In-event protection method and system for friend-making investment telecommunication network fraud victims

Abstract

The invention provides an in-event protection method and system for friend-making investment telecommunication network fraud victims, and the method comprises the steps: carrying out the real-time statistical analysis of a debit card transaction flow, and obtaining the basic features, derivative features and customer static features of a debit card; carrying out box separation on the basic features and the derivative features, formulating rule features according to box separation conditions, and carrying out statistics on daily rule hit conditions of each debit card; marking the debit card with a good label or a bad label; splicing the rule hit condition and the customer static features to obtain a target feature set; performing data cleaning on the data set; performing model training on the initial score card model by using the target feature set and the debit card quality tag to obtain a target score card model; and performing deceiving probability scoring on the account through a scoring standard of the target scoring card model, and outputting a predicted high-probability deceived account set through threshold division. According to the invention, in-event intervention can be realized from a bank end, and fund safety of victims is effectively protected.

Description

Technical Field

[0001] The present invention relates to the field of public security, and in particular to a method and system for protecting victims of dating and investment-related telecommunications network fraud. Background Art

[0002] With the continuous deepening of digital development and the continuous advancement of network technology, telecommunications network fraudsters have gradually set up corresponding rhetoric and fraud methods based on the differences in the main victim groups, making it difficult to guard against. In dating and investment-related telecommunications network fraud cases, since most of the victims have a certain economic foundation, the amount involved in the case is generally huge, which will have a great impact on the normal life of the customers. Bank accounts are an important channel for the flow of funds involved in the case, which will undoubtedly cause serious damage to the normal operation and reputation of the bank. Therefore, banks should also upgrade the corresponding identification technology for suspected victims of dating and investment-related telecommunications network fraud, and take necessary measures to reduce customer losses.

[0003] At present, most banks focus their monitoring and identification of accounts on the accounts involved in the case, and rarely take the protection of victims into consideration to reduce losses for deceived customers. Moreover, most monitoring and identification methods are post-processing, which cannot well retain the funds that customers are being defrauded of. Faced with the increasingly covert methods and increasingly advanced technical means of telecommunications network fraud criminals, the difficulty of identifying victims of telecommunications network fraud continues to increase. Combined with the actual situation that fraud cases occur in a short time, the money is transferred quickly, and it is difficult to recover it afterwards, the current methods are no longer sufficient to effectively respond. Therefore, it is increasingly important to improve the technical level and ability of in-process identification of accounts suspected of being victims of telecommunications network fraud, so as to take necessary measures on relevant accounts in a timely manner to protect the financial security of victims of telecommunications network fraud.

[0004] In view of this, it is urgent to study a scoring model for victims of dating and investment telecommunications network fraud in order to improve the accuracy of account identification of victims of telecommunications network fraud, achieve prior warning, and better protect the financial security of victims of telecommunications network fraud. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method and system for protecting victims of dating and investment telecommunications network fraud, which can effectively protect the financial security of victims of telecommunications network fraud.

[0006] In a first aspect, the present invention provides a method for protecting victims of dating and investment telecommunications network fraud, the method comprising: Step S1: Conduct real-time statistical analysis on debit card transaction flow, capture corresponding indicators as basic features of debit cards, obtain derived features by combining basic features, and extract customer's own attributes as customer static features; Step S2: bin each basic feature and derived feature respectively, formulate rule features according to the binning situation, and make a judgment after each transaction of each debit card. If the transaction satisfies the rule feature after it is generated, the number of times the debit card hits the rule is increased by 1, and the daily rule hit situation of each debit card is counted; Step S3: Count whether the holder of each debit card has reported a crime or related police situation every day. If so, the debit card of that day is recorded as a bad label, otherwise it is recorded as a good label, and the good and bad labels of the debit cards are obtained; Step S4: Combine the daily rule hits of each debit card with the customer's static features to obtain a target feature set; Step S5: Use a random sampling method to divide the data set into a training set and a validation set, and use the data of the next month after the sample cutoff month as the test set; Step S6: Clean the data set to remove outliers and missing values. Step S7: Use the target feature set and the good and bad debit card labels to train the model on the training set, use the AUC of the validation set as the evaluation index, obtain the target scorecard model, and verify it through the test set; Step S8: Input the real-time processed rule hits and customer static features of the victims of telecommunications network fraud into the target scoring card model, score the account for probability of being deceived, and then divide it by threshold to output the predicted set of high-probability deceived accounts.

[0007] Furthermore, the basic features are selected based on expert experience, and include at least the number of debit card transactions on the day, the number of transactions during non-normal periods on the day, the number of trading counterparties on the day, the amount of funds received on the day, the amount of inter-bank transfers to unfamiliar counterparties on the day, the amount of transfers over six months, the amount of funds transferred in from securities or wealth management channels on the day, and the number of days since the last account movement. Furthermore, the derived characteristics include the proportion of transactions in abnormal time periods to the total number of transactions, the proportion of the amount transferred across banks to unfamiliar counterparties on the same day to the amount transferred across banks in the past six months, and the total amount of money transferred across banks to unfamiliar counterparties immediately after the amount was transferred in from securities or wealth management channels on the same day.

[0008] Furthermore, the customer static characteristics include age, occupation and gender.

[0009] Furthermore, the rule features include the amount of inter-bank transfers to unfamiliar counterparties on the same day exceeding three times the amount of transfers in the past six months, and the amount of inter-bank transfers to unfamiliar counterparties immediately exceeding 20,000 yuan after an amount is transferred in from securities or wealth management channels on the same day.

[0010] Furthermore, the step S6 also includes binning based on the toad open source package and the actual situation of each feature, analyzing the availability of each feature by calculating the correlation coefficient and IV value between each feature and the label, and eliminating features whose effective information is lower than a certain value.

[0011] Furthermore, after step 6, the method further includes: performing WOE conversion on the sample data, and using a two-way stepwise regression method to screen the characteristic variables again, so as to obtain the characteristic variables finally used for modeling.

[0012] Furthermore, the training process in step S7 is specifically as follows: the sample data is iteratively trained with a logistic regression model through the sklearn open source package, the AUC of the validation set is used as an evaluation indicator and combined with the F2 evaluation indicator to generate an optimal score card, and the output scoring criteria are saved to obtain a target score card model, which is then verified on the test set. If the verification result does not meet expectations, the model parameters are adjusted through Bayesian parameter adjustment to obtain an updated target score card model.

[0013] In a second aspect, the present invention provides a system for protecting victims of dating and investment telecommunications network fraud, the system comprising: The data extraction module is used to conduct real-time statistical analysis of debit card transaction flows, capture corresponding indicators as basic features of debit cards, obtain derived features by combining basic features, and extract customer attributes as customer static features; The rule feature statistics module is used to bin each basic feature and derived feature, formulate rule features based on the binning situation, and make judgments after each debit card transaction. If the transaction meets the rule feature after it is generated, the number of times the debit card hits the rule is increased by 1, and the daily rule hit situation of each debit card is counted; The label setting module is used to count whether the holder of each debit card has reported a crime or related police situation every day. If so, the debit card on that day is recorded as a bad label, otherwise it is recorded as a good label, and the good and bad labels of the debit card are obtained; The feature splicing module is used to splice the daily rule hits of each debit card with the customer's static features to obtain the target feature set; The data partitioning module is used to divide the data set into a training set and a validation set by using a random sampling method, and the data of the next month after the sample cutoff month is used as the test set; The data processing module is used to clean the data set and process outliers and missing values; The model training module is used to train the model on the training set using the target feature set and the good and bad debit card labels, and use the AUC of the validation set as the evaluation indicator to obtain the target scorecard model, which is then verified using the test set; The fraud prediction module is used to input the rule hits and customer static features of real-time processed telecommunications network fraud victims into the target scoring card model, score the account's probability of being deceived, and then output a predicted set of high-probability fraud accounts through threshold division.

[0014] Furthermore, the basic features are selected based on expert experience, and include at least the number of debit card transactions on the day, the number of transactions during non-normal periods on the day, the number of trading counterparties on the day, the amount of funds received on the day, the amount of inter-bank transfers to unfamiliar counterparties on the day, the amount of transfers over six months, the amount of funds transferred in from securities or wealth management channels on the day, and the number of days since the last account movement. Furthermore, the derived characteristics include the proportion of transactions in abnormal time periods to the total number of transactions, the proportion of the amount transferred across banks to unfamiliar counterparties on the same day to the amount transferred across banks in the past six months, and the total amount of money transferred across banks to unfamiliar counterparties immediately after the amount was transferred in from securities or wealth management channels on the same day.

[0015] Furthermore, the customer static characteristics include age, occupation and gender.

[0016] Furthermore, the rule features include the amount of inter-bank transfers to unfamiliar counterparties on the same day exceeding three times the amount of transfers in the past six months, and the amount of inter-bank transfers to unfamiliar counterparties immediately exceeding 20,000 yuan after an amount is transferred in from securities or wealth management channels on the same day.

[0017] Furthermore, the data partitioning module also includes taking the data of the next month of the sample cutoff month as a test set to verify the credibility of the trained model. If the feasibility of the model is lower than a predetermined value, the model training parameters are updated and the model training is repeated.

[0018] Furthermore, the data processing module also includes binning processing in combination with the toad open source package and the actual situation of each feature, analyzing the availability of each feature by calculating the correlation coefficient and IV value between each feature and the label, and eliminating features whose effective information is lower than a certain value.

[0019] Furthermore, the data processing module also includes: performing WOE conversion on the sample data, and using a two-way stepwise regression method to screen the characteristic variables again to obtain the characteristic variables finally used for modeling.

[0020] Furthermore, the model training module is specifically as follows: the sample data is iteratively trained with a logistic regression model through the sklearn open source package, the AUC of the validation set is used as the evaluation indicator and combined with the F2 evaluation indicator to generate the optimal score card, and the output scoring criteria are saved to obtain the target score card model, which is then verified on the test set. If the verification result does not meet expectations, the model parameters are adjusted through Bayesian parameter adjustment to obtain an updated target score card model.

[0021] One or more technical solutions provided by the present invention have at least the following technical effects or advantages: The pre-loan scoring card model in the credit field is used to evaluate the victim accounts of the telecommunications network and determine the probability of fraud. The model is trained based on transaction characteristic indicators to obtain the target scoring card model. The abnormal rules triggered by the account and the account static information are substituted into the target scoring card model to obtain the final score. According to the score output by the model, the probability of fraud of the account can be judged, which can effectively improve the recognition level of victims of telecommunications network fraud, make the intervention on the bank side more timely and accurate, and effectively make up for the lack of intervention in the process, retain the defrauded funds to a greater extent, and better protect the financial security of victims of telecommunications network fraud. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0023] Figure 1 The present invention is a flowchart of an execution method for protecting victims of dating and investment-related telecommunications network fraud in the first embodiment of the present invention.

[0024] Figure 2 This is a schematic diagram of the structure of a system for protecting victims of dating and investment-related telecommunications network fraud in the second embodiment of the present invention. DETAILED DESCRIPTION

[0025] The embodiments of the present application provide a method and system for protecting victims of dating and investment-related telecommunications network fraud during the process, which is used to compensate for the lack of intervention in existing telecommunications network frauds during the process, and can better protect the financial security of victims of telecommunications network fraud.

[0026] The technical solution in the embodiment of the present application has the following general idea: the scoring card model is a risk control model commonly used in the financial field, which is mainly used to evaluate the credit of customers, and then decide whether to grant credit, the credit limit and interest rate, etc., to reduce the risks in transactions. However, in the new field of identifying victims of telecommunications network fraud, there is no precedent for the use of this model. This application combines the scoring card model in the credit field and implements it in the field of preventing telecommunications network fraud to improve the accuracy of account identification of victims of telecommunications network fraud, so as to construct a dating and investment telecommunications network fraud victim scoring model for assessing the probability of account fraud. Specifically, based on the mature expert experience of the banking industry and based on the real-time flow data of debit cards, a series of victim protection label rules are designed. If the customer's use of a debit card triggers the judgment rule, a model is constructed with the customer's static feature variables to improve the accuracy of account identification of victims of telecommunications network fraud.

[0027] In order to better understand the above technical solution, the technical solution of the present invention will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0028] Embodiment 1 This embodiment provides a method for protecting victims of dating and investment telecommunications network fraud. Figure 1 As shown, the method includes: Step S1: Conduct real-time statistical analysis on debit card transaction flow, capture corresponding indicators as basic features of debit cards, obtain derived features by combining basic features, and extract customer's own attributes as customer static features; Step S2, bin each basic feature and derived feature respectively, formulate rule features according to the binning situation, make a judgment after each debit card is moved, if the rule feature is satisfied after the flow is generated, then the number of times the debit card hits the rule +1, and count the daily rule hits of each debit card. For example, the amount that a customer transfers to an unfamiliar opponent immediately after transferring money from a securities or financial channel is a highly discrete data. In order to avoid the impact of fluctuations in some amounts, the amount can be binned according to intervals of 2,000 yuan, and the proportion of good and bad samples in each box is counted. According to statistics, when the amount exceeds 20,000 yuan, the proportion of bad samples increases significantly. At this time, 20,000 yuan can be used as the threshold for triggering the rule to formulate the rule feature; Step S3: Count whether the holder of each debit card has reported a crime or related police situation every day. If so, the debit card of that day is recorded as a bad label, otherwise it is recorded as a good label, and the good and bad labels of the debit cards are obtained; Step S4: Combine the daily rule hits of each debit card with the customer's static features to obtain a target feature set; Step S5: using a random sampling method, the data set is divided into a training set and a validation set in a ratio of 3:1, and an adversarial validation method is used to ensure that there is no significant difference in the distribution of the divided training set and validation set, and the data of the next month after the sample cutoff month is used as a test set. The validation set is used to subsequently verify the credibility of the trained model. If the model credibility is lower than a predetermined value, the model training parameters are adjusted to retrain the model; Step S6: Clean the data set to remove outliers and missing values. Step S7: Use the target feature set and the good and bad debit card labels to train the model on the training set, use the AUC of the validation set as the evaluation index, obtain the target scorecard model, and verify it with the test set to avoid overfitting of the model; Step S8: Input the rule hits and customer static features of the real-time processed telecommunications network fraud victims into the target scoring card model, score the account fraud probability according to the scoring criteria of the target scoring card model, and then divide by threshold to output the predicted high probability fraud account set.

[0029] Preferably, the basic features are selected based on expert experience, and include at least the number of debit card transactions on the day, the number of transactions during non-normal hours on the day, the number of counterparties on the day, the amount of funds received on the day, the amount of inter-bank transfers to unfamiliar counterparties on the day, the amount of transfers over six months, the amount of funds transferred in from securities or financial management channels on the day, and the number of days since the last account movement; The derived features include the proportion of transactions during non-normal periods to the total number of transactions, the proportion of the amount transferred across banks to unfamiliar counterparties on the same day to the amount transferred across banks in the past six months, and the total amount of money transferred across banks to unfamiliar counterparties immediately after the amount was transferred in from securities or wealth management channels on the same day; the derived features are obtained by combining the basic features.

[0030] The customer static characteristics include age, occupation and gender.

[0031] Preferably, the rule features include the amount of inter-bank transfers to unfamiliar counterparties on the same day exceeding three times the amount of transfers in the past six months, and the amount of inter-bank transfers to unfamiliar counterparties immediately after the amount of money transferred in from securities or wealth management channels on the same day exceeding 20,000 yuan.

[0032] Preferably, step S6 also includes binning based on the toad open source package and the actual situation of each feature, analyzing the availability of each feature by calculating the correlation coefficient and IV value between each feature and the label, and eliminating features whose effective information is lower than a certain value.

[0033] Preferably, after step 6, the method further includes: performing WOE conversion on the sample data, and using a two-way stepwise regression method to screen the characteristic variables again to obtain the characteristic variables ultimately used for modeling.

[0034] Preferably, the training process in step S7 is specifically as follows: iteratively training the logistic regression model on the sample data through the sklearn open source package, using the AUC of the validation set as the evaluation indicator and combining it with the F2 evaluation indicator to generate the optimal score card, and saving the output scoring criteria to obtain the target score card model, and then verifying it on the test set. If the verification result does not meet expectations, the model parameters are adjusted through Bayesian parameter adjustment to obtain an updated target score card model.

[0035] Based on the same inventive concept, the present application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0036] Embodiment 2 This embodiment provides a system for protecting victims of dating and investment telecommunications network fraud. Figure 2 As shown, the system comprises: The data extraction module is used to conduct real-time statistical analysis of debit card transaction flows, capture corresponding indicators as basic features of debit cards, obtain derived features by combining basic features, and extract customer attributes as customer static features; The rule feature statistics module is used to bin each basic feature and derived feature separately, formulate rule features according to the binning situation, and make judgments after each debit card is moved. If the rule feature is satisfied after the flow is generated, the number of times the debit card hits the rule is increased by 1, and the daily rule hits of each debit card are counted. For example, the amount that a customer transfers to an unfamiliar opponent immediately after transferring money from a securities or financial channel is a highly discrete data. In order to avoid the impact of fluctuations in some amounts, the amount can be binned according to intervals of 2,000 yuan, and the proportion of good and bad samples in each box is counted. According to statistics, when the amount exceeds 20,000 yuan, the proportion of bad samples increases significantly. At this time, 20,000 yuan can be used as the threshold for triggering the rule to formulate the rule feature; The label setting module is used to count whether the holder of each debit card has reported a crime or related police situation every day. If so, the debit card on that day is recorded as a bad label, otherwise it is recorded as a good label, and the good and bad labels of the debit card are obtained; The feature splicing module is used to splice the daily rule hits of each debit card with the customer's static features to obtain the target feature set; The data partitioning module is used to use a random sampling method to divide the data set into a training set and a validation set in a ratio of 3:1, and use an adversarial validation method to ensure that there is no obvious difference in the distribution of the divided training set and validation set, and use the data of the next month after the sample cutoff month as the test set. The validation set is used to subsequently verify the credibility of the trained model. If the model credibility is lower than a predetermined value, the model training parameters are adjusted to re-train the model; The data processing module is used to clean the data set and process outliers and missing values; The model training module is used to train the model on the training set using the target feature set and the good and bad debit card labels, and use the AUC of the validation set as the evaluation indicator to obtain the target scorecard model, which is then validated using the test set to avoid overfitting of the model; The fraud prediction module is used to input the rule hits and customer static features of real-time processed telecommunications network fraud victims into the target scoring card model, score the account fraud probability according to the scoring criteria of the target scoring card model, and then output the predicted high probability fraud account set through threshold division.

[0037] Preferably, the basic features are selected based on expert experience, and include at least the number of debit card transactions on the day, the number of transactions during non-normal hours on the day, the number of counterparties on the day, the amount of funds received on the day, the amount of inter-bank transfers to unfamiliar counterparties on the day, the amount of transfers over six months, the amount of funds transferred in from securities or financial management channels on the day, and the number of days since the last account movement; The derivative features include the proportion of transactions during non-normal periods to the total number of transactions, the proportion of the amount transferred across banks to unfamiliar counterparties on the same day to the amount transferred across banks in the past six months, and the total amount of money transferred across banks to unfamiliar counterparties immediately after the amount was transferred in from securities or wealth management channels on the same day; The customer static characteristics include age, occupation and gender.

[0038] Preferably, the rule features include the amount of inter-bank transfers to unfamiliar counterparties on the same day exceeding three times the amount of transfers in the past six months, and the amount of inter-bank transfers to unfamiliar counterparties immediately after the amount of money transferred in from securities or wealth management channels on the same day exceeding 20,000 yuan.

[0039] Preferably, the data processing module also includes binning processing in combination with the toad open source package and the actual situation of each feature, analyzing the availability of each feature by calculating the correlation coefficient and IV value between each feature and the label, and eliminating features whose effective information is lower than a certain value.

[0040] Preferably, the data processing module further comprises: performing WOE conversion on the sample data, and using a two-way stepwise regression method to screen the characteristic variables again to obtain the characteristic variables finally used for modeling.

[0041] Preferably, the model training module is specifically as follows: the sample data is iteratively trained with a logistic regression model through the sklearn open source package, the AUC of the validation set is used as the evaluation index and combined with the F2 evaluation index to generate the optimal score card, and the output scoring criteria are saved to obtain the target score card model, which is then verified on the test set. If the verification result does not meet expectations, the model parameters are adjusted through Bayesian parameter adjustment to obtain an updated target score card model.

[0042] Since the device introduced in the second embodiment of the present invention is a device used to implement the method of the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the device based on the method introduced in the first embodiment of the present invention, so it is not described here in detail. All devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0043] The technical solution provided in the embodiment of the present application has at least the following technical effects or advantages: the present invention mainly uses the idea of ​​constructing a scoring card model in the credit field to evaluate the credit of customers, and implements it in the field of preventing telecommunications network fraud to construct a scoring model for victims of dating and investment telecommunications network fraud for evaluating the probability of account fraud. At the same time, combined with the mature expert experience of the banking industry, a series of victim protection label rules are designed based on the real-time flow data of debit cards. If the customer's use of a debit card triggers the judgment rule, the debit card number and the rule triggered by it will be recorded as an early warning record. However, such a judgment model still has the problem of being inaccurate. Different judgment rules have different importance for identifying the accounts of victims of telecommunications network fraud. If the same weight is set, it is easy to cause inaccurate judgment. Therefore, it is considered to use this series of indicators, supplemented by customer static feature variables, to build a model to improve the accuracy of identifying the accounts of victims of telecommunications network fraud.

[0044] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for protecting victims of dating and investment telecommunications network fraud, characterized by: The method comprises: Step S1: Conduct real-time statistical analysis on debit card transaction flow, capture corresponding indicators as basic features of debit cards, obtain derived features by combining basic features, and extract customer's own attributes as customer static features; Step S2: bin each basic feature and derived feature respectively, formulate rule features according to the binning situation, and make a judgment after each transaction of each debit card. If the transaction satisfies the rule feature after it is generated, the number of times the debit card hits the rule is increased by 1, and the daily rule hit situation of each debit card is counted; Step S3: Count whether the holder of each debit card has reported a crime or related police situation every day. If so, the debit card of that day is recorded as a bad label, otherwise it is recorded as a good label, and the good and bad labels of the debit cards are obtained; Step S4: Combine the daily rule hits of each debit card with the customer's static features to obtain a target feature set; Step S5: Use a random sampling method to divide the data set into a training set and a validation set, and use the data of the next month after the sample cutoff month as the test set; Step S6: Clean the data set to remove outliers and missing values. Step S7: Use the target feature set and the good and bad debit card labels to train the model on the training set, use the AUC of the validation set as the evaluation index, obtain the target scorecard model, and verify it through the test set; Step S8: Input the real-time processed rule hits and customer static features of the victims of telecommunications network fraud into the target scoring card model, score the account for probability of being deceived, and then divide it by threshold to output the predicted set of high-probability deceived accounts.

2. A method for protecting victims of dating and investment telecommunications network fraud according to claim 1, characterized in that: The basic features are selected based on expert experience, and include at least the number of debit card transactions on the day, the number of transactions during non-normal hours on the day, the number of trading counterparties on the day, the amount of funds received on the day, the amount of inter-bank transfers to unfamiliar counterparties on the day, the amount of transfers over six months, the amount of funds transferred in from securities or financial channels on the day, and the number of days since the last account movement; The derivative features include the proportion of transactions during non-normal periods to the total number of transactions, the proportion of the amount transferred across banks to unfamiliar counterparties on the same day to the amount transferred across banks in the past six months, and the total amount of money transferred across banks to unfamiliar counterparties immediately after the amount was transferred in from securities or wealth management channels on the same day; The customer static characteristics include age, occupation and gender.

3. A method for protecting victims of dating and investment telecommunications network fraud according to claim 1, characterized in that: The rule features include the amount of inter-bank transfers to unfamiliar counterparties on the same day exceeding three times the amount of transfers in the past six months, and the amount of inter-bank transfers to unfamiliar counterparties immediately exceeding 20,000 yuan after an amount is transferred in from securities or wealth management channels on the same day.

4. A method for protecting victims of dating and investment telecommunications network fraud according to claim 1, characterized in that: The step S6 also includes binning based on the toad open source package and the actual situation of each feature, analyzing the availability of each feature by calculating the correlation coefficient and IV value between each feature and the label, and eliminating features whose effective information is lower than a certain value.

5. The method for protecting victims of dating and investment telecommunications network fraud according to claim 1, characterized in that: After step 6, the method further includes: performing WOE transformation on the sample data, and using a two-way stepwise regression method to screen the characteristic variables again, so as to obtain the characteristic variables finally used for modeling.

6. A method for protecting victims of dating and investment telecommunications network fraud according to claim 1, characterized in that: The training process in step S7 is specifically as follows: iteratively training the sample data for logistic regression through the sklearn open source package, using the AUC of the validation set as the evaluation indicator and combining it with the F2 evaluation indicator to generate the optimal score card, and saving the output scoring criteria to obtain the target score card model, which is then verified on the test set. If the verification result does not meet expectations, the model parameters are adjusted through Bayesian parameter adjustment to obtain an updated target score card model.

7. A system for protecting victims of dating and investment telecommunications network fraud, characterized by: The method comprises: The data extraction module is used to conduct real-time statistical analysis of debit card transaction flows, capture corresponding indicators as basic features of debit cards, obtain derived features by combining basic features, and extract customer attributes as customer static features; The rule feature statistics module is used to bin each basic feature and derived feature, formulate rule features based on the binning situation, and make judgments after each debit card transaction. If the transaction meets the rule feature after it is generated, the number of times the debit card hits the rule is increased by 1, and the daily rule hit situation of each debit card is counted; The label setting module is used to count whether the holder of each debit card has reported a crime or related police situation every day. If so, the debit card on that day is recorded as a bad label, otherwise it is recorded as a good label, and the good and bad labels of the debit card are obtained; The feature splicing module is used to splice the daily rule hits of each debit card with the customer's static features to obtain the target feature set; The data partitioning module is used to divide the data set into a training set and a validation set by using a random sampling method, and the data of the next month after the sample cutoff month is used as the test set; The data processing module is used to clean the data set and process outliers and missing values; The model training module is used to train the model on the training set using the target feature set and the good and bad debit card labels, and use the AUC of the validation set as the evaluation indicator to obtain the target scorecard model, which is then verified using the test set; The fraud prediction module is used to input the rule hits and customer static features of real-time processed telecommunications network fraud victims into the target scoring card model, score the account's probability of being deceived, and then output a predicted set of high-probability fraud accounts through threshold division.

8. A system for protecting victims of telecommunication network fraud involving dating and investment according to claim 7, characterized in that: The basic features are selected based on expert experience, and include at least the number of debit card transactions on the day, the number of transactions during non-normal hours on the day, the number of trading counterparties on the day, the amount of funds received on the day, the amount of inter-bank transfers to unfamiliar counterparties on the day, the amount of transfers over six months, the amount of funds transferred in from securities or financial channels on the day, and the number of days since the last account movement; The derivative features include the proportion of transactions during non-normal periods to the total number of transactions, the proportion of the amount transferred across banks to unfamiliar counterparties on the same day to the amount transferred across banks in the past six months, and the total amount of money transferred across banks to unfamiliar counterparties immediately after the amount was transferred in from securities or wealth management channels on the same day; The customer static characteristics include age, occupation and gender.

9. A system for protecting victims of telecommunication network fraud involving dating and investment according to claim 7, characterized in that: The data processing module also includes combining the toad open source package and the actual situation of each feature to perform binning processing, analyzing the availability of each feature by calculating the correlation coefficient and IV value between each feature and the label, and eliminating features with effective information below a certain value.

10. A system for protecting victims of dating and investment telecommunication network fraud according to claim 7, characterized in that: The data processing module also includes: performing WOE transformation on the sample data, and using a two-way stepwise regression method to screen the characteristic variables again to obtain the characteristic variables finally used for modeling.

Images