call record behavior sets, including: Collecting application download and installation behavior sets, where all call record users stored in all history tables in the application download and installation behavior set form a call record history table, and all application users stored in all history tables in the application download and installation behavior set form an application history table; The history tables that meet the filtering conditions obtained by filtering the application download and installation behaviors collectively form a call record behavior set.

[0025] Reference Figure 2 , collect application download and installation behavior sets, including: Determine a third history table set according to a frequent user strategy of the call record history table, each history table in the third history table set stores a call record user, and the call record users stored in all history tables in the third history table set constitute a call record history table; Determine a fourth history table set according to a frequent user strategy of the application history table, each history table in the fourth history table set stores an application user, and the application users stored in all the history tables in the fourth history table set constitute the application history table; If the third history table set is closely related to the fourth history table set, the third history table set is determined as the application download and installation behavior set.

[0026] Embodiment 2

[0027] The present invention proposes a network security protection system based on big data retrieval and analysis corresponding to the method of embodiment 1, and the system module diagram is as follows: Figure 3 As shown, including: Operation recording module, used to collect mobile terminal operation information; A scene judgment module is used to judge whether the scenes to which the call record history table and the application history table belong are closely related scenes according to the distance relationship between the call record history table and the application history table. If so, a call record behavior set is collected, and the call record behavior set stores call record user information, application user information, application user download time and application installation time; A matching determination module, used to analyze the download time or installation time of the application in the call record behavior set according to the mobile terminal operation information; A matching output module, for matching the call record user with the application user and the application user with the application after the time of downloading the application or installing the application; The early warning module is used to initiate a security early warning based on the matching result between the application user and the application.

[0028] The implementation methods of each module and module function in the system are completely consistent with the steps of the method in Example 1, so they will not be repeated here.

[0029] Embodiment 3

[0030] The present invention proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the network security protection method based on big data retrieval and analysis as described in Example 1 is implemented.

[0031] Embodiment 4

[0032] The present invention proposes a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the network security protection method based on big data retrieval and analysis as described in Example 1.

[0033] In the embodiments disclosed in the present application, the computer storage medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. More specific examples of computer storage media may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0034] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0035] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A network security protection method based on big data retrieval and analysis, characterized in that: The following steps are involved: Collect mobile terminal operation information; Determine whether the scenarios to which the call record history table and the application history table belong are closely related scenarios according to the distance relationship between the call record history table and the application history table. If so, collect a call record behavior set, wherein the call record behavior set stores call record user information, application user information, application user download time, and application installation time; According to the mobile terminal operation information, the download time or installation time of the application in the call record behavior set is analyzed; after the time of downloading the application or installing the application, the call record user is matched with the application user, and the application user is matched with the application; Initiate a security warning based on the matching results between application users and applications.

2. The network security protection method based on big data retrieval and analysis as claimed in claim 1 is characterized in that: The mobile terminal operation information includes a matching condition and a parsing condition; the analysis of the download time or installation time of the application in the call record behavior set according to the mobile terminal operation information is specifically: If the type of at least one matching condition is a call record type, analyzing the download time or installation time of the application in the call record behavior set; If the types of all matching conditions included in the mobile terminal operation information are application types, the download time or installation time of the application in the call record behavior set is analyzed.

3. The network security protection method based on big data retrieval and analysis as claimed in claim 1 is characterized in that: The distance relationship is the distance relationship between the call record time and duration in the call record history table and the installation time interval of the application in the application history table.

4. The network security protection method based on big data retrieval and analysis as claimed in claim 1 is characterized in that: The call record collection behavior set is specifically: The mobile terminal operation information also includes a filtering condition, collecting an application download and installation behavior set, wherein the call record users stored in all history tables in the application download and installation behavior set constitute a call record history table, and the application users stored in all history tables in the application download and installation behavior set constitute an application history table; The history table satisfying the filtering condition is obtained by filtering the application download and installation behavior set to form the call record behavior set.

5. The network security protection method based on big data retrieval and analysis as claimed in claim 4 is characterized in that: The collection application download and installation behavior set includes: Determine a third history table set according to a frequent user strategy of the call record history table, wherein each history table in the third history table set stores a call record user, and the call record users stored in all history tables in the third history table set constitute a call record history table; Determine a fourth history table set according to a frequent user strategy of the application history table, wherein each history table in the fourth history table set stores application users, and the application users stored in all history tables in the fourth history table set constitute the application history table; If the third history table set is the same as the fourth history table set, the third history table set is determined as the application download and installation behavior set.

6. The network security protection method based on big data retrieval and analysis as claimed in claim 5 is characterized in that: The frequent user strategy specifically includes: obtaining an association relationship between the user and the call record or application usage record based on the frequency of the user's operation.

7. The network security protection method based on big data retrieval and analysis as claimed in claim 2 is characterized in that: The matching of the call record user with the application user and the matching of the application user with the application is specifically as follows: The matching conditions include call record matching conditions and application matching conditions; According to the call record matching conditions, the matching results of the call record user and the application user are processed, and according to the application matching conditions, the matching results of the application user and the application are processed.

8. A network security protection system based on big data retrieval and analysis, characterized in that: include: Operation recording module, used to collect mobile terminal operation information; A scene judgment module is used to judge whether the scenes to which the call record history table and the application history table belong are closely related scenes according to the distance relationship between the call record history table and the application history table. If so, a call record behavior set is collected, and the call record behavior set stores call record user information, application user information, application user download time and application installation time; A matching determination module, used to analyze the download time or installation time of the application in the call record behavior set according to the mobile terminal operation information; A matching output module, for matching the call record user with the application user and the application user with the application after the time of downloading the application or installing the application; The early warning module is used to initiate a security early warning based on the matching result between the application user and the application.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the network security protection method based on big data retrieval and analysis as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: The computer program enables the computer to execute the network security protection method based on big data retrieval and analysis as described in any one of claims 1 to 7.

Images