A GOIP fraud prevention method, device and medium based on signaling feature analysis

Abstract

The present invention discloses a GOIP fraud prevention method, device and medium based on signaling feature analysis. The method comprises the following steps: collecting signaling data of a target number; decomposing the signaling parameters of the target number from the signaling data of the target number; constructing a signaling feature engineering according to the signaling parameters of multiple target numbers; and using a trained deep learning model to perform feature analysis on the signaling feature engineering to obtain a fraud prediction result of the target number. The embodiment of the present invention deeply mines the device features and behavior features of the simple GOIP of an external data line, constructs a deep learning model capable of identifying the simple GOIP number of an external data line through an LSTM deep learning algorithm, and trains and optimizes the model algorithm to achieve accurate identification of the simple GOIP number of an external data line, and finally realizes the closure of the number and pushes the relevant departments to jointly combat it.

Description

Technical Field

[0001] The present invention relates to the technical field of telecommunication anti-fraud, and in particular to a GOIP fraud prevention method, device and medium based on signaling feature analysis. Background Art

[0002] With the continuous upgrading and iteration of fraud technology, fraud methods have also shown new changes. A simple GOIP device that uses a mobile phone and an external data cable to form a network has gradually become popular. This new type of simple device has become a new choice for fraudsters because of its simple structure, easy to carry and hide. Compared with traditional GOIP devices, this upgraded simple device not only adds an external data cable on the original basis, realizes a more convenient mobile phone card replacement operation, but also eliminates the tedious steps of manual card insertion and removal, greatly improving the efficiency of fraud. These improvements make fraud activities more concealed and increase the difficulty for law enforcement agencies to identify and track.

[0003] However, existing technical means mainly focus on identification based on the combination of number outbound calling behavior patterns and remote control chat software usage characteristics. However, due to the wide variety of remote control chat software on the market, it is difficult to achieve full coverage and accurate identification in actual applications, which leads to the low accuracy of existing GOIP identification, which urgently needs to be optimized. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a GOIP fraud prevention method, device and medium based on signaling feature analysis.

[0005] The first aspect of the present invention provides a GOIP fraud prevention method based on signaling feature analysis, comprising the following steps:

[0006] Collect signaling data of the target number;

[0007] Decomposing the signaling parameters of the target number from the signaling data of the target number;

[0008] Construct signaling feature engineering based on the signaling parameters of multiple target numbers;

[0009] The signaling feature engineering is analyzed using the trained deep learning model to obtain a fraud prediction result of the target number.

[0010] Furthermore, the signaling data of the target number includes registration signaling data and call signaling data; wherein the registration signaling data is obtained through the S1MME interface and / or the N2 interface; and the call signaling data is obtained through the Mw interface.

[0011] Furthermore, the signaling parameters decomposed from the signaling data of the target number specifically include the registered base station, registered device, registration time, calling device, calling time, calling times, calling times, calling duration, and called number of the target number.

[0012] Furthermore, the signaling feature engineering specifically includes the following feature parameters:

[0013] The first characteristic parameter: the number of target numbers registered with the same registration base station using the same registration device within a preset time period;

[0014] The second characteristic parameter: the registration interval of the target number registered under the same registration base station using the same registration device within a preset time period;

[0015] The third characteristic parameter: the number of target numbers registered with adjacent registration base stations using the same registration device within a preset time period;

[0016] Fourth characteristic parameter: the registration interval of the target number registered under the adjacent registration base station using the same registration device within a preset time period;

[0017] Fifth characteristic parameter: the total number of outgoing calls made using the same outgoing device;

[0018] Sixth characteristic parameter: the duration of the caller call using the same calling device;

[0019] Seventh characteristic parameter: distribution of call duration of calling parties using the same calling device for calling;

[0020] Eighth characteristic parameter: the proportion of callers using the same calling device to make a call;

[0021] Ninth characteristic parameter: the rate of called party hang-up when using the same calling device to make a call;

[0022] The tenth characteristic parameter: the overlap of called numbers when using the same calling device to make a calling call.

[0023] Furthermore, the signaling feature engineering is constructed according to the signaling parameters of the multiple target numbers, and specifically includes the following steps:

[0024] classifying the plurality of target numbers according to the registered device, the registered base station and the calling device;

[0025] Obtaining the geographical location relationship of the registered base stations, and determining the adjacent registered base stations of each registered base station;

[0026] Obtaining a first characteristic parameter and a second characteristic parameter according to the signaling characteristics of the target number under the same registered device and the same registered base station;

[0027] Obtaining a third characteristic parameter and a fourth characteristic parameter according to the signaling characteristics of the target number under the same registered device and the adjacent registered base stations of each registered base station;

[0028] According to the signaling characteristics of the target number under the same calling device, a fifth characteristic parameter, a sixth characteristic parameter, a seventh characteristic parameter, an eighth characteristic parameter, a ninth characteristic parameter and a tenth characteristic parameter are obtained.

[0029] Furthermore, the deep learning model is an LSTM neural network model, the excitation function of the LSTM neural network model is a softplus function, the loss function is a MAPE function, and the optimization function is a gradient descent function.

[0030] Furthermore, the deep learning model is trained by the following steps:

[0031] Obtain training samples and perform binarization processing on the training samples;

[0032] Using the binarized training samples to tune the parameters of the deep learning model to obtain target parameters;

[0033] Apply the target parameters to the deep learning model to obtain a trained deep learning model.

[0034] Furthermore, the use of the trained deep learning model to perform feature analysis on the signaling feature engineering to obtain a fraud prediction result of the target number specifically includes the following steps:

[0035] According to the trained deep learning model, the fraud weight of each signaling parameter in the signaling feature engineering is obtained;

[0036] Applying the fraud weight to the signaling data of the target number to obtain the total fraud weight of the target number;

[0037] Compare the total fraud weight of the target number with the preset fraud weight;

[0038] For target numbers whose total fraud weight is greater than the preset fraud weight, output the fraud prediction result of the fraud number;

[0039] For target numbers whose total fraud weight is not greater than the preset fraud weight, the fraud prediction results of normal numbers are output.

[0040] A second aspect of the present invention discloses an electronic device, including a processor and a memory;

[0041] The memory is used to store programs;

[0042] The processor executes the program to implement the GOIP fraud prevention method based on signaling feature analysis.

[0043] A third aspect of the present invention discloses a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the GOIP fraud prevention method based on signaling feature analysis.

[0044] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0045] The embodiments of the present invention have the following beneficial effects: The embodiments of the present invention are a GOIP fraud prevention method, device and medium based on signaling feature analysis. By deeply mining the device features and behavior features of the simple GOIP using the external data line, a deep learning model capable of identifying the simple GOIP number of the external data line is constructed through the LSTM deep learning algorithm, and the model algorithm is trained and tuned to achieve accurate identification of the simple GOIP number of the external data line, and finally the number is shut down and pushed to the relevant departments for coordinated crackdown. Compared with traditional machine learning methods, the LSTM deep learning algorithm used in the present invention is good at processing time series signaling data, thereby accurately identifying the new simple GOIP of the external data line from the massive signaling big data, and has a good anti-fraud effect.

[0046] Additional aspects and advantages of the present invention will be given in part in the following description, and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 It is a schematic diagram of the networking effect of the simple GOIP device targeted by the embodiment of the present invention.

[0049] Figure 2 It is a basic flow chart of a GOIP fraud prevention method based on signaling feature analysis of the present invention.

[0050] Figure 3It is a communication flow diagram for target number registration under 4G network.

[0051] Figure 4 It is a communication flow diagram for target number registration in 5G network.

[0052] Figure 5 It is a diagram of the target number calling process.

[0053] Figure 6 It is a schematic diagram of signaling parameters decomposed from target number signaling data of the present invention.

[0054] Figure 7 This is a schematic diagram of the LSTM deep learning network structure adopted in the present invention.

[0055] Figure 8 It is a schematic diagram of the effect of the excitation function in the LSTM deep learning network adopted in the present invention.

[0056] Fig. 9 It is a structural schematic diagram of an electronic device of the present invention.

[0057] Fig.10 It is a schematic diagram of the structure of a computer-readable storage medium of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] The new simple GOIP device according to the embodiment of the present invention has the following effects: Figure 1 As shown in the figure. It uses a mobile phone as an outbound calling device, and connects an external data line to the mobile phone. The external data line can insert up to 72 SIM cards, and the caller number can be changed without manually inserting and removing the card. This type of simple GOIP device implements telecommunications fraud by quickly and frequently changing the caller number. It can simulate the communication behavior of multiple real users to avoid investigation by relevant departments.

[0060] In order to effectively control this type of GOIP equipment, Figure 2 As shown, the first embodiment of the present invention provides a GOIP fraud prevention method based on signaling feature analysis, comprising the following steps:

[0061] S1. Collect signaling data of the target number;

[0062] S2. Decompose the signaling parameters of the target number from the signaling data of the target number;

[0063] S3. Construct signaling feature engineering based on signaling parameters of multiple target numbers;

[0064] S4. Use the trained deep learning model to perform feature analysis on the signaling feature engineering to obtain a fraud prediction result of the target number.

[0065] The embodiments of the present invention make up for the shortcoming of low accuracy of simple GOIP recognition in the prior art by deeply exploring the characteristics of using an external data line, realize the rapid locking and disposal of fraudulent numbers of new simple GOIP devices, and effectively combat telecommunications network fraud.

[0066] The following specifically describes the implementation process of each step of the present invention:

[0067] S1. Collect signaling data of the target number.

[0068] When using this type of simple GOIP device to commit fraud, fraudsters often insert the external data line and SIM card into the mobile phone used as the outbound calling device in advance, test the outbound calling device and the mobile phone card in advance, and ensure that calls can be made normally. Therefore, a significant feature will appear in the activation stage of these SIM cards, that is, the target numbers corresponding to 2-72 SIM cards are registered using the same outbound calling device. To this end, the embodiment of the present invention collects the registration signaling data of the target number, and predicts the fraud of the target number through the registration signaling data.

[0069] Specifically, the communication process of the target number registered in the 4G / 5G network is as follows: Figure 3 , 4 As shown. In a 4G environment, when the target number accesses the network, switches to a base station, or reconnects to the network, the device will initiate a registration process for the number. During this process, the mobile phone will send an initial registration signaling containing IMSI (International Mobile Subscriber Identity) or GUTI (Globally Unique Temporary Identifier) ​​to the eNodeB module on the network side, and the eNodeB will forward the registration signaling to the MME through the S1MME interface. Therefore, by monitoring and analyzing the signaling messages on the S1MME interface, the registration signaling data of the target number can be captured.

[0070] In a 5G environment, when the target number accesses the network, switches to a base station, or reconnects to the network, the device will initiate a registration process for the number. During this process, the mobile phone will send a registration signaling message to the AMF (Access and Mobility Management Function) through the gNodeB module. The transmission between the gNodeB module and the AMF is carried out through the N2 interface, so by monitoring and analyzing the signaling messages on the N2 interface, the registration signaling data of the target number can be captured.

[0071] On the other hand, when fraudsters use this type of simple GOIP device to commit fraud, the SIM card used for fraud will show the behavior characteristics of high-frequency outbound calls, which is significantly different from the normal call phone number. Therefore, the embodiment of the present invention further collects the call signaling data of the target number and predicts the fraud of the target number through the call signaling data.

[0072] like Figure 5 As shown in the figure, when a call occurs, the target number sends an initial SIP (Session Initiation Protocol) message through the P-CSCF to establish a voice call; the P-CSCF forwards the SIP message to the S-CSCF serving the user through the Mw interface to conduct the voice call. Therefore, by monitoring and analyzing the signaling messages on the Mw interface, the call signaling data of the target number can be captured.

[0073] S2. Decompose the signaling parameters of the target number from the signaling data of the target number.

[0074] After obtaining the signaling data of the target number, the embodiment of the present invention decomposes the required signaling parameters from the signaling data of the target number to construct a signaling feature engineering. Specifically, the signaling parameters decomposed from the signaling data of the target number in the embodiment of the present invention include the registered base station, registered device, registration time, calling device, calling time, number of calls, calling call duration, called number of the calling hang-up object, etc. of the target number. Examples of signaling parameters are as follows: Figure 6 In the implementation process, as the data or external conditions change, the decomposed signaling parameters may also be adjusted, and the present application does not limit the specific types of signaling parameters.

[0075] S3. Construct signaling feature engineering based on the signaling parameters of multiple target numbers.

[0076] After obtaining the required signaling parameters, the embodiment of the present invention can aggregate the signaling parameters of multiple target numbers to construct a signaling feature engineering. Specifically, the implementation effect of the signaling feature engineering is shown in the following table:

[0077] Table 1 Signaling feature engineering

[0078]

[0079]

[0080] The embodiment of the present invention sets the preset time period to 1 minute. By decomposing the signaling parameters obtained from the target number signaling data, the above characteristic parameters can be obtained by statistical methods to construct signaling feature engineering. In some embodiments, the above characteristic parameters can also be obtained by artificial intelligence. The embodiment of the present invention predicts the fraud of the target number based on the constructed signaling feature engineering.

[0081] S4. Use the trained deep learning model to perform feature analysis on the signaling feature engineering to obtain a fraud prediction result of the target number.

[0082] The deep learning model used in the embodiment of the present invention is an LSTM (Long Short-Term Memory) neural network model. The LSTM neural network model is a model built based on bionics theory, so the model retains the information of the previous layer and combines it with the new information input by the current layer for calculation. The general linear process of the traditional model (input data, process data and get results) cannot do this. The LSTM neural network model improves the linear process of the traditional model. It has a cyclic network that allows some information to persist. Figure 7 As shown, Figure 7 In this example, x represents the input vector, A represents the state of the middle layer, and h represents the output vector. The LSTM recurrent neural network model uses three gates to control the information state, namely the forget gate, input gate, and output gate. Through the above process, the input, calculation, and output of the LSTM model cell structure are completed. After that, the model will repeatedly perform iterative calculations on the middle layer, repeating until the specified result is obtained or the predetermined number of iterations is reached.

[0083] The embodiment of the present invention predicts whether the collected target number is a simple GOIP number of an external data line based on the LSTM neural network model. The LSTM neural network model solves the problem of long-term memory of the input vector based on the standard recurrent neural network model. Since the signaling data used in the embodiment of the present invention is time series data, the LSTM neural network model has a stronger memory ability for time series than other neural network models, has a better fit, and can more fully consider the influencing factors of historical signaling data, which is suitable as a prediction model for GOIP fraud numbers.

[0084] Commonly used activation functions in LSTM neural network models include sigmoid activation function, tanh activation function, softplus function, etc. Figure 8As shown, the softplus function is an improved function based on the sigmoid function and the tanh function, which solves the problem of high saturation rate of the sigmoid function and improves the problem of too high probability of gradient vanishing of the tanh function. The sigmoid function and the tanh function have a slow derivation speed during the model calculation process, while the softplus function has a fast derivation calculation speed, which improves the calculation efficiency of the model. Therefore, the neural network model using the softplus function has a faster convergence speed. The softplus function can also make the output value of a part of the middle layer of the model zero, improve the sparsity of the model, and reduce the probability of overfitting. In addition, the softplus function has good support for time series data, while other excitation functions often have gradient vanishing when calculated on time series data. Therefore, the excitation function of the LSTM neural network model in the embodiment of the present invention is implemented using the softplus function, and the formula is as follows:

[0085] Softplusζ(x) = ln(1 + exp(x));

[0086] Commonly used loss functions in LSTM neural network models include MAE function (Mean Absolute Error), MAPE function (Mean Absolute Percentage Error), RMSE function (Root Mean Squared Error), etc. For the sake of computational efficiency, the MAPE function is used as the loss function in the embodiment of the present invention, and the MAE function and RMSE function are used as supplementary evaluation functions of model performance.

[0087] Commonly used optimization functions in LSTM neural network models include gradient descent function, Newton function, quasi-Newton function, etc. Since the Newton function and quasi-Newton function have poor computing performance for time series data, the embodiment of the present invention uses the gradient descent function as the optimization function of the model.

[0088] In the embodiment of the present invention, the LSTM neural network model is built by the Pytorch module based on the Python language. Calling the torch.nnLSTMCell() method in the Pytorch module can call out an LSTM neural network model suitable for time series data operations. The parameters included are as follows:

[0089] Table 2 Model parameters

[0090]

[0091] In the embodiment of the present invention, the LSTM neural network model is trained by the following steps:

[0092] Obtain training samples and perform binarization on the training samples: The present invention obtains several fraudulent numbers and normal numbers as samples through the telecommunications operator data interface, and trains the model through the training samples. First, the training samples are binarized so that the model can recognize signaling data, as shown below:

[0093] Table 3 Data sample table

[0094]

[0095]

[0096] After obtaining the training samples, the embodiment of the present invention constructs a training set and a test set at a ratio of 1:5, inputs the training set into the model in a feature vector format, and the model outputs a fraud prediction result of the number.

[0097] The embodiment of the present invention uses an experimental method to adjust parameters. During the adjustment process, the number of intermediate layers is first set to 1, and the number is continuously increased iteratively. The Loss function (MAE, MAPE, and RMSE) is used to evaluate the model performance at this time to find a suitable setting for the number of intermediate layers. The Loss values ​​of different numbers of intermediate layers obtained through experiments are selected, and the number of intermediate layers with a smaller value is set as the model parameter. As shown in the following table:

[0098] Table 4 Intermediate layer number adjustment table

[0099] Middle Layers MAE MAPE RMSE 1 9.32 0.245 10.12 2 8.45 0.179 9.66 3 8.75 0.194 9.89 4 8.83 0.210 10.15 5 9.14 0.223 10.53 6 9.48 0.256 10.82

[0100] It can be observed in Table 4 that the number of intermediate layers is first set to 1 by default, at which time the MAPE value is 0.245, the MAE value is 9.32, and the RMSE value is 10.12. When the number of intermediate layers is set to 2, the loss function reaches a minimum value, at which time the MAPE is 0.179, the MAE is 8.45, and the RMSE is 9.66. When the number of intermediate layers is increased, the MAPE and other test values ​​begin to increase, proving that when the number of intermediate layers is set to 2, the loss function reaches a minimum value.

[0101] Next, determine the number of nodes in the middle layer. First, set it to 1 by default and calculate the MAE, MAPE, and RMSE test values, as shown in the following table:

[0102] Table 5 Node number adjustment table

[0103]

[0104]

[0105] It can be observed in Table 5 that when the number of nodes is set to 5, the MAPE value is the minimum, and the calculation results of the MAE and RMSE functions are also the minimum. When the number of nodes is initially set to 1, the MAE value is 8.22, the MAPE value is 0.145, and the RMSE value is 9.62. When the number of nodes is increased, the MAE, MAPE, and RMSE indicators begin to decrease. When the number of nodes is set to 5, MAE, MAPE, and RMSE gradually decrease to the minimum value. At this time, MAE=6.64, MAPE=0.064, and RMSE=8.11. The three indicators are also in a relatively stable state. At this time, the values ​​of the three indicators begin to rise when the number of nodes is increased. Therefore, it is judged that when the number of nodes is 5, the model performance is locally optimal.

[0106] Based on this, the module parameters Num_layers (number of intermediate layers) are updated to 3, and Hidden_size (number of nodes) is updated to 5.

[0107] In order to ensure the computational efficiency of the model, the embodiment of the present invention uses the softplus function, whose MAPE value is 0.064, which is still too large, so the excitation function needs to be optimized. According to the characteristics of the time series data of this solution, the piecewise function may have the problem of segmenting continuous time series data, affecting the continuity of the model prediction, so it is chosen to add a bias term to the softplus function to make it undergo a linear transformation. Based on the test data set constructed in the above steps, a tuning experiment is carried out to observe its impact on the model performance, as shown in the following table:

[0108] Table 6 Softplus function optimization adjustment

[0109] Bias formula Loss value ln(1.5) ln(1+exp(x))+ln(1.5) 0.081 0 ln(1+exp(x)) 0.063 ln(0.5) ln(1+exp(x))+ln(0.5) 0.062 ln(0.4) ln(1+exp(x))+ln(0.4) 0.067 ln(0.3) ln(1+exp(x))+ln(0.3) 0.775

[0110] In the above table, ln(1.5), ln(0.5), ln(0.4) and ln(0.3) are set as function bias terms, and compared on the data set. When the bias term is set to ln(1.0), ln(1.0) = 0, which is the original Softplus function. At this time, the Loss function value is 0.063. When it is increased to ln(1.5), the Loss function value becomes 0.081, indicating that the adjustment direction is wrong. When it is reduced to ln(0.5), the Loss function value is reduced to 0.062. If the bias term is further reduced, the Loss function value will no longer decrease. Therefore, the extreme value is found, corresponding to ln(0.5), and the new excitation function is obtained:

[0111] Softplus_new(x) = ln(1 + exp(x)) + ln (0.5);

[0112] Through comparative tests, the model Loss function value is lower when the Softplus_new function is applied. For the data used by the model, there is a better fit and a better calculation effect is obtained. Therefore, the Softplus_new function is used as the excitation function, and finally the LSTM neural network model that has completed the training is obtained.

[0113] After building the LSTM neural network model, use the trained deep learning model to perform feature analysis on the signaling feature engineering to obtain the fraud prediction results of the target number. The specific steps include:

[0114] S4-1. According to the completed deep learning model, the fraud weight of each signaling parameter in the signaling feature engineering is obtained;

[0115] S4-2 applies a fraud weight to the signaling data of the target number to obtain a total fraud weight of the target number;

[0116] S4-3. The total fraud weight of the target number is compared with the preset fraud weight;

[0117] S4-4. For the target number whose total fraud weight is greater than the preset fraud weight, the fraud prediction result of the fraud number is output;

[0118] S4-5. For target numbers whose total fraud weight is not greater than the preset fraud weight, output the fraud prediction result of the normal number.

[0119] Based on the LSTM neural network model optimized above, the collected positive and negative sample data are input into the model to predict whether it is a new type of simple GOIP number using an external data line. The predicted value is calculated and compared with the true value to obtain the accuracy and recall rate, as follows:

[0120] Table 7 Model parameter adjustment results (sample data from January to August)

[0121]

[0122] From the above training results, it can be seen that the neural network model built by the embodiment of the present invention has excellent performance and accurate prediction results. Compared with traditional machine learning methods, the LSTM neural network model used in the embodiment of the present invention is good at processing time series signaling data, thereby accurately identifying the new simple GOIP of the external data line from the massive signaling big data.

[0123] Fig. 9It is a structural diagram of the electronic device proposed in the second embodiment of the present invention. The memory of this embodiment stores program instructions for implementing the GOIP fraud prevention method based on signaling feature analysis of any of the above embodiments. The processor is used to execute the program instructions stored in the memory to perform the GOIP fraud prevention method based on signaling feature analysis. Among them, the processor can also be called a CPU (Central Processing Unit). The processor may be an integrated circuit chip with signal processing capabilities. The processor can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0124] The contents of the method in the first embodiment of the present invention are all applicable to the electronic device embodiment. The functions specifically implemented by the electronic device embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method.

[0125] Fig.10 It is a schematic diagram of the structure of the computer-readable storage medium of the third embodiment of the present invention. The computer-readable storage medium of the fourth embodiment of the present invention stores program instructions that can implement the above-mentioned GOIP fraud prevention method based on signaling feature analysis, wherein the program instructions can be stored in the above-mentioned storage medium in the form of a software product, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned computer-readable storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes, or terminal devices such as computers, servers, mobile phones, tablets, etc.

[0126] The contents of the method in the first embodiment of the present invention are all applicable to the computer-readable storage medium embodiment. The functions specifically implemented by the computer-readable storage medium embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method.

[0127] This embodiment also provides a computer program product. When the computer program product runs on a computer, the computer executes the above-mentioned related steps to implement the GOIP fraud prevention method based on signaling feature analysis provided in the above embodiment.

[0128] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0129] Those skilled in the art will appreciate that the modules in the devices in the embodiments of the present invention may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments of the present invention may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the corresponding claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the corresponding claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0130] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0131] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0132] In addition, each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. In particular, for embodiments such as devices, equipment, etc., since they are basically similar to method embodiments, the relevant parts can refer to the partial description of the method embodiments. The embodiments of devices, equipment, etc. described above are merely schematic, wherein the modules, units, etc. described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed in multiple places, such as nodes of a system network. Specifically, some or all of the modules and units may be selected according to actual needs to achieve the purpose of the above-mentioned embodiment scheme. Those skilled in the art can understand and implement it without paying creative labor.

[0133] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0134] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0135] In addition, the terms "first", "second", etc. used in the embodiments of the present invention are only used for descriptive purposes and should not be understood as indicating or implying relative importance, or implicitly indicating the number of technical features indicated in the present embodiment. Therefore, the features defined by the terms "first", "second", etc. in the embodiments of the present invention can explicitly or implicitly indicate that the embodiment includes at least one of the features. In the description of the present invention, the word "multiple" means at least two or two or more, such as two, three, four, etc., unless otherwise clearly and specifically defined in the embodiments.

[0136] In the embodiments of the present invention, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element. In addition, components, features, and elements with the same name in different embodiments of the present invention may have the same meaning or different meanings, and their specific meanings need to be determined by their explanation in the specific embodiment or further combined with the context in the specific embodiment.

[0137] Although the embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and cannot be construed as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention. A person of ordinary skill in the art will easily think of other embodiments of the present invention after considering the specification and practicing the present invention. This application is intended to cover any variation, use or adaptation of the present invention, which follows the general principles of the present invention and includes common knowledge or customary technical means in the art that are not disclosed in the present invention. The specification and embodiments are to be regarded as exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

Claims

1. A GOIP fraud prevention method based on signaling feature analysis, characterized in that: The following steps are involved: Collect signaling data of the target number; Decomposing the signaling parameters of the target number from the signaling data of the target number; Construct signaling feature engineering based on the signaling parameters of multiple target numbers; The signaling feature engineering is analyzed using the trained deep learning model to obtain a fraud prediction result for the target number.

2. A GOIP fraud prevention method based on signaling feature analysis according to claim 1, characterized in that: The signaling data of the target number includes registration signaling data and call signaling data; wherein the registration signaling data is obtained through the S1MME interface and / or the N2 interface; and the call signaling data is obtained through the Mw interface.

3. A GOIP fraud prevention method based on signaling feature analysis according to claim 2, characterized in that: The signaling parameters decomposed from the signaling data of the target number specifically include the registered base station, registered device, registration time, calling device, calling time, number of calls, calling call duration, and called number of the target number.

4. A GOIP fraud prevention method based on signaling feature analysis according to claim 1, characterized in that: The signaling feature engineering specifically includes the following feature parameters: The first characteristic parameter: the number of target numbers registered with the same registration base station using the same registration device within a preset time period; The second characteristic parameter: the registration interval of the target number registered under the same registration base station using the same registration device within a preset time period; The third characteristic parameter: the number of target numbers registered with adjacent registration base stations using the same registration device within a preset time period; Fourth characteristic parameter: the registration interval of the target number registered under the adjacent registration base station using the same registration device within a preset time period; Fifth characteristic parameter: the total number of outgoing calls made using the same outgoing device; Sixth characteristic parameter: the duration of the caller call using the same calling device; Seventh characteristic parameter: distribution of call duration of calling parties using the same calling device for calling; Eighth characteristic parameter: the proportion of callers using the same calling device to make a call; Ninth characteristic parameter: the rate of called party hang-up when using the same calling device to make a call; The tenth characteristic parameter: the overlap of called numbers when using the same calling device to make a calling call.

5. A GOIP fraud prevention method based on signaling feature analysis according to claim 4, characterized in that: The signaling feature engineering is constructed according to the signaling parameters of multiple target numbers. The specific steps include: classifying the plurality of target numbers according to the registered device, the registered base station and the calling device; Obtaining the geographical location relationship of the registered base stations, and determining the adjacent registered base stations of each registered base station; Obtaining a first characteristic parameter and a second characteristic parameter according to the signaling characteristics of the target number under the same registered device and the same registered base station; Obtaining a third characteristic parameter and a fourth characteristic parameter according to the signaling characteristics of the target number under the same registered device and the adjacent registered base stations of each registered base station; According to the signaling characteristics of the target number under the same calling device, a fifth characteristic parameter, a sixth characteristic parameter, a seventh characteristic parameter, an eighth characteristic parameter, a ninth characteristic parameter and a tenth characteristic parameter are obtained.

6. A GOIP fraud prevention method based on signaling feature analysis according to claim 1, characterized in that: The deep learning model is an LSTM neural network model, the excitation function of the LSTM neural network model is a softplus function, the loss function is a MAPE function, and the optimization function is a gradient descent function.

7. A GOIP fraud prevention method based on signaling feature analysis according to claim 6, characterized in that: The deep learning model is trained by the following steps: Obtain training samples and perform binarization processing on the training samples; Using the binarized training samples to tune the parameters of the deep learning model to obtain target parameters; Apply the target parameters to the deep learning model to obtain a trained deep learning model.

8. A GOIP fraud prevention method based on signaling feature analysis according to claim 1, characterized in that: The method of using the trained deep learning model to perform feature analysis on the signaling feature engineering to obtain a fraud prediction result of the target number specifically includes the following steps: According to the trained deep learning model, the fraud weight of each signaling parameter in the signaling feature engineering is obtained; Applying the fraud weight to the signaling data of the target number to obtain the total fraud weight of the target number; Compare the total fraud weight of the target number with a preset fraud weight; For target numbers whose total fraud weight is greater than the preset fraud weight, the fraud prediction result of the fraud number is output; For target numbers whose total fraud weight is not greater than the preset fraud weight, the fraud prediction results of normal numbers are output.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement a GOIP fraud prevention method based on signaling feature analysis as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement a GOIP fraud prevention method based on signaling feature analysis as described in any one of claims 1-8.

Images