Telecommunication fraud detection method and related equipment

Abstract

The invention provides a telecommunication fraud detection method, and the method comprises the steps: obtaining attribute information and historical transfer information provided by a user, and inputting the attribute information and historical transfer information into a telecommunication fraud detection model which comprises a graph attention network and a classification neural network; then, attribute feature vectors are constructed according to the attribute information, a historical transfer relation graph is constructed according to the historical transfer information, and the historical transfer relation graph comprises historical transfer feature vectors; then, according to the attribute feature vector and a historical transfer relation graph, based on a graph attention network, extracting fusion transfer features of the user; and inputting the fused transfer features into a classification neural network to obtain a telecommunication fraud prediction result. According to the method, by analyzing the relevance between the attribute information provided by the user and the historical transfer information, whether the user relates to the telecommunication fraud or not is detected and analyzed from the overall perspective, and the accuracy and efficiency of telecommunication fraud detection are improved; meanwhile, the user information utilized by the method is provided by the user, so that the information acquisition difficulty is reduced.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and in particular to a telecommunications fraud detection method, a telecommunications fraud detection device, a computer device, and a computer-readable storage medium. Background Art

[0002] Telecom fraud refers to the criminal behavior of fabricating false information and setting up scams through telephone, Internet and text messages, and conducting remote and contactless fraud on victims to induce victims to make payments or transfer money. Therefore, it is very important to detect possible telecom fraud in a timely and accurate manner and take active actions to protect the property safety of the people.

[0003] The key link in telecommunications fraud is money transfer. Traditional telecommunications fraud detection methods often analyze the communication process between users and criminals during the money transfer process, such as extracting relevant acoustic features from the tone of voice in the call, or tracking the frequency and location of communication.

[0004] However, this method has a narrow coverage and is difficult to collect information, which makes the efficiency of telecommunications fraud detection low. Summary of the invention

[0005] The present application provides a telecommunications fraud detection method, which is used to solve the problems of greater difficulty in information collection and narrow coverage in related technologies.

[0006] In a first aspect, the present application provides a telecommunications fraud detection method. The method is applied to a telecommunications fraud detection device, and the steps of the method include:

[0007] Acquire attribute information and historical transfer information provided by a user, and input the attribute information and the historical transfer information into a telecommunications fraud detection model, wherein the telecommunications fraud detection model includes a graph attention network and a classification neural network;

[0008] constructing an attribute feature vector according to the attribute information, and constructing a historical transfer relationship graph according to the historical transfer information, wherein the historical transfer relationship graph includes the historical transfer feature vector;

[0009] Extracting the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph;

[0010] The fused transfer features are input into the classification neural network to obtain telecommunication fraud prediction results.

[0011] In some possible implementations, extracting the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph may be performed in the following manner:

[0012] Determining a transfer attention coefficient according to the attribute feature vector and the historical transfer feature vector;

[0013] According to the transfer attention coefficient and the historical transfer relationship graph, the fused transfer features of the user are extracted based on the graph attention network.

[0014] In some possible implementations, the historical transfer relationship graph includes adjacent first user nodes and second user nodes, and extracting the user's fused transfer features based on the graph attention network according to the transfer attention coefficient and the historical transfer relationship graph can be performed in the following manner:

[0015] According to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node, a fused transfer feature of the first user node is extracted based on the graph attention network.

[0016] In some possible implementations, the transfer attention coefficient between the first user node and the second user node includes a shared weight matrix, and the shared weight matrix is ​​a matrix shared by the first user node and the second user node, and the method further includes:

[0017] Determine a plurality of transfer attention coefficients between the first user node and the second user node according to the plurality of shared weight matrices, and determine a target transfer attention coefficient between the first user node and the second user node according to the plurality of transfer attention coefficients;

[0018] At this time, extracting the fused transfer feature of the first user node based on the graph attention network according to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node includes:

[0019] According to the target transfer attention coefficient and the historical transfer feature vector of the second user node, a fused transfer feature of the first user node is extracted based on the graph attention network.

[0020] In some possible implementations, the inputting the fused transfer feature into the classification neural network to obtain a telecommunications fraud prediction result may be performed in the following manner:

[0021] Inputting the fused transfer feature of the first user node into the classification neural network to obtain a predicted value;

[0022] When the predicted value is greater than a threshold, it is determined that the user corresponding to the first user node is involved in telecommunications fraud.

[0023] In some possible implementations, the method further includes:

[0024] If the user is involved in telecommunications fraud, the transfer process involving the user will be stopped.

[0025] In some possible implementations, the method further includes:

[0026] The telecommunications fraud detection model is trained according to historical telecommunications fraud data to obtain a trained telecommunications fraud detection model.

[0027] In a second aspect, the present application provides a telecommunications fraud detection device. The device comprises:

[0028] An acquisition module, used to acquire attribute information and historical transfer information provided by a user, and input the attribute information and the historical transfer information into a telecommunications fraud detection model, wherein the telecommunications fraud detection model includes a graph attention network and a classification neural network;

[0029] An information conversion module, configured to construct an attribute feature vector according to the attribute information, and to construct a historical transfer relationship graph according to the historical transfer information, wherein the historical transfer relationship graph includes the historical transfer feature vector;

[0030] A feature extraction module, configured to extract the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph;

[0031] A prediction module is used to obtain a prediction result according to the fused transfer features input into the classification neural network.

[0032] In some possible implementations, when extracting the fused transfer features of the user based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph, the feature extraction module is specifically used to:

[0033] Determining a transfer attention coefficient according to the attribute feature vector and the historical transfer feature vector;

[0034] According to the transfer attention coefficient and the historical transfer relationship graph, the fused transfer features of the user are extracted based on the graph attention network.

[0035] In some possible implementations, the historical transfer relationship graph includes adjacent first user nodes and second user nodes, and when extracting the fused transfer features of the user based on the graph attention network according to the transfer attention coefficient and the historical transfer relationship graph, the feature extraction module is specifically used to:

[0036] According to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node, a fused transfer feature of the first user node is extracted based on the graph attention network.

[0037] In some possible implementations, the transfer attention coefficient between the first user node and the second user node includes a shared weight matrix, where the shared weight matrix is ​​a matrix shared by the first user node and the second user node, and the feature extraction module in the device is further used to:

[0038] Determine a plurality of transfer attention coefficients between the first user node and the second user node according to the plurality of shared weight matrices, and determine a target transfer attention coefficient between the first user node and the second user node according to the plurality of transfer attention coefficients;

[0039] Under this condition, when extracting the fused transfer feature of the first user node based on the graph attention network according to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node, the feature extraction module is specifically used to:

[0040] According to the target transfer attention coefficient and the historical transfer feature vector of the second user node, a fused transfer feature of the first user node is extracted based on the graph attention network.

[0041] In some possible implementations, when the fused transfer feature is input into the classification neural network to obtain a telecommunications fraud prediction result, the prediction module is specifically used to:

[0042] Inputting the fused transfer feature of the first user node into the classification neural network to obtain a predicted value;

[0043] When the predicted value is greater than a threshold, it is determined that the user corresponding to the first user node is involved in telecommunications fraud.

[0044] In some possible implementations, the device further includes a control module for stopping a transfer process involving the user when the user is involved in telecommunications fraud.

[0045] In some possible implementations, the device further includes a training module for training the telecommunications fraud detection model based on historical telecommunications fraud data to obtain a trained telecommunications fraud detection model.

[0046] In a third aspect, the present application provides a device, wherein the device includes a processor and a memory.

[0047] The processor is used to execute instructions stored in the memory so that the device performs the telecommunications fraud detection method as described in the first aspect or any implementation of the first aspect.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium. The computer-readable storage medium includes instructions, which, when executed on a device, enable the device to execute the telecommunications fraud detection method as described in the first aspect or any implementation of the first aspect.

[0049] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on a device, enables the device to execute the telecommunications fraud detection method described in the first aspect or any one of the implementations of the first aspect.

[0050] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0051] It can be seen from the above technical solutions that the embodiments of the present application have at least the following advantages:

[0052] On the one hand, this method uses the graph attention network to extract and fuse feature information. By deeply analyzing the correlation between the attribute information provided by the user and the historical transfer information, it comprehensively detects and analyzes whether the user is involved in telecommunications fraud from a global perspective, thereby reducing the false detection rate and missed detection rate and improving the efficiency of telecommunications fraud detection. On the other hand, the user information used by this method is all provided by the user during transfers or daily financial activities, which reduces the difficulty of information collection and protects the customer's privacy to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0054] Figure 1 A flowchart of a telecommunications fraud detection method disclosed in an embodiment of the present application;

[0055] Figure 2 A historical transfer relationship diagram disclosed in an embodiment of the present application;

[0056] Figure 3 A schematic diagram of generating fusion features disclosed in an embodiment of the present application;

[0057] Figure 4A schematic diagram of generating fusion features based on a multi-head attention mechanism disclosed in an embodiment of the present application;

[0058] Figure 5 This is a schematic diagram of the structure of a telecommunications fraud detection device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The scheme in the embodiments provided in this application will be described below in conjunction with the drawings in this application.

[0060] The terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to be limiting of the present application. The terms "first" and "second" in the embodiments of the present application are only used for descriptive purposes and cannot be understood as indicating or implying relative importance, operation time sequence, or implicitly indicating the number of indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0061] In order to facilitate understanding of the technical solution of the present application, the background technology involved in the present application is first introduced in detail.

[0062] Telecom fraud refers to the criminal act of remotely inducing victims to make payments or transfers through false information. Since banks conduct behavioral detection on accounts that make large transfers at one time, fraudsters will not use one account to transfer money, but will pass it layer by layer like a tree structure until the amount received by the bottom account is less than 10,000 yuan, and then withdraw cash from the ATM to avoid inspections by relevant agencies. Traditional telecommunications fraud detection methods often analyze the communication process between users and criminals during the transfer process, such as extracting relevant acoustic features from the tone of voice in the call, or tracking the frequency and location of communication. When fraudsters transfer amounts multiple times and in small amounts, traditional telecommunications fraud detection methods will find it difficult to collect relevant communication information. On the other hand, telecommunications fraud comes in various forms, including not only telephone fraud, but also fraud through web pages, WeChat, online games, etc. This method can usually only track information under one contact method at a time, and has a narrow coverage.

[0063] The key link in telecommunications fraud is money transfer. The study and analysis of money transfer behavior is conducive to exploring the internal root causes of money transfer, thereby stopping the fraud process at the money transfer link and protecting the property safety of ordinary users. Among them, ordinary users have many money transfer behaviors in their daily lives, such as small daily living expenses, shopping malls with thousands of yuan, and large transfers to purchase valuables. Each transfer can be directly or indirectly related to the user, but it is difficult to find effective correlation with the transfer of fraudsters.

[0064] In view of this, the present application provides a telecommunications fraud detection method. The method comprises:

[0065] The telecommunications fraud detection device obtains attribute information and historical transfer information provided by the user, and inputs the attribute information and historical transfer information into a telecommunications fraud detection model, which includes a graph attention network and a classification neural network. Then, an attribute feature vector is constructed based on the attribute information, and a historical transfer relationship graph is constructed based on the historical transfer information, wherein the historical transfer relationship graph includes a historical transfer feature vector. Next, based on the attribute feature vector and the historical transfer relationship graph, the user's fused transfer features are extracted based on the graph attention network. Finally, the fused transfer features are input into the classification neural network to obtain a telecommunications fraud prediction result.

[0066] On the one hand, this method uses the graph attention network to extract and fuse feature information. By deeply analyzing the correlation between the attribute information provided by the user and the historical transfer information, it comprehensively detects and analyzes whether the user is involved in telecommunications fraud from a global perspective, thereby reducing the false detection rate and missed detection rate and improving the efficiency of telecommunications fraud detection. On the other hand, the user information used by this method is all provided by the user during transfers or daily financial activities, which reduces the difficulty of information collection and protects the customer's privacy to the greatest extent.

[0067] Next, the telecommunications fraud detection method provided in the embodiment of the present application will be introduced in conjunction with the accompanying drawings.

[0068] See also Figure 1 This is a flow chart of a telecommunications fraud detection method disclosed in an embodiment of the present application, the method comprising:

[0069] S102: Obtain attribute information and historical transfer information provided by the user, and input the attribute information and historical transfer information into a telecommunications fraud detection model, which includes a graph attention network and a classification neural network.

[0070] When users register to open a bank account or use their account to invest, consume, and other activities, they will provide basic attribute information, such as name, account number, contact number, age, name, amount, and quantity of financial products, fund products, insurance products, and other consumer goods purchased. When users transfer money through their accounts, banks can also record the transfer information provided by users, such as the time, amount, initiator, and recipient of the transfer. At the same time, banks can also obtain the relationship between this transfer and the last collection based on historical transfer information, such as the time since the last collection and the amount compared to the last collection.

[0071] Then, the telecommunications fraud detection device can input the acquired attribute information and historical transfer information into a telecommunications fraud detection model, wherein the telecommunications fraud detection model includes a graph attention network and a classification neural network.

[0072] Graph Attention Network (GAT) is a neural network model for processing graph structured data. It captures the structural information of the graph and the relationship between nodes by introducing the attention mechanism to perform weighted summation on the nodes in the graph. Among them, the attention mechanism is a technology that simulates the "attention" phenomenon in the human visual system. It enables the model to automatically select and focus on the features most relevant to the current task by weighted processing of the input data, thereby improving the performance and effect of the model. The core of the attention mechanism is to calculate the weight of each element in the input sequence. These weights determine the degree of importance the model attaches to each element when generating the output. In this way, GAT can highlight the important nodes and edges in the graph by learning the attention weights between nodes.

[0073] S104: constructing an attribute feature vector according to the attribute information, and constructing a historical transfer relationship graph according to the historical transfer information.

[0074] In deep learning algorithms, data needs to be converted from other formats into character data in order to be recognizable.

[0075] For example, for categorical attribute data, one-hot encoding can be used for format conversion. One-hot encoding can assign a unique binary vector to each data in other formats, with one bit of the binary vector set to 1 and the rest to 0. For text data, natural language processing technology can be used to convert it into a numerical vector, such as using Word2vec technology for format conversion. In a possible implementation, the converted vector data also needs to be normalized to make data of different dimensions comparable.

[0076] like Figure 2 As shown, each user node in the historical transfer relationship graph corresponds to one or a group of users, and there is a transfer relationship between adjacent user nodes. The historical transfer relationship graph includes historical transfer feature vectors corresponding to each user node, wherein the historical transfer feature vectors are converted based on the acquired historical transfer information through the above method.

[0077] S106: According to the attribute feature vector and the historical transfer relationship graph, the user's fused transfer features are extracted based on the graph attention network.

[0078] In the graph attention network, the most important part is the graph attention layer, and the entire GAT structure is a stack of this layer.

[0079] In this layer, the input is a set of node features, where N is the number of nodes and F is the number of node features:

[0080]

[0081] The output is a new set of node features, where N is the number of nodes and F' is the number of new node features:

[0082]

[0083] That is, after passing through the graph attention layer, the original node information h is updated to h'. In order to enable the network to extract deeper information from the original input, generally speaking, F'>F, that is, the graph attention layer is a network that increases the dimension of the signal.

[0084] When the telecommunications fraud detection model obtains the attribute feature vector, the historical transfer relationship graph and the historical transfer vector, it can obtain the fused transfer feature information based on the structure, attribute feature vector and historical transfer vector in the historical transfer relationship graph and the graph attention mechanism. The fused transfer feature information will contain more detailed information than the attribute feature vector and the historical transfer vector, respectively.

[0085] Specifically, for each user node in the historical transfer relationship graph, a shared weight matrix is ​​configured W∈R F×F ', and use the self-attention mechanism for each user node to calculate the attention coefficient between every two adjacent user nodes. Among them, the transfer attention coefficient is related to the information of the initiating user, the receiving user and the transfer itself, so the transfer attention coefficient between two user nodes can be obtained as follows:

[0086]

[0087] in represents the attribute feature vector of user i, represents the transfer feature vector from user i to user j, represents the attribute feature vector of user j, W represents the shared weight matrix, and a represents a weight matrix.

[0088] In some possible implementations, in order to facilitate the calculation and comparison of coefficients between different nodes, the attention coefficients obtained by the above formula can be normalized, for example, using a softmax function:

[0089]

[0090] In GAT, the attention mechanism uses a single-layer feedforward neural network with a weight of a∈R 2F', which can use an activation function and concatenate the feature vectors of nodes i and j and the transfer feature vector. For example, the nonlinear activation function LeakyRelu can be used. At this time, the refined formula of the entire attention mechanism is expressed as:

[0091]

[0092] like Figure 3 As shown in the figure, for each user node in the historical transfer graph structure, the feature information contained in all adjacent nodes can be aggregated to generate fusion features. Specifically, the formula can be:

[0093]

[0094] Wherein, σ is an activation function, and the embodiment of the present application does not limit the selection of the activation function.

[0095] In some possible implementations, the shared weight matrix included in the transfer attention coefficient can select different values ​​for adaptively extracting multiple features in the transfer. In this way, a multi-head attention mechanism can be introduced to more accurately extract fusion features.

[0096] Specifically, Figure 4 As shown in the figure, this method first calculates the fused feature representation of the user node under each independent attention mechanism, and then weights and splices the independent attention outputs together:

[0097]

[0098] Among them, K = 1, 2, 3...k, represents multiple independent attention mechanisms, is the attention coefficient between two adjacent user nodes under an attention mechanism.

[0099] S108: Input the integrated transfer features into the classification neural network to obtain the telecommunications fraud prediction results.

[0100] After obtaining the integrated transfer features, the telecommunications fraud prediction device can input the integrated transfer features of the user node into the classification neural network to obtain a prediction value, and determine whether the user is involved in fraud based on the prediction value.

[0101] Specifically, taking the fusion feature of the first user node as an example, the telecommunications fraud prediction device can input the fusion transfer feature of the first user node into the classification neural network. For example, the telecommunications fraud prediction device can use the sigmoid function to classify the fusion transfer information and output a prediction value. When the prediction value is greater than the threshold, it can be determined that the user corresponding to the first user node is involved in telecommunications fraud.

[0102] In this way, the method uses the graph attention network to extract fusion feature information, and through in-depth analysis of the correlation between the attribute information provided by the user and the historical transfer information, comprehensively detects and analyzes whether the user is involved in telecommunications fraud from a global perspective, reducing the false detection rate and missed detection rate, and improving the efficiency of telecommunications fraud detection. For example, the method can identify transfers by ordinary users that have little correlation with historical transfer features as telecommunications fraud and mark the users. Alternatively, the method can also mine the technical characteristics of transfers between telecommunications fraudsters. For example, for accounts that have been marked as telecommunications fraudsters, the GAT network is used to mine the correlation between the transfer and the last collection, such as the time since the last collection, the amount of the last collection, etc., and transfers with a high correlation will be identified as involving telecommunications fraud.

[0103] In some possible implementations, if a user is found to be involved in telecommunications fraud, the telecommunications fraud prediction device may issue an alarm to stop the transfer process involving the user. For example, the telecommunications fraud prediction device may include a control module to directly intervene in the transfer process involving the user, or the telecommunications fraud prediction device may also send an alarm message to other devices used to intervene in the transfer process through a communication module.

[0104] In some possible implementations, the telecommunications fraud prediction device may also include a training module for training the telecommunications fraud detection model based on historical telecommunications fraud data to obtain a trained telecommunications fraud detection model. For example, the loss value of the prediction result can be determined based on the bank's existing transfer data and telecommunications fraud data, for example, using a cross entropy loss function. Then, the weights of the model are updated according to an optimization method, for example, using an adaptive moment estimation algorithm (Adaptive Moment Estimation, Adam), a stochastic gradient descent (Stochastic Gradient Descent, SGD), a particle swarm optimization algorithm (Particle Swarm Optimization, PSO), and the like.

[0105] Based on the above description, the embodiment of the present application provides a method for predicting telecommunications fraud. On the one hand, the method uses a graph attention network to extract fusion feature information, and through in-depth analysis of the correlation between the attribute information provided by the user and the historical transfer information, comprehensively detects and analyzes whether the user is involved in telecommunications fraud from a global perspective, reducing the false detection rate and missed detection rate, and improving the efficiency of telecommunications fraud detection; on the other hand, the user information used by the method is provided by the user during the transfer or daily financial activities, which reduces the difficulty of information collection and protects the privacy of customers to the greatest extent.

[0106] The above is a detailed introduction to the telecommunications fraud detection method provided in the embodiment of the present application. Next, the telecommunications fraud detection device and equipment provided in the embodiment of the present application will be introduced in conjunction with the accompanying drawings.

[0107] See also Figure 5 A telecommunications fraud detection device 500 is shown. The device comprises:

[0108] An acquisition module 502 is used to acquire attribute information and historical transfer information provided by a user, and input the attribute information and historical transfer information into a telecommunications fraud detection model, wherein the telecommunications fraud detection model includes a graph attention network and a classification neural network;

[0109] An information conversion module 504 is used to construct an attribute feature vector according to the attribute information, and to construct a historical transfer relationship graph according to the historical transfer information, wherein the historical transfer relationship graph includes the historical transfer feature vector;

[0110] A feature extraction module 506 is used to extract the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph;

[0111] The prediction module 508 is used to obtain a prediction result according to the fused transfer features input into the classification neural network.

[0112] In some possible implementations, when extracting the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph, the feature extraction module 506 is specifically used to:

[0113] Determine the transfer attention coefficient based on the attribute feature vector and the historical transfer feature vector;

[0114] According to the transfer attention coefficient and the historical transfer relationship graph, the user's fused transfer features are extracted based on the graph attention network.

[0115] In some possible implementations, the historical transfer relationship graph includes adjacent first user nodes and second user nodes. When extracting the user's fused transfer features based on the graph attention network according to the transfer attention coefficient and the historical transfer relationship graph, the feature extraction module 506 is specifically used to:

[0116] According to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node, a fused transfer feature of the first user node is extracted based on the graph attention network.

[0117] In some possible implementations, the transfer attention coefficient between the first user node and the second user node includes a shared weight matrix, where the shared weight matrix is ​​a matrix shared by the first user node and the second user node, and the feature extraction module 506 in the device is further used to:

[0118] Determine a plurality of transfer attention coefficients between a first user node and a second user node according to a plurality of shared weight matrices, and determine a target transfer attention coefficient between the first user node and the second user node according to the plurality of transfer attention coefficients;

[0119] Under this condition, when extracting the fused transfer feature of the first user node based on the graph attention network according to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node, the feature extraction module 506 is specifically used to:

[0120] According to the target transfer attention coefficient and the historical transfer feature vector of the second user node, the fused transfer feature of the first user node is extracted based on the graph attention network.

[0121] In some possible implementations, when obtaining a prediction result based on the fused transfer features of the input classification neural network, the prediction module 508 is specifically used to:

[0122] Obtaining a prediction value according to the fused transfer feature of the first user node input into the classification neural network;

[0123] When the predicted value is greater than the threshold, it is determined that the user corresponding to the first user node is involved in telecommunications fraud.

[0124] In some possible implementations, the device also includes a control module for stopping the transfer process involving the user when the user is involved in telecommunications fraud.

[0125] In some possible implementations, the device also includes a training module for training a telecommunications fraud detection model based on historical telecommunications fraud data to obtain a trained telecommunications fraud detection model.

[0126] The present application provides a device for implementing a telecommunications fraud detection method. The device includes a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory so that the device executes the telecommunications fraud detection method.

[0127] The present application provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a device, the device executes the above-mentioned telecommunications fraud detection method.

[0128] The present application provides a computer program product containing instructions, which, when executed on a device, enables the device to execute the above-mentioned telecommunications fraud detection method.

[0129] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0130] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0131] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0132] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0133] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A telecommunications fraud detection method, characterized in that: The method comprises: Acquire attribute information and historical transfer information provided by a user, and input the attribute information and the historical transfer information into a telecommunications fraud detection model, wherein the telecommunications fraud detection model includes a graph attention network and a classification neural network; constructing an attribute feature vector according to the attribute information, and constructing a historical transfer relationship graph according to the historical transfer information, wherein the historical transfer relationship graph includes the historical transfer feature vector; Extracting the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph; The fused transfer features are input into the classification neural network to obtain telecommunication fraud prediction results.

2. The method according to claim 1, characterized in that The extracting the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph includes: Determining a transfer attention coefficient according to the attribute feature vector and the historical transfer feature vector; According to the transfer attention coefficient and the historical transfer relationship graph, the fused transfer features of the user are extracted based on the graph attention network.

3. The method according to claim 2, characterized in that The historical transfer relationship graph includes adjacent first user nodes and second user nodes, and extracting the user's fused transfer features based on the graph attention network according to the transfer attention coefficient and the historical transfer relationship graph includes: According to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node, a fused transfer feature of the first user node is extracted based on the graph attention network.

4. The method according to claim 3, characterized in that The transfer attention coefficient between the first user node and the second user node includes a shared weight matrix, and the shared weight matrix is ​​a matrix shared by the first user node and the second user node. The method further includes: Determine a plurality of transfer attention coefficients between the first user node and the second user node according to the plurality of shared weight matrices, and determine a target transfer attention coefficient between the first user node and the second user node according to the plurality of transfer attention coefficients; The extracting the fused transfer feature of the first user node based on the graph attention network according to the transfer attention coefficient between the first user node and the second user node and the historical transfer feature vector of the second user node includes: According to the target transfer attention coefficient and the historical transfer feature vector of the second user node, a fused transfer feature of the first user node is extracted based on the graph attention network.

5. The method according to claim 3, characterized in that: The step of inputting the fused transfer feature into the classification neural network to obtain a telecommunications fraud prediction result includes: Inputting the fused transfer feature of the first user node into the classification neural network to obtain a predicted value; When the predicted value is greater than a threshold, it is determined that the user corresponding to the first user node is involved in telecommunications fraud.

6. The method according to claim 5, characterized in that The method further comprises: If the user is involved in telecommunications fraud, the transfer process involving the user will be stopped.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: The telecommunications fraud detection model is trained according to historical telecommunications fraud data to obtain a trained telecommunications fraud detection model.

8. A telecommunications fraud detection device, characterized in that: The device comprises: An acquisition module, used to acquire attribute information and historical transfer information provided by a user, and input the attribute information and the historical transfer information into a telecommunications fraud detection model, wherein the telecommunications fraud detection model includes a graph attention network and a classification neural network; An information conversion module, configured to construct an attribute feature vector according to the attribute information, and to construct a historical transfer relationship graph according to the historical transfer information, wherein the historical transfer relationship graph includes the historical transfer feature vector; A feature extraction module, configured to extract the user's fused transfer features based on the graph attention network according to the attribute feature vector and the historical transfer relationship graph; A prediction module is used to obtain a prediction result according to the fused transfer features input into the classification neural network.

9. A computer device, characterized in that: The computer equipment comprises: Memory for storing computer programs or computer instructions; A processor, configured to execute a computer program or computer instruction stored in the memory, so that the computer device executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is executed, it is used to implement the method according to any one of claims 1 to 7.

Images