Fraud identification method and device, electronic equipment and medium

Abstract

The embodiment of the invention provides a fraud recognition method and device, electronic equipment and a medium, and relates to the technical field of computers. The method comprises the following steps: acquiring behavior data of a target user in multiple dimensions in a target time period, wherein the behavior data comprises historical communication behavior data and / or historical social media data; extracting time sequence analysis features, text mining features and / or social relation network features of the historical communication behavior data and the historical social media data; obtaining a preset fraud recognition model, wherein the preset fraud recognition model comprises a plurality of base classifiers, a data converter and a meta classifier; respectively inputting the feature data as input data into a plurality of base classifiers, and acquiring output data of the plurality of base classifiers; inputting the output data of the plurality of base classifiers into a data converter for conversion to obtain second feature data; and inputting the second feature data into the meta classifier, and outputting a fraud recognition result. According to the method, the user is identified through the behavior data of multiple dimensions, and the accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a fraud identification method, device, electronic equipment and medium. Background Art

[0002] With the rapid development of telecommunications technology, communication networks have become an indispensable part of people's daily lives and work. Some people use this as a channel to commit fraud, such as through phone calls, text messages, social media, etc. Traditional methods of identifying fraud mainly rely on the following methods: (1) Identification using rule-based systems: This type of system relies on a set of predefined rules to identify fraudulent behavior. These rules may include specific phone numbers, keywords, or text message content. However, once the fraudster changes his strategy, these rules will become invalid; (2) Blacklist: The blacklist records known fraudster information such as phone numbers. Although this method can block known fraudsters, it cannot identify new or unknown fraud sources; (3) Manual monitoring: In some industries involving high-risk transactions, manual monitoring may be used to identify fraudulent behavior. This method requires high manpower costs and is inefficient. Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present invention provide a fraud identification method, device, electronic device and medium.

[0004] In a first aspect, an embodiment of the present invention provides a fraud identification method, comprising:

[0005] Acquire behavior data of multiple dimensions of a target user within a target time period, wherein the behavior data of multiple dimensions include historical communication behavior data and / or historical social media data;

[0006] Extracting first feature data of the historical communication behavior data and the historical social media data, wherein the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features;

[0007] Obtaining a preset fraud identification model, wherein the fraud identification model includes a plurality of base classifiers, a data converter, and a meta classifier;

[0008] The feature data is respectively input as input data into the multiple base classifiers to obtain output data of the multiple base classifiers; the output data of the multiple base classifiers is input into the data converter for conversion to obtain second feature data; the second feature data is input into the meta classifier to output a fraud identification result.

[0009] Optionally, the time series analysis characteristics include distribution characteristics;

[0010] The extracting of the first characteristic data of the historical communication behavior data and the historical social media data includes: calculating the daily change rate sequence corresponding to the historical communication behavior data based on the daily usage included in the historical communication behavior data, and using the daily change rate sequence corresponding to the historical communication behavior data as the distribution feature corresponding to the historical communication behavior data; calculating the daily change rate sequence corresponding to the historical social media data based on the daily usage included in the historical social media data, and using the daily change rate sequence corresponding to the historical social media data as the distribution feature corresponding to the historical social media data.

[0011] Optionally, the time series analysis feature includes a periodic feature;

[0012] The extracting of the first characteristic data of the historical communication behavior data and the historical social media data includes: calculating the mean value and standard deviation corresponding to the historical communication behavior data according to the daily usage included in the historical communication behavior data; calculating the coefficient of variation corresponding to the historical communication behavior data according to the mean value and standard deviation corresponding to the historical communication behavior data, and using the coefficient of variation corresponding to the historical communication behavior data as the periodic characteristic corresponding to the historical communication behavior data; calculating the mean value and standard deviation corresponding to the historical social media data according to the daily usage included in the historical social media data; calculating the coefficient of variation corresponding to the historical social media data according to the mean value and standard deviation corresponding to the historical social media data, and using the coefficient of variation corresponding to the historical social media data as the periodic characteristic corresponding to the historical social media data.

[0013] Optionally, the historical communication behavior data includes the number of daily calls and the number of daily text messages;

[0014] The distribution characteristics of the historical communication behavior data are extracted according to the following process: based on the daily number of calls, a first daily change rate sequence corresponding to the number of calls within the target time period is determined, and the first daily change sequence is used as the distribution characteristics corresponding to the number of calls; based on the daily number of text messages, a second daily change sequence corresponding to the number of text messages within the target time period is determined, and the second daily change sequence is used as the distribution characteristics corresponding to the number of text messages.

[0015] Optionally, the periodic characteristics of the historical communication behavior data are extracted according to the following process: based on the daily number of calls, determine a first mean value and a first standard deviation corresponding to the number of calls within the target time period, calculate a first coefficient of variation based on the first mean value and the first standard deviation, and use the first coefficient of variation as the periodic characteristics corresponding to the number of calls; based on the daily number of text messages, determine a second mean value and a second standard deviation corresponding to the number of text messages within the target time period, calculate a second coefficient of variation based on the second mean value and the second standard deviation, and use the second coefficient of variation as the periodic characteristics corresponding to the number of text messages.

[0016] Optionally, the historical social media data includes: daily usage frequency of a specified application and daily click-through rate of a specified website;

[0017] The distribution characteristics of the historical social media data are extracted according to the following process: based on the daily usage frequency of the designated application, a third daily change rate sequence corresponding to the usage frequency of the designated application within the target time period is determined, and the third daily change sequence is used as the distribution characteristic corresponding to the usage frequency of the designated application; based on the daily click-through rate of the designated website, a fourth daily change sequence corresponding to the click-through rate of the designated website within the target time period is determined, and the fourth daily change sequence is used as the distribution characteristic corresponding to the click-through rate of the designated website.

[0018] Optionally, the periodic features of the historical social media data are extracted according to the following process:

[0019] Based on the daily usage frequency of the designated application, determine the third mean value and the third standard deviation corresponding to the usage frequency of the designated application within the target time period, calculate the third coefficient of variation based on the third mean value and the third standard deviation, and use the third coefficient of variation as the periodic feature corresponding to the daily usage frequency of the designated application; based on the daily click-through rate of the designated website, determine the fourth mean value and the fourth standard deviation corresponding to the click-through rate of the designated website within the target time period, calculate the fourth coefficient of variation based on the fourth mean value and the fourth standard deviation, and use the fourth coefficient of variation as the periodic feature corresponding to the click-through rate of the designated website.

[0020] Optionally, the historical social media data includes text data published by the target user in a designated application; the text mining features include text sentiment tendency and keywords;

[0021] The text mining features of the historical social media data are extracted according to the following process: the text data posted by the target user in the designated application is input into a first language model as input data to obtain the text sentiment tendency output by the first language model; the text data posted by the target user in the designated application is input into a second language model as input data to obtain the keywords output by the second language model.

[0022] Optionally, the extracting of the first feature data of the historical communication behavior data and the historical social media data includes: constructing at least one social network based on the historical communication behavior data and the historical social media data; the social network uses users as nodes and relationships between users as edges; calculating the centrality of the target user in the social network, and using the centrality as a social relationship network feature corresponding to the target user.

[0023] Optionally, the method also includes: when the fraud identification result determines that the target user is a suspected fraudster, matching the target user with a known fraud network based on the historical communication behavior data and the historical social media data to determine whether the target user belongs to the known fraud network.

[0024] Optionally, the method further includes: when the fraud identification result determines that the target user is a suspected fraudster, blocking the communication link of the target user and sending an early warning notification to the called user corresponding to the target user.

[0025] Optionally, the method also includes: when the fraud identification result is to determine that the target user is not a fraudster, constructing a behavior pattern of the target user based on the historical communication behavior data and the historical social media data; obtaining the target user's current communication behavior data and current social media data in real time, and determining whether the current communication behavior data and current social media data are consistent with the target user's behavior pattern, so as to identify whether the target user is a suspected fraudster.

[0026] In a second aspect, an embodiment of the present invention provides a fraud identification device, comprising:

[0027] A data acquisition module, used to acquire behavior data of multiple dimensions of a target user within a target time period, wherein the behavior data of multiple dimensions include historical communication behavior data and / or historical social media data;

[0028] A feature extraction module, used to extract first feature data of the historical communication behavior data and the historical social media data, wherein the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features;

[0029] A model acquisition module, used to acquire a preset fraud identification model, wherein the fraud identification model includes a plurality of base classifiers, a data converter and a meta classifier;

[0030] The identification module is used to input the feature data as input data into the multiple base classifiers respectively to obtain output data of the multiple base classifiers; input the output data of the multiple base classifiers into the data converter for conversion to obtain second feature data; input the second feature data into the meta classifier to output a fraud identification result.

[0031] Optionally, the time series analysis characteristics include distribution characteristics;

[0032] The feature extraction module is used to: calculate the daily change rate sequence corresponding to the historical communication behavior data based on the daily usage included in the historical communication behavior data, and use the daily change rate sequence corresponding to the historical communication behavior data as the distribution feature corresponding to the historical communication behavior data; calculate the daily change rate sequence corresponding to the historical social media data based on the daily usage included in the historical social media data, and use the daily change rate sequence corresponding to the historical social media data as the distribution feature corresponding to the historical social media data.

[0033] Optionally, the time series analysis feature includes a periodic feature;

[0034] The feature extraction module is used to: calculate the mean value and standard deviation corresponding to the historical communication behavior data based on the daily usage included in the historical communication behavior data; calculate the coefficient of variation corresponding to the historical communication behavior data based on the mean value and standard deviation corresponding to the historical communication behavior data, and use the coefficient of variation corresponding to the historical communication behavior data as the periodic feature corresponding to the historical communication behavior data; calculate the mean value and standard deviation corresponding to the historical social media data based on the daily usage included in the historical social media data; calculate the coefficient of variation corresponding to the historical social media data based on the mean value and standard deviation corresponding to the historical social media data, and use the coefficient of variation corresponding to the historical social media data as the periodic feature corresponding to the historical social media data.

[0035] Optionally, the historical communication behavior data includes the number of daily calls and the number of daily text messages;

[0036] The feature extraction module is used to: determine, based on the daily number of calls, a first daily change rate sequence corresponding to the number of calls within the target time period, and use the first daily change sequence as the distribution feature corresponding to the number of calls; determine, based on the daily number of text messages, a second daily change sequence corresponding to the number of text messages within the target time period, and use the second daily change sequence as the distribution feature corresponding to the number of text messages.

[0037] Optionally, the feature extraction module is used to: determine a first mean value and a first standard deviation corresponding to the number of calls within the target time period based on the daily number of calls, calculate a first coefficient of variation based on the first mean value and the first standard deviation, and use the first coefficient of variation as the periodic feature corresponding to the number of calls; determine a second mean value and a second standard deviation corresponding to the number of text messages within the target time period based on the daily number of text messages, calculate a second coefficient of variation based on the second mean value and the second standard deviation, and use the second coefficient of variation as the periodic feature corresponding to the number of text messages.

[0038] Optionally, the historical social media data includes: daily usage frequency of a specified application and daily click-through rate of a specified website;

[0039] The feature extraction module is used to: determine the third daily change rate sequence corresponding to the designated application usage frequency within the target time period based on the daily usage frequency of the designated application, and use the third daily change sequence as the distribution feature corresponding to the designated application usage frequency; determine the fourth daily change sequence corresponding to the designated website click rate within the target time period based on the daily click rate of the designated website, and use the fourth daily change sequence as the distribution feature corresponding to the designated website click rate.

[0040] Optionally, the feature extraction module is used to: determine a third mean value and a third standard deviation corresponding to the frequency of use of the designated application within the target time period based on the daily frequency of use of the designated application, calculate a third coefficient of variation based on the third mean value and the third standard deviation, and use the third coefficient of variation as the periodic feature corresponding to the daily frequency of use of the designated application; determine a fourth mean value and a fourth standard deviation corresponding to the click-through rate of the designated website within the target time period based on the daily click-through rate of the designated website, calculate a fourth coefficient of variation based on the fourth mean value and the fourth standard deviation, and use the fourth coefficient of variation as the periodic feature corresponding to the click-through rate of the designated website.

[0041] Optionally, the historical social media data includes text data published by the target user in a designated application; the text mining features include text sentiment tendency and keywords;

[0042] The feature extraction module is used to: input the text data published by the target user in the designated application as input data into a first language model to obtain the text sentiment tendency output by the first language model; input the text data published by the target user in the designated application as input data into a second language model to obtain the keywords output by the second language model.

[0043] Optionally, the feature extraction module is used to: construct at least one social network based on the historical communication behavior data and the historical social media data; the social network uses users as nodes and the relationships between users as edges; calculate the centrality of the target user in the social network, and use the centrality as the social relationship network feature corresponding to the target user.

[0044] Optionally, the device also includes a network matching module, which is used to: when the fraud identification result is that the target user is determined to be a suspected fraudster, match the target user with a known fraud network based on the historical communication behavior data and the historical social media data to determine whether the target user belongs to the known fraud network.

[0045] Optionally, the device also includes an early warning module, which is used to: when the fraud identification result determines that the target user is a suspected fraudster, block the communication link of the target user and send an early warning notification to the called user corresponding to the target user.

[0046] Optionally, the device also includes a pattern recognition module, which is used to: when the fraud identification result is that the target user is determined to be a non-fraudster, construct a behavior pattern of the target user based on the historical communication behavior data and the historical social media data; obtain the target user's current communication behavior data and current social media data in real time, and determine whether the current communication behavior data and current social media data are consistent with the target user's behavior pattern, so as to identify whether the target user is a suspected fraudster.

[0047] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement the fraud identification method provided by the embodiment of the present invention when executing the program stored in the memory.

[0048] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the fraud identification method provided by an embodiment of the present invention.

[0049] The technical solution provided by the embodiment of the present invention brings at least the following beneficial effects:

[0050] The fraud identification method provided by the embodiment of the present invention extracts the time series analysis features, text mining features and social relationship network features of the historical communication behavior data and / or historical social media data of the target user in the target time period, and inputs the feature data as input data into multiple base classifiers of the fraud identification model to obtain the output data of the multiple base classifiers; the output data of the multiple base classifiers are input into the data converter of the fraud identification model for conversion to obtain the second feature data; the second feature data is input into the meta classifier of the fraud identification model to obtain the fraud identification result. The method can provide a more comprehensive perspective to analyze and identify fraudulent behavior by collecting data from multiple channels, including call records, text message content and social network interaction data; the first feature data is analyzed by multiple base classifiers, data converters and meta classifiers, which improves the accuracy compared with the traditional single model fraud identification method. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0052] Figure 1 A schematic diagram showing a flow chart of a fraud identification method according to an embodiment of the present invention;

[0053] Figure 2 A schematic diagram showing a flow chart of a fraud identification method according to another embodiment of the present invention;

[0054] Figure 3 A schematic diagram showing a flow chart of a fraud identification method according to another embodiment of the present invention;

[0055] Figure 4 A schematic diagram showing the structure of a fraud identification device according to an embodiment of the present invention is shown;

[0056] Figure 5 A schematic structural diagram of an electronic device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0057] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0058] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0059] Figure 1 FIG. 1 is a flow chart showing a fraud identification method provided by an embodiment of the present invention. Figure 1 As shown, the method includes:

[0060] Step S101: acquiring behavior data of multiple dimensions of a target user within a target time period, where the behavior data of multiple dimensions include historical communication behavior data and / or historical social media data.

[0061] In this step, the user's behavior data is collected from multiple channels (such as telephone networks, SMS platforms, social media), such as communication behavior data (such as call records, SMS records, etc., call records can include the districts and counties of the caller and the called party, call duration, average daily call duration, number of calls, average daily number of calls, card activation time, number of short-time callbacks, etc.) and social media data (such as published and shared content, comments and replies, follow lists, usage data of designated applications, click-through rates of designated websites, etc.). In an optional embodiment, the target user's device information, such as device type, operating system, and location data, can be obtained, and relevant data of third parties, such as transaction alerts and abnormal notifications of financial institutions, can also be obtained.

[0062] In an optional embodiment, after collecting the historical communication behavior data and / or historical social media data of the target user, the collected data is cleaned (e.g., processing missing values ​​and erroneous data), denoised, and standardized (e.g., normalizing call duration, average daily call duration, number of calls, average daily number of calls, and number of short-time callbacks to a normal distribution, and performing hot-single encoding on the corresponding counties) to improve data quality.

[0063] Step S102: extracting first feature data of historical communication behavior data and historical social media data, where the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features.

[0064] Among them, time series analysis features include distribution features and periodic features. For distribution features, by statistically analyzing the trend of data changes over a period of time, the concentration or dispersion of data in different time periods can be identified. For example, in fraud identification, the number of calls and text messages per day can be calculated to determine the change patterns of these indicators over time and derive distribution features. For periodic features, the periodic changes of data are analyzed, such as fixed patterns on a weekly or monthly basis. For example, some fraudulent activities may occur more frequently on specific weekdays or holidays. Through the sliding window method, a fixed-length window can be moved on the time series, and statistical data within each window can be calculated to identify periodic changes.

[0065] In an optional embodiment, the distribution characteristics and periodic characteristics of the historical communication behavior data and the historical social media data may be extracted according to the following process:

[0066] According to the daily usage conditions (e.g., the number of daily calls and the number of daily text messages) included in the historical communication behavior data, a daily change rate sequence corresponding to the historical communication behavior data is calculated, and the daily change rate sequence corresponding to the historical communication behavior data is used as a distribution feature corresponding to the historical communication behavior data;

[0067] According to the daily usage included in the historical communication behavior data, the average value and standard deviation corresponding to the historical communication behavior data are calculated; according to the average value and standard deviation corresponding to the historical communication behavior data, the coefficient of variation corresponding to the historical communication behavior data is calculated, and the coefficient of variation corresponding to the historical communication behavior data is used as the periodic feature corresponding to the historical communication behavior data;

[0068] According to the daily usage conditions included in the historical social media data (such as the daily usage frequency of a specified application and the daily click rate of a specified website), a daily change rate sequence corresponding to the historical social media data is calculated, and the daily change rate sequence corresponding to the historical social media data is used as a distribution feature corresponding to the historical social media data;

[0069] Based on the daily usage included in the historical social media data, the mean and standard deviation corresponding to the historical social media data are calculated. Based on the mean and standard deviation corresponding to the historical social media data, the coefficient of variation corresponding to the historical social media data is calculated, and the coefficient of variation corresponding to the historical social media data is used as the periodic feature corresponding to the historical social media data.

[0070] To facilitate understanding of the above process of calculating the distribution characteristics and periodic characteristics corresponding to the communication behavior data, the number of daily calls and the number of daily text messages are used as examples for explanation.

[0071] For the number of daily calls, the first daily change rate sequence corresponding to the number of calls in the target time period is determined based on the number of daily calls, and the first daily change sequence is used as the distribution feature corresponding to the number of calls. The first mean value and the first standard deviation corresponding to the number of calls in the target time period are determined based on the number of daily calls, and the first coefficient of variation is calculated based on the first mean value and the first standard deviation, and the first coefficient of variation is used as the periodic feature corresponding to the number of calls.

[0072] For the number of daily SMS, the second daily change sequence corresponding to the number of SMS in the target time period is determined based on the number of daily SMS, and the second daily change sequence is used as the distribution feature corresponding to the number of SMS. For the number of daily SMS, the second daily change sequence corresponding to the number of SMS in the target time period is determined based on the number of daily SMS, and the second daily change sequence is used as the distribution feature corresponding to the number of SMS.

[0073] C t represents the number of calls on day t, S t represents the number of SMS messages on day t, and T represents the total number of days in the target time period. The daily change rate is calculated according to the following formula:

[0074]

[0075] Among them, △C t Indicates the daily change rate of the number of calls, △S t Indicates the daily change rate of the number of SMS messages.

[0076] The coefficient of variation was calculated according to the following formula:

[0077]

[0078] in, represents the average number of calls, Indicates the average number of SMS messages. represents the variance of the number of calls, represents the variance of the number of SMS messages, σ C represents the standard deviation of the number of calls, σ S Indicates the standard deviation of the number of SMS messages, CV C Indicates the coefficient of variation corresponding to the number of calls, CV S Indicates the number of mutations corresponding to the number of SMS messages.

[0079] The process of calculating the distributional characteristics and periodic characteristics corresponding to the social media data is the same as the process of calculating the distributional characteristics and periodic characteristics corresponding to the communication behavior data. For example, according to the daily usage frequency of the specified application, the third daily change rate sequence corresponding to the usage frequency of the specified application in the target time period is determined, and the third daily change sequence is used as the distributional characteristics corresponding to the usage frequency of the specified application; according to the daily usage frequency of the specified application, the third mean value and the third standard deviation corresponding to the usage frequency of the specified application in the target time period are determined, and the third coefficient of variation is calculated based on the third mean value and the third standard deviation, and the third coefficient of variation is used as the periodic characteristics corresponding to the daily usage frequency of the specified application. According to the daily click-through rate of the specified website, the fourth daily change sequence corresponding to the click-through rate of the specified website in the target time period is determined, and the fourth daily change sequence is used as the distributional characteristics corresponding to the click-through rate of the specified website. According to the daily click-through rate of the specified website, the fourth mean value and the fourth standard deviation corresponding to the click-through rate of the specified website in the target time period are determined, and the fourth coefficient of variation is calculated based on the fourth mean value and the fourth standard deviation, and the fourth coefficient of variation is used as the periodic characteristics corresponding to the click-through rate of the specified website.

[0080] Optionally, the text mining features include the sentiment tendency of the text data (such as positive, negative or gravity) and the keywords of the text data. For example, natural language processing technology is used to analyze the text data in social media data (such as published and shared content, comments and replies) to obtain the sentiment tendency and keywords of the text data. Optionally, the text data posted by the target user in the designated application is input as input data into the first language model to obtain the text sentiment tendency output by the first language model; the text data posted by the target user in the designated application is input as input data into the second language model to obtain the keywords output by the second language model.

[0081] Optionally, the social relationship network features include the centrality of the target user in the social network, such as degree centrality, proximity centrality, etc. Centrality is a commonly used concept in social network analysis (SNA), which is used to express the degree of a point or a person in the social network in the entire network. This degree is expressed in numbers and is called centrality. Degree centrality refers to the sum of the direct connections between a point and other points. The proximity centrality calculates the sum of the distances from a point to all other points. The smaller the sum, the shorter the path from this point to all other points, which means that the point is closer to all other points. In an embodiment of the present invention, at least one social network can be constructed based on the user's call records, text message records, social media interaction data, etc. (for example, a social network is constructed based on call records and text message records, and another social network is constructed using social media interaction data). In a social network, nodes represent individuals or entities, and each node is connected to multiple other nodes, indicating that there is some form of interaction or connection between them.

[0082] Step S103: Obtain a preset fraud identification model, which includes multiple base classifiers, a data converter and a meta classifier.

[0083] The base classifier is trained using a variety of machine learning algorithms (such as support vector machine SVM, random forest, deep learning network, etc.). The data converter is used to convert the output data of the base classifier (such as the probability that the target user is a suspected fraudster) to obtain new feature data. Optionally, the data converter can map the output data of the base classifier to a point in a new high-dimensional space by simple combination or using methods such as decision trees, so that the meta-classifier is used to identify the target user based on the new feature data to determine whether the target user is a suspected fraudster.

[0084] Optionally, the fraud identification model can be trained as follows:

[0085] Step 1: Training base models: Use multiple machine learning algorithms to train the first feature data separately to obtain multiple base classifiers.

[0086] Step 2: Generate new features: Map the output data of the base classifier into the second feature data through simple combination or using methods such as decision trees.

[0087] Step 3: Train the meta-classifier: Use the meta-classifier to train the second feature data. The meta-classifier is based on a supervised learning algorithm and combines these new features to obtain more accurate prediction results.

[0088] Step 4: Evaluation and optimization: Comprehensively evaluate and optimize the performance of the meta-classifier.

[0089] The following is an example of using the random forest algorithm to train the base classifier. The output of the random forest algorithm is determined according to the following formula:

[0090]

[0091] Among them, x represents the first feature data of the input, k represents the number of trees, and w i Represents the weight of the i-th tree, Tree i (x) represents the output data of the i-th tree, and RandomForest(x) represents the output data of the random forest.

[0092] Step S104: input the feature data as input data into multiple base classifiers to obtain output data of the multiple base classifiers; input the output data of the multiple base classifiers into a data converter for conversion to obtain second feature data; input the second feature data into a meta-classifier to output a fraud identification result. The fraud identification result includes suspected fraudsters or non-fraudsters.

[0093] The fraud identification method provided by the embodiment of the present invention extracts the time series analysis features, text mining features and social relationship network features of the historical communication behavior data and / or historical social media data of the target user in the target time period, and inputs the feature data as input data into multiple base classifiers of the fraud identification model to obtain the output data of the multiple base classifiers; the output data of the multiple base classifiers are input into the data converter of the fraud identification model for conversion to obtain the second feature data; the second feature data is input into the meta classifier of the fraud identification model to obtain the fraud identification result. The method can provide a more comprehensive perspective to analyze and identify fraudulent behavior by collecting data from multiple channels, including call records, text message content and social network interaction data; the first feature data is analyzed by multiple base classifiers, data converters and meta classifiers, which improves the accuracy compared with the traditional single model fraud identification method.

[0094] Optionally, the fraud identification method provided by the embodiment of the present invention further includes: when the fraud identification result is that the target user is determined to be a suspected fraudster, blocking the communication link of the target user and sending a warning notification to the called user corresponding to the target user. That is, when a possible fraud behavior is detected, a warning signal is automatically sent to the user, and corresponding response measures are taken, such as blocking a suspicious communication link, automatically sending a warning text message to the user, and sharing information with relevant institutions (such as banks, police stations) to jointly respond to fraud incidents.

[0095] Figure 2 FIG. 2 is a flow chart of a fraud identification method provided by another embodiment of the present invention. Figure 2 As shown, the method includes:

[0096] Step S201: acquiring behavior data of multiple dimensions of a target user within a target time period, where the behavior data of multiple dimensions include historical communication behavior data and / or historical social media data.

[0097] Step S202: extracting first feature data from historical communication behavior data and historical social media data, where the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features.

[0098] Step S203: Obtain a preset fraud identification model, which includes multiple base classifiers, a data converter and a meta classifier.

[0099] Step S204: input the feature data as input data into multiple base classifiers respectively to obtain output data of the multiple base classifiers; input the output data of the multiple base classifiers into the data converter for conversion to obtain second feature data; input the second feature data into the meta classifier to output the fraud identification result.

[0100] Step S205: When the fraud identification result determines that the target user is a suspected fraudster, the target user is matched with a known fraud network based on historical communication behavior data and historical social media data to determine whether the target user belongs to the known fraud network.

[0101] Among them, steps S201-S204 can refer to Figure 1 To avoid repetition, the present invention is not limited to the embodiments shown.

[0102] For step S205, if the target user is determined to be a suspected fraudster, it is determined whether the target user belongs to a known fraud network. For example, a social network constructed based on historical communication behavior data and historical social media data is calculated and compared with a known fraud network, such as comparing the centrality of the target user in the social network with the centrality of the nodes in the known fraud network. If the two are similar, it is determined that the target user belongs to the known fraud network.

[0103] The fraud identification method provided by the embodiment of the present invention determines whether the target user belongs to a known fraud network when the target user is identified as a suspected fraudster. If so, the target user can be monitored according to the early warning strategy for the known fraud network and personalized early warning can be implemented. If not, an early warning strategy for the target user can be formulated to provide more effective early warning.

[0104] Figure 3 FIG. 2 is a flow chart showing a fraud identification method provided by another embodiment of the present invention. Figure 3 As shown, the method includes:

[0105] Step S301: acquiring behavior data of multiple dimensions of a target user within a target time period, wherein the behavior data of multiple dimensions include historical communication behavior data and / or historical social media data.

[0106] Step S302: extracting first feature data of historical communication behavior data and historical social media data, where the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features.

[0107] Step S303: Obtain a preset fraud identification model, which includes multiple base classifiers, a data converter and a meta classifier.

[0108] Step S304: input the feature data as input data into multiple base classifiers respectively to obtain output data of the multiple base classifiers; input the output data of the multiple base classifiers into the data converter for conversion to obtain second feature data; input the second feature data into the meta classifier to output the fraud identification result.

[0109] Step S305: When the fraud identification result determines that the target user is a suspected fraudster, the target user is matched with a known fraud network based on historical communication behavior data and historical social media data to determine whether the target user belongs to the known fraud network.

[0110] Step S306: When the fraud identification result determines that the target user is not a fraudster, a behavior pattern of the target user is constructed based on historical communication behavior data and historical social media data.

[0111] Step S307: Acquire the current communication behavior data and current social media data of the target user in real time, and determine whether the current communication behavior data and current social media data are consistent with the behavior pattern of the target user, so as to identify whether the target user is a suspected fraudster.

[0112] Steps S301-S305 can refer to Figure 2 To avoid repetition, the present invention will not be described in detail in the embodiments shown.

[0113] For steps S306-S307, if the target user is identified as a non-fraudster, it means that the target user's behavior in the target time period is normal, and then the normal behavior pattern of the target user can be constructed through historical communication behavior data and historical social media data (behavior pattern refers to the user's behavior and habits in a specific environment). Monitor the communication behavior and social media behavior of the target user, obtain the communication behavior data and social media data of the target user in real time, and determine whether the current communication behavior data and social media data conform to the normal behavior pattern. If it conforms, it means that the current behavior of the target user is normal. If it does not conform, it means that the current behavior of the target user (for example, the user's frequent cross-regional communication in a short period of time, or the behavior of making a large number of call attempts at unconventional times) is abnormal. Optionally, the historical communication behavior data and historical social media data can be mined by a sequential pattern mining algorithm to determine the normal behavior pattern of the target user. Sequential Pattern Mining Algorithms: A set of algorithms for mining frequently occurring sequential patterns in data. These algorithms can identify recurring ordered events or behavior patterns in data.

[0114] The fraud identification method provided by the embodiment of the present invention, when determining that the target user is not a fraudster, constructs the normal behavior pattern of the target user based on historical communication behavior data and historical social media data. If the current communication behavior data and social media data of the target user do not conform to the normal behavior pattern, it can be determined that the current behavior of the target user is abnormal, and potential fraudulent behavior can be discovered early, thereby reducing the occurrence of telecommunications fraud incidents.

[0115] Figure 4 FIG. 2 shows a schematic diagram of the structure of a fraud identification device provided by an embodiment of the present invention. Figure 4 As shown, the fraud identification device 400 includes:

[0116] A data acquisition module 401 is used to acquire behavior data of multiple dimensions of a target user within a target time period, wherein the behavior data of multiple dimensions includes historical communication behavior data and / or historical social media data;

[0117] A feature extraction module 402 is used to extract first feature data of the historical communication behavior data and the historical social media data, wherein the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features;

[0118] A model acquisition module 403, used to acquire a preset fraud identification model, wherein the fraud identification model includes a plurality of base classifiers, a data converter and a meta classifier;

[0119] The identification module 404 is used to input the feature data as input data into the multiple base classifiers respectively to obtain output data of the multiple base classifiers; input the output data of the multiple base classifiers into the data converter for conversion to obtain second feature data; input the second feature data into the meta classifier to output a fraud identification result.

[0120] Optionally, the time series analysis characteristics include distribution characteristics;

[0121] The feature extraction module is used to: calculate the daily change rate sequence corresponding to the historical communication behavior data based on the daily usage included in the historical communication behavior data, and use the daily change rate sequence corresponding to the historical communication behavior data as the distribution feature corresponding to the historical communication behavior data; calculate the daily change rate sequence corresponding to the historical social media data based on the daily usage included in the historical social media data, and use the daily change rate sequence corresponding to the historical social media data as the distribution feature corresponding to the historical social media data.

[0122] Optionally, the time series analysis feature includes a periodic feature;

[0123] The feature extraction module is used to: calculate the mean value and standard deviation corresponding to the historical communication behavior data based on the daily usage included in the historical communication behavior data; calculate the coefficient of variation corresponding to the historical communication behavior data based on the mean value and standard deviation corresponding to the historical communication behavior data, and use the coefficient of variation corresponding to the historical communication behavior data as the periodic feature corresponding to the historical communication behavior data; calculate the mean value and standard deviation corresponding to the historical social media data based on the daily usage included in the historical social media data; calculate the coefficient of variation corresponding to the historical social media data based on the mean value and standard deviation corresponding to the historical social media data, and use the coefficient of variation corresponding to the historical social media data as the periodic feature corresponding to the historical social media data.

[0124] Optionally, the historical communication behavior data includes the number of daily calls and the number of daily text messages;

[0125] The feature extraction module is used to: determine, based on the daily number of calls, a first daily change rate sequence corresponding to the number of calls within the target time period, and use the first daily change sequence as the distribution feature corresponding to the number of calls; determine, based on the daily number of text messages, a second daily change sequence corresponding to the number of text messages within the target time period, and use the second daily change sequence as the distribution feature corresponding to the number of text messages.

[0126] Optionally, the feature extraction module is used to: determine a first mean value and a first standard deviation corresponding to the number of calls within the target time period based on the daily number of calls, calculate a first coefficient of variation based on the first mean value and the first standard deviation, and use the first coefficient of variation as the periodic feature corresponding to the number of calls; determine a second mean value and a second standard deviation corresponding to the number of text messages within the target time period based on the daily number of text messages, calculate a second coefficient of variation based on the second mean value and the second standard deviation, and use the second coefficient of variation as the periodic feature corresponding to the number of text messages.

[0127] Optionally, the historical social media data includes: daily usage frequency of a specified application and daily click-through rate of a specified website;

[0128] The feature extraction module is used to: determine the third daily change rate sequence corresponding to the designated application usage frequency within the target time period based on the daily usage frequency of the designated application, and use the third daily change sequence as the distribution feature corresponding to the designated application usage frequency; determine the fourth daily change sequence corresponding to the designated website click rate within the target time period based on the daily click rate of the designated website, and use the fourth daily change sequence as the distribution feature corresponding to the designated website click rate.

[0129] Optionally, the feature extraction module is used to: determine a third mean value and a third standard deviation corresponding to the frequency of use of the designated application within the target time period based on the daily frequency of use of the designated application, calculate a third coefficient of variation based on the third mean value and the third standard deviation, and use the third coefficient of variation as the periodic feature corresponding to the daily frequency of use of the designated application; determine a fourth mean value and a fourth standard deviation corresponding to the click-through rate of the designated website within the target time period based on the daily click-through rate of the designated website, calculate a fourth coefficient of variation based on the fourth mean value and the fourth standard deviation, and use the fourth coefficient of variation as the periodic feature corresponding to the click-through rate of the designated website.

[0130] Optionally, the historical social media data includes text data published by the target user in a designated application; the text mining features include text sentiment tendency and keywords;

[0131] The feature extraction module is used to: input the text data published by the target user in the designated application as input data into a first language model to obtain the text sentiment tendency output by the first language model; input the text data published by the target user in the designated application as input data into a second language model to obtain the keywords output by the second language model.

[0132] Optionally, the feature extraction module is used to: construct at least one social network based on the historical communication behavior data and the historical social media data; the social network uses users as nodes and the relationships between users as edges; calculate the centrality of the target user in the social network, and use the centrality as the social relationship network feature corresponding to the target user.

[0133] Optionally, the device also includes a network matching module, which is used to: when the fraud identification result is that the target user is determined to be a suspected fraudster, match the target user with a known fraud network based on the historical communication behavior data and the historical social media data to determine whether the target user belongs to the known fraud network.

[0134] Optionally, the device also includes an early warning module, which is used to: when the fraud identification result determines that the target user is a suspected fraudster, block the communication link of the target user and send an early warning notification to the called user corresponding to the target user.

[0135] Optionally, the device also includes a pattern recognition module, which is used to: when the fraud identification result is that the target user is determined to be a non-fraudster, construct a behavior pattern of the target user based on the historical communication behavior data and the historical social media data; obtain the target user's current communication behavior data and current social media data in real time, and determine whether the current communication behavior data and current social media data are consistent with the target user's behavior pattern, so as to identify whether the target user is a suspected fraudster.

[0136] The above device can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the fraud identification method provided by the embodiment of the present invention.

[0137] Figure 5 FIG. 1 is a schematic diagram showing the structure of an electronic device according to an embodiment of the present invention. Figure 5 As shown, the electronic device includes:

[0138] Processor 501, communication interface 502, memory 503 and communication bus 504, wherein the processor 501, communication interface 502, memory 503 communicate with each other via the communication bus 504.

[0139] Memory 503, used for storing computer programs;

[0140] The processor 501 is used to implement the fraud identification method provided by any embodiment of the present invention when executing the program stored in the memory 503.

[0141] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0142] The communication interface is used for communication between the above terminal and other devices.

[0143] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0144] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0145] In another embodiment provided by the present invention, a computer-readable storage medium is provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the fraud identification method described in any one of the above embodiments.

[0146] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any fraud identification method described in the above embodiments.

[0147] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0148] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0149] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0150] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A fraud identification method, characterized in that: include: Acquire behavior data of multiple dimensions of a target user within a target time period, wherein the behavior data of multiple dimensions include historical communication behavior data and / or historical social media data; Extracting first feature data of the historical communication behavior data and the historical social media data, wherein the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features; Obtaining a preset fraud identification model, wherein the fraud identification model includes a plurality of base classifiers, a data converter, and a meta classifier; Input the feature data as input data into the multiple base classifiers respectively to obtain output data of the multiple base classifiers; input the output data of the multiple base classifiers into the data converter for conversion to obtain second feature data; The second feature data is input into the meta-classifier, and a fraud identification result is output.

2. The method according to claim 1, characterized in that The time series analysis characteristics include distribution characteristics; The extracting the historical communication behavior data and the first feature data of the historical social media data includes: According to the daily usage included in the historical communication behavior data, a daily change rate sequence corresponding to the historical communication behavior data is calculated, and the daily change rate sequence corresponding to the historical communication behavior data is used as a distribution feature corresponding to the historical communication behavior data; According to the daily usage included in the historical social media data, a daily change rate sequence corresponding to the historical social media data is calculated, and the daily change rate sequence corresponding to the historical social media data is used as a distribution feature corresponding to the historical social media data.

3. The method according to claim 2, characterized in that The time series analysis characteristics include periodic characteristics; The extracting the historical communication behavior data and the first feature data of the historical social media data includes: According to the daily usage included in the historical communication behavior data, calculate the mean value and standard deviation corresponding to the historical communication behavior data; according to the mean value and standard deviation corresponding to the historical communication behavior data, calculate the coefficient of variation corresponding to the historical communication behavior data, and use the coefficient of variation corresponding to the historical communication behavior data as the periodic feature corresponding to the historical communication behavior data; According to the daily usage included in the historical social media data, the mean value and standard deviation corresponding to the historical social media data are calculated; according to the mean value and standard deviation corresponding to the historical social media data, the coefficient of variation corresponding to the historical social media data is calculated, and the coefficient of variation corresponding to the historical social media data is used as the periodic feature corresponding to the historical social media data.

4. The method according to claim 3, characterized in that The historical communication behavior data includes the number of daily calls and the number of daily text messages; The distribution characteristics of the historical communication behavior data are extracted according to the following process: Determine, according to the daily number of calls, a first daily change rate sequence corresponding to the number of calls within the target time period, and use the first daily change sequence as a distribution feature corresponding to the number of calls; According to the daily number of short messages, a second daily variation sequence corresponding to the number of short messages within the target time period is determined, and the second daily variation sequence is used as a distribution feature corresponding to the number of short messages.

5. The method according to claim 4, characterized in that The periodic features of the historical communication behavior data are extracted according to the following process: Determine, according to the number of daily calls, a first average value and a first standard deviation corresponding to the number of calls within the target time period, calculate a first coefficient of variation according to the first average value and the first standard deviation, and use the first coefficient of variation as a periodic feature corresponding to the number of calls; According to the daily number of short messages, a second daily variation sequence corresponding to the number of short messages within the target time period is determined, and the second daily variation sequence is used as a distribution feature corresponding to the number of short messages.

6. The method according to claim 3, characterized in that The historical social media data includes: daily usage frequency of a specified application and daily click-through rate of a specified website; The distribution characteristics of the historical social media data are extracted according to the following process: Determine, according to the daily usage frequency of the designated application, a third daily change rate sequence corresponding to the usage frequency of the designated application within the target time period, and use the third daily change sequence as a distribution feature corresponding to the usage frequency of the designated application; According to the daily click rate of the designated website, a fourth-day variation sequence corresponding to the click rate of the designated website within the target time period is determined, and the fourth-day variation sequence is used as a distribution feature corresponding to the click rate of the designated website.

7. The method according to claim 6, characterized in that The periodic features of the historical social media data are extracted according to the following process: Determine, according to the daily usage frequency of the designated application, a third mean value and a third standard deviation corresponding to the usage frequency of the designated application within the target time period, calculate a third coefficient of variation according to the third mean value and the third standard deviation, and use the third coefficient of variation as a periodic feature corresponding to the daily usage frequency of the designated application; According to the daily click rate of the designated website, determine the fourth mean value and the fourth standard deviation corresponding to the click rate of the designated website within the target time period, calculate the fourth coefficient of variation according to the fourth mean value and the fourth standard deviation, and use the fourth coefficient of variation as the periodic feature corresponding to the click rate of the designated website.

8. The method according to claim 1, characterized in that The historical social media data includes text data published by the target user in a designated application; the text mining features include text sentiment and keywords; The text mining features of the historical social media data are extracted according to the following process: Inputting the text data published by the target user in the designated application as input data into a first language model to obtain the sentiment tendency of the text output by the first language model; The text data published by the target user in the designated application is input into the second largest language model as input data to obtain keywords output by the second largest language model.

9. The method according to claim 1, characterized in that: The extracting the historical communication behavior data and the first feature data of the historical social media data includes: Constructing at least one social network based on the historical communication behavior data and the historical social media data; the social network uses users as nodes and relationships between users as edges; The centrality of the target user in the social network is calculated, and the centrality is used as a social relationship network feature corresponding to the target user.

10. The method according to claim 1, characterized in that The method further comprises: In the case where the fraud identification result is that the target user is determined to be a suspected fraudster, the target user is matched with a known fraud network based on the historical communication behavior data and the historical social media data to determine whether the target user belongs to the known fraud network.

11. The method according to claim 1, characterized in that: The method further comprises: In the case where the fraud identification result determines that the target user is a suspected fraudster, the communication link of the target user is blocked, and an early warning notification is sent to the called user corresponding to the target user.

12. The method according to claim 1, characterized in that The method further comprises: When the fraud identification result is that the target user is determined to be a non-fraudster, constructing a behavior pattern of the target user based on the historical communication behavior data and the historical social media data; The current communication behavior data and current social media data of the target user are obtained in real time, and it is determined whether the current communication behavior data and current social media data conform to the behavior pattern of the target user, so as to identify whether the target user is a suspected fraudster.

13. A fraud identification device, characterized in that: include: A data acquisition module, used to acquire behavior data of multiple dimensions of a target user within a target time period, wherein the behavior data of multiple dimensions include historical communication behavior data and / or historical social media data; A feature extraction module, used to extract first feature data of the historical communication behavior data and the historical social media data, wherein the first feature data includes one or more of the following: time series analysis features, text mining features, and social relationship network features; A model acquisition module, used to acquire a preset fraud identification model, wherein the fraud identification model includes a plurality of base classifiers, a data converter and a meta classifier; The recognition module is used to input the feature data as input data into the multiple base classifiers respectively to obtain output data of the multiple base classifiers; input the output data of the multiple base classifiers into the data converter for conversion to obtain second feature data; The second feature data is input into the meta-classifier, and a fraud identification result is output.

14. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, configured to implement the method according to any one of claims 1 to 12 when executing a program stored in a memory.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images