Fraud control method and device based on AI large model call-out return visit and medium

Abstract

The invention discloses a fraud control method and device based on AI large model call-out return visit and a medium. The method comprises the following steps: constructing a user behavior feature tag system, and performing data marking operation on a machine learning data set by using the user behavior feature tag system; training the marked machine learning data set to obtain an AI large model with an outbound capability; and completing an outbound operation about the fraud call through the AI large model. According to the method, a cross-domain fusion AI large model is constructed through data such as real-time signaling, roaming signaling integration, terminal information and internet access DPI data, and an effective fraud recognition effect is achieved through data fusion modeling. And on the other hand, through the functions of outbound return visit study and judgment, voice early warning and dissuasion and the like, the targets of automatic accurate study and judgment and early warning in advance can be achieved, and the anti-fraud work efficiency is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of AI big model technology, and in particular to a fraud control method, device and medium based on AI big model outbound call return visit. Background Art

[0002] As technology develops and society changes, the forms of fraud are also constantly evolving. In the past, fraud often took on a high frequency and cast a wide net. Fraudsters would send a large number of text messages or make calls, trying to make up for the lack of quality with quantity. Although this strategy had a low success rate, it was widespread because of its low cost.

[0003] In recent years, telecommunications network fraud has gradually shifted towards low frequency and high precision. Unlike in the past, today’s fraudsters pay more attention to the selection of targets. They will collect personal information of potential victims through various channels and use this information to carefully design scams, making the fraudulent behavior very similar to normal user behavior in many aspects.

[0004] Traditional call behavior-based models mainly rely on features such as call frequency, time, and location to identify suspicious behavior. However, in the low-frequency, high-precision fraud model, the effectiveness of these traditional features is greatly reduced. As the call behavior of fraudsters is increasingly difficult to distinguish from the normal communications of ordinary users, call behavior modeling alone is no longer sufficient to achieve efficient fraud identification. Summary of the invention

[0005] In view of this, the embodiment of the present invention provides a fraud control method, device and medium based on AI large model outbound call return visit The first aspect of the present invention provides a fraud control method based on AI large model outbound call return visit, comprising the following steps: Constructing a user behavior feature labeling system, and using the user behavior feature labeling system to perform data labeling operations on machine learning data sets; By completing the training of the labeled machine learning data set, an AI large model with outbound calling capabilities is obtained; The outbound calling operation regarding fraudulent calls is completed through the AI ​​big model.

[0006] Furthermore, the construction of the user behavior feature label system specifically includes the following steps: Collect cross-domain fusion data associated with users; the cross-domain fusion data specifically includes user identity data, VOLTE registration signaling, call signaling, and Internet bills; Conduct behavioral analysis on cross-domain fusion data associated with users to generate user portraits; Perform statistical analysis on user portraits and generate behavioral feature labels for behavioral features that appear repeatedly in multiple user portraits; A user behavior feature label system is constructed based on the generated multiple behavior feature labels.

[0007] Furthermore, the use of the user behavior feature labeling system to perform data labeling on the machine learning data set specifically includes the following steps: Get normal phone samples as positive samples and fraud phone samples as negative samples to build a machine learning data set; Analyze the behavioral characteristics of each telephone sample in the machine learning dataset; assign a user behavioral characteristic label to each telephone sample.

[0008] Furthermore, the AI ​​big model is an XGBoost tree model, and the model function of the XGBoost tree model is: ; in, To predict the output, k represents the number of trees, Represents the k-th tree model; each time a tree is trained, the objective function is: ; Among them, N represents the number of samples, t represents the training of the tth tree, represents the tree model generated in the tth round, represents the regular term; the complexity of the tree is: ; Where T represents the total number of leaves in the tree, express The L2 norm of .

[0009] Furthermore, the AI ​​big model with outbound calling capability is obtained by completing the labeled machine learning data set training, which specifically includes the following steps: Select one or more model parameters to be fixed, and adjust the remaining parameters to perform model training; the model parameters include the number of boosting rounds, the weight ratio of positive and negative samples, post-pruning parameters, learning rate, minimum weight of child nodes, subsample ratio, and column sampling ratio; The optimal model parameter settings are evaluated through cross-validation and used as a large AI model with outbound calling capabilities.

[0010] Furthermore, the outbound call operation on fraudulent calls is completed by the AI ​​big model, specifically including the following steps: Receive the target number sent by the operator and use the AI ​​big model to determine the probability of the target number being involved in fraud; When the probability of the target number being involved in fraud is higher than the first probability threshold, the target number is shut down by CRM, and then an outbound call operation is performed using the AI ​​big model to obtain the outbound call result of the target number; when the outbound call result of the target number is not a fraud number, the target number is restored by CRM; When the probability of the target number being involved in fraud is between the first probability threshold and the second probability threshold, the AI ​​big model is used to perform an outbound call operation to obtain the outbound call result of the target number; when the outbound call result of the target number is a fraud number, the CRM shutdown operation is performed on the target number; When the probability of the target number being involved in fraud is lower than the second probability threshold, the target number is determined to be a non-fraud number and no operation is performed.

[0011] Furthermore, the use of the AI ​​big model for outbound calling operation specifically includes the following steps: Tracing the target number to obtain the callback number to be called; Make an outbound call to the callback number through the SIP proxy server, and play a preset fraud voice prompt to the callback number; the voice prompt is used to guide the user to identify the fraud number of the closed number; Receiving a DTMF signal sent by a user as an outbound call result of a callback number; the DTMF signal is transmitted via SIPINFO, RFC2833 or INBAND; According to the outbound call result of each callback number, it is determined whether the target number is a fraud number.

[0012] Furthermore, judging whether the target number is a fraud number according to the outbound call result of each callback number specifically includes the following steps: Perform DTMF signal analysis on the outbound call result to obtain the recognition result of the target number by the user corresponding to each callback number; Summarize the recognition results of the target number by the user corresponding to each return number to obtain a fraud recognition data set of the target number; When all the identification results in the fraud identification data set are fraud results, determining that the outbound call result of the target number is a fraud number; When the identification results in the fraud identification data set are all non-fraud results, determining that the outbound call result of the target number is a non-fraud number; When the identification results in the fraud identification data set include both fraud results and non-fraud results, manually identifying the outbound call result of the target number to determine whether it is a fraud number or a non-fraud number; Wherein, when the DTMF signal is transmitted through the SIP signaling channel, the outbound call result is subjected to DTMF signal analysis, specifically, the DTMF key triggered by the user is identified through the signal field in the SIPINFO packet; When the DTMF signal is transmitted through the RTP channel, if the data packet contains an RFC2833 data packet carrying the DTMF signal, the outbound call result is subjected to DTMF signal analysis, specifically, the DTMF key triggered by the user is identified through the TeleponeEvent field in the RFC2833 data packet; When the DTMF signal is transmitted via the RTP channel, if the data packet does not contain the RFC2833 data packet carrying the DTMF signal, the outbound call result is subjected to DTMF signal analysis, specifically by extracting the RTP data packet to perform spectrum analysis to identify the DTMF key triggered by the user.

[0013] A second aspect of the present invention discloses an electronic device, comprising a processor and a memory; The memory is used to store programs; The processor executes the program to implement the fraud control method based on AI large model outbound call return.

[0014] The third aspect of the present invention discloses a computer-readable storage medium, which stores a program, and the program is executed by a processor to implement the fraud control method based on AI large model outbound call return.

[0015] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0016] The embodiments of the present invention have the following beneficial effects: The present invention is a fraud control method, device and medium based on AI big model outbound call return visit. Through real-time signaling, roaming signaling integration, terminal information, Internet DPI data and other data, a cross-domain fusion AI big model is constructed, and effective fraud identification effect is achieved through data fusion modeling. On the other hand, the present invention can achieve the goals of automated accurate judgment and early warning through functions such as outbound call return visit judgment and voice warning dissuasion, effectively improving the efficiency of anti-fraud work.

[0017] Additional aspects and advantages of the present invention will be given in part in the following description, and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 It is a basic implementation flow chart of a fraud control method based on AI large model outbound call return visit in the present invention.

[0020] Figure 2 It is a schematic diagram of the user behavior feature label system architecture constructed by the present invention.

[0021] Figure 3 It is a schematic diagram of the outbound call operation processing flow of the AI ​​large model of the present invention.

[0022] Figure 4 It is a schematic diagram of the communication flow of the outbound call operation of the AI ​​large model of the present invention.

[0023] Figure 5 It is a schematic diagram of the DTMF signal recognition process of the present invention.

[0024] Figure 6 It is a structural schematic diagram of an electronic device of the present invention.

[0025] Figure 7 It is a schematic diagram of the structure of a computer-readable storage medium of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0027] Although there are many anti-fraud models at present, some models have integrated O domain (Operation Support System) signaling and B domain (Business Support System) call records, combined with data such as B domain user basic information, and have the data conditions for various data fusion analyses, and can realize big data model analysis, identification, and disposal of fraud-related numbers. However, the fraud situation has gradually developed into low-frequency and high-precision fraud, and the calling behavior is close to the calling behavior of normal users. Fraudsters continue to test system loopholes and the fraud methods are constantly updated. The big data anti-fraud modeling work faces huge challenges. The identification accuracy rate of call behavior modeling alone is not high. In order to improve the service level of operators, other means of assistance are urgently needed.

[0028] In this regard, the first embodiment of the present invention provides a fraud control method based on AI large model outbound call return visit, such as Figure 1 The following steps are shown: S1. Build a user behavior feature labeling system, and use the user behavior feature labeling system to perform data labeling operations on the machine learning data set; S2. Obtain an AI model with outbound calling capabilities by completing the training of the labeled machine learning dataset; S3. Complete outbound calling operations regarding fraudulent calls through the AI ​​big model.

[0029] In the embodiment of the present invention, an AI big model is constructed by fusing data. The AI ​​big model can effectively distinguish between fraudulent call behaviors and normal call behaviors, realize automatic and accurate judgment of fraudulent calls, and effectively improve the efficiency of anti-fraud work.

[0030] The implementation process of each step of the present invention is discussed in detail below.

[0031] S1. Build a user behavior feature labeling system, and use the user behavior feature labeling system to perform data labeling operations on the machine learning data set.

[0032] In step S1, the user behavior feature label system is constructed through the user's cross-domain fusion data. Specifically, the cross-domain fusion data includes the following data: 1. User basic information data. User basic information data includes the value of the user's package, whether it is a fusion package, whether the user has an out-of-town ID card, whether the household registration place is rural, etc.

[0033] 2. VOLTE registration signaling. The key fields of VOLTE registration signaling are shown in Table 1: Table 1 VOLTE registration signaling table

[0034] 3. Call signaling data. The call signaling data is shown in Table 2: Table 2 Call signaling table

[0035] 4. Internet call data. Internet call data is shown in Table 3: Table 3 Online call list

[0036] The embodiment of the present invention can analyze and simulate the actual behavior pattern of users by collecting cross-domain fusion data associated with users, that is, to perform behavior modeling on users, and then construct a user profile for each user. The user's usage preferences such as calling time, called type, calling location, etc. are obtained by analyzing the cross-domain fusion data associated with users, and the usage preferences are summarized to form a user profile.

[0037] After obtaining multiple user portraits, the embodiment of the present invention performs statistical analysis on the user portraits and generates behavioral feature labels for the behavioral features that appear repeatedly in multiple user portraits. Specifically, the embodiment of the present invention classifies behavioral features into categories such as call features, terminal features, location features, Internet features, social features, and SMS features, and generates corresponding behavioral feature labels in each category based on the different behaviors of users in the user portraits. For example, the Internet feature category includes labels such as Internet traffic, Internet time, whether VOIP software is used, and whether remote control software is used, which respectively correspond to users who use different traffic, different time, and different Internet access methods. Finally, a structure such as the following is constructed based on the multiple behavioral feature labels generated. Figure 2 The user behavior feature label system shown.

[0038] In step S1, the user behavior feature labeling system is used to perform data labeling operations on the machine learning dataset. The machine learning dataset requires positive samples (normal phone samples) and negative samples (fraudulent phone samples). In this embodiment of the present invention, the numbers of users who have successfully signed the anti-fraud agreement and have been restored provided by the relevant departments are used as the source of non-fraudulent users, and the user numbers in the work orders involved in the case provided by the relevant departments are used as the source of fraudulent users to construct a machine learning dataset. After that, the behavioral characteristics of each phone sample in the machine learning dataset are further analyzed; user behavior feature labels are assigned to each phone sample. The dataset samples are shown in Table 4: Table 4 Dataset samples

[0039] In the embodiment of the present invention, the feature index is binarized and assigned to the telephone sample, 0 represents no, and 1 represents yes. The data set is divided into two parts: training set (80%) and test set (20%). The training set is used for model training and parameter adjustment, and the test set is used for the final model evaluation.

[0040] S2. Obtain an AI model with outbound calling capabilities by completing the training of the labeled machine learning dataset.

[0041] The AI ​​big model used in the embodiment of the present invention is the XGBoost tree model. Boosting belongs to an ensemble learning algorithm, which combines multiple weak learners into a strong learner according to different weights, and optimizes the objective function by continuously fitting the residual, so as to achieve accurate prediction and classification effects. Based on Boosting, XGBoost performs a second-order Taylor expansion on the lose function and adds a regularization term to measure the decrease of the objective function and the complexity of the model to prevent overfitting.

[0042] Therefore, XGBoost, as an improved Boosting algorithm based on GBDT, has the advantages of fast training speed and high prediction accuracy, and is suitable for use as an AI large model in the embodiment of the present invention.

[0043] The model function of the XGBoost tree model is: ; in, To predict the output, k represents the number of trees, Represents the kth tree model. Each time a tree is trained, the objective function is: ; Among them, N represents the number of samples, t represents the training of the tth tree, represents the tree model generated in the tth round, represents the regular term. The complexity of the tree is: ; Where T represents the total number of leaves in the tree, express The L2 norm of .

[0044] As a preferred embodiment, the training of the XGBoost model is achieved through parameter tuning. Specifically, the embodiment of the present invention mainly focuses on the following parameters: num_boost_round (number of boost rounds), scale_pos_weight (positive and negative sample weight ratio), gamma (post-pruning parameter), eta (learning rate), min_child_weight (minimum weight of child nodes), subsample (subsample ratio), colsample_bytree (column sampling ratio when constructing a tree). In addition, all models set random_state to 2024 to ensure the reproducibility of the results.

[0045] In the parameter tuning process, the embodiment of the present invention first fixes some parameters (such as eta, min_child_weight, subsample and colsample_bytree are all set to 0.2, 4, 0.9 and 0.9), and then makes detailed adjustments to other parameters. For example, the value of num_boost_round is tested as 500, 800, 1000, etc. to explore the impact of different boost rounds on model performance. scale_pos_weight is adjusted from 300 to 600 to examine the ability of the model to handle unbalanced data with different positive and negative sample weight ratios.

[0046] After multiple rounds of experiments, the results show that when num_boost_round is 800, scale_pos_weight is 600, and gamma is 4, the model achieves the best performance, which is reflected in the accuracy rate rising to 97.98%. At the same time, the precision rate, recall rate, and false positive rate also achieve a good balance, which are 92.03%, 84.84%, and 7.97%, respectively, as shown in Table 5: Table 5. Results of some parameter adjustments for XGBoost

[0047] After model training, the AI ​​big model is used to determine whether the number belongs to a fraudulent user. The specific probability of a fraudulent user is shown in Table 6: Table 6 XGBoost model output results

[0048] S3. Complete outbound calling operations regarding fraudulent calls through the AI ​​big model.

[0049] In step S3, the outbound call operation on the fraudulent call is completed by the AI ​​big model, which specifically includes the following steps: S3-1. Receive the target number sent by the operator and use the AI ​​big model to determine the probability of the target number being involved in fraud; S3-2a. When the probability of the target number being involved in fraud is higher than the first probability threshold, after the CRM shutdown operation is performed on the target number, the AI ​​large model is used for outbound call operation to obtain the outbound call result of the target number; when the outbound call result of the target number is a non-fraud number, the CRM recovery operation is performed on the target number; S3-2b. When the probability of the target number being involved in fraud is between the first probability threshold and the second probability threshold, use the AI ​​large model to perform an outbound call operation to obtain the outbound call result of the target number; when the outbound call result of the target number is a fraud number, the CRM shutdown operation is performed on the target number; S3-2c. When the probability of the target number being involved in fraud is lower than the second probability threshold, the target number is determined to be a non-fraudulent number and no operation is performed.

[0050] The trained AI big model in the embodiment of the present invention has the ability to judge the probability of a user being involved in fraud. After the judgment of the probability of fraud is completed, the embodiment of the present invention defines two probability thresholds, and numbers above the first probability threshold are regarded as high-risk numbers, numbers between the first probability threshold and the second probability threshold are regarded as low-risk numbers, and numbers below the second probability threshold are regarded as normal numbers.

[0051] As a specific embodiment, the first probability threshold can be set to 80%, and the second probability threshold can be set to 60%. Numbers with a fraud probability of 60% to 80% can be output to low-risk numbers, and numbers with a fraud probability greater than 80% can be output to high-risk numbers.

[0052] For high-risk numbers, the probability of the number being involved in fraud is higher. After the model detects the risky number, it should prioritize shutting down the number, and then send it to the AI ​​large model for AI outbound call operation. If the outbound call result is a fraud number, just keep it shut down. If the outbound call result is not a fraud number, start the target number's restoration process, automatically complete the shutdown of the shut-down number, and ensure the normal use of the target number, thereby reducing accidental injuries.

[0053] For low-risk numbers, the probability that the number is involved in fraud is slightly lower, and the model is not accurate enough. After the model detects the risk, the target number should be sent to the AI ​​large model for AI outbound call operation. If the outbound call result is fraud, the number will be shut down. If the outbound call result is not fraud, no action is required to ensure the normal use of the number, so as to avoid slipping through the net.

[0054] The specific execution process of step S3 is as follows: Figure 3 The embodiment of the present invention adopts different response methods for numbers of different risk levels, and executes first shutting down and then outbound calls for high-risk numbers, and first outbound calls and then shutting down for low-risk numbers, so as to achieve a balance between shutdown timeliness and accuracy.

[0055] In step S3-2, the outbound call operation is performed using the AI ​​big model, which specifically includes the following steps: S3-2-1. Trace the target number to get the return number you need to call; S3-2-2. Make an outbound call to the return number through the SIP proxy server and play a preset fraud voice prompt to the return number; the voice prompt is used to guide the user to identify the fraud number on the shutdown number; S3-2-3 receives the DTMF signal sent by the user as the result of the outbound call to the callback number; the DTMF signal is transmitted by SIPINFO, RFC2833 or INBAND; S3-2-4. Determine whether the target number is a fraud number based on the outbound call result of each callback number.

[0056] In the embodiment of the present invention, the outbound call operation of the AI ​​large model is performed through the SIP proxy server. When the SIP proxy server receives the outbound call instruction from the AI ​​large model, it initiates a call to the called number as the caller and notifies the RTP server to transmit the media stream data packet to the called number. The specific outbound call process is as follows: Figure 4 shown.

[0057] As a specific example, the fraud voice prompt played by the AI ​​large model is as follows: AI Customer Service: Hello, this is the anti-fraud hotline. The system has detected that you have recently received a suspected fraud call with the last number XXXX. In order to protect the safety of your property, we would like to share the content of the call with you. Please select according to the voice content: if the content does not involve fraud, please press 0; if it is fraud involving impersonating customer service, please press 1; if it is fraud involving false credit investigation, please press 2; if it is fraud involving fake orders and rebates, please press 3; if it is fraud involving impersonating a leader or acquaintance, please press 4; if it is fraud involving false investment and financial management, please press 5; if it is other types of fraud, please press 6; (user selects by pressing buttons...).

[0058] AI customer service (reminder to prevent fraud): OK, we have understood and recorded it. This type of number is suspected of having a very high risk of fraud. Whenever the other party asks for a transfer, verification code, etc., be sure to verify more to avoid being deceived. There have been many telecommunications and Internet fraud calls recently, so please be vigilant. If you receive similar fraud calls again, you can call the national anti-fraud hotline 96110 to report it. Thank you for your cooperation. Goodbye.

[0059] In the embodiment of the present invention, S3-2-4. According to the outbound call result of each callback number, it is determined whether the target number is a fraud number, specifically comprising the following steps: S3-2-4-1. DTMF signal analysis is performed on the outbound call result to obtain the recognition result of the target number corresponding to each return number of the user; S3-2-4-2. The identification results of the target number corresponding to each return number are summarized to obtain a fraud identification data set of the target number; S3-2-4-3a. When the identification results in the fraud identification data set are all fraud results, it is determined that the outbound call result of the target number is a fraud number; S3-2-4-3b. When the identification results in the fraud identification data set are all non-fraud results, it is determined that the outbound call result of the target number is a non-fraud number; S3-2-3c. When the identification results in the fraud identification data set include both fraud results and non-fraud results, the outbound call result of the target number is determined to be a fraud number or a non-fraud number through manual identification.

[0060] In the embodiment of the present invention, the identification given by the user is determined by analyzing the DTMF signal sent by the user. In the SIP proxy server, the DTMF signal may transmit DTMF data through the SIP signaling channel and be transmitted separately from the voice data. In this regard, the embodiment of the present invention identifies the DTMF key through the signal field in the SIPINFO packet. The DTMF signal may also be transmitted through the RTP channel. At this time, it is necessary to consider the situation separately. If the data packet contains an RFC2833 data packet loaded with DTMF signals, the DTMF signal analysis is performed on the outbound call result, and the DTMF key triggered by the user is specifically identified through the TeleponeEvent field in the RFC2833 data packet; at this time, it is necessary to obtain the TeleponeEvent parameters negotiated by the SDP in advance before performing the RFC2833 DTMF detection. If the data packet does not contain an RFC2833 data packet loaded with DTMF signals, the DTMF signal analysis is performed on the outbound call result, and the spectrum analysis is performed by extracting the RTP data packet to identify the DTMF key triggered by the user.

[0061] Specific implementation effects such as Figure 5 As shown, the embodiment of the present invention identifies the DTMF signal fed back by the user in the above manner to learn whether the target number is a fraud. When the results fed back by the user in all the return numbers are all fraud numbers, the outbound call result of the target number is judged to be a fraud number; when the results fed back by the user in all the return numbers are all non-fraud numbers, the outbound call result of the target number is judged to be a non-fraud number; if the results fed back by the user in all the return numbers include both fraud numbers and non-fraud numbers, manual identification is performed by professionals such as the government anti-fraud comprehensive management platform to judge whether the number is a fraud number or a non-fraud number.

[0062] In summary, the embodiments of the present invention fully integrate real-time signaling, roaming signaling integration, terminal information, Internet DPI data, etc. to build a cross-domain integrated AI big data model, train the AI ​​model based on fraudulent number samples, and maximize the countermeasure effect through data fusion modeling. The present invention uses cutting-edge technologies such as AI and big data to build an AI big model. Through functions such as outbound call return analysis and judgment, voice warning and dissuasion, etc., it can achieve the goals of automated accurate analysis and judgment, early warning, and improve the efficiency of anti-fraud work.

[0063] Figure 6It is a structural diagram of the electronic device proposed in the second embodiment of the present invention. The memory of this embodiment stores program instructions for implementing the fraud control method based on AI large model outbound call return visit of any of the above embodiments. The processor is used to execute the program instructions stored in the memory to perform fraud control based on AI large model outbound call return visit. Among them, the processor can also be called CPU (Central Processing Unit). The processor may be an integrated circuit chip with signal processing capabilities. The processor can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0064] The contents of the method in the first embodiment of the present invention are all applicable to the electronic device embodiment. The functions specifically implemented by the electronic device embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method.

[0065] Figure 4 It is a structural diagram of the computer-readable storage medium of the third embodiment of the present invention. The computer-readable storage medium of the fourth embodiment of the present invention stores program instructions that can implement the above-mentioned fraud control method based on AI large model outbound call return, wherein the program instructions can be stored in the above-mentioned storage medium in the form of a software product, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of each implementation method of the present invention. The aforementioned computer-readable storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes, or terminal devices such as computers, servers, mobile phones, tablets, etc.

[0066] The contents of the method in the first embodiment of the present invention are all applicable to the computer-readable storage medium embodiment. The functions specifically implemented by the computer-readable storage medium embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method.

[0067] This embodiment also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement the fraud control method based on AI large model outbound call return provided in the above embodiment.

[0068] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0069] Those skilled in the art will appreciate that the modules in the devices in the embodiments of the present invention may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments of the present invention may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the corresponding claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the corresponding claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0070] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0071] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0072] In addition, each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. In particular, for embodiments such as devices and equipment, since they are basically similar to method embodiments, the relevant parts can refer to the partial description of the method embodiments. The embodiments of the devices and equipment described above are merely schematic, wherein the modules, units, etc. described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed in multiple places, such as nodes of a system network. Specifically, some or all of the modules and units may be selected according to actual needs to achieve the purpose of the above-mentioned embodiment scheme. Those skilled in the art can understand and implement it without paying creative labor.

[0073] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0074] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0075] In addition, the terms "first", "second", etc. used in the embodiments of the present invention are only used for descriptive purposes and should not be understood as indicating or implying relative importance, or implicitly indicating the number of technical features indicated in the present embodiment. Therefore, the features defined by the terms "first", "second", etc. in the embodiments of the present invention can explicitly or implicitly indicate that the embodiment includes at least one of the features. In the description of the present invention, the word "multiple" means at least two or two or more, such as two, three, four, etc., unless otherwise clearly and specifically defined in the embodiments.

[0076] In the embodiments of the present invention, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element. In addition, components, features, and elements with the same name in different embodiments of the present invention may have the same meaning or different meanings, and their specific meanings need to be determined by their explanation in the specific embodiment or further combined with the context in the specific embodiment.

[0077] Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and cannot be construed as limitations of the present invention, and those of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention. Those skilled in the art will readily come to think of other embodiments of the present invention after considering the specification and practicing the present invention. This application is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art that are not disclosed in the present invention. The specification and embodiments are intended to be exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

Claims

1. A fraud control method based on AI large model outbound call return visit, characterized in that: The following steps are involved: Constructing a user behavior feature labeling system, and using the user behavior feature labeling system to perform data labeling operations on machine learning data sets; By completing the training of the labeled machine learning data set, an AI large model with outbound calling capabilities is obtained; The outbound calling operation regarding fraudulent calls is completed through the AI ​​big model.

2. According to claim 1, a fraud control method based on AI large model outbound call return visit is characterized in that: The construction of the user behavior feature label system specifically includes the following steps: Collect cross-domain fusion data associated with users; the cross-domain fusion data specifically includes user identity data, VOLTE registration signaling, call signaling, and Internet bills; Conduct behavioral analysis on cross-domain fusion data associated with users to generate user portraits; Perform statistical analysis on user portraits and generate behavioral feature labels for behavioral features that appear repeatedly in multiple user portraits; A user behavior feature label system is constructed based on the generated multiple behavior feature labels.

3. According to claim 1, a fraud control method based on AI large model outbound call return visit is characterized in that: The use of the user behavior feature labeling system to perform data labeling on the machine learning data set specifically includes the following steps: Get normal phone samples as positive samples and fraudulent phone samples as negative samples to build a machine learning data set; Analyze the behavioral characteristics of each telephone sample in the machine learning dataset; assign a user behavioral characteristic label to each telephone sample.

4. According to claim 1, a fraud control method based on AI large model outbound call return visit is characterized in that: The AI ​​big model is an XGBoost tree model, and the model function of the XGBoost tree model is: ； in, To predict the output, k represents the number of trees, Represents the k-th tree model; each time a tree is trained, the objective function is: ； Among them, N represents the number of samples, t represents the training of the tth tree, represents the tree model generated in the tth round, represents the regular term; the complexity of the tree is: Where T represents the total number of leaves in the tree, express The L2 norm of .

5. According to claim 1, a fraud control method based on AI large model outbound call return visit is characterized in that: The method of obtaining an AI large model with outbound calling capability by completing the labeled machine learning data set training specifically includes the following steps: Select one or more model parameters to be fixed, and adjust the remaining parameters to perform model training; the model parameters include the number of boosting rounds, the weight ratio of positive and negative samples, post-pruning parameters, learning rate, minimum weight of child nodes, subsample ratio, and column sampling ratio; The optimal model parameter settings are evaluated through cross-validation and used as a large AI model with outbound calling capabilities.

6. According to claim 1, a fraud control method based on AI large model outbound call return visit is characterized in that: The method of completing the outbound call operation regarding fraudulent calls through the AI ​​big model specifically includes the following steps: Receive the target number sent by the operator and use the AI ​​model to determine the probability of the target number being involved in fraud; When the probability of the target number being involved in fraud is higher than the first probability threshold, the target number is shut down by CRM, and then an outbound call operation is performed using the AI ​​big model to obtain the outbound call result of the target number; when the outbound call result of the target number is not a fraud number, the target number is restored by CRM; When the probability of the target number being involved in fraud is between the first probability threshold and the second probability threshold, the AI ​​big model is used to perform an outbound call operation to obtain the outbound call result of the target number; when the outbound call result of the target number is a fraud number, the CRM shutdown operation is performed on the target number; When the probability of the target number being involved in fraud is lower than the second probability threshold, the target number is determined to be a non-fraud number and no operation is performed.

7. According to claim 6, a fraud control method based on AI large model outbound call return visit is characterized in that: The outbound call operation using the AI ​​big model specifically includes the following steps: Tracing the target number to obtain the callback number to be called; Make an outbound call to the callback number through the SIP proxy server, and play a preset fraud voice prompt to the callback number; the voice prompt is used to guide the user to identify the fraud number of the closed number; Receiving a DTMF signal sent by a user as an outbound call result of a callback number; the DTMF signal is transmitted via SIPINFO, RFC2833 or INBAND; According to the outbound call result of each callback number, it is determined whether the target number is a fraud number.

8. According to claim 7, a fraud control method based on AI large model outbound call return visit is characterized in that: The step of judging whether the target number is a fraud number according to the outbound call result of each callback number specifically includes the following steps: Perform DTMF signal analysis on the outbound call result to obtain the recognition result of the target number by the user corresponding to each callback number; Summarize the recognition results of the target number by the user corresponding to each return number to obtain a fraud recognition data set of the target number; When all the identification results in the fraud identification data set are fraud results, determining that the outbound call result of the target number is a fraud number; When the identification results in the fraud identification data set are all non-fraud results, determining that the outbound call result of the target number is a non-fraud number; When the identification results in the fraud identification data set include both fraud results and non-fraud results, manually identifying the outbound call result of the target number to determine whether it is a fraud number or a non-fraud number; Wherein, when the DTMF signal is transmitted through the SIP signaling channel, the outbound call result is subjected to DTMF signal analysis, specifically, the DTMF key triggered by the user is identified through the signal field in the SIPINFO packet; When the DTMF signal is transmitted through the RTP channel, if the data packet contains an RFC2833 data packet carrying the DTMF signal, the outbound call result is subjected to DTMF signal analysis, specifically, the DTMF key triggered by the user is identified through the TeleponeEvent field in the RFC2833 data packet; When the DTMF signal is transmitted via the RTP channel, if the data packet does not contain the RFC2833 data packet carrying the DTMF signal, the outbound call result is subjected to DTMF signal analysis, specifically by extracting the RTP data packet to perform spectrum analysis to identify the DTMF key triggered by the user.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement a fraud control method based on AI large model outbound call return as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement a fraud control method based on AI large model outbound call return as described in any one of claims 1-8.

Images