Abnormal number tracing method and device based on big data, equipment and medium

Abstract

The invention provides an abnormal number tracing method and device based on big data, equipment and a medium. Comprising the following steps: if a to-be-traced number is determined as an abnormal number from a pre-acquired abnormal number behavior feature library, tracing the to-be-traced number according to a pre-acquired traceability tag library to obtain a plurality of feature tags corresponding to the to-be-traced number; according to the plurality of feature tags corresponding to the to-be-traced number and a traceability tag library, determining a target group to which the to-be-traced number belongs and a plurality of feature tags of the target group by adopting an atlas analysis technology; and constructing a group relation graph by adopting a graph technology according to the plurality of feature tags of the target group. According to the method provided by the invention, the full-scene and full-life-cycle accurate identification and traceability of the abnormal number are realized.

Description

Technical Field

[0001] The present application relates to the technical field of big data analysis, and in particular to a method, device, equipment and medium for tracing abnormal numbers based on big data. Background Art

[0002] With the rapid advancement of technology, online fraud methods are becoming more complex and covert. Criminals cleverly use the convenience of the Internet and mobile communications to trick victims into transferring money and leaking sensitive information through identity forgery and false information, causing huge harm. In order to effectively curb this trend, anti-fraud tracing technology has rapidly emerged as a key defense measure.

[0003] The current tracing of fraudulent numbers mainly includes Internet Protocol (IP) address tracking, communication number flow tracing, virtual dial-up integrated communication (GSM Over Internet Protocol, GOIP) device identification and tracing, black market fraud information database and other technical means to achieve comprehensive tracing of abnormal numbers from source to destination.

[0004] However, the tracing depth of the above abnormal number tracing technology is low, resulting in low tracing accuracy. Summary of the invention

[0005] The present application provides a method, device, equipment and medium for tracing the source of abnormal numbers based on big data, so as to solve the problems of low depth and low tracing accuracy of existing abnormal number tracing technology.

[0006] In a first aspect, the present application provides a method for tracing abnormal numbers based on big data, comprising:

[0007] Determine from the pre-acquired abnormal number behavior feature library that the number to be traced is an abnormal number, then trace the number to be traced according to the pre-acquired traceability label library to obtain multiple feature labels corresponding to the number to be traced, wherein the abnormal number behavior feature library includes multiple abnormal numbers and feature data corresponding to each abnormal number, and the traceability label library includes multiple dimensional feature labels obtained based on the characteristics of multiple dimensions in user attribute characteristics, network access channel characteristics, communication behavior characteristics, Internet behavior characteristics, natural person characteristics and risk characteristics in historical data analyzed based on big data;

[0008] Determine, according to the plurality of characteristic tags corresponding to the number to be traced and the traceability tag library, a plurality of characteristic tags of the target group to which the number to be traced belongs;

[0009] According to the multiple characteristic tags of the target group, a group relationship graph is constructed by using graph technology, and the group relationship graph is used to indicate the characteristic relationship between multiple users in the target group.

[0010] Optionally, the method as described above, determining multiple characteristic tags of the target group to which the number to be traced belongs according to the multiple characteristic tags corresponding to the number to be traced and the traceability tag library, includes:

[0011] Acquire multiple target numbers associated with the number to be traced;

[0012] Based on the traceability label library, the multiple target numbers are traced respectively to obtain multiple feature labels corresponding to each target number;

[0013] The multiple characteristic tags of the target group to which the number to be traced belongs include: multiple characteristic tags of the number to be traced, and characteristic tags corresponding to the multiple target numbers.

[0014] Optionally, the method described above, based on multiple feature tags of the target group, uses graph technology to construct a group relationship graph, including:

[0015] According to multiple feature tags of the target group, the number to be traced is taken as the main node, and other numbers in the target group and different feature tags are taken as nodes. All nodes are associated with the calling and called relationships between numbers and the relationships between the feature tags of each number to obtain the group relationship graph.

[0016] Optionally, in the method described above, before tracing the number to be traced according to the pre-acquired traceability tag library to obtain a plurality of characteristic tags corresponding to the number to be traced, the method further includes:

[0017] Get historical data of multiple numbers from the source database;

[0018] Based on the historical data of the multiple numbers, feature analysis is performed using machine learning to obtain feature data of multiple dimensions including user attribute features, network access channel features, communication behavior features, Internet behavior features, natural person features, and risk features;

[0019] The feature data of the multiple dimensions are labeled to obtain feature labels of the multiple dimensions, and the feature labels of the multiple dimensions are stored in a traceability label library.

[0020] Optionally, in the method described above, labeling the feature data of the multiple dimensions to obtain feature labels of the multiple dimensions includes:

[0021] Extracting multiple indivisible atomic labels from the feature data of the multiple dimensions;

[0022] Based on the multiple atomic tags, determining multiple rule tags according to preset business rules;

[0023] Based on the multiple atomic tags, the user's historical behavior is analyzed through a deep learning algorithm to obtain multiple algorithm tags and multiple real-time tags; wherein the multiple algorithm tags include: user risk level, abnormal device behavior, and high-risk IP association tags, and the multiple real-time tags include call behavior, SMS behavior, traffic behavior, trajectory behavior, and model detection times;

[0024] Based on the multiple atomic tags and the preset multiple time periods, obtaining a combined tag corresponding to each time period;

[0025] The feature tags of the multiple dimensions are acquired according to the multiple atomic tags, the multiple rule tags, the multiple algorithm tags, the multiple real-time tags and the combined tags corresponding to each time period.

[0026] Optionally, in the method described above, the feature labels of multiple dimensions include:

[0027] User basic tags, channel tags, terminal tags, natural person tags, user risk tags, call behavior tags, SMS behavior tags, Internet behavior tags, traffic behavior tags, and time-space behavior tags.

[0028] Optionally, the method described above uses machine learning to perform feature analysis based on the historical data of the multiple numbers. It includes:

[0029] Preprocessing the historical data of the multiple numbers to obtain processed historical data of the multiple numbers, and performing feature analysis on the processed historical data of the multiple numbers using a machine learning method;

[0030] The preprocessing includes at least one of the following processing methods: data cleaning, abnormal data elimination, missing data completion, data format conversion and unified encoding using a preset encoding method.

[0031] Optionally, the method as described above further comprises:

[0032] Obtaining the number to be traced;

[0033] Based on the similarity between the feature data of the number to be traced and the feature data corresponding to each abnormal number in the abnormal number behavior feature library, it is determined whether the number to be traced is an abnormal number.

[0034] In a second aspect, the present application provides an abnormal number tracing device based on big data, comprising:

[0035] A module for obtaining a feature label of the number to be traced, which is used to trace the number to be traced according to the pre-acquired tracing label library to obtain multiple feature labels corresponding to the number to be traced if the number to be traced is determined to be an abnormal number from the pre-acquired abnormal number behavior feature library, wherein the abnormal number behavior feature library includes multiple abnormal numbers and feature data corresponding to each abnormal number, and the tracing label library includes multiple dimensions of feature labels obtained based on the characteristics of multiple dimensions in user attribute characteristics, network access channel characteristics, communication behavior characteristics, Internet behavior characteristics, natural person characteristics and risk characteristics in historical data analyzed based on big data;

[0036] A target group feature label obtaining module determines multiple feature labels of the target group to which the number to be traced belongs based on multiple feature labels corresponding to the number to be traced and the traceability label library using language;

[0037] The group relationship map construction module is used to construct a group relationship map using a map technology according to multiple feature tags of the target group, and the group relationship map is used to indicate the feature relationship between multiple users in the target group.

[0038] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0039] The memory stores computer-executable instructions;

[0040] The processor executes the computer-executable instructions stored in the memory to implement the method described in the first aspect.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0042] The abnormal number tracing method, device, equipment and medium based on big data provided by the present application, if it is determined from a pre-acquired abnormal number behavior feature library that the number to be traced is an abnormal number, then the number to be traced is traced according to a pre-acquired traceability label library, and multiple feature labels corresponding to the number to be traced are obtained, wherein the abnormal number behavior feature library includes multiple abnormal numbers and feature data corresponding to each abnormal number, and the traceability label library includes multiple dimensions of feature labels obtained based on the big data analysis of user attribute characteristics, network access channel characteristics, communication behavior characteristics, Internet behavior characteristics, natural person characteristics and risk characteristics in historical data; according to the multiple feature labels corresponding to the number to be traced and the traceability label library, multiple feature labels of the target group to which the number to be traced belongs are determined; according to the multiple feature labels of the target group, a group relationship map is constructed by using graph technology to achieve accurate identification and tracing of abnormal numbers in all scenarios and throughout the entire life cycle. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] Figure 1 A schematic diagram of the group relationship map of the abnormal number tracing method based on big data proposed in this application;

[0045] Figure 2 This is a flow chart of the first embodiment of the abnormal number tracing method based on big data proposed in this application;

[0046] Figure 3 This is a flow chart of Embodiment 2 of the abnormal number tracing method based on big data proposed in this application;

[0047] Figure 4 A flowchart of the third embodiment of the abnormal number tracing method based on big data provided by the present application;

[0048] Figure 5 A flowchart of a fourth embodiment of the abnormal number tracing method based on big data provided by the present application;

[0049] Figure 6 A flowchart of a fifth embodiment of the method for tracing the source of abnormal numbers based on big data provided in an embodiment of the present application;

[0050] Figure 7 A framework diagram of the process of constructing a traceability tag library in the abnormal number tracing method based on big data provided in an embodiment of the present application;

[0051] Figure 8 A tracing flow chart of the abnormal number tracing method based on big data provided in an embodiment of the present application;

[0052] Fig. 9 A schematic diagram of the structure of an abnormal number tracing device based on big data provided in an embodiment of the present application;

[0053] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0054] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0055] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0056] With the rapid advancement of science and technology, telecommunications network fraud methods are becoming increasingly complex and covert. The current tracing of fraudulent numbers mainly includes Internet Protocol (IP) address tracking, communication number flow tracing, virtual dial-up integrated communication (GSM Over Internet Protocol, GOIP) equipment identification and tracing, black industry fraud information database and other technical means. However, the above-mentioned tracing technologies have a single data dimension, insufficient data utilization, insufficient tracing accuracy, long tracing cycle and lack of full life cycle tracing. In the face of increasingly complex and changing situations, there is a lack of effective data mining and analysis methods, resulting in a waste of data resources and inaccurate number tracing results.

[0057] In order to solve the above problems, the inventor proposed to integrate multi-dimensional data sources (including call records, traffic, signaling, trajectory and other data), build a comprehensive number feature model and feature label, and then build a fine-grained label system including atomic labels, rule labels, combination labels, algorithm labels and real-time labels. This dynamic label system can reflect the changes in number behavior in real time, ensure the timeliness and accuracy of the label, and significantly improve the accuracy of identifying fraudulent and high-risk numbers.

[0058] Figure 1 This is a schematic diagram of the group relationship map of the abnormal number tracing method for big data provided by this application. Figure 1As shown in the figure, the group relationship map can intuitively display the relationship structure between the target number and the associated numbers in the form of nodes and edges. Using machine learning and graph analysis technology, it is easy to identify closely connected groups or specific behavior patterns in the group, thereby providing support for number tracing. Secondly, the group relationship map can not only display the current association relationship, but also dynamically track changes in user behavior through real-time tags and algorithm tags. Through this dynamic identification, the system can quickly discover newly emerging high-risk numbers and identify potential risk groups, facilitating timely intervention measures. In addition, the group relationship map provides a graphical and visual presentation method, making complex relationship structures more intuitive.

[0059] The execution subject of the abnormal number tracing method based on big data provided in the embodiment of the present application can be a server. Among them, the server can be a computer or other equipment. This embodiment does not impose any special restrictions on the implementation method of the execution subject. As long as the execution subject can determine that the number to be traced is an abnormal number from the abnormal number behavior feature library obtained in advance, the number to be traced is traced according to the pre-acquired traceability label library, and multiple feature labels corresponding to the number to be traced are obtained, wherein the abnormal number behavior feature library includes multiple abnormal numbers and feature data corresponding to each abnormal number, and the traceability label library includes multiple dimensions of feature labels obtained based on the user attribute characteristics, network access channel characteristics, communication behavior characteristics, Internet behavior characteristics, natural person characteristics and risk characteristics in the historical data of big data analysis; according to the multiple feature labels corresponding to the number to be traced and the traceability label library, determine the multiple feature labels of the target group to which the number to be traced belongs; according to the multiple feature labels of the target group, a group relationship map is constructed using the map technology, and the group relationship map is used to indicate the feature relationship between multiple users in the target group.

[0060] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0061] Figure 2 This is a flow chart of the first embodiment of the abnormal number tracing method based on big data provided by this application. Figure 2 As shown, the method may include:

[0062] S201. If the number to be traced is determined to be an abnormal number from the pre-acquired abnormal number behavior feature library, the number to be traced is traced according to the pre-acquired tracing label library to obtain a plurality of feature labels corresponding to the number to be traced.

[0063] In the embodiment of the present application, the abnormal number behavior feature library is constructed by analyzing abnormal numbers according to the cutting-edge fusion strategy of deep learning and big data technology, wherein the abnormal number behavior feature library mainly includes multiple abnormal numbers and feature data corresponding to each abnormal number. Specifically, the abnormal number behavior feature library is constructed as follows: (1) Supervised learning classification: Use supervised learning algorithms such as logistic regression and random forest to accurately classify the behavioral characteristics of known abnormal numbers, establish clear classification boundaries, and provide basic classification rules for the identification process. (2) Unsupervised learning clustering: Use unsupervised learning algorithms such as K-means and DBSCAN to cluster user behavior data to reveal potential patterns and group characteristics in the data, and provide clues for discovering new abnormal patterns. (3) Deep learning mining: Introduce deep learning models such as CNN, RNN, and GNN, and use their ability to process complex sequences and relationship networks to deeply explore the deep-level characteristics, behavior patterns, and association networks behind user behavior, providing comprehensive and in-depth information support for the construction of the abnormal number behavior feature library. (4) Feature selection and optimization: Combine domain knowledge and model performance evaluation to screen and optimize the extracted features and construct a multi-dimensional, highly correlated abnormal user behavior feature set. (5) Feature library construction: Based on the above feature set, an abnormal user behavior feature library is constructed. The library not only contains surface features, but also covers deep-level behavior patterns and association networks, providing a solid data foundation and strong technical support for the subsequent efficient identification of fraudulent and high-risk users.

[0064] In addition, the traceability label library is a label library obtained by labeling the extracted features based on the construction of user feature models and cluster analysis. It mainly includes feature labels of multiple dimensions obtained based on the characteristics of user attributes, network access channels, communication behavior, Internet behavior, natural person characteristics and risk characteristics in historical data based on big data analysis.

[0065] Exemplarily, in an embodiment of the present application, when there is a number to be traced, it is first determined whether the number exists in the pre-built abnormal number behavior feature library. If the number is marked as an abnormal number, it indicates that the number meets the conditions for further tracing.

[0066] Optionally, the method further comprises:

[0067] Get the number to be traced;

[0068] Based on the similarity between the feature data of the number to be traced and the feature data corresponding to each abnormal number in the abnormal number behavior feature library, it is determined whether the number to be traced is an abnormal number.

[0069] Specifically, first obtain the number to be traced that needs to be traced and analyzed. The number to be traced may be obtained through user input, automatic detection, etc., and marked as a number that needs further analysis; then extract a set of feature data from the number to be traced, and these feature data may include the behavior information of the number, such as call frequency, call market, geographical distribution, call time, etc. These feature data reflect the behavior pattern of the number to be traced. Then, compare the feature data of the number to be traced with the feature data of each known abnormal number in the abnormal number behavior feature library, and calculate the similarity between the two; through similarity analysis, it can be determined whether the behavior pattern of the number to be traced is similar to the abnormal numbers in the abnormal number behavior feature library. If the similarity reaches a certain preset threshold, the number to be traced is determined to be an abnormal number.

[0070] For example, the machine learning model that has been built can be used to identify potential high-risk numbers by comparing the behavioral characteristics of the number to be traced with the abnormal behavioral characteristics in the abnormal number behavioral characteristic library, providing strong technical support for anti-fraud work. The specific implementation methods may include: (1) Model fusion strategy: Combining the classification ability of the supervised learning model, the clustering analysis ability of the unsupervised learning model, and the processing ability of the deep learning model for complex data, a comprehensive recognition model is formed to ensure the accuracy and comprehensiveness of recognition. (2) Similarity calculation and optimization: Using a variety of advanced algorithms such as cosine similarity, efficient and accurate similarity calculation is performed between user behavior characteristics and the characteristics in the abnormal user behavior characteristic library. Through parallel processing technology and algorithm optimization, the computing efficiency is improved and the recognition time is shortened. (3) Threshold setting and dynamic adjustment: Based on anti-fraud work experience and expert advice, a reasonable similarity threshold is set to determine whether the user is a high-risk user involved in fraud. At the same time, according to the system operation status and feedback information, the threshold is dynamically adjusted to adapt to the ever-changing fraud methods and patterns. (4) Real-time risk monitoring and early warning: The recognition process is embedded in the real-time data stream processing system to achieve continuous monitoring of user behavior and risk assessment. Once a potential high-risk user involved in fraud is discovered, the early warning mechanism will be immediately triggered to provide timely response and disposal support for anti-fraud work.

[0071] S202: Determine multiple characteristic tags of the target group to which the number to be traced belongs based on multiple characteristic tags corresponding to the number to be traced and a traceability tag library.

[0072] Among them, the target group is a set of numbers with similar behavioral characteristics defined in the feature tag library, which is often used for identification and classification. For example, there may be "fraud number group", "marketing harassment number group", etc. The numbers in these groups have certain similarities in behavioral patterns.

[0073] Specifically, the behavioral feature information of the number to be traced is first extracted, and this information is converted into multiple feature labels. For example, if the number has frequent long-distance call behavior and high call frequency, the number will be given feature labels such as "high frequency call" and "high proportion of long-distance calls". Then the feature label of the number to be traced is compared with the group feature label in the traceability label library, where the traceability label library defines typical label sets for various target groups. For example, the "harassment number group" may have labels such as "high frequency calls to strange numbers" and "late night calls". By comparing with the traceability label library, it can be determined whether the label of the number to be traced is highly consistent with the feature label set of a specific target group. For example, if the label of the number to be traced has a high degree of match with the label of the "marketing harassment number group", it can be classified as a marketing harassment number group. After determining the target group to which the number to be traced belongs, the feature label of the target group will be assigned to the number to be traced to further manage the number, such as marking it as a harassment number, restricting communication, etc.

[0074] S203. Based on multiple feature tags of the target group, a group relationship map is constructed using graph technology.

[0075] Among them, graph technology is a technology that represents data relationships through nodes and edges. In this embodiment, nodes can represent different users or numbers, and edges represent the behavioral characteristic relationships between these users. The group relationship graph is a relationship network built based on graph technology, which is used to indicate the characteristic relationships between multiple users in the target group. The nodes in the graph represent individuals in the target group (such as abnormal numbers), and the edges represent the similarities or associations in certain behavioral characteristics between these individuals. The group relationship graph can help identify the structure and potential connections within the group, which is convenient for further analysis and management.

[0076] Furthermore, based on multiple characteristic tags of the target group, a group relationship map is constructed using graph technology, including:

[0077] According to multiple characteristic tags of the target group, the number to be traced is taken as the main node, and other numbers in the target group and different characteristic tags are taken as nodes. All nodes are associated with the calling and called relationships between numbers and the relationships between the characteristic tags of each number to obtain a group relationship map.

[0078] When constructing the overall relationship graph, the number to be traced is set as the main node of the group relationship graph, and other high-risk numbers in the target group and their characteristic tags (such as call patterns, geographical distribution, etc.) are selected as other nodes in the graph. These nodes together constitute the basic structure of the entire group relationship graph. Then the edge of the caller-called relationship is established: In the graph, the caller-called relationship between each target group number forms the "edge" in the graph. If there is a direct caller-called record between the two numbers, the system establishes an edge between the two nodes to indicate that there is a connection between the two. This process can reveal the direct communication relationship between the number to be traced and other numbers in the target group, which helps to identify potential common behavior patterns. In addition to the direct communication relationship, the system also uses the characteristic tags of each number to establish further relationships. If two numbers share certain similar characteristic tags (such as high frequency of long-distance calls), the system will create an associated edge between the two nodes to show the behavioral similarity between the numbers. Generate a group relationship graph: By integrating the caller-called relationship and the characteristic tag relationship together, the system generates a complete group relationship graph. The graph contains the number to be traced, other numbers in the target group, and their associated feature labels, and shows the association pattern between numbers through edges. This relationship graph not only shows the direct communication between numbers, but also reveals the correlation in behavior patterns, enabling the system to analyze the behavior structure of high-risk numbers from multiple dimensions. The resulting group relationship graph can be used for further analysis and identification. Through graph analysis techniques (such as community discovery, path analysis, etc.), the system can discover closely connected groups of numbers in the graph, identify possible high-risk behavior patterns, and provide key structured information for anti-fraud work.

[0079] Exemplarily, the construction of graph relationships will combine the following aspects of risk assessment: (1) First, analyze the basic information and channel characteristics of the user when he or she accesses the network to determine whether he or she has high-risk network access behavior. These feature labels can reflect the reliability of the user's network access channel and identity information, and form some basic information of the nodes in the graph. (2) Through in-depth analysis of the user's communication and Internet behavior patterns (such as abnormally high-frequency calls, irregular Internet behavior, etc.), behavioral feature labels are generated and marked in the graph. These features help identify possible abnormal behavior nodes and display connections with other high-risk behavior nodes in the graph. (3) Check the user's certificate information and terminal device information to identify certificate risks (such as multiple network access applications) and terminal risks (such as frequent device changes, use of high-risk devices, etc.). These feature labels help identify and connect nodes in the graph, such as showing the sharing of certificate information between different users in the graph. (4) Using the fraudulent number as the node and the caller and called party relationship as the edge, a team relationship network graph is constructed. Using graph analysis technologies such as community discovery and path analysis, the complex relationship structure between team members can be identified. The distribution of edges and nodes in the graph can help identify closely connected groups of fraud teams, and discover the team's behavioral patterns by analyzing call patterns, time patterns and other features. (5) As data is updated and fraud methods change, the graph analysis model needs to be optimized and iterated to maintain the accuracy and adaptability of the analysis. For example, the model can adjust the graph construction rules based on newly identified behavioral patterns, thereby more effectively revealing the structure of potential fraud teams. (6) Finally, the graph analysis results are presented in intuitive ways such as charts and network diagrams, making the traceability report clearer and easier to understand. The detailed report includes user portraits, risk behavior analysis, team relationship networks and other content, providing a strong reference for anti-fraud work and supporting staff to identify team structure, member interactions and potential crime patterns.

[0080] The abnormal number tracing method based on big data provided in the embodiment of the present application obtains the characteristic label of the number to be traced, compares it with the abnormal number behavior feature library, and determines whether the number is an abnormal number; if it is abnormal, the traceability label library is used to match it with similar characteristic labels to determine the target group to which it belongs. Based on the characteristic labels of the target group, the system uses graph technology to construct a group relationship map to display the characteristic relationships between users in the group, so as to identify related behaviors and potential abnormal patterns within the group, and provide in-depth structured information for anti-fraud work.

[0081] Figure 3 This is a flow chart of the second embodiment of the abnormal number tracing method based on big data provided by this application. Figure 3 As shown, in Figure 1Based on the embodiment, the process of determining multiple feature tags of the target group to which the number to be traced belongs according to multiple feature tags corresponding to the number to be traced and the traceability tag library is explained in detail. The specific process includes:

[0082] S301. Acquire multiple target numbers associated with the number to be traced.

[0083] First, multiple target numbers that are associated with the number to be traced are identified and obtained. The association can be determined through call records, common behavior characteristics (such as similar call patterns) or other correlations. These target numbers usually have certain behavioral or pattern similarities with the number to be traced.

[0084] S302: Tracing multiple target numbers respectively based on the traceability tag library to obtain multiple feature tags corresponding to each target number.

[0085] In an embodiment of the present application, each target number is traced and analyzed through a traceability label library, and a set of characteristic labels is assigned to it. The multiple characteristic labels of the target group include: multiple characteristic labels of the number to be traced, and characteristic labels corresponding to multiple target numbers. Among them, the traceability label library contains behavioral characteristic labels of different types of numbers. By matching the labels in the label library, a set of characteristic labels can be generated for the target number. These labels reflect the behavioral characteristics of each target number, such as call frequency, geographical distribution, call time, etc. This process helps the system identify the behavioral patterns of the target numbers, and then determine whether they are similar to the behavioral characteristics of the numbers to be traced.

[0086] By combining the feature tags of the number to be traced with the feature tags of multiple associated target numbers, a feature tag set of the target group can be generated. This set not only shows the behavioral characteristics of the number to be traced, but also reflects the collective behavioral patterns of the target numbers associated with it, thereby more accurately defining the position of the number to be traced in the target group.

[0087] The abnormal number tracing method based on big data provided in the embodiment of the present application comprehensively generates a characteristic label set of the target group to which the number to be traced belongs through the characteristic analysis of the tracing label library and the associated numbers, thereby accurately describing the behavior pattern of the number to be traced. This characteristic label set can help identify whether the number to be traced belongs to a specific high-risk group, and provide reliable data support for subsequent risk management and classification.

[0088] Figure 4 This is a flow chart of the third embodiment of the abnormal number tracing method based on big data provided by this application. Figure 4 As shown, in Figure 1Based on the embodiment, before tracing the number to be traced according to the pre-acquired traceability tag library to obtain multiple feature tags corresponding to the number to be traced, the method further includes:

[0089] S401. Obtain historical data of multiple numbers from a source database.

[0090] Among them, the source database stores a large amount of historical data of numbers, including the behavior and attribute information of these numbers, providing a data basis for feature analysis and tracing. Historical data refers to the historical activity data of numbers in the communication network, including communication records, Internet behavior, user attributes, etc., which is the basic information for building feature labels. It should be noted that historical data is widely collected from user attributes and communication behavior data, mainly covering key elements such as call record records, network traffic, signaling information, location trajectory, etc., to ensure the comprehensiveness and diversity of the data source.

[0091] S402. Based on the historical data of multiple numbers, feature analysis is performed using machine learning to obtain feature data of multiple dimensions including user attribute features, network access channel features, communication behavior features, Internet behavior features, natural person features, and risk features.

[0092] In this step, machine learning algorithms and big data technology are used to extract relevant features of fraudulent behavior from multi-dimensional and massive user data, including basic user attributes, network access channel characteristics, Internet behavior patterns, communication behavior patterns, consumption patterns, terminal types used, etc. The extracted features need to be classified and organized according to their nature and importance, including but not limited to basic attribute characteristics (such as number type, status, product packages, etc.), network access channel characteristics (such as acceptance channel type, channel ownership, channel status, acceptor, etc.), consumption characteristics (such as billing, package charges, payment methods, number of payments, etc.), communication behavior characteristics (such as average daily number of calls, call duration, caller ratio, average daily number of SMS received, etc.), Internet behavior characteristics (such as types of websites visited, APP usage characteristics, traffic distribution, etc.), natural person characteristics (such as age, gender, region, document risk, etc.), risk characteristics (such as red and yellow cards, model detection, etc.), to ensure that the label library is not only rich in content and well-structured, but also can flexibly adapt to changes in traceability needs. Through intelligent feature extraction and cluster analysis, a multi-dimensional, multi-level user feature model and labeling system can be constructed, providing a scientific basis for subsequent refined labeling.

[0093] S403: labeling the feature data of multiple dimensions to obtain feature labels of multiple dimensions, and storing the feature labels of multiple dimensions in a traceability label library.

[0094] After obtaining the feature data of each dimension, these feature data are labeled and converted into feature tags that can be directly applied. The feature data of each dimension will generate corresponding tags, such as: user attribute feature tags (such as "young users", "remote areas"), communication behavior feature tags (such as "high-frequency calls to unfamiliar numbers", "frequent late-night activities"), risk feature tags (such as "high-risk device use", "associated blacklist numbers"), and these generated feature tags will be stored in the traceability tag library to form a complete set of feature tag libraries. The tags in the traceability tag library will then be used for traceability analysis, and accurate traceability and classification of numbers can be achieved by quickly matching and comparing the features of the traceable numbers.

[0095] The abnormal number tracing method based on big data provided in the embodiment of the present application describes the generation of multi-dimensional feature labels through machine learning feature analysis of a large amount of historical data before tracing the number to form a tracing label library. This label library provides rich label support for the subsequent tracing of the source number, can quickly identify and match the behavioral characteristics of the number, and lay the foundation for accurate group classification and risk assessment.

[0096] Figure 5 This is a flow chart of the fourth embodiment of the abnormal number tracing method based on big data provided by this application. Figure 5 As shown, in Figure 4 Based on the embodiment, the feature data of multiple dimensions are labeled to obtain feature labels of multiple dimensions, including:

[0097] S501. Extract multiple indivisible atomic labels from feature data of multiple dimensions.

[0098] Among them, atomic tags refer to the most basic and indivisible tag units, which are directly generated based on the user's basic attributes or single behavior data, and directly reflect the specific characteristics of a certain dimension of the user, such as "user gender = male", "user age = 30 years old", providing the most basic data support for subsequent tag combination and algorithm analysis.

[0099] S502: Based on the multiple atomic tags, multiple rule tags are determined according to preset business rules.

[0100] Among them, rule tags are tags generated based on atomic tags and in accordance with specific business rules. These rules can include specific behavior patterns or conditional judgments, which can quickly respond to business changes, improve the flexibility and adaptability of number identification, and are also easy to understand and maintain. For example, "Is it cross-provincial network access = yes" (if the province to which the certificate belongs is inconsistent with the province to which the number belongs, it is cross-provincial network access, 1 is yes and 0 is no), "Is the certificate blacklist = yes" (there is a blacklist number under the number-associated certificate).

[0101] In this step, atomic tags are combined or converted into higher-level rule tags according to preset business rules. Business rules can contain various conditions, such as "if a user uses different devices multiple times within a specific time period, generate a 'multi-device frequent switching' tag." Rule tags help identify user compliance and potential risk behaviors, providing a layer of behavior tags based on business logic.

[0102] S503: Based on multiple atomic tags, the user's historical behavior is analyzed by a deep learning algorithm to obtain multiple algorithm tags and multiple real-time tags.

[0103] Among them, algorithmic labels are labels generated after learning and analyzing user historical behavior data through machine learning, deep learning and other algorithms. This type of label usually involves complex computing models and a large amount of data training, which can capture the underlying laws and patterns behind user behavior. For example, through similarity calculation methods (such as cosine similarity, Jaccard similarity, etc.), the behavioral characteristics of the user to be traced are compared with the characteristics in the fraud user behavior feature library, and the similarity between them is calculated. If the similarity between the behavioral characteristics of the user to be traced and the fraud user exceeds the threshold, the user is considered to be a high-risk user involved in fraud. Algorithmic labels mainly include: user risk level, abnormal device behavior, and high-risk IP association labels. Multiple real-time labels include call behavior, SMS behavior, traffic behavior, trajectory behavior, and model detection times.

[0104] Real-time tags are tags generated in real time based on the user's current behavior or status. Such tags usually rely on real-time data streams, such as communication data and signaling data, and can reflect the user's immediate status and behavior. They are of great significance for rapid response and timely intervention, and can promptly identify and handle ongoing fraudulent behavior.

[0105] S504: Based on multiple atomic tags and multiple preset time periods, obtain a combined tag corresponding to each time period.

[0106] Among them, the combined label is a higher-level label formed by combining multiple atomic labels or rule labels according to a certain logic. The combination may be based on the user's multi-dimensional characteristics or behavior patterns, used to describe the user's more complex attributes or behaviors, and can more comprehensively characterize user characteristics and improve recognition accuracy. It is an important means to build user portraits and conduct accurate tracing. For example, "the number of numbers involved in the case under the same certificate in the past six months = the past six months + the number involved in the case + the number of the same certificate", "the number of users involved in the case in the past six months = the past six months + the number involved in the case + the number of the same certificate".

[0107] S505. Acquire feature tags of multiple dimensions according to multiple atomic tags, multiple rule tags, multiple algorithm tags, multiple real-time tags, and a combination tag corresponding to each time period.

[0108] In this step, a complete set of feature tags is generated by integrating various tags (atomic tags, rule tags, algorithm tags, real-time tags, and combination tags) to describe the multi-dimensional behavioral characteristics of users in detail. These feature tags can display the user's behavior pattern, risk level, real-time status, etc. from multiple levels, providing comprehensive data support for traceability and risk management.

[0109] Among them, feature labels of multiple dimensions include: user basic labels, channel labels, terminal labels, natural person labels, user risk labels, call behavior labels, SMS behavior labels, Internet behavior labels, traffic behavior labels, and time-space behavior labels.

[0110] Exemplarily, the accuracy of feature labels can be ensured by updating and storing labels. Specifically, obtaining feature labels of multiple dimensions may include the following work contents: (1) Label storage: Data storage: Store the updated label data in a special label library to facilitate subsequent query, analysis and application. The label library supports efficient indexing and retrieval mechanisms to meet the needs of rapid response and large-scale data processing. Data security: In the process of label storage, strictly abide by data security specifications, encrypt sensitive data, and ensure that the data is not illegally accessed or leaked. Data quality monitoring: Establish a data quality monitoring mechanism, regularly check and evaluate the quality of label data, and ensure the accuracy and reliability of labels. For any problems found, correct and optimize them in a timely manner. (2) Label update: With the changes in user behavior and the addition of new data sources, the original label system may not accurately reflect the current status of the user. Therefore, it is necessary to update the labels regularly. (3) Label adjustment: Adjust the original label system according to the new feature extraction and clustering results, including adding new labels, deleting outdated labels, adjusting label caliber, etc. (4) Algorithm optimization: With the continuous iteration and optimization of machine learning algorithms, models are retrained regularly and algorithm labels are updated to improve recognition accuracy and efficiency.

[0111] The abnormal number tracing method based on big data provided in the embodiment of the present application uses a multi-level labeling processing method to convert atomic labels into a more identifiable feature label set through business rules, deep learning algorithms, time period division, etc. By integrating various labels, it is possible to more carefully and accurately characterize user behavior and risk characteristics in multiple dimensions, thereby achieving comprehensive tracing of users and accurate risk assessment.

[0112] Figure 6 The flowchart of the fifth embodiment of the abnormal number tracing method based on big data provided in the embodiment of the present application is as follows. Figure 6 As shown, in Figure 4 Based on the embodiment, feature analysis is performed using machine learning based on historical data of multiple numbers. This includes:

[0113] S601. Preprocess the historical data of multiple numbers to obtain processed historical data of the multiple numbers, and perform feature analysis on the processed historical data of the multiple numbers using a machine learning method.

[0114] In this step, the collected historical data of multiple numbers are first preprocessed. The specific preprocessing steps may include the following methods: Data cleaning: remove noise and invalid items in the data, such as removing invalid call records or incomplete behavior data. Data cleaning can improve the accuracy of the data and avoid the model from being trained on invalid data. Abnormal data removal: identify and remove obviously abnormal records in the data set. For example, if the user's call duration or Internet traffic exceeds a reasonable range, these abnormal data can be removed to avoid affecting the results of model training. Missing data completion: fill in the missing items in the data to ensure that each data item is complete. For example, records that lack geographic location information can be completed through reasonable interpolation or mean filling. The completed data is more continuous and consistent, which is conducive to subsequent feature analysis. Data format conversion: convert the data into a unified format so that different feature data can be processed consistently. For example, all time formats are unified into a standard timestamp format, and location data is unified into a latitude and longitude format, etc., to ensure data normalization. Unified encoding: Use preset encoding methods to encode different types of data, such as converting classification features into numerical labels, encoding text information into numerical vectors, etc. Unified encoding makes the data adapt to the input format of the machine learning algorithm and facilitates algorithm processing.

[0115] After preprocessing the historical data, the processed data is subjected to feature analysis using machine learning methods. The purpose of feature analysis is to extract key features that reflect user behavior patterns and risk characteristics from the preprocessed data. Machine learning methods may include cluster analysis, classification algorithms, association rules, etc. The specific feature analysis process may include the following: User behavior pattern recognition: Machine learning models can automatically extract user behavior characteristics in terms of call frequency, Internet access time, device usage, etc., and identify specific behavior patterns from them. Risk feature extraction: Machine learning algorithms are used to discover potential risk patterns in the data. For example, behaviors such as frequent device changes and use of high-risk IP addresses can be identified as risk characteristics to support subsequent labeling processing. Feature optimization: The preliminary features generated by feature analysis can be screened, reduced in dimension, and optimized to ensure that the extracted features are more representative and accurate.

[0116] The abnormal number tracing method based on big data provided in the embodiment of the present application lays a high-quality data foundation for subsequent machine learning modeling and labeling processing by preprocessing and feature analysis of multiple number historical data. The preprocessing step ensures the integrity and consistency of the data, while the feature analysis extracts key behavioral features, providing strong support for the behavioral pattern and risk analysis of the number.

[0117] Figure 7 This is a flowchart of the process of constructing a traceability tag library in the abnormal number traceability method based on big data provided in the embodiment of the present application. Figure 7 As shown in the figure, the construction of the traceability tag library is the basis of the entire traceability process of abnormal numbers. By building a comprehensive user portrait and fine-grained feature tags, it can provide data support for the subsequent identification and tracing of abnormal numbers.

[0118] Figure 8 This is a flow chart of the source tracing method for abnormal numbers based on big data provided in the embodiment of the present application. Figure 8 As shown, the tracing process of abnormal numbers mainly focuses on using these tags and advanced big data and machine learning technologies to accurately identify and trace fraud-related and high-risk users.

[0119] Fig. 9 This is a schematic diagram of the structure of the abnormal number tracing device based on big data provided in the embodiment of the present application. Fig. 9 As shown, the abnormal number tracing device 90 based on big data includes a feature label obtaining module 901 for the number to be traced, a feature label obtaining module 902 for the target group, and a group relationship map construction module 903, wherein:

[0120] The module 901 for obtaining the characteristic label of the number to be traced is used for tracing the number to be traced according to the tracing label library obtained in advance to obtain a plurality of characteristic labels corresponding to the number to be traced if it is determined from the abnormal number behavior characteristic library obtained in advance that the number to be traced is an abnormal number, wherein the abnormal number behavior characteristic library includes a plurality of abnormal numbers and characteristic data corresponding to each abnormal number, and the tracing label library includes characteristic labels of multiple dimensions obtained based on the characteristics of user attribute characteristics, network access channel characteristics, communication behavior characteristics, Internet behavior characteristics, natural person characteristics and risk characteristics in the historical data analyzed based on big data;

[0121] The target group feature label obtaining module 902 is used to determine multiple feature labels of the target group to which the number to be traced belongs according to multiple feature labels corresponding to the number to be traced and the traceability label library;

[0122] The group relationship graph construction module 903 is used to construct a group relationship graph based on multiple feature tags of the target group using graph technology. The group relationship graph is used to indicate the feature relationships between multiple users in the target group.

[0123] Optionally, the target group feature label obtaining module 902 is further specifically used for:

[0124] Obtain multiple target numbers associated with the number to be traced;

[0125] Based on the traceability tag library, multiple target numbers are traced respectively to obtain multiple feature tags corresponding to each target number;

[0126] The multiple feature tags of the target group to which the number to be traced belongs include: multiple feature tags of the number to be traced, and feature tags corresponding to multiple target numbers.

[0127] Optionally, the group relationship map construction module 903 is further specifically used for:

[0128] According to multiple characteristic tags of the target group, the number to be traced is taken as the main node, and other numbers in the target group and different characteristic tags are taken as nodes. All nodes are associated with the calling and called relationships between numbers and the relationships between the characteristic tags of each number to obtain a group relationship map.

[0129] Optionally, the target group feature label obtaining module 902 is further specifically used for:

[0130] Get historical data of multiple numbers from the source database;

[0131] Based on the historical data of multiple numbers, feature analysis is performed using machine learning to obtain feature data in multiple dimensions including user attribute features, network access channel features, communication behavior features, Internet behavior features, natural person features, and risk features;

[0132] The feature data of multiple dimensions are labeled to obtain feature labels of multiple dimensions, and the feature labels of multiple dimensions are stored in the traceability label library.

[0133] Optionally, the module 901 for obtaining the characteristic label of the number to be traced is further specifically used for:

[0134] Extract multiple indivisible atomic labels from feature data of multiple dimensions;

[0135] Based on multiple atomic tags, multiple rule tags are determined according to preset business rules;

[0136] Based on multiple atomic tags, the user's historical behavior is analyzed through a deep learning algorithm to obtain multiple algorithm tags and multiple real-time tags; the multiple algorithm tags include: user risk level, device behavior abnormality, and high-risk IP association tags, and the multiple real-time tags include call behavior, SMS behavior, traffic behavior, trajectory behavior, and model detection times;

[0137] Based on multiple atomic labels and multiple preset time periods, obtain a combined label corresponding to each time period;

[0138] According to multiple atomic tags, multiple rule tags, multiple algorithm tags, multiple real-time tags and the combined tags corresponding to each time period, feature tags of multiple dimensions are obtained.

[0139] Optionally, the module 901 for obtaining the characteristic label of the number to be traced is further specifically used for:

[0140] Feature tags in multiple dimensions include: user basic tags, channel tags, terminal tags, natural person tags, user risk tags, call behavior tags, SMS behavior tags, Internet behavior tags, traffic behavior tags, and time-space behavior tags.

[0141] Optionally, the target group feature label obtaining module 902 is further specifically used for:

[0142] Preprocessing the historical data of multiple numbers to obtain processed historical data of the multiple numbers, and performing feature analysis on the processed historical data of the multiple numbers using a machine learning method;

[0143] Preprocessing includes at least one of the following processing methods: data cleaning, abnormal data elimination, missing data completion, data format conversion, and unified encoding using a preset encoding method.

[0144] Optionally, the module 901 for obtaining the characteristic label of the number to be traced is further specifically used for:

[0145] Get the number to be traced;

[0146] Based on the similarity between the feature data of the number to be traced and the feature data corresponding to each abnormal number in the abnormal number behavior feature library, it is determined whether the number to be traced is an abnormal number.

[0147] Fig.10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.10 As shown, the electronic device 100 includes:

[0148] The electronic device 100 may include a processor 1001 with one or more processing cores, a memory 1002 with one or more computer-readable storage media, a communication component 1003 and other components. The processor 1001, the memory 1002 and the communication component 1003 are connected via a bus 1004.

[0149] In the specific implementation process, at least one processor 1001 executes the computer execution instructions stored in the memory 1002, so that at least one processor 1001 executes the above-mentioned abnormal number tracing method based on big data.

[0150] The specific implementation process of the processor 1001 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0151] In the above Fig.10 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0152] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0153] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0154] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0155] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0156] To this end, an embodiment of the present application provides a computer-readable storage medium, in which multiple instructions are stored, and the instructions can be loaded by a processor to execute the steps of any one of the abnormal number tracing methods based on big data provided in the embodiment of the present application.

[0157] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0158] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0159] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for tracing abnormal numbers based on big data, characterized in that: include: If the number to be traced is determined to be an abnormal number from the pre-acquired abnormal number behavior feature library, the number to be traced is traced according to the pre-acquired traceability label library to obtain multiple feature labels corresponding to the number to be traced, wherein the abnormal number behavior feature library includes multiple abnormal numbers and feature data corresponding to each abnormal number, and the traceability label library includes multiple dimensions of feature labels obtained based on the user attribute characteristics, network access channel characteristics, communication behavior characteristics, Internet behavior characteristics, natural person characteristics and risk characteristics in the historical data analyzed based on big data; Determine, according to the plurality of characteristic tags corresponding to the number to be traced and the traceability tag library, a plurality of characteristic tags of the target group to which the number to be traced belongs; According to the multiple characteristic tags of the target group, a group relationship graph is constructed by using graph technology, and the group relationship graph is used to indicate the characteristic relationship between multiple users in the target group.

2. The method according to claim 1, characterized in that The step of determining, based on the plurality of characteristic tags corresponding to the number to be traced and the traceability tag library, a plurality of characteristic tags of a target group to which the number to be traced belongs includes: Acquire multiple target numbers associated with the number to be traced; Based on the traceability label library, the multiple target numbers are traced respectively to obtain multiple feature labels corresponding to each target number; The multiple characteristic tags of the target group to which the number to be traced belongs include: multiple characteristic tags of the number to be traced, and characteristic tags corresponding to the multiple target numbers.

3. The method according to claim 1, characterized in that The method of constructing a group relationship map using a map technology based on multiple feature tags of the target group includes: According to multiple feature tags of the target group, the number to be traced is taken as the main node, and other numbers in the target group and different feature tags are taken as nodes. All nodes are associated with the calling and called relationships between numbers and the relationships between the feature tags of each number to obtain the group relationship graph.

4. The method according to any one of claims 1 to 3, characterized in that: Before tracing the number to be traced according to the pre-acquired tracing label library to obtain a plurality of characteristic labels corresponding to the number to be traced, the method further includes: Get historical data of multiple numbers from the source database; Based on the historical data of the multiple numbers, feature analysis is performed using machine learning to obtain feature data of multiple dimensions including user attribute features, network access channel features, communication behavior features, Internet behavior features, natural person features, and risk features; The feature data of the multiple dimensions are labeled to obtain feature labels of the multiple dimensions, and the feature labels of the multiple dimensions are stored in a traceability label library.

5. The method according to claim 4, characterized in that Labeling the feature data of the multiple dimensions to obtain feature labels of the multiple dimensions includes: Extracting multiple indivisible atomic labels from the feature data of the multiple dimensions; Based on the multiple atomic tags, determining multiple rule tags according to preset business rules; Based on the multiple atomic tags, the user's historical behavior is analyzed through a deep learning algorithm to obtain multiple algorithm tags and multiple real-time tags; wherein the multiple algorithm tags include: user risk level, abnormal device behavior, and high-risk IP association tags, and the multiple real-time tags include call behavior, SMS behavior, traffic behavior, trajectory behavior, and model detection times; Based on the multiple atomic tags and the preset multiple time periods, obtaining a combined tag corresponding to each time period; The feature tags of the multiple dimensions are acquired according to the multiple atomic tags, the multiple rule tags, the multiple algorithm tags, the multiple real-time tags and the combined tags corresponding to each time period.

6. The method according to claim 5, characterized in that The feature labels of the multiple dimensions include: User basic tags, channel tags, terminal tags, natural person tags, user risk tags, call behavior tags, SMS behavior tags, Internet behavior tags, traffic behavior tags, and time-space behavior tags.

7. The method according to claim 4, characterized in that The feature analysis based on the historical data of the multiple numbers by machine learning includes: Preprocessing the historical data of the multiple numbers to obtain processed historical data of the multiple numbers, and performing feature analysis on the processed historical data of the multiple numbers using a machine learning method; The preprocessing includes at least one of the following processing methods: data cleaning, abnormal data elimination, missing data completion, data format conversion and unified encoding using a preset encoding method.

8. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Obtaining the number to be traced; Based on the similarity between the feature data of the number to be traced and the feature data corresponding to each abnormal number in the abnormal number behavior feature library, it is determined whether the number to be traced is an abnormal number.

9. A device for tracing abnormal numbers based on big data, characterized in that: include: A module for obtaining a feature label of the number to be traced, which is used to, if the number to be traced is determined to be an abnormal number from a pre-acquired abnormal number behavior feature library, trace the number to be traced according to the pre-acquired tracing label library, and obtain multiple feature labels corresponding to the number to be traced, wherein the abnormal number behavior feature library includes multiple abnormal numbers and feature data corresponding to each abnormal number, and the tracing label library includes multiple dimensions of feature labels obtained based on the user attribute characteristics, network access channel characteristics, communication behavior characteristics, Internet behavior characteristics, natural person characteristics and risk characteristics in the historical data analyzed based on big data; A target group feature label obtaining module, used to determine a plurality of feature labels of the target group to which the number to be traced belongs according to a plurality of feature labels corresponding to the number to be traced and the traceability label library; The group relationship map construction module is used to construct a group relationship map using a map technology according to multiple feature tags of the target group, and the group relationship map is used to indicate the feature relationship between multiple users in the target group.

10. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 8 when executed by a processor.

Images