Number identification method, device, equipment, medium and program product

Abstract

The invention provides a number identification method and device, equipment, a medium and a program product. The method comprises the following steps: determining a number alarm set by a monitoring strategy; constructing a sending number library based on the number alarm set through a DBSCAN clustering algorithm; constructing a training data set based on a sending number library, a balanced number set of Internet accounts and network side short message XDR big data; based on the training data set, an ExtraTrees classifier is used for training, and a prediction classification model is obtained; and carrying out prediction classification on the current network number based on the prediction classification model. By adopting the method provided by the embodiment of the invention, the accuracy and robustness of the number identification method can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a number identification method, device, equipment, medium and program product. Background Art

[0002] In the related art, the identification of illegal and gray industry numbers usually determines whether it is an illegal and gray industry number by identifying the communication characteristics or location information and traffic information of the target number. However, this method is usually only applicable to situations where there are fewer Internet accounts, and can only identify illegal and gray industry Internet accounts in a smaller range, resulting in less applicability and lower identification efficiency of illegal and gray industry mobile phone number identification methods. Summary of the invention

[0003] The present disclosure provides a number identification method, device, equipment, medium and program product. The technical solution of the present disclosure is as follows:

[0004] In a first aspect, the present disclosure provides a number identification method, comprising:

[0005] Determine the number alarm set through the monitoring strategy; wherein the monitoring strategy is used to monitor the verification code sending port of the black and gray production service platform;

[0006] Building a sending number library based on the number alarm set by using a DBSCAN clustering algorithm; wherein the sending number library is a scenario-based number library;

[0007] Constructing a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data;

[0008] Based on the training data set, an ExtraTrees classifier is used for training to obtain a prediction classification model;

[0009] The existing network numbers are predicted and classified based on the prediction and classification model.

[0010] In a possible implementation manner, determining the number alarm set by using a monitoring strategy includes:

[0011] Load monitoring strategies on the spam SMS monitoring platform;

[0012] Detect the number alarm set that hits the monitoring strategy; wherein the number alarm set includes at least one of a policy identifier, an Internet service platform identifier, a sending number, a receiving number, and a sending time.

[0013] In a possible implementation, constructing a sending number library based on the number alert set by using a DBSCAN clustering algorithm includes:

[0014] Extracting number features from the number alarm set;

[0015] Using the DBSCAN clustering algorithm based on the number features in the number alert set, identifying the sending numbers used by the Internet service platform in different scenarios;

[0016] A sending number library is constructed based on the sending numbers used by the Internet service platform in different scenarios.

[0017] In a possible implementation, identifying sending numbers used by the Internet service platform in different scenarios based on number features in the number alert set by using a DBSCAN clustering algorithm includes:

[0018] Selecting sending and receiving numbers from the number features in the number alert set to construct a feature vector;

[0019] Count the time period characteristics and sending frequency of the sending number, and count the user characteristics of the receiving number;

[0020] The DBSCAN clustering algorithm is used to identify the sending numbers used in different scenarios by the Internet service platform based on the feature vector, the time period characteristics and sending frequency of the sending number, and the user characteristics of the receiving number.

[0021] In a possible implementation, constructing a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data includes:

[0022] Obtain a dataset of illegally registered Internet accounts and a dataset of numbers in normal use;

[0023] Based on the illegally registered Internet account data set and the normally used number set, a balanced number set of Internet accounts is constructed;

[0024] The network side SMS XDR big data is obtained by decoding the signaling collected on the network side; wherein the network side SMS XDR big data includes at least one of the time when all network users receive SMS, the sending number, the receiving number, and the SMS length;

[0025] A training data set is constructed based on the sending number library, the balanced number set of the Internet account, and the network-side SMS XDR big data.

[0026] In a possible implementation, the training is performed based on the training data set using an ExtraTrees classifier to obtain a prediction classification model, including:

[0027] Performing data preprocessing on the training data set to obtain a preprocessed training data set; wherein the data preprocessing includes at least one of missing value processing, numerical data conversion processing, and data normalization processing;

[0028] Performing feature engineering processing on the preprocessed training data set through statistical analysis and feature importance evaluation to obtain an optimized training data set;

[0029] Based on the optimized training data set, the ExtraTrees classifier is used for training to obtain a predictive classification model; wherein the predictive classification model is used to perform predictive classification processing on existing network numbers to determine the target numbers of the existing network numbers involving black and gray Internet accounts.

[0030] In a second aspect, the present disclosure provides a number identification device, comprising:

[0031] A determination module, used to determine a number alarm set through a monitoring strategy; wherein the monitoring strategy is used to monitor the verification code sending port of the black and gray production service platform;

[0032] The first construction module is used to construct a sending number library based on the number alarm set by using a DBSCAN clustering algorithm; wherein the sending number library is a scenario-based number library;

[0033] A second construction module is used to construct a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data;

[0034] A training module, used for training using an ExtraTrees classifier based on the training data set to obtain a prediction classification model;

[0035] The identification module is used to predict and classify the existing network numbers based on the prediction and classification model.

[0036] In a third aspect, the present disclosure provides an electronic device, including:

[0037] processor;

[0038] a memory for storing instructions executable by the processor;

[0039] The processor is configured to execute the instructions to implement the method described in the first aspect.

[0040] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method described in the first aspect when executed by a processor.

[0041] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program / instructions, characterized in that when the computer program / instructions are executed by a processor, the method described in the first aspect is implemented.

[0042] The technical solution disclosed in this disclosure brings at least the following beneficial effects:

[0043] In the embodiments of the present disclosure, the number alarm set is determined by the monitoring strategy; the sending number library is constructed based on the number alarm set by the DBSCAN clustering algorithm; the training data set is constructed based on the sending number library, the balanced number set of the Internet account, and the network-side SMS XDR big data; based on the training data set, the ExtraTrees classifier is used for training to obtain a predictive classification model; and the existing network numbers are predicted and classified based on the predictive classification model. In this way, on the one hand, the training data set is constructed based on the sending number library, the balanced number set of the Internet account, and the network-side SMS XDR big data, which can provide rich training data for the training of the predictive classification model, thereby improving the accuracy of the prediction results of the predictive classification model; on the other hand, combining the DBSCAN clustering algorithm and the ExtraTrees classifier for predictive classification model training can enable the predictive classification model to handle complex feature interactions, improve the accuracy and robustness of the prediction results of the predictive classification model, and improve the accuracy and robustness of the number recognition method.

[0044] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0046] Figure 1 A flowchart of a number identification method provided by an embodiment of the present disclosure;

[0047] Figure 2 is a flowchart of another number identification method provided by an embodiment of the present disclosure;

[0048] Figure 3 is a structural schematic diagram of a number identification device provided by an embodiment of the present disclosure;

[0049] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0050] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0051] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0052] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0053] The acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations.

[0054] It should be noted that in the embodiments of the present disclosure, there may be existing solutions in the industry such as certain software, components, models, etc., which should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present disclosure, but it does not mean that the applicant has or will necessarily use the solution.

[0055] In the related technologies, the Internet black and gray industry is an industry that uses the Internet to conduct illegal activities such as telecommunications network fraud. The Internet black and gray industry has formed a huge and complete industrial chain, posing a serious threat to network security and economic development. Since almost all websites and apps (Applications) on the Internet currently use mobile phone numbers and verification codes to register accounts, the Internet black and gray industry has developed a "code receiving platform" to provide support for Internet accounts. The "code receiving platform" trades mobile phone numbers and verification codes through the Internet, and is responsible for batch receiving, identifying, and processing verification codes. Then, it is output to the black and gray industry terminal in the form of a software client or an API (Application Programming Interface). Black and gray industry operators use these mobile phone numbers to illegally register Internet accounts, and use these Internet accounts to engage in black and gray industry related activities, resulting in these Internet accounts being involved in the case. The source cannot be traced to the final offender. Therefore, such service platforms provide black and gray industries with a hiding space for illegal Internet accounts, increasing the difficulty of combating black and gray industries. For this reason, mining Internet accounts with illegal registration behavior has become one of the focuses of combating Internet black and gray industries.

[0056] In the related art, whether a target mobile phone number is a black and gray industry number is usually determined by the communication characteristics of the target mobile phone number and the application scenario characteristics satisfied by the communication characteristics. The communication characteristics include social characteristics, call volume characteristics, duration characteristics, and behavioral characteristics. Alternatively, a list of suspected black industry mobile phone numbers is obtained through relevant data sets such as mobile phone location and traffic. Specifically, the mobile phone location can be extracted, and mobile phone numbers whose mobile phone locations correspond to remote areas can be screened out and filled into the first mobile phone number list; the traffic packages corresponding to the mobile phone numbers in the first mobile phone number list are extracted, and the mobile phone numbers that have not activated the traffic packages are screened out according to the activation information of the traffic packages, and filled into the second mobile phone number list as a list of suspected black industry mobile phone numbers. The above scheme has at least the following technical problems:

[0057] Identifying black and gray market numbers through the communication characteristics of the target number is relatively mature, but it is mainly used in situations where there are not many Internet accounts. It is extremely difficult to obtain the target number from hundreds of millions of Internet accounts. Although the identification accuracy is high, the scope of black and gray market Internet accounts that can be identified is small by identifying the black and gray market mobile phone numbers under the conditions that the mobile phone is located in a remote area and the traffic package has abnormal conditions.

[0058] Based on this, the embodiments of the present disclosure provide a number identification method, device, equipment, medium and program product, which can mine mobile phone numbers with illegal Internet account registration behavior. The method loads a monitoring strategy in a spam SMS monitoring system to monitor the sending port that triggers the verification code when registering or logging in to a suspected black and gray production APP or platform, and combines the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) unsupervised clustering algorithm and profile analysis to build a sending number library under different scenarios of Internet APP / platform; based on network crawlers and legally authorized black and gray production website infiltration, a balanced number set containing normal and illegally registered Internet accounts is constructed, and the reception quantity characteristics, interactive platform distribution characteristics, frequency characteristics, time distribution characteristics, length distribution characteristics, etc. of the number set within a certain period are extracted to construct a complete data set for subsequent training and testing; the data set is feature combined and converted, and the ExtraTrees (Extremely Randomized Trees) classifier is used for training, which has high accuracy, precision, recall rate and F1 value (F1 The optimized model is dumped into a file for predicting and classifying the existing network numbers to mine more mobile phone numbers with illegal Internet account registration behaviors.

[0059] The number identification method provided by the embodiment of the present disclosure has at least the following beneficial effects:

[0060] 1. High recognition accuracy: 1) Combined with DBSCAN unsupervised clustering algorithm and profile analysis, a sending number library for Internet APP / platform scenarios is constructed; 2) ExtraTrees classifier is used for training. This algorithm can handle complex feature interactions and performs well in multiple indicators such as precision, recall rate and F1 value, ensuring the accuracy and robustness of the model. 2. Completeness and diversity of data set construction: 1) Through web crawlers and legally authorized black and gray production website infiltration, a balanced number set is obtained, including normal and illegally registered numbers, providing rich training data for the model. 2) Multi-dimensional feature extraction: Extracting multi-dimensional features of the number set in terms of receiving quantity, interaction platform, frequency, time distribution, length distribution, etc., helps to build a complete and discriminative data set. 3. Rapid deployment and high practicality: The optimized model is saved as a file, which is convenient for rapid loading and use in the production environment, thereby realizing real-time prediction and classification of existing network numbers; the coverage of actual application scenarios has high practicality. In this way, the number identification method provided in the embodiment of the present disclosure constructs a multi-scenario sending number library for the Internet APP / platform, so that the model can adapt to the detection of violations in different scenarios, thereby improving the efficiency of number identification in practical applications.

[0061] The technical solutions provided by various embodiments of the present disclosure are described in detail below in conjunction with the accompanying drawings.

[0062] Figure 1 The flowchart of a number identification method provided by the embodiment of the present disclosure is as follows. The number identification method can be applied to a server, for example, a single server or a server cluster. Figure 1 As shown, the number identification method may include the following steps:

[0063] S101, determine a number alarm set through a monitoring strategy.

[0064] Among them, the monitoring strategy is used to monitor the verification code sending port of the black and gray production service platform.

[0065] In an embodiment of the present disclosure, the verification code sending port of the black and gray industry service platform can be monitored through a monitoring strategy to obtain the number information of the black and gray industry service platform sending the verification code, and a number alarm set is constructed based on the obtained number information of the black and gray industry service platform sending the verification code. Exemplarily, the black and gray industry service platform can be a black and gray industry APP or a black and gray industry platform, and the number alarm set can be, for example, a number alarm list.

[0066] In some possible implementations, determining a number alert set by a monitoring strategy includes:

[0067] Load monitoring strategies on the spam SMS monitoring platform;

[0068] Detect the number alarm set that hits the monitoring strategy; wherein the number alarm set includes at least one of a policy identifier, an Internet service platform identifier, a sending number, a receiving number, and a sending time.

[0069] In the embodiments of the present disclosure, it is considered that when an Internet APP or platform registers a user, it usually guides the user to enter a mobile phone number and triggers the issuance of a verification code to verify the mobile phone number. After the verification is passed, the Internet APP or platform will create an account with the mobile phone number as the ID (Identification). Since the mobile phone number is a real-name system, in order to hide the real identity in the process of carrying out illegal activities, the black and gray industry operators will use fake base stations, code receiving platforms, etc. to illegally register Internet accounts using non-personal numbers. When triggering the issuance of a verification code, the Internet APP or platform usually uses the following methods: 1) Global universal number: usually a standard number for international services, also applicable to SMS sending within China; 2) Short number: a port number starting with 106, which is usually a dedicated number for receiving or sending marketing and service notifications; 3) Virtual number: generally a mobile phone number provided by a virtual operator, usually used for bulk SMS sending. Therefore, it is necessary to use a monitoring strategy to load it into the spam SMS detection system (i.e., the spam SMS monitoring platform), and output the alarm content (i.e., the number alarm set) that hits the monitoring strategy for subsequent analysis. The alarm content may include the policy ID, sending number, receiving number, sending time, etc. Exemplarily, one or more policy IDs may be defined for each Internet APP or Internet platform, including the following contents: policy ID, hit keyword expression, for example, the identification strategy of the verification code received when APP1 is registered is: including APP1 and code keywords, and including 6 consecutive numbers; for another example, the identification strategy of the verification code received when APP2 is registered is: including APP2 and verification code (verification code) keywords, and including 6 consecutive numbers. By loading the above monitoring strategy on the spam SMS monitoring platform, the alarm list of the hit strategy (that is, the number alarm set) can be output. Exemplarily, after associating the policy ID with the traffic APP / platform, the following contents are output: 1) Internet APP / platform name; 2) Sending number; 3) Receiving number; 4) Sending time. In this way, by continuously updating the monitoring policy list, most of the Internet APP / platforms that may be involved in black and gray industries such as instant messaging APPs, remote control APPs, and virtual currency trading APPs can be covered.

[0070] S102, constructing a sending number library based on the number alarm set by using a DBSCAN clustering algorithm.

[0071] Among them, the sending number library is a number library divided into different scenarios.

[0072] In the embodiment of the present disclosure, after obtaining the number alert set, the DBSCAN clustering algorithm can be used to process the number alert set, and the sending in the number alert set can be divided according to different scenarios to obtain the sending numbers in different scenarios, for example, the sending numbers used by Internet APP or Internet platform in different scenarios. Based on the sending numbers in different scenarios, a sending number library is constructed.

[0073] In a possible implementation, a sending number library is constructed based on a number alert set by using a DBSCAN clustering algorithm, including:

[0074] Extract number features from number alarm set;

[0075] The DBSCAN clustering algorithm is used to identify the sending numbers used by Internet service platforms in different scenarios based on the number features in the number alert set;

[0076] Build a sending number library based on the sending numbers used in different scenarios by the Internet service platform.

[0077] In the embodiments of the present disclosure, when constructing a sending number library based on a number alert set by using a DBSCAN clustering algorithm, the number features of the sending number can be first extracted from the number alert set obtained above. The number features can include, for example, one or more of the features of the sending number and the receiving number, the sending frequency of the sending number, the time distribution features of the sending number, the diversity of the receiving number, and the message interval time. Then, the number features in the number alert set can be analyzed and processed by the DBSCAN clustering algorithm, for example, the number features in the number alert set can be analyzed and processed by using the DBSCAN unsupervised clustering algorithm and profile analysis to identify the sending numbers used by the Internet service platform in different scenarios. Afterwards, a sending number library can be constructed based on the sending numbers used by the Internet service platform in different scenarios.

[0078] In a further possible implementation, the sending numbers used by the Internet service platform in different scenarios are identified based on the number features in the number alert set by using the DBSCAN clustering algorithm, including:

[0079] Selecting sending and receiving numbers from the number features in the number alarm set to construct a feature vector;

[0080] Count the time period characteristics and sending frequency of the sending number, and count the user characteristics of the receiving number;

[0081] The DBSCAN clustering algorithm is used to identify the sending numbers used by the Internet service platform in different scenarios based on feature vectors, time period characteristics of sending time, sending frequency, and user characteristics of the receiving number.

[0082] In an embodiment of the present disclosure, when identifying the sending numbers used by the Internet service platform in different scenarios based on the number features in the number alarm set through the DBSCAN clustering algorithm, the features of the sending number and the receiving number can be selected from the number features in the number alarm set to construct a feature vector. The feature vector can be represented by a multidimensional vector, for example, each dimension corresponds to a feature, and the data is standardized. It is also possible to count the time period characteristics and sending frequency of the sending number, wherein the sending frequency of the sending number can be, for example, the number of times the sending number is sent within a specific time period; the time period characteristics of the sending number can be, for example, the time distribution characteristics of the sending number, for example, the time period characteristics of the sending time of the sending number: for example, morning, noon, evening, etc., the sending time of the sending number in different scenarios may be different. And, it is also possible to count the user characteristics of the receiving number, such as counting the diversity of the receiving number: whether a certain sending number is for a wide user group, or for a specific user group (such as users who receive repeated messages may be related to a certain scenario). Or, it is also possible to count the message interval time: in different scenarios, the sending interval of continuous text messages may be different.

[0083] Then, the DBSCAN clustering algorithm can be used to identify the sending numbers used by the Internet service platform in different scenarios based on the feature vector, the time period characteristics of the sending time, the sending frequency, and the user characteristics of the receiving number. Exemplarily, the multidimensional vector can be used as the input of the DBSCAN clustering algorithm. The DBSCAN clustering algorithm can process noise and discriminate clusters by density, perform contour analysis on the clustering results of the DBSCAN clustering algorithm, calculate the contour coefficient of each point, and calculate the average contour coefficient to evaluate the overall clustering quality. According to the results of the contour coefficient, adjust the parameters of the DBSCAN clustering algorithm (such as the minimum number of samples required to form a core point and the maximum distance for a point to be considered as a neighbor) to optimize the clustering effect. By analyzing the characteristics of each cluster, the scenarios they correspond to can be determined. For example: the sending time of a cluster is concentrated during working hours on weekdays, the receiving number coverage is wide and the sending frequency is high, which may correspond to the "triggering the verification code to be sent when registering" scenario; the sending time of another cluster is relatively scattered, but the receiving number coverage is limited, which may correspond to the "triggering the verification code to be sent when retrieving the password" scenario. In this way, through the cluster analysis of the DBSCAN clustering algorithm, a sending number library for different Internet APP / platform scenarios can be constructed for subsequent analysis, so that the predictive classification model can adapt to the detection of violations in different scenarios and improve the recognition efficiency in practical applications.

[0084] S103, constructing a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data.

[0085] In an embodiment of the present disclosure, after obtaining the sending number library, a training data set can be constructed based on the balanced number set of Internet accounts and the network-side SMS XDR big data for training the prediction classification model. Exemplarily, the balanced number set based on the Internet account and the network-side SMS XDR (Extended Detection and Response) big data can be obtained before constructing the sending number library, or after constructing the sending number library, or at the same time as constructing the sending number library.

[0086] In a possible implementation, a training data set is constructed based on a sending number library, a balanced number set of Internet accounts, and network-side SMS XDR big data, including:

[0087] Obtain a dataset of illegally registered Internet accounts and a dataset of numbers in normal use;

[0088] Based on the dataset of illegally registered Internet accounts and the normally used number set, a balanced number set of Internet accounts is constructed;

[0089] The network side SMS XDR big data is obtained by decoding the signaling collected on the network side; wherein the network side SMS XDR big data includes at least one of the time when all network users receive SMS, the sending number, the receiving number, and the SMS length;

[0090] A training data set is constructed based on the sending number database, the balanced number set of Internet accounts, and the SMS XDR big data on the network side.

[0091] In the embodiments of the present disclosure, considering that the code receiving platform is an online platform that provides virtual mobile phone number services, these platforms allow users to rent temporary mobile phone numbers to receive verification code SMS messages. Generally, the numbers provided by these platforms are distributed all over the world and can be used to register various Internet accounts. Therefore, by obtaining the number pools that these platforms provide services to the outside, a data set for constructing illegal registration of Internet accounts can be constructed. As an example, a list of numbers used to provide services to the outside can be obtained on the decoding platform to construct positive samples. For example, it can be obtained through web crawler technology: for some platforms that make profits through advertising models and provide decoding services to the outside for free, the list of number pools that provide services to the outside is usually presented on the page. At this time, web crawler technology can be used to crawl and filter the number list belonging to a certain range (such as a certain operator) in the number pool as a component of the positive sample; or, under legal authorization, by scanning vulnerabilities and penetrating websites of black and gray production, the black and gray production number pool in the background is obtained. Through the steps of information collection, vulnerability discovery and utilization, database access and data analysis on the target black and gray production website, a list of numbers belonging to a certain range (such as a certain operator) is obtained as a component of the positive sample. It is also possible to obtain a set of numbers in normal use (negative samples, target = 0). For example, by examining factors such as the user's star rating, package charges, and group customers, a list of user numbers that meet multiple high-quality conditions and are equivalent to the positive sample can be sampled as the composition of negative samples. Through the above two aspects, a balanced number set containing normal and illegal Internet accounts can be constructed. SMS XDR big data can be obtained by decoding the signaling collected from the network side, including the time when all network users receive SMS, the sending number, the receiving number, the SMS length (excluding content), and other fields. In this way, through the penetration of network crawlers and legally authorized black and gray production websites, a balanced number set is obtained, including normal and illegal registered numbers, which provides rich training data for the model; moreover, extracting multi-dimensional features of the number set in terms of reception quantity, interactive platform, frequency, time distribution, length distribution, etc., also helps to build a complete and discriminative data set.

[0092] Afterwards, a training data set can be constructed based on the above-mentioned sending number library (hereinafter referred to as A), the balanced number set of Internet accounts (hereinafter referred to as B), and the network-side SMS XDR big data (hereinafter referred to as S) for model training. As an example, through big data analysis, for each number in the number set B, the interaction between it and the numbers in the number library A within a certain period is counted to construct a data set. The data set mainly includes the following fields: 1) Receiving quantity characteristics: the number of times that the numbers in number set B receive SMS messages sent from numbers in the registration scenario of Internet APP / platform suspected of black and gray industries; 2) Interaction platform distribution characteristics: the number of numbers in number set B that receive SMS messages sent from numbers in the registration scenario of Internet APP / platform suspected of black and gray industries (deduplication), in order to monitor whether number B receives registration requests from major Internet platforms within a certain period; 3) Frequency characteristics: the frequency of SMS messages sent from numbers in number set B in the registration scenario of Internet APP / platform suspected of black and gray industries, such as the average time interval; 4) Time distribution characteristics: the time period characteristics of SMS messages sent from numbers in number set B in the registration scenario of Internet APP / platform suspected of black and gray industries: for example, morning, noon, evening, etc., the sending time in different scenarios may be different. 5) Length distribution characteristics: the length distribution characteristics of SMS messages sent from numbers in number set B in the registration scenario of Internet APP / platform suspected of black and gray industries, such as mean, mode, etc. By combining number library A and network-side SMS XDR big data, we count the reception quantity characteristics, interaction platform distribution characteristics, frequency characteristics, time distribution characteristics, length distribution characteristics, etc. of each number in number set B within a certain period one by one, and build a complete training data set for subsequent training and testing.

[0093] S104, based on the training data set, use the ExtraTrees classifier to perform training to obtain a prediction classification model.

[0094] In the embodiments of the present disclosure, after the training data set is constructed, the ExtraTrees classifier can be used to perform model training based on the training data set, and the trained model can be used as a prediction classification model to identify the existing mobile phone number and predict whether the existing mobile phone number is a mobile phone number that has violated the regulations in registering an Internet account. Among them, the ExtraTrees classifier (Extremely Randomized Trees) is an ensemble learning algorithm based on decision trees, which can improve the accuracy and stability of the model by constructing multiple decision trees and averaging (or voting) their prediction results. Compared with other classifiers, the ExtraTrees classifier has the following advantages in processing the above feature set: 1) Strong adaptability: In the identification of illegal registration behaviors, the data may be very complex and diverse. ExtraTrees can handle complex feature interactions and heterogeneous data, which helps to capture the characteristic patterns of different illegal behaviors; 2) Efficient processing of large data sets: Since illegal registration behaviors involve massive call records and multi-dimensional data (such as sending frequency, time distribution, receiving number distribution, etc.), ExtraTrees can effectively process these large-scale data and quickly generate classification models; 3) Reduce overfitting risk: Due to the randomness and diversity of ExtraTrees, it can reduce the risk of overfitting of the model, so that the model still performs well when facing new and unseen data. This is especially important for identifying new or changing illegal behaviors.

[0095] In a possible implementation, based on the training data set, an ExtraTrees classifier is used for training to obtain a prediction classification model, including:

[0096] Performing data preprocessing on the training data set to obtain a preprocessed training data set; wherein the data preprocessing includes at least one of missing value processing, numerical data conversion processing, and data normalization processing;

[0097] Perform feature engineering on the preprocessed training data set through statistical analysis and feature importance evaluation to obtain an optimized training data set;

[0098] Based on the optimized training data set, the ExtraTrees classifier is used for training to obtain a predictive classification model. The predictive classification model is used to perform predictive classification processing on existing network numbers to determine the target numbers of the existing network numbers that are involved in the black and gray Internet accounts.

[0099] In an embodiment of the present disclosure, when training is performed using an ExtraTrees classifier based on a training data set to obtain a predictive classification model, the training data set can be preprocessed to obtain a preprocessed training data set. Data preprocessing includes, for example: performing missing value processing, removing missing values, and obtaining a complete data set; performing numerical data conversion processing, converting categorical data in features into numerical data through unique hot encoding to ensure that the model can process; performing data normalization processing, such as scaling numerical features to the same range through normalization processing to reduce the impact of magnitude differences between feature values ​​on the model. Afterwards, feature engineering processing can be performed on the preprocessed training data set to obtain an optimized training data set. As an example, statistical analysis and feature importance evaluation can be used to select features that have a significant impact on the classification task, reduce redundant features, and improve the training efficiency of the model. The proposal of this application adopts a feature importance evaluation based on a tree model to obtain the importance score of each feature and determine the feature subset that contributes most to the classification task. Through the feature selection algorithm, low-importance features are eliminated, and feature subsets with high importance are retained to reduce redundancy and improve the efficiency of model training. If the feature subset still has a high correlation after the initial selection, the principal component analysis (PCA) and other dimensionality reduction techniques are applied to reduce the feature dimension and optimize the data structure. In this way, new features can be constructed and the original features can be transformed through feature combination and transformation, thus improving the expression ability and performance of the model and obtaining a dataset optimized by feature engineering.

[0100] As a specific example, the content length of short messages is standardized. Taking the mean value of the SMS length as 100 characters and the standard deviation as 20 characters, the standardized SMS length can be calculated by the formula: (length-mean) / standard deviation. For example, if the length of a SMS is 150 characters, its standardized length is (150-100) / 20=5. If the standardized length exceeds 2, it is marked as possible important information. Next, based on the reception time feature, the time window analysis method is used to divide the time of the day into multiple time periods, such as one time period per hour. The number of SMS received in each time period is counted to obtain the SMS reception feature of each time period. For example, the SMS reception situation on a certain day is: 10 messages are received in the 0-1 period, 15 messages are received in the 1-2 period, and so on. By comparing the feature distribution of different time periods, if the number of SMS received in a certain period is significantly higher than that in other periods, it is judged that there is abnormal behavior in the period. Then, the feature combination operation is performed on the number of registered ports and the number of black and gray production APPs involved in the number. For example, if the number of registered ports of the black and gray product apps involved in a certain number is 5 and the number of black and gray product apps is 3, the combined eigenvalue is 5*3=15. If the combined eigenvalue exceeds 10, an abnormal warning signal is output. According to the proportion of black and gray product text messages to all text messages, a correlation analysis is performed. For example, the proportion of black and gray product text messages of a certain number is 30%. By calculating the correlation coefficient between it and other features (such as text message reception time, text message length, etc.), if the correlation coefficient is significant, it is judged that there is a relationship between the proportion and other features, and it is determined whether further feature interaction is needed. Common feature patterns are obtained by clustering the statistical eigenvalues. For example, the K-means algorithm is used to cluster features such as text message length, reception time, and number of black and gray product apps to obtain several feature patterns. Principal component analysis (PCA) is used to reduce the dimensionality of all features. For example, the original features include text message length, reception time, number of black and gray product apps, etc., and several principal component features are obtained through principal component analysis, which retains the main information while reducing noise interference.

[0101] Afterwards, the optimized feature set (i.e., the optimized training data set) may be used to train the ExtraTrees classifier. Exemplarily, the following process may be included:

[0102] ExtraTrees parameter tuning: Obtaining the optimal parameter combination for ExtraTrees usually requires the use of hyperparameter tuning techniques. During the hyperparameter tuning process, different parameter combinations can be tested to select the parameter set that achieves the best performance on the validation dataset. This is as follows:

[0103] 1) Determine the parameters that need to be tuned: The ExtraTrees classifier has several important hyperparameters that can affect the performance of the model. Common tuning parameters include: a) The number of decision trees: larger values ​​can generally improve the stability of the model, but the training time will increase; b) The number of features used to find the best split; c) The minimum number of samples a node must have before splitting; d) The minimum number of samples that a leaf node must contain. It also controls the depth of the tree to prevent overfitting; e) The maximum depth of the tree, setting a smaller value helps prevent overfitting. 2) Choose a tuning method: Select the Grid Search method to traverse all possible parameter combinations and find the best combination. Combine cross-validation to evaluate the performance of the model to ensure that the selected parameter combination performs well on different data partitions.

[0104] The optimized model is applied to the test set to obtain the predicted labels of the black and gray numbers, which are compared with the real labels, and the evaluation indicators such as accuracy, precision, recall and F1 value are calculated. The experimental results show that the accuracy of the model on the test set reaches 95%, the precision and recall rates are both over 90%, and the F1 value is 93, indicating that the model can effectively identify black and gray numbers. Afterwards, the trained prediction and classification model can be dumped into a file and used to predict and classify the numbers on the existing network.

[0105] S105: Predict and classify the existing network numbers based on the prediction and classification model.

[0106] In the embodiments of the present disclosure, after obtaining the prediction classification model, the prediction classification model can be used to predict and classify the existing network numbers. For example, the prediction classification model can be used to predict and classify the existing network numbers based on the sending number library A and the network-side SMS XDR big data S, so as to discover mobile phone numbers suspected of registering black and gray Internet accounts in real time and continuously.

[0107] It is understandable that in the face of massive call record data, the MapReduce framework (mapping / reduction framework) can be used to perform parallel processing on a large amount of structured and unstructured SMS call record data, and to count the number of reception characteristics, interactive platform distribution characteristics, frequency characteristics, time distribution characteristics, length distribution characteristics, etc. within a certain period of time, so as to realize rapid data processing and classification and ensure accuracy and speed when processing large amounts of data.

[0108] In the embodiments of the present disclosure, the number alarm set is determined by the monitoring strategy; the sending number library is constructed based on the number alarm set by the DBSCAN clustering algorithm; the training data set is constructed based on the sending number library, the balanced number set of the Internet account, and the network-side SMS XDR big data; based on the training data set, the ExtraTrees classifier is used for training to obtain a predictive classification model; and the existing network numbers are predicted and classified based on the predictive classification model. In this way, on the one hand, the training data set is constructed based on the sending number library, the balanced number set of the Internet account, and the network-side SMS XDR big data, which can provide rich training data for the training of the predictive classification model, thereby improving the accuracy of the prediction results of the predictive classification model; on the other hand, combining the DBSCAN clustering algorithm and the ExtraTrees classifier for predictive classification model training can enable the predictive classification model to handle complex feature interactions and improve the accuracy and robustness of the prediction results of the predictive classification model.

[0109] To make the number identification method provided by the embodiment of the present disclosure clearer, Figure 2 For explanation. Figure 2 As shown, the number identification method includes:

[0110] 1. Load monitoring strategies in the spam SMS monitoring system to monitor the sending port of the verification code triggered when registering or logging into the suspected black and gray production APP or platform.

[0111] When users register on an Internet APP, they are usually guided to enter their mobile phone numbers and trigger the issuance of a verification code to verify the mobile phone number. After the verification is passed, the Internet platform will create an account with the mobile phone number as the ID. Since my country has implemented a real-name system for mobile phone numbers, in order to hide their true identities during illegal activities, operators of black and gray industries will use fake base stations, code receiving platforms, etc. to illegally register Internet accounts using numbers that are not their own.

[0112] Internet apps or platforms usually use the following methods to trigger the issuance of verification codes:

[0113] 1) Global Number: Usually a standard number for international services, also applicable to SMS sending within China.

[0114] 2) Short number: A port number starting with 106. This type of number is usually a dedicated number used to receive or send marketing and service notifications.

[0115] 3) Virtual number: Generally, it is a mobile phone number provided by a virtual operator, usually used for sending bulk SMS messages.

[0116] Therefore, it is necessary to use monitoring strategies to load into the spam SMS detection system, and output the alarms that hit the monitoring strategies for subsequent analysis. The alarm content includes the strategy ID, sending number, receiving number, sending time, etc.

[0117] One or more policy IDs are defined for each Internet APP or platform, covering the following:

[0118] Strategy ID, hit keyword expression. For example, the recognition strategy for the verification code received when APP1 registered is: including APP1 and code keywords, and containing 6 consecutive digits;

[0119] For example, the verification code identification strategy received when APP2 is registered is: it contains APP1 and verification code keywords, and contains 6 consecutive digits.

[0120] 2. By loading the above strategy in the spam SMS monitoring system, you can output the alarm list (number alarm set) that hits the strategy. After associating the strategy ID with the traffic APP / platform, the following content is output:

[0121] 1) Internet APP / Platform Name

[0122] 2) Send number

[0123] 3) Receiving number

[0124] 4) Sending time

[0125] By continuously updating the monitoring strategy list, we can cover the mainstream domestic instant messaging apps, remote control apps, virtual currency trading apps and other Internet apps / platforms that may be involved in the black and gray industries.

[0126] 3. For the alarm list obtained above, extract the features of the sending numbers, and use the DBSCAN clustering algorithm to identify the sending numbers used by the APP in different scenarios.

[0127] 1) Select the features of the sending number and the receiving number to construct a feature vector. The feature vector is represented by a multidimensional vector, where each dimension corresponds to a feature, and the data is standardized:

[0128] a) Sending frequency: the number of times a number is sent within a specific time period.

[0129] b) Time distribution characteristics: Time period characteristics of the sending time: for example, morning, noon, evening, etc. The sending time in different scenarios may be different.

[0130] c) Diversity of receiving numbers: whether a sending number is targeted at a wide user group or a specific user group (for example, repeated receiving users may be related to a certain scenario).

[0131] d) Message interval: In different scenarios, the interval between sending consecutive SMS messages may vary.

[0132] Combining the DBSCAN unsupervised clustering algorithm with silhouette analysis, the multidimensional vector is used as the input of DBSCAN, which processes noise and discriminates clusters by density. The clustering results of DBSCAN are subjected to silhouette analysis, the silhouette coefficient of each point is calculated, and the average silhouette coefficient is calculated to evaluate the overall clustering quality. According to the results of the silhouette coefficient, the parameters of DBSCAN (such as the minimum number of samples required to constitute a core point and the maximum distance for a point to be considered a neighbor) are adjusted to optimize the clustering effect.

[0133] By analyzing the characteristics of each cluster, we can determine the scenarios they correspond to. For example:

[0134] The sending time of a cluster is concentrated during working hours on weekdays. The receiving numbers cover a wide range and the sending frequency is high, which may correspond to the scenario of "triggering the sending of verification code during registration".

[0135] The sending time of the other cluster is more scattered, but the coverage of the receiving numbers is limited, which may correspond to the scenario of "triggering the verification code to be sent when retrieving the password".

[0136] Through cluster analysis, a sending number database for different Internet APP / platform scenarios is constructed for subsequent analysis.

[0137] 4. As mentioned above, code receiving platforms are online platforms that provide virtual mobile phone number services. These platforms allow users to rent temporary mobile phone numbers to receive verification code SMS messages. Usually, the numbers provided by these platforms are distributed all over the world and can be used to register various Internet accounts. Therefore, by obtaining the number pools provided by these platforms for external services, it is possible to construct a dataset for constructing illegal registration of Internet accounts.

[0138] 1) Obtain a dataset of illegally registered Internet accounts (positive samples, target = 1)

[0139] A list of domestic numbers used to provide external services is obtained on the decoding platform to construct positive samples. There are two ways to obtain these numbers:

[0140] a) Web crawlers: Some platforms that make money through advertising models and provide decoding services for free usually present the list of number pools that provide services to the outside world on the page. This proposal uses web crawler technology to crawl and filter the number list in the number pool that belongs to a certain range (such as domestic, a certain operator) as the composition of positive samples;

[0141] b) With legal authorization, obtain the backend black and gray industry number pool by performing vulnerability scanning and website penetration on black and gray industry websites. By collecting information, discovering and exploiting vulnerabilities, accessing databases and analyzing data on target black and gray industry websites, obtain a list of numbers belonging to a specific range (such as domestic, a certain operator) as the composition of positive samples;

[0142] 2) Obtain a set of normally used numbers (negative samples, target = 0)

[0143] By examining factors such as the user's star rating, package charges, and group customers, we randomly select a list of user numbers that meet multiple high-quality conditions and are of a comparable size to the positive samples as the composition of the negative samples.

[0144] Through the above two aspects, a balanced number set containing normal and illegally registered Internet accounts is constructed.

[0145] 5. Combine the sending number library for different scenarios of Internet APP / platform built in step 3 (hereinafter referred to as A), the balanced number set of illegally registered Internet accounts built in step 4 (hereinafter referred to as B), and the SMS XDR big data on the network side (hereinafter referred to as S) to build a complete data set.

[0146] The SMS XDR data is obtained by decoding the signaling collected from the network side, including fields such as the time when all network users receive the SMS, the sending number, the receiving number, and the SMS length (excluding the content).

[0147] Through big data analysis, for each number in number set B, statistics are collected on its interaction with numbers in number library A within a certain period, and a data set is constructed. The data set mainly includes the following fields:

[0148] 1) Receiving quantity feature: the number of times the numbers in number set B receive text messages sent by numbers in the registration scenario of Internet apps / platforms suspected of being involved in illegal and gray industries;

[0149] 2) Interaction platform distribution characteristics: The number of numbers in number set B that receive registration requests from Internet apps / platforms suspected of being involved in illegal and gray industries (de-duplicated), to monitor whether number B receives registration requests from major Internet platforms within a certain period;

[0150] 3) Frequency characteristics: the frequency of receiving SMS messages from numbers in number set B in the registration scenario of Internet apps / platforms suspected of being involved in illegal and gray industries, such as the average time interval;

[0151] 4) Time distribution characteristics: The time period characteristics of the SMS sent by the numbers in number set B under the registration scenario of the Internet APP / platform suspected of black and gray industries: for example, morning, noon, evening, etc. The sending time in different scenarios may be different.

[0152] 5) Length distribution characteristics: The length distribution characteristics of SMS messages sent by numbers in number set B from the registration scenarios of Internet apps / platforms suspected of being involved in illegal and gray industries, such as mean, mode, etc.

[0153] By combining the number library A and the SMS XDR big data S, the reception quantity characteristics, interaction platform distribution characteristics, frequency characteristics, time distribution characteristics, length distribution characteristics, etc. of each number in the number set B within a certain period are counted one by one to build a complete data set for subsequent training and testing.

[0154] 6. Perform preprocessing and feature engineering on the dataset constructed in step 5

[0155] 1) Data preprocessing: Remove missing values ​​through data preprocessing to obtain a complete data set. For categorical data in features, convert them into numerical data through one-hot encoding to ensure that the model can process them. Perform data normalization, such as scaling numerical features to the same range through normalization to reduce the impact of magnitude differences between feature values ​​on the model.

[0156] 2) Feature Engineering: Through statistical analysis and feature importance evaluation, select features that have a significant impact on the classification task, reduce redundant features, and improve the training efficiency of the model. This application proposal uses a tree model-based feature importance evaluation to obtain the importance score of each feature and determine the feature subset that contributes most to the classification task. Through the feature selection algorithm, remove low-importance features and retain high-importance feature subsets to reduce redundancy and improve model training efficiency. If the feature subset still has a high correlation after preliminary selection, apply dimensionality reduction techniques such as principal component analysis (PCA) to reduce feature dimensions and optimize the data structure.

[0157] For example, the content length of short messages is standardized. Taking the mean value of the SMS length as 100 characters and the standard deviation as 20 characters, the standardized SMS length can be calculated by the formula: (length-mean) / standard deviation. For example, if the length of a SMS is 150 characters, its standardized length is (150-100) / 20=5. If the standardized length exceeds 2, it is marked as possible important information. Next, based on the reception time feature, the time window analysis method is used to divide the time of the day into multiple time periods, such as one time period per hour. The number of SMS received in each time period is counted to obtain the SMS reception feature of each time period. For example, the SMS reception situation on a certain day is: 10 messages are received in the 0-1 period, 15 messages are received in the 1-2 period, and so on. By comparing the feature distribution of different time periods, if the number of SMS received in a certain period is significantly higher than that in other periods, it is judged that there is abnormal behavior in that period. Then, the feature combination operation is performed on the number of registered ports and the number of black and gray production APPs involved in the number. For example, if the number of registered ports of the black and gray product apps involved in a certain number is 5 and the number of black and gray product apps is 3, the combined eigenvalue is 5*3=15. If the combined eigenvalue exceeds 10, an abnormal warning signal is output. According to the proportion of black and gray product text messages to all text messages, a correlation analysis is performed. For example, the proportion of black and gray product text messages of a certain number is 30%. By calculating the correlation coefficient between it and other features (such as text message reception time, text message length, etc.), if the correlation coefficient is significant, it is judged that there is a relationship between the proportion and other features, and it is determined whether further feature interaction is needed. Common feature patterns are obtained by clustering the statistical eigenvalues. For example, the K-means algorithm is used to cluster features such as text message length, reception time, and number of black and gray product apps to obtain several feature patterns. Principal component analysis (PCA) is used to reduce the dimensionality of all features. For example, the original features include text message length, reception time, number of black and gray product apps, etc., and several principal component features are obtained through principal component analysis, which retains the main information while reducing noise interference.

[0158] This embodiment constructs new features and transforms original features through feature combination and conversion, improves the expression ability and performance of the model, and obtains a data set optimized by feature engineering.

[0159] 7. Use the optimized feature set and train with the ExtraTrees classifier

[0160] The ExtraTrees classifier (Extremely Randomized Trees) is an ensemble learning algorithm based on decision trees. It improves the accuracy and stability of the model by building multiple decision trees and averaging (or voting) their prediction results. Compared with other classifiers, the ExtraTrees classifier has the following advantages in processing the above feature set:

[0161] 1) Strong adaptability: In the identification of illegal registration behaviors, the data may be very complex and diverse. ExtraTrees can handle complex feature interactions and heterogeneous data, which helps to capture the characteristic patterns of different illegal behaviors.

[0162] 2) Efficient processing of large data sets: Since illegal registration behaviors involve massive call records and multi-dimensional data (such as sending frequency, time distribution, receiving number distribution, etc.), ExtraTrees can effectively process these large-scale data and quickly generate classification models.

[0163] 3) Reduce the risk of overfitting: Due to the randomness and diversity of ExtraTrees, it can reduce the risk of overfitting of the model, so that the model still performs well when facing new and unseen data. This is especially important for identifying new or changing violations.

[0164] ExtraTrees parameter tuning: Obtaining the optimal parameter combination for ExtraTrees usually requires the use of hyperparameter tuning techniques. During the hyperparameter tuning process, we test different parameter combinations and select the parameter set that achieves the best performance on the validation dataset.

[0165] 1) Determine the parameters that need to be tuned: The ExtraTrees classifier has several important hyperparameters that can affect the performance of the model. Common tuning parameters include:

[0166] a) Number of decision trees: Larger values ​​generally improve the stability of the model, but training time will increase

[0167] b) Number of features used to find the best segmentation

[0168] c) The minimum number of samples a node must have before it splits

[0169] d) The minimum number of samples that must be included in a leaf node. It also controls the depth of the tree to prevent overfitting.

[0170] e) Maximum depth of the tree. Setting a smaller value helps prevent overfitting.

[0171] 2) Select the tuning method: Select the grid search method to traverse all possible parameter combinations and find the best combination. Combine cross-validation to evaluate the performance of the model to ensure that the selected parameter combination performs well on different data partitions.

[0172] The optimized model was applied to the test set to obtain the predicted labels of the illegal and gray market numbers, which were compared with the true labels, and the evaluation indicators such as accuracy, precision, recall and F1 value were calculated. The results showed that the accuracy of the model on the test set reached 95%, the precision and recall rates also exceeded 90%, and the F1 value was 93, indicating that the model can effectively identify illegal and gray market numbers.

[0173] 8. Dump the optimized model into a file for predicting and classifying existing network numbers.

[0174] The trained model is used to predict and classify the numbers on the existing network based on the sending number database A and the network-side SMS XDR big data S, so as to detect numbers suspected of registering black and gray Internet accounts in real time and continuously.

[0175] When faced with massive amounts of call record data, this embodiment can use the MapReduce framework to perform parallel processing on a large amount of structured and unstructured SMS call record data, and count the number of reception characteristics, interactive platform distribution characteristics, frequency characteristics, time distribution characteristics, length distribution characteristics, etc. of the number within a certain period, so as to achieve rapid processing and classification of data and ensure accuracy and speed when processing large amounts of data.

[0176] The specific implementation and technical effects of each step of this embodiment are similar to those of the above method embodiments, and will not be repeated here.

[0177] Based on the same inventive concept, the embodiment of the present disclosure also provides a number recognition device. Figure 3 As shown, the number recognition device 300 includes:

[0178] The determination module 310 is used to determine the number alarm set through a monitoring strategy; wherein the monitoring strategy is used to monitor the verification code sending port of the black and gray production service platform;

[0179] The first construction module 320 is used to construct a sending number library based on the number alarm set by using a DBSCAN clustering algorithm; wherein the sending number library is a scenario-based number library;

[0180] A second construction module 330 is used to construct a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data;

[0181] A training module 340 is used to perform training based on the training data set using an ExtraTrees classifier to obtain a prediction classification model;

[0182] The identification module 350 is used to predict and classify the existing network numbers based on the prediction and classification model.

[0183] In a possible implementation, the determining module 310 includes:

[0184] A loading unit, used for loading monitoring strategies on the spam message monitoring platform;

[0185] A detection unit is used to detect a number alarm set that hits the monitoring strategy; wherein the number alarm set includes at least one of a policy identifier, an Internet service platform identifier, a sending number, a receiving number, and a sending time.

[0186] In a possible implementation manner, the first building module 320 includes:

[0187] An extraction unit, used to extract number features in the number alarm set;

[0188] An identification unit, used to identify sending numbers used by the Internet service platform in different scenarios based on number features in the number alert set by using a DBSCAN clustering algorithm;

[0189] A construction unit is used to construct a sending number library based on the sending numbers used in different scenarios by the Internet service platform.

[0190] In a possible implementation, the identification unit includes:

[0191] A selection subunit, configured to select a sending number and a receiving number from the number features in the number alarm set to construct a feature vector;

[0192] A statistical subunit, used to count the time period characteristics and sending frequency of the sending number, and to count the user characteristics of the receiving number;

[0193] The identification subunit is used to identify the sending number used in different scenarios by the Internet service platform based on the feature vector, the time period characteristics and sending frequency of the sending number, and the user characteristics of the receiving number through the DBSCAN clustering algorithm.

[0194] In a possible implementation manner, the second building module 330 includes:

[0195] An acquisition unit, used to acquire a data set of illegally registered Internet accounts and a set of numbers in normal use;

[0196] A balanced number set construction unit, used to construct a balanced number set of Internet accounts based on the illegally registered Internet account data set and the normally used number set;

[0197] A decoding unit, used to obtain the network side SMS XDR big data by decoding the signaling collected on the network side; wherein the network side SMS XDR big data includes at least one of the time when all network users receive SMS, the sending number, the receiving number, and the SMS length;

[0198] The training set construction unit is used to construct a training data set based on the sending number library, the balanced number set of the Internet account, and the network side SMS XDR big data.

[0199] In a possible implementation, the training module 340 includes:

[0200] A first processing unit, configured to perform data preprocessing on the training data set to obtain a preprocessed training data set; wherein the data preprocessing includes at least one of missing value processing, numerical data conversion processing, and data normalization processing;

[0201] A second processing unit is used to perform feature engineering processing on the preprocessed training data set through statistical analysis and feature importance evaluation to obtain an optimized training data set;

[0202] A training unit is used to train an ExtraTrees classifier based on the optimized training data set to obtain a prediction classification model; wherein the prediction classification model is used to perform prediction classification processing on existing network numbers to determine target numbers involving black and gray Internet accounts in the existing network numbers.

[0203] The specific implementation method and technical effect of the device provided in the embodiment of the present disclosure are similar to those of the above-mentioned method embodiment, and will not be repeated here.

[0204] According to an embodiment of the present disclosure, the present disclosure also discloses an electronic device, a computer-readable storage medium, and a computer program product.

[0205] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement an embodiment of the present disclosure is shown. The electronic device 400 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0206] like Figure 4As shown, the electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0207] Multiple components in the electronic device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the electronic device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0208] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above, such as the number recognition method. For example, in some embodiments, the number recognition method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of the number recognition method described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform the number recognition method in any other appropriate manner (e.g., by means of firmware).

[0209] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0210] The program code of the computer program product for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0211] In the context of the present disclosure, a computer-readable storage medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may be a machine-readable signal medium or a machine-readable storage medium. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0212] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0213] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0214] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0215] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0216] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A number identification method, characterized in that: include: Determine the number alarm set through the monitoring strategy; wherein the monitoring strategy is used to monitor the verification code sending port of the black and gray production service platform; Building a sending number library based on the number alarm set by using a DBSCAN clustering algorithm; wherein the sending number library is a scenario-based number library; Constructing a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data; Based on the training data set, an ExtraTrees classifier is used for training to obtain a prediction classification model; The existing network numbers are predicted and classified based on the prediction and classification model.

2. The number recognition method according to claim 1, characterized in that: Determining the number alarm set by monitoring strategy includes: Load monitoring strategies on the spam SMS monitoring platform; Detect the number alarm set that hits the monitoring strategy; wherein the number alarm set includes at least one of a policy identifier, an Internet service platform identifier, a sending number, a receiving number, and a sending time.

3. The number recognition method according to claim 2, characterized in that: The method of constructing a sending number library based on the number alert set by using a DBSCAN clustering algorithm includes: Extracting number features from the number alarm set; Using the DBSCAN clustering algorithm based on the number features in the number alert set, identifying the sending numbers used by the Internet service platform in different scenarios; A sending number library is constructed based on the sending numbers used by the Internet service platform in different scenarios.

4. The number recognition method according to claim 3, characterized in that: The method of identifying sending numbers used by the Internet service platform in different scenarios based on the number features in the number alert set by using the DBSCAN clustering algorithm includes: Selecting sending and receiving numbers from the number features in the number alert set to construct a feature vector; Count the time period characteristics and sending frequency of the sending number, and count the user characteristics of the receiving number; The DBSCAN clustering algorithm is used to identify the sending numbers used in different scenarios by the Internet service platform based on the feature vector, the time period characteristics and sending frequency of the sending number, and the user characteristics of the receiving number.

5. The number recognition method according to claim 1, characterized in that: The construction of a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data includes: Obtain a dataset of illegally registered Internet accounts and a dataset of numbers in normal use; Based on the illegally registered Internet account data set and the normally used number set, a balanced number set of Internet accounts is constructed; The network side SMS XDR big data is obtained by decoding the signaling collected on the network side; wherein the network side SMS XDR big data includes at least one of the time when all network users receive SMS, the sending number, the receiving number, and the SMS length; A training data set is constructed based on the sending number library, the balanced number set of the Internet account, and the network-side SMS XDR big data.

6. The number recognition method according to claim 1, characterized in that: Based on the training data set, the ExtraTrees classifier is used for training to obtain a prediction classification model, including: Performing data preprocessing on the training data set to obtain a preprocessed training data set; wherein the data preprocessing includes at least one of missing value processing, numerical data conversion processing, and data normalization processing; Performing feature engineering processing on the preprocessed training data set through statistical analysis and feature importance evaluation to obtain an optimized training data set; Based on the optimized training data set, the ExtraTrees classifier is used for training to obtain a predictive classification model; wherein the predictive classification model is used to perform predictive classification processing on existing network numbers to determine the target numbers of the existing network numbers involving black and gray Internet accounts.

7. A number recognition device, characterized in that: include: A determination module, used to determine a number alarm set through a monitoring strategy; wherein the monitoring strategy is used to monitor the verification code sending port of the black and gray production service platform; The first construction module is used to construct a sending number library based on the number alarm set by using a DBSCAN clustering algorithm; wherein the sending number library is a scenario-based number library; A second construction module is used to construct a training data set based on the sending number library, the balanced number set of Internet accounts, and the network-side SMS XDR big data; A training module, used for training using an ExtraTrees classifier based on the training data set to obtain a prediction classification model; The identification module is used to predict and classify the existing network numbers based on the prediction and classification model.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images