Telecommunication fraud early warning method

Abstract

The invention discloses a telecommunication fraud early warning method. The system obtains telecommunication fraud case data through multiple channels of texts, voices, pictures, videos and links, and classifies the telecommunication fraud case data. For non-text data, the system converts the non-text data into a text through a technical means, and then carries out preprocessing, word frequency statistics and similarity calculation to generate training data. Meanwhile, the system obtains behavior data of the client from the application server, carries out telecommunication fraud detection, and sends out early warning and pushes a disposal instruction if a detection result exceeds a set threshold value. The system overcomes the defects that a traditional early warning mode depends on call surface data and is difficult to deeply analyze information content, enhances the recognition capability of multimedia information such as pictures and the like, and can effectively cope with various forms of telecommunication fraud. By combining the neural network and the cosine similarity algorithm, the system expands the early warning analysis range, and solves the problem that the rule is difficult to cover fraud numbers and information.

Description

Technical Field

[0001] The present invention relates to the field of anti-fraud technology, and in particular to a telecommunications fraud early warning method. Background Art

[0002] In recent years, telecommunications fraud cases have occurred frequently. Criminals use fraudulent text messages and fraudulent phone calls to send to victims in large numbers to commit fraud in real time. Many telecommunications network fraud crimes have developed in an organized manner. According to the requirements of the Ministry of Industry and Information Technology, early warning monitoring, big data analysis and other mechanisms should be established to prevent commercial short messages or commercial calls sent without the consent or request of users, prevent and combat telecommunications fraud crimes, safeguard the legitimate rights and interests of the people, and ensure national security and social stability. How telecommunications operators can use various technical means to establish a mechanism for predicting user behavior related to fraud and harassment, build fraud-related early warning and analysis capabilities, and achieve the purpose of preventing and combating telecommunications fraud is a current technical problem. How to prevent telecommunications telephone fraud, timely block the call behavior of criminals, and predict the fraud risk level of operator number cards is also crucial.

[0003] The existing telecommunications fraud prevention systems include: 1. The mobile terminal is used to detect and determine fraud based on the current telecommunications data according to the predetermined constraint rules when receiving SMS messages or incoming calls, and use machine learning algorithms to detect whether it is telecommunications fraud. If the detection result is determined to be telecommunications fraud, the fraud data information is uploaded to the big data analysis terminal; 2. Big data analysis end, used to collect real-time statistics of fraud data information uploaded from mobile terminals, and send fraud warning information to the fraud blocking and management end for bank card accounts or phone numbers with a number of reports exceeding a certain threshold; 3. Fraud prevention and management end, used to take timely corresponding measures to prevent the occurrence of telecommunications fraud incidents when receiving fraud warning information.

[0004] The main disadvantages of the prior art are: 1. Determine whether it is a fraud based on the reported number in the cloud, and then issue an early warning. This is easy to generalize, and fraud numbers that are difficult to cover by the rules are often generated; 2. There is no analysis of the fraudulent message itself, and the image information cannot be accurately analyzed. Summary of the invention

[0005] The purpose of the present invention is to solve the problems in the background technology and provide a telecommunications fraud early warning method.

[0006] The above technical objectives of the present invention are achieved through the following technical solutions: Step 1: Collect telecommunications fraud case data and classify the data types into text, voice, video, image, and network link addresses; Step 2: Convert text, voice, video, image, and web link address data into text; Step 3: Use the TF-IWF algorithm to analyze text data and establish a sensitive vocabulary corpus and early warning model; Step 4: Obtain message data, classify and textualize the acquired message data, and then use the TextRank algorithm to compare the sensitive word corpus and early warning model in step 3 to determine whether it is fraudulent data; Step 5: If the detected message data is fraudulent data, the system will automatically issue a warning message.

[0007] As a preferred method: the specific method of structured classification in step 1 is: Step 1-1: Identify the suffix of the collected telecommunications fraud case data, and use file extension recognition technology to determine that files ending with "txt" are text files; files ending with "jpg, png, gif, bmp" are image files; files ending with "mp3, wav, ogg" are audio files; files ending with "mp4, avi, mkv" are video files; files that do not meet the above classification standards are classified as other files; Step 1-2: Among the image files, the pyzbar library is used to perform a two-dimensional code recognition technology judgment. The files that meet the two-dimensional code characteristics are the two-dimensional code files, and the rest are still classified as the image files; Step 1-3: Use pyzbar to parse the QR code in the QR code file, obtain the information therein, and use regular expressions to judge the information. The files that start with "http: / / " or "https: / / " and contain "youtube.com" or "vimeo.com" are audio files; the files that start with "http: / / " or "https: / / " and contain content ending in image format ("jpg", "png", "gif", "bmp") are image files; the others are network link addresses; the files that do not start with "http: / / " or "https: / / " are text files; Step 1-4: Among the other files, the URL parsing technology is used to determine that "http, htttps, com, cn" are network connection addresses and are classified as the network connection addresses, and the rest are still classified as the other files; Although the accuracy of file extension recognition technology is slightly lower than that of magic number recognition technology and content analysis recognition technology on the market, this solution does not require high accuracy and focuses more on speed. Therefore, the simplicity, speed and wide applicability of file extension recognition technology are more in line with the advantages.

[0008] As a preferred method: the specific identification method in step 2 is: Step 2-1: The audio file is converted into text using speech recognition (ASR) technology; Step 2-2: Using text recognition OCR technology in the image file to convert it into text; Step 2-3: In the video file, use the summary search FFmpeg, first take a screenshot and then perform step 2-2 to convert it into text; Step 2-4: In the network link address, use the http library to obtain the html information of the website page and convert it into text; Fraud identification methods need to process multiple types of data, including text, voice, video, images, and web link addresses, and convert them into analyzable text forms for subsequent processing using the TF-IWF algorithm and the TextRank similarity algorithm.

[0009] ASR technology focuses on the conversion of speech to text. Its algorithm complexity is relatively moderate. In terms of computer resource usage and time cost, it can directly meet the needs of early warning identification methods. In contrast, the mainstream HMM on the market is mainly used for speech recognition acoustic modeling, focusing on modeling the temporal characteristics of speech. Even if it can be used for text-to-speech conversion, it will bring additional work for the initial process integration of other types of data. Although ANN can be used for speech recognition, as a more general model architecture, it is not as directly applicable as ASR technology in data processing and will lead to low operating efficiency.

[0010] OCR technology is suitable for the recognition of printed text and relatively standardized handwritten text. Its algorithm complexity is relatively low, so it has little impact on operating efficiency. ICR is mainly for handwritten text recognition and requires a lot of training. Therefore, OCR technology can meet the basic needs of early warning methods for text recognition.

[0011] FFmpeg is a tool specifically used for multimedia processing. It is targeted at video processing and can be used directly through the command line. It can use corresponding library calls in different programming languages ​​and has high flexibility. OpenCV is mainly a computer vision library. Its functions focus more on analyzing and processing visual features in images and videos. In the specific task of video capture, it is not as targeted as FFmpeg. Therefore, FFmpeg better meets the needs of early warning methods for video recognition.

[0012] The HTTP library is highly versatile and applicable to different environments. It is not limited by the browser environment to obtain HTML information by sending HTTP requests, while DOM manipulation depends on the DOM interface provided by the browser, which makes it unusable in non-browser environments and has poor versatility. Therefore, HTTP better meets the needs of early warning methods for network connection identification.

[0013] As a preferred method: the specific method of analyzing the text in step 3 is: Step 3-1: The word graph scanning algorithm based on the prefix dictionary uses the Jieba word segmentation to perform word segmentation processing on the text data; Step 3-1-1: Build a prefix dictionary containing Chinese words and their prefix information, and store them in a Trie tree structure, where each node in the Trie tree represents a character; Step 3-1-2: loop through the text data, convert a set of the text data into a character set to complete word graph construction; Step 3-1-3: Jieba word segmentation scans the character set, and matches the character set with the prefix dictionary starting from the first character in the character set. If the match is successful, the path is marked to form a word for forming a complete word; if the match is unsuccessful, the next character in the character set is matched again; Step 3-1-4: Output the word segmentation result of the text data.

[0014] Step 3-2: assign different weights to the text data according to the word positions, the weight of the title and keywords is "5", the weight of the first word in the paragraph is "3", and the rest is "1"; Step 3-3: Remove stop words from the text data, count word frequencies, and form<wi, frei, vi> Triplet (word, frequency, weight); Step 3-4: Calculate the similarity of the words with a frequency greater than 2 in the triple. When the similarity is higher than 0.85, generate a quadruple<wi,wj,simij,frei+frej> (word 1, word 2, similarity, word frequency sum), remove duplicate words; Step 3-5: Replace the word frequency in the triple with the word frequency of the quadruple to obtain an optimized triple set; Step 3-6: Calculate the weight values ​​of the words in the triple set by the TF-IWF algorithm. The triple set is vectorized using the bag-of-words model to be input into the neural network model (CNN); the neural network model (CNN) combines the word frequency (TF) of the word in the current text and the word frequency (IWF) in the corpus. If a word appears frequently in the current text but is extremely uncommon in other texts, its weight value will be relatively high, generating an early warning model; Step 3-6-1: Obtain the vector dimension of the text data according to the length of the text data; Step 3-6-2: Vectorize the triples and input them into the CNN model, and set the label as a fraud case; Step 3-6-3: The CNN model predicts the input data. If the variance between the prediction result and the actual result exceeds the set threshold, it means that the CNN model makes a prediction error. The back propagation algorithm and the stochastic gradient descent algorithm are used to adjust the convolution kernel weights, the pooling window size and step size, and the neuron weights until the variance does not exceed the set threshold. The training is successful to generate the early warning model.

[0015] The TF-IWF algorithm formula is:

[0016] The numerator ni,j of the TF part represents the number of times word ti appears in text j, and the denominator represents the sum of all word frequencies in text j. The numerator of the IWF part represents the sum of all word frequencies in the corpus, and nti represents the total frequency of word ti in the corpus. The meaning of the IWF part is to calculate the logarithm of the ratio of the total number of words in the corpus to the number of times the word appears in the corpus in the text to be checked.

[0017] When the human brain recognizes text, it is based on the comprehensive understanding of the entire semantic scene and language habits. It is a fuzzy and highly flexible cognitive process, while computers need clear and structured data to process effectively. Word segmentation breaks down continuous text into independent words, making text data structured, which is more conducive to the computer's requirements for data processing; assigning weights enables computers to better identify key information in text; removing stop words reduces redundant information in the data and improves the efficiency of computer processing; triples and quadruples standardize the structural form of data, organize data in an orderly manner that meets the requirements of the algorithm, and provide a suitable data input format for the TF-IWF algorithm.

[0018] The Jieba word segmentation technology is used. From the perspective of weighting, it is difficult to directly integrate complex weighted rules into the algorithm of the forward maximum matching method (FMM) and the reverse maximum matching method (RMM); from the perspective of removing stop words, the rule-based minimum word segmentation does not have the advantage of processing stop words, and it mainly focuses on how to segment the text with the least number of words. Therefore, in terms of comprehensive accuracy and efficiency, the Jieba word segmentation is more suitable for the requirements of the early warning method for word segmentation.

[0019] As a preferred method, the specific method for determining fraudulent messages in step 4 is: Step 4-1: Obtain user behavior data; Step 4-2: Execute steps 1 to 3 on the user behavior data; Step 4-3: Combined with the neural network, the TextRank algorithm is used to calculate the similarity between the user behavior data and the early warning model data. If it exceeds the set threshold, it is judged as a fraudulent message.

[0020] The sentence similarity formula of the TextRank algorithm is:

[0021] In the formula, Si and Sj represent two sentences respectively, and Wk represents the words in the sentence. The numerator means the number of identical words that appear in both sentences at the same time, and the denominator is the sum of the logarithms of the number of words in the sentence. The denominator is designed in this way to curb the advantage of longer sentences in similarity calculation.

[0022] By obtaining user behavior data and processing the data in text form, combined with a neural network trained with previous real data, the system makes up for the previous situation of generalizing whether a fraud is determined based on the reported number in the cloud. It can more comprehensively identify fraud data and analyze the content of the fraud message itself, thus improving the accuracy of the early warning.

[0023] As a preferred step 5, the early warning information processing specifically includes the following: Step 5-1: The warning model sends the warning to the message server through the post() method in the http protocol; Step 5-2: The message service center receives the warning and analyzes the warning information through the get() method in the http protocol. Warning messages involving bank accounts or finance are manipulated by account restrictions, and the rest are manipulated by communication blocking.

[0024] Fraud detection and judgment of multimedia messages through predetermined rules and neural network learning algorithms is a forward-looking preventive measure. By detecting at the source, potential fraud information can be discovered as early as possible, and judgments can be made and corresponding measures can be taken before users receive the message, greatly reducing the risk of users suffering losses.

[0025] In summary, the beneficial effects of the present invention are: Combined with neural networks, the traditional telecommunications network fraud warnings for mobile phones and landlines, such as call (contact) time, call duration, number of calls, etc., are extended to telecommunications fraud warnings in multiple multimedia forms such as voice, QR code, text, pictures, URLs, and videos; Preprocess the fraud case data; Use the TF-IWF algorithm to perform sensitive word segmentation on the preprocessed data; Similarity calculation is performed using the TextRank algorithm and the cosine similarity algorithm; When the similarity calculation exceeds the threshold, a message is pushed to the server for corresponding warning processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of extracting sensitive words in the present invention; Figure 2 It is a flow chart of the early warning method of the present invention. DETAILED DESCRIPTION

[0027] The following specific embodiments are merely explanations of the present invention and are not limitations of the present invention. After reading this specification, those skilled in the art may make modifications to the embodiments without any creative contribution as needed. However, such modifications are protected by the patent law as long as they are within the scope of the claims of the present invention.

[0028] The present invention will be described in detail below with reference to the accompanying drawings by way of embodiments.

[0029] Example 1: Figure 1 The system flow chart is shown. The method for implementing telecommunications fraud includes the following steps: Step 1: Collect telecommunications fraud case data and classify the data types into text, voice, video, image, and network link addresses, specifically: Step 1-1: Identify the suffix of the collected telecommunications fraud case data, and use file extension recognition technology to determine that files ending with "txt" are text files; files ending with "jpg, png, gif, bmp" are image files; files ending with "mp3, wav, ogg" are audio files; files ending with "mp4, avi, mkv" are video files; files that do not meet the above classification standards are classified as other files; Step 1-2: Among the image files, the pyzbar library is used to perform a two-dimensional code recognition technology judgment. The files that meet the two-dimensional code characteristics are the two-dimensional code files, and the rest are still classified as the image files; Step 1-3: Use pyzbar to parse the QR code in the QR code file, obtain the information therein, and use regular expressions to judge the information. The files that start with "http: / / " or "https: / / " and contain "youtube.com" or "vimeo.com" are audio files; the files that start with "http: / / " or "https: / / " and contain content ending in image format ("jpg", "png", "gif", "bmp") are image files; the others are network link addresses; the files that do not start with "http: / / " or "https: / / " are text files; Step 1-4: Among the other files, the URL parsing technology is used to determine that "http, htttps, com, cn" are network connection addresses and are classified as the network connection address files, and the rest are still classified as the other files, as shown in the following table:

[0030] Step 2: Convert the data in text, voice, video, image, and network link address into text, specifically: Step 2-1: The audio file is converted into text using speech recognition ASR technology, for example: 1. First build the following parameters and store them in params as follows: params = { "app_id": app_id, (application ID) "dev_pid": 1537, (Mandarin recognition) "format": "pcm", (pulse code modulation format) "rate": "16000", (audio sampling rate) "token": get_token(api_key, secret_key) (get authorization token function)} 2. Through the audio file path, use the read() method to loop read the audio file content and store it in audio_data: with open(audio_file_path, "r") as f: audio_data = f.read() 3. Send audio_data to the speech recognition platform: request = requests.Request("POST", "https: / / vop.baidu.com / server_api",data=audio_data,params=params) response = requests.Session().send(request.prepare()) 4. Get the recognition data fed back by speech recognition: if response.status_code == 200: result = response.json()["result"]print("Recognition result:", result)else:print("Recognition failed, error code:",response.status_code) Step 2-2: In the image file, use text recognition OCR technology to convert it into text, for example: 1. First build the following parameters and store them in params, and read the image data in the image file path through the read() method, as shown below: params = { "app_id": app_id, (application id) "api_key": api_key, (key) "image": open(picture_file_path, "rb").read()}2. Send params to the text recognition platform for image recognition:response = requests.Request("POST", "https: / / aip.baidu.com / oasis / api / v1 / ocr / text",data=params)3. Get the data returned by the recognition platform:if response.status_code== 200:result = response.json()["words_result"]for word in result:print(word["text"])else:print("Recognition failed, error code:", response.status_code) Step 2-3: In the video file, use the summary search FFmpeg, first take a screenshot and then perform step 2-2 to convert it into text, for example: def extract_frame_from_video(input_video, output_image,time): command= f"ffmpeg -i {input_video} -ss {time} -vframes 1 {output_image}"subprocess.call(command, shell=True)input_video_path = "input_video.mp4" (output video path)output_image_path = "output_image.jpg" (output image path)time_to_extract= "00:01:30" (intercepted at 1 minute and 30 seconds)extract_frame_from_video(input_video_path, output_image_path, time_to_extract)In the above code, a function extract_frame_from_video is defined, which accepts the input video path, output image path and intercepted time point as parameters, and then calls the FFmpeg command line tool to intercept a frame from the video and save it as an image.

[0031] Step 2-4: In the network link address, use the http library to obtain the html information of the website page and convert it into text, for example: folder_path = "your_folder_path_here" (network connection address file path) forfilename in os.listdir(folder_path): file_path = os.path.join(folder_path,filename) if os.path.isfile(file_path): with open(file_path, 'r', encoding='utf-8') as f: url = f.read line().strip() response = requests.get(url) ifresponse.status_code == 200: html_content = response.text print(f"HTMLcontent from {url}:\n{html_content[:500]}...\n") else: print(f"Failed tofetch the page from {url}. Status code: {response.status_code}")

[0032] Step 3: Use the TF-IWF algorithm to analyze text data and build a sensitive vocabulary corpus and early warning model. Specifically: Step 3-1: The word graph scanning algorithm based on the prefix dictionary uses the Jieba word segmentation to perform word segmentation on the text data, for example: “You need to pay a handling fee to recharge, and you can receive the bonus after recharging. Repeat this operation to get more bonuses.” Step 3-1-1: Build a prefix dictionary containing Chinese words and their prefix information, and store them in a Trie tree structure. Each node in the Trie tree represents a character, for example: This Chinese dictionary includes, but is not limited to, words such as "您 (nín)", "需 (xū)", "支付 (zhī fù)", "手续费 (shǒu xù fèi)", "进行 (jìn xíng)", "充值 (chōng zhí)", "领取 (lǐng qǔ)", "奖金 (jiǎng jīn)", "重复 (chóng fù)" and their prefix information. For the word "支付 (zhī fù)", in the Trie tree, starting from the root node, the two character nodes "支 (zhī)" and "付 (fù)" are inserted in sequence, and at the "付 (fù)" node, it is marked that this node represents a complete word. For "手续费 (shǒu xù fèi)", the three character nodes "手 (shǒu)", "续 (xù)", and "费 (fèi)" are inserted in sequence, and at the "费 (fèi)" node, it is marked as a complete word, as well as "充值 (chōng zhí)", "领取 (lǐng qǔ)", "奖金 (jiǎng jīn)", "重复 (chóng fù)".

[0033] Step 3-1-2: Traverse the text data in a loop, convert a set of the text data into a character set to complete the construction of the word graph; Step 3-1-3: Jieba segmentation scans the word graph for the character set, starting from the first character of the character set to match with the prefix dictionary. If the match is successful, mark the path to form a word for forming a complete word; if not successful, re-match from the next character of the character set. For example: Scan "您 (nín)": Check the prefix dictionary, there is a word with "您 (nín)" as the prefix (the word "您 (nín)" itself), mark the path (a specific mark can be added to the node or edge in the word graph), and take "您 (nín)" as the current matching part (which may form a longer word path later); Scan "需 (xū)": Check the prefix dictionary, a word with "您需 (nín xū)" as the prefix is not found, and assume that a word with "需 (xū)" as the prefix is not found under the condition of meeting common word conditions, do not mark the path, and the current matching part starts anew from "需 (xū)"; Scan "支付 (zhī fù)": Check the prefix dictionary, a word with "需支付 (xū zhī fù)" as the prefix is not found, but a word with "支付 (zhī fù)" as the prefix is found, mark the path, update the word graph structure, take "支付 (zhī fù)" as a new node (including the two characters "支 (zhī)" and "付 (fù)", and adjust the connection of relevant edges); Scan "手续费 (shǒu xù fèi)": Check the prefix dictionary, a word with "支付手续费 (zhī fù shǒu xù fèi)" as the prefix is not found, but a word with "手续费 (shǒu xù fèi)" as the prefix is found, mark the path and update the word graph; Scan "进行 (jìn xíng)": Check the prefix dictionary, a word with "手续费进行 (shǒu xù fèi jìn xíng)" as the prefix is not found, and assume that a word with "进行 (jìn xíng)" as the prefix is not found under the condition of meeting common word conditions, do not mark the path; Scan "充值 (chōng zhí)": Check the prefix dictionary, a word with "进行充值 (jìn xíng chōng zhí)" as the prefix is not formed, but a word with "充值 (chōng zhí)" as the prefix is found, mark the path and update the word graph.

[0034] Step 3-1-4: Output the word segmentation result of the text data. For example: After word segmentation, it is shown as: "您 (nín)", "需 (xū)", "支付 (zhī fù)", "手续费 (shǒu xù fèi)", "进行 (jìn xíng)", "充值 (chōng zhí)", "充值后 (chōng zhí hòu)", "可 (kě)", "领取 (lǐng qǔ)", "奖金 (jiǎng jīn)", "重复 (chóng fù)", "此 (cǐ)", "操作 (cāo zuò)", "可 (kě)", "获取 (huò qǔ)", "更多 (gèng duō)", "奖金 (jiǎng jīn)"; Step 3-2: Different weights are assigned to the text data according to the word positions. The weight of the title and keywords is "5", the weight of the first word in the paragraph is "3", and the rest is "1", for example: <you, 1>, <need, 1>, <pay, 1>, <payment, 1>, <conduct, 1>, <recharge, 1>, <after recharge, 1>, <can, 1>, <receive, 1>, <bonus, 1>, <repeat, 1>, <this, 1>, <operation, 1>, <can, 1>, <get, 1>, <more, 1>, <bonus, 1>; Step 3-3: Remove stop words from the text data, count word frequencies, and form<wi, frei, vi> Triples (word, frequency, weight) such as: After removing the stop words <you,1>, <need,1>, <can,1>, and <this,1>, the remaining words are <need,1,1>, <pay,1,1>, <payment,1,1>, <conduct,1,1>, <recharge,2,1>, <after recharge,1,1>, <receive,1,1>, <bonus,2,1>, <repeat,1,1>, <operation,1,1>, <get,1,1>, and <more,1,1>; Step 3-4: Calculate the similarity of the words with a frequency greater than 2 in the triple. When the similarity is higher than 0.85, generate a quadruple<wi,wj,simij,frei+frej> (word 1, word 2, similarity, word frequency sum), remove duplicate words, for example: The similarity between the words "recharge" and "after recharge" is higher than 0.85, generating a four-tuple <recharge, after recharge, 0.85, 3>; the similarity between "bonus" and "more" is higher than 0.85, generating a four-tuple <bonus, more, 0.85, 3>; Step 3-5: Replace the word frequency in the triple with the word frequency of the quadruple to obtain an optimized triple set, for example: <need, 1, 1>, <pay, 1, 1>, <pay and receive, 1, 1>, <conduct, 1, 1>, <recharge, 3, 1>, <receive, 1, 1>, <bonus, 3, 1>, <repeat, 1, 1>, <operate, 1, 1>, <get, 1, 1>, <more, 1, 1>; Step 3-6: Calculate the weight of the words in the triple set by the TF-IWF algorithm. Combine the word frequency (TF) in the current text and the word frequency (IWF) in the corpus. If a word appears frequently in the current text but is extremely uncommon in other texts, its weight will be relatively high, generating an early warning model, for example: Among the words present in the neural network, “recharge”, “bonus”, “payment”, and “handling fee” may have a specific distribution in the fraud document category, so the weight values ​​of <“recharge”, 3>, <“bonus”, 3>, <“payment”, 1>, and <“handling fee”, 1> will be higher; Step 3-6-1: Obtain the vector dimension of the text data according to the length of the text data; Step 3-6-2: Vectorize the triples and input them into the CNN model, and set the label as a fraud case; Step 3-6-3: The CNN model predicts the input data. If the variance between the prediction result and the actual result exceeds the set threshold, it means that the CNN model makes a prediction error. The back propagation algorithm and the stochastic gradient descent algorithm are used to adjust the convolution kernel weights, the pooling window size and step size, and the neuron weights until the variance does not exceed the set threshold. The training is successful to generate the early warning model.

[0035] Step 4: Obtain message data, classify and process the acquired message data into text, and then use the TextRank algorithm to compare it with the sensitive word corpus and early warning model in step 3 to determine whether it is fraudulent data. Specifically: Step 4-1: Obtain user behavior data; Step 4-2: Execute steps 1 to 3 on the user behavior data; Step 4-3: Combined with the neural network, the TextRank algorithm is used to calculate the similarity between the user behavior data and the early warning model data. If it exceeds the set threshold, it is judged as a fraudulent message, for example: The information that the user received, "You can get a bonus by recharging after paying the fee." is extracted and calculated by the TextRank algorithm. The similarity with the sentence "You need to pay the handling fee to recharge, and you can get a bonus after recharging." is greater than 80%, which is determined to be telecommunications fraud; the TextRank algorithm formula is as follows:

[0036] In the formula, Si and Sj represent two sentences respectively, and Wk represents the words in the sentence. The numerator means the number of identical words that appear in both sentences at the same time, and the denominator is the sum of the logarithms of the number of words in the sentence. The denominator is designed in this way to curb the advantage of longer sentences in similarity calculation; Step 5: If the detected message data is fraudulent data, the system will automatically issue a warning message, specifically: Step 5-1: The warning model sends a warning to the message server. The message structure is as follows: class FraudWarningMessage: def __init__(self): (Initialization function, used to create an instance of the FraudWarningMessage class and initialize all member variables.) self.source_app = " (Records which application the message comes from) self.source_user = "" (Records which user end the message comes from, if applicable) self.source_ip = "" (Records the IP address of the message source, if available) self.keywords = [] (Records the keywords involved in the message, stored in list form) self.similarity_value = 0.0 (Records the similarity value between the message and the warning model) self.data_type = "" (Records the data type (such as the type after conversion from text, voice, video, etc.)) self.model_version = "" (Records the version of the warning model) self.training_data_source ="" (Records the source of the training data) self.additional_notes = "" (Records other additional information (which can be expanded according to actual needs), such as explanations of the warning results in special circumstances) Step 5-2: The message service center analyzes the warning information. Warning messages involving bank accounts or finance are handled by account restriction, and the rest are handled by communication blocking.

Claims

1. A telecommunications fraud early warning method, characterized in that: include: Step 1: Collect telecommunications fraud case data and classify the data types into text, voice, video, image, and network link addresses; Step 2: Convert the data in text, voice, video, image, and network link address into text; Step 3: Use the TF-IWF algorithm to analyze text data and establish a sensitive vocabulary corpus and early warning model; Step 4: Obtain user behavior data, classify and textualize the acquired message data, and then use the TextRank algorithm to compare it with the sensitive word corpus and the early warning model in step 3 to determine whether it is fraudulent data; Step 5: If the detected message data is fraudulent data, the system will automatically issue a warning message.

2. A telecommunications fraud early warning method according to claim 1, characterized in that ,The specific method of structured classification in step 1 is: Step 1-1: Identify the suffixes of the collected telecommunications fraud case data, and classify them into text files, image files, audio files, video files, other files, network connection addresses, and QR code files according to the file suffix types; Step 1-2: For the image files classified in step 1-1, the image files that meet the characteristics of the two-dimensional code are classified as the two-dimensional code files, and the rest are still classified as the image files; Step 1-3: Parse the QR code file and classify the data according to the structured classification in step 1-1; Step 1-4: Among the other files, the network address resolution technology is used to determine that the network link address is classified as the network connection address, and the rest are still classified as the other files.

3. A telecommunications fraud early warning method according to claim 2, characterized in that: The specific method of text processing in step 2 is: Step 2-1: The audio file is converted into text using speech recognition technology data; Step 2-2: The image file is converted into text using text recognition technology data; Step 2-3: For the video file, use summary search to first capture the video and then repeat step 2-2 to convert it into text; Step 2-4: The network link address uses the http library to obtain text data.

4. A telecommunications fraud early warning method according to claim 1, characterized in that: The specific method for analyzing the text in step 3 is: Step 3-1: performing word segmentation processing on the text data based on the Jieba word segmentation of the word graph scanning algorithm of the prefix dictionary; Step 3-2: weighting the text data after word segmentation; Step 3-3: remove stop words in the text data, count word frequencies, and form triples; Step 3-4: Calculate similarity for the words in the text data whose frequency exceeds a threshold, and generate quadruplets for the words whose calculation results exceed the threshold; Step 3-5: replacing the triples with the quadruples to form an optimized triple set; Step 3-6: Use the TF-IWF algorithm to calculate the weight value of the triple set and generate an early warning model.

5. A telecommunications fraud early warning method according to claim 4, characterized in that: The step 3-1 comprises the following steps: Step 3-1-1: construct a prefix dictionary containing Chinese words and their prefix information, and store them in a data structure, where each node in the data structure represents a character; Step 3-1-2: loop through the text data, convert a set of the text data into a character set to complete word graph construction; Step 3-1-3: Jieba word segmentation scans the character set, and matches the character set with the prefix dictionary starting from the first character in the character set. If the match is successful, the path is marked to form a word for forming a complete word; if the match is unsuccessful, the next character in the character set is matched again; Step 3-1-4: Output the word segmentation result of the text data.

6. A telecommunications fraud early warning method according to claim 5, characterized in that: The steps 3-6 also include inputting the classified training data into a neural network (CNN) for training, including the following steps: Step 3-6-1: Obtain the vector dimension of the text data according to the length of the text data; Step 3-6-2: Vectorize the triples and input them into the CNN model, and set the label as a fraud case; Step 3-6-3: The CNN model predicts the input data. If the variance between the prediction result and the actual result exceeds the set threshold, it means that the CNN model makes a prediction error. The back propagation algorithm and the stochastic gradient descent algorithm are used to adjust the convolution kernel weights, the pooling window size and step size, and the neuron weights until the variance does not exceed the set threshold. The training is successful to generate the early warning model.

7. A telecommunications fraud early warning method according to claim 1, characterized in that: The TF-IWF algorithm formula in step 3 is: ； The numerator ni,j of the TF part represents the number of times word ti appears in text j, and the denominator represents the sum of all word frequencies in text j. The numerator of the IWF part represents the sum of all word frequencies in the corpus, and nti represents the total frequency of word ti in the corpus. The meaning of the IWF part is to calculate the logarithm of the ratio of the total number of words in the corpus to the number of times the word appears in the corpus in the text to be checked.

8. A telecommunications fraud early warning method according to claim 1, characterized in that: The specific method of determining whether the message is a fraudulent message in step 4 is as follows: Step 4-1: Obtain the user behavior data; Step 4-2: Execute steps 1 to 3 on the user behavior data; Step 4-3: Combined with the neural network, the TextRank algorithm is used to calculate the similarity between the user behavior data and the data in the early warning model. If it exceeds the set threshold, it is judged as a fraudulent message.

9. A telecommunications fraud early warning method according to claim 1, characterized in that: The sentence similarity formula of the TextRank algorithm in step 4 is: ； In the formula, Si and Sj represent two sentences respectively, and Wk represents the words in the sentences. The numerator means the number of identical words that appear in both sentences at the same time, and the denominator is the sum of the logarithms of the number of words in the sentences. This design of the denominator can curb the advantage of longer sentences in similarity calculation.

10. A telecommunications fraud early warning method according to claim 1, characterized in that: The step 5 of early warning information processing specifically includes: Step 5-1: The warning model uses the http protocol to send the warning to the message server; Step 5-2: The message service center uses the http protocol to analyze the warning information. Warning messages involving bank accounts or finance are manipulated by account restrictions, and the rest are manipulated by communication blocking.

Images