Telecommunication fraud behavior identification method

Abstract

The invention discloses a telecommunication fraud behavior recognition method, which comprises the following steps: firstly, establishing an APP acquisition specification, performing static and dynamic detection, and constructing a feature library; in the dynamic detection, voiceprint information of call voice is collected and compared with a cloud voiceprint library, and high-risk voiceprints are recognized. Meanwhile, sensitive words in a call are monitored, and a high-risk value is calculated in combination with voiceprint information. And when the high-risk voiceprint is identified and the high-risk value exceeds a threshold value, determining that the phone is a fraud phone and carrying out early warning. In addition, the scheme also considers the association between the voiceprint information and the continuous high-risk value and the voiceprint association degree during the multi-person combined call, thereby improving the recognition accuracy. A fraud-related APP detection model is constructed by fusing multiple features. According to the scheme, voiceprint recognition, sensitive word monitoring and big data analysis technologies are innovatively combined, accurate recognition and early warning of fraud calls are achieved, and the capacity of preventing harassment and fraud is effectively improved. Meanwhile, the scheme further has a self-updating and optimizing mechanism, and high efficiency and stability of long-term operation are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of telecommunications fraud behavior identification, and in particular to a telecommunications fraud behavior identification method. Background Art

[0002] With the rapid advancement of mobile communication technology, smartphones have become a necessity in people's lives, greatly enriching people's communication and service methods. However, this convenience is also accompanied by increasingly serious problems of telephone harassment and fraud. Criminals carry out fraudulent activities through phone calls, text messages and various APPs, causing serious economic losses and psychological burdens to users.

[0003] Traditionally, in order to deal with this problem, the industry mainly relies on manual labeling methods. Users or relevant institutions will mark harassing calls as risk numbers and include them in the cloud database. When a number is marked multiple times, it will be blacklisted and intercepted. However, this method has many limitations. First, the process of manual labeling requires a lot of time and manpower, and is easily affected by subjective judgment, resulting in uneven accuracy of labeling. Secondly, the recognition rate of traditional methods is low, especially for fraudulent calls using new numbers or forged numbers, which are often difficult to effectively identify. In addition, traditional technologies lack in-depth analysis of the content of the call and are helpless against fraudulent information in voice calls. More importantly, in the context of the big data era, traditional methods have failed to make full use of voice data as a valuable resource, ignoring its huge potential in anti-harassment and anti-fraud. For this reason, this application proposes a method for identifying telecommunications fraud behavior. Summary of the invention

[0004] This application provides a method for identifying telecommunications fraud behavior, and uses dynamic detection technology to capture abnormal behavior of APP in real time. At the same time, combined with advanced voiceprint recognition and sensitive word monitoring technology, the call content is deeply analyzed to accurately identify fraudulent calls. In addition, the solution also needs to take advantage of big data and artificial intelligence to deeply mine and analyze massive voice data, so as to build an efficient fraud-related APP detection model. This effectively solves the problems existing in the background technology.

[0005] This application provides a telecommunications fraud behavior identification method, including:

[0006] S101, establish APP collection specifications for fraud cases, conduct preliminary static detection, and build a preliminary feature library;

[0007] S102, dynamically detect the APP, build a dynamic sandbox to capture the behavior characteristics of the APP when it is running, and form dynamic characteristic information of the fraudulent APP;

[0008] S103, during the dynamic detection process, when there is a call function in the fraudulent APP, the voiceprint information of the call voice signal is collected, and the features are extracted and encoded;

[0009] S104, comparing the voiceprint features with the cloud voiceprint database to identify high-risk voiceprints;

[0010] S105, monitoring sensitive words in the call, and if the high-risk voiceprint information corresponds to a word in the sensitive word library, calculating a high-risk value;

[0011] S106, after identifying the high-risk voiceprint and calculating the high-risk value, the call is determined to be a fraudulent call and an early warning is directly performed;

[0012] S107, combining call voice signal analysis to integrate all fraud-related APP features for training and construct a fraud-related APP detection model.

[0013] Preferably, the voiceprint information in S103 includes:

[0014] Spectral characteristics of speech, fundamental frequency, formant, speaking rate, and intonation.

[0015] Preferably, the S104, cloud voiceprint library, includes:

[0016] What is stored is the voiceprint information characteristics of historical fraudsters. The comparison mainly compares the call frequency of the voice, the number of call recipients of the voice, and the characteristics of the call recipients of the voice.

[0017] When comparing voiceprints, set the similarity threshold to 0.65. When the similarity exceeds this threshold, it is considered a high-risk voiceprint.

[0018] Preferably, the S105 includes:

[0019] Use speech recognition technology to convert call voice signals into text and match them with sensitive words in the sensitive word library;

[0020] When the high-risk voiceprint information corresponds to a word in the sensitive word library, the high-risk value is calculated in combination with the sensitive word;

[0021] This high-risk value is recorded as the basic high-risk value and serves as the initial high-risk value;

[0022] Preferably, the calculating of the high-risk value comprises:

[0023] The high risk value calculation formula is as follows:

[0024]

[0025] Sensitive word weight i is the weight of the i-th sensitive word, indicating the degree of harm of the sensitive word in fraud calls; the frequency of occurrence of sensitive wordsi is the number of times the i-th sensitive word appears in the call; n is the total number of sensitive words, that is, the number of different sensitive words detected in the call.

[0026] Preferably, the S105 further includes:

[0027] S201, calculating the high-risk value of each call based on the voiceprint information comparison result and sensitive word analysis, and determining a high-risk value threshold;

[0028] S202, for the same voiceprint information, if the high-risk value is reached twice or more during a call, exceeding the set threshold, the voiceprint information is marked as a continuous high-risk value;

[0029] S203, calculating the correspondence between the key speech semantic features in the continuous high-risk values ​​and the call time.

[0030] Preferably, the S202, continuous high-risk values, includes:

[0031] The calculation formula for continuous high-risk values ​​is as follows:

[0032] m is the number of consecutive calls with high risk values; HRV j It is the high-risk value of the j-th call, which can be calculated through voiceprint comparison and sensitive word analysis; the semantic feature matching degree is a value between 0 and 1, which indicates the matching degree between the key voice semantic features in the call content and the known fraud patterns and keywords. The value range is controlled between the similarity threshold of 0.65+0.1~0.3 during voiceprint comparison; the call time weight is the weight coefficient for call time adjustment.

[0033] Preferably, the step S201 includes:

[0034] S301, collecting voiceprint information of multiple people and multiple people speaking, and defining different combination types;

[0035] S302, calculating the same voiceprint-same group correlation, different voiceprint-same group correlation and the same voiceprint-different group correlation according to the definition;

[0036] S303, calculating the high-risk value of the voiceprint information matching degree based on the fused correlation information.

[0037] Preferably, the step S302, combining the degree of association, includes:

[0038] Definition: Same Voiceprint-Same Group Correlation SS-SP measures the frequency of the same voiceprint talking to the same group of people in a given time period and the matching degree of voiceprint features;

[0039] The DS-SP correlation between different voiceprints and the same group of people evaluates the frequency of calls between different voiceprints and the matching degree of voiceprint features for the same group of people; the SS-DP correlation between the same voiceprint and different groups of people analyzes the frequency of calls between the same voiceprint and different groups of people and the matching degree of voiceprint features;

[0040] The formula for calculating the combined correlation is as follows:

[0041] CC=β 1 ×(SS-SP)+β 2 ×(DS-SP)+β 3 ×(SS-DP)

[0042] β 1 , β 2 , β 3 is the weight coefficient and β 1 +β 2 +β 3 =1.

[0043] Preferably, the S301 includes:

[0044] S401, combining the combined correlation of the voiceprint information in the cloud, constructing a characteristic relationship between the voiceprint information and the continuous high-risk value;

[0045] S402, determining the change ratio of consecutive high-risk values ​​within a unit time window;

[0046] S403, directly matching sensitive words with cloud voiceprint information for incoming calls within the dangerous time window;

[0047] S404: If there are unrecorded voiceprint features and keywords in the cloud voiceprint information, update the cloud voiceprint information features and sensitive word library.

[0048] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0049] 1. Extract key features that are helpful for classification from the original call voice signal, and accurately extract the voiceprint features in the call voice signal, including spectral characteristics, fundamental frequency, resonance peak, speaking speed, intonation and other key information. This feature extraction method not only improves the accuracy of voiceprint recognition, but also ensures the stability and reliability of the feature vector, laying a solid foundation for subsequent high-risk voiceprint recognition. At the same time, the feature vector is normalized and binary encoded, which further improves the efficiency of comparison and recognition, making voiceprint recognition technology more efficient and convenient in practical applications.

[0050] 2. By combining high-risk voiceprint information with words in the sensitive word library, an innovative high-risk value calculation model is proposed. This model comprehensively considers the importance of sensitive words, the frequency of occurrence, and the overall situation of the call content, and can comprehensively and objectively evaluate the fraud risk of calls. The introduction of high-risk values ​​not only improves the accuracy of fraud identification, but also realizes accurate early warning and timely handling of fraudulent calls, effectively protecting the property safety and privacy rights of users. The implementation of this technical solution is of great significance to combating telecommunications fraud and maintaining social stability.

[0051] 3. Through the marking and calculation of continuous high-risk values, voiceprint information with continuous high risks is effectively identified and highlighted, providing a strong basis for timely security measures. In addition, the solution also considers the impact of call time on risk assessment, as well as the matching degree between key voice semantic features and fraud patterns, further improving the accuracy and pertinence of risk assessment. Finally, through the correction of the basic high-risk value of the voiceprint by continuous high-risk values, the dynamic update of risk assessment is achieved, ensuring the timeliness and reliability of the assessment results.

[0052] 4. Through the marking and calculation of continuous high-risk values, voiceprint information with continuous high risks is effectively identified and highlighted, providing a strong basis for timely security measures. In addition, the solution also considers the impact of call time on risk assessment, as well as the matching degree between key voice semantic features and fraud patterns, further improving the accuracy and pertinence of risk assessment. Finally, through the correction of the basic high-risk value of the voiceprint by continuous high-risk values, the dynamic update of risk assessment is achieved, ensuring the timeliness and reliability of the assessment results.

[0053] 5. By integrating multiple correlation information and calculating the combined correlation, this method can more effectively identify voiceprint features that are highly associated with specific fraud types or groups of people. When the combined correlation exceeds the set threshold, the voiceprint information of the call can be marked as a high-risk value, thereby achieving rapid and accurate detection of fraudulent behavior. This greatly reduces the false alarm and missed alarm rates and improves the accuracy of fraud detection. This method is not only suitable for voiceprint analysis of a single fraud type or group of people, but can also handle multiple fraud types and complex combinations of people. By adjusting the weight coefficient and threshold, the system can easily adapt to different application scenarios and data sets, showing strong adaptability and robustness. At the same time, multi-dimensional correlation analysis also provides strong support for subsequent fraud prediction and prevention.

[0054] 6. By closely combining the voiceprint information in the cloud with continuous high-risk values, an innovative characteristic relationship is constructed that reflects the dynamic changes of voiceprints and the association with potential risk patterns. In particular, by setting a precise unit time window and stipulating that the high-risk value ratio exceeds 30%, it is a dangerous time window. This mechanism makes the capture of risk periods more accurate and provides strong support for subsequent risk identification and response. At the same time, the self-update mechanism in the solution ensures that the voiceprint information characteristics and sensitive word library keep pace with the times, so that the system can continue to adapt to complex and changing risk environments.

[0055] 7. Incoming calls within the dangerous time window can be quickly and accurately identified through sensitive word matching of cloud voiceprint information, greatly improving the efficiency and accuracy of fraud detection. This instant response capability is of great significance for timely blocking fraudulent behavior and protecting user property safety. At the same time, the system's adaptability and continuous optimization capabilities also ensure that it can maintain high efficiency and stability in long-term operation, providing long-term and reliable protection for user communication security. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 The present invention is a flowchart of telecommunications fraud identification according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] To facilitate the understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more related listed items.

[0059] Embodiment 1:

[0060] like Figure 1 As shown, a method for identifying telecommunications fraud behavior includes the following steps:

[0061] S101, establish APP collection specifications for fraud cases, conduct preliminary static detection, and build a preliminary feature library.

[0062] Specifically, we will establish standardized operation procedures and elements for collecting data on APPs involved in fraud cases, and use a static detection engine with broad-spectrum features of similar codes. The broad-spectrum features of the static detection engine for fraud-related APPs should include code execution sequences, signatures, classes, strings, and custom features, to comprehensively form a preliminary feature library for fraud-related APPs.

[0063] Among them, static sandbox farming is constructed based on static engine detection based on broad-spectrum features, including signature fingerprint features, class file features, string features, code execution sequence features, SO file features, and custom features. It solves the problems of low accuracy and incomplete coverage of traditional detection methods and effectively identifies fraudulent apps.

[0064] S102, dynamically detect the APP, build a dynamic sandbox to capture the behavioral characteristics of the APP when it is running, and form dynamic characteristic information of the fraud-related APP.

[0065] Specifically, a dynamic sandbox is developed based on customized ROM sandbox technology and automated shell removal engine technology, and the samples to be tested are run in it. The dynamic engine performs all-round detection of mobile apps' privacy behaviors, network behaviors, file operations, SMS operations, command line monitoring, audio and video recording and camera monitoring, screenshots when apps are running, simulator detection shielding, privacy feedback data monitoring, etc., and then outputs an app dynamic detection report based on the scores of the behavior analysis results. The dynamic detection engine is used to achieve 360-degree dynamic scanning of fraud-related apps and form app dynamic feature information.

[0066] Among them, the dual engines work in parallel to form a full intelligence feature library of fraud-related APPs, which is expected to cover more than 5 million features.

[0067] S103, during the dynamic detection process, when there is a call function in the fraud-related APP, the voiceprint information of the call voice signal is collected, and the features are extracted and encoded.

[0068] Among them, voiceprint information includes: spectral characteristics, fundamental frequency, formant, speaking speed, and intonation of speech;

[0069] Specifically, the openSMILE tool is used to extract the perceptual linear prediction coefficient (PLP) feature from the call voice signal, and the script is used to call the config file corresponding to the PLP feature to generate the PLP feature data of the call voice signal, which is called voiceprint information; the PLP feature data is further extracted through the Faster RCNN network to obtain more refined voice features, and the extracted features are converted into vector form, with each eigenvalue corresponding to an element in the vector. The feature vectors are normalized to have the same numerical range. The processed feature vectors are binary encoded for subsequent comparison and recognition.

[0070] S104, comparing the voiceprint features with the cloud voiceprint database to identify high-risk voiceprints.

[0071] Specifically, the extracted and encoded voiceprint features are compared with the cloud voiceprint database, and the similarity between the voiceprint to be tested and the voiceprint in the database is calculated using the similarity measurement method Euclidean distance. If the similarity exceeds the preset threshold, it is considered that a high-risk voiceprint has been identified.

[0072] The cloud voiceprint database stores the voiceprint information characteristics of historical fraudsters. The comparison mainly compares the call frequency of the voice, the number of call objects of the voice, and the characteristics of the call objects of the voice.

[0073] When comparing voiceprints, set the similarity threshold to 0.65 (or adjust according to actual conditions). When the similarity exceeds this threshold, it is considered a high-risk voiceprint.

[0074] S105, monitoring sensitive words in the call, if the high-risk voiceprint information corresponds to a word in the sensitive word library, calculating a high-risk value.

[0075] Specifically, voice recognition technology is used to convert call voice signals into text and match them with sensitive words in the sensitive word library. When the high-risk voiceprint information corresponds to a word in the sensitive word library, the high-risk value is calculated in combination with the sensitive word; this high-risk value is recorded as the basic high-risk value as the initial high-risk value.

[0076] Among them, sensitive words include sensitive words for various fraud methods such as fake rebates, pig killing, online gambling, fake shopping, etc. during fraud calls. Specifically, they can include: suspected, compensation, congratulations, upgrade, confirm, verification code, payment, ID card, long-distance, mobile phone number and other words; the sensitive words in the sensitive word library need to be updated in time according to the fraud methods and words.

[0077] The high risk value calculation formula is as follows:

[0078]

[0079] Sensitive word weight i is the weight of the i-th sensitive word, indicating the importance or harm degree of the sensitive word in fraud calls. Different sensitive words may have different weights, which can be set according to actual conditions. For example, "verification code" may have a higher weight than "congratulations" because it is more common and more critical in fraud calls;

[0080] Frequency of sensitive words i is the number of times the i-th sensitive word appears in the call. This value reflects the frequency of occurrence of sensitive words in the call. The more times it appears, the more likely the call content is fraudulent;

[0081] n is the total number of sensitive words, that is, the number of different sensitive words detected in the call.

[0082] S106, after identifying the high-risk voiceprint and calculating the high-risk value, the call is determined to be a fraudulent call and an early warning is directly performed.

[0083] Specifically, after determining that it is a fraud call, an alarm signal is sent to the relevant management department, the call is automatically hung up or blocked, and a fraud warning notification is sent to the user. At the same time, relevant information of the fraud call is recorded, such as the phone number, call time, call content summary (if possible), high-risk voiceprint features, etc., for subsequent analysis and tracking.

[0084] Report directly to the relevant management department for technical blocking of calls and subsequent scientific education on fraud.

[0085] S107, combining call voice signal analysis to integrate all fraud-related APP features for training and construct a fraud-related APP detection model.

[0086] Specifically, the malicious program is analyzed, the features of black and white samples are extracted, and then the xgboost algorithm is used for model training and family identification of malicious samples. The samples identified as white are then subjected to anomaly detection, the purpose of which is to detect new malicious samples that the model cannot detect. Finally, based on the recognition results, the samples that are misidentified are added to the training set for retraining. The multi-category features of the APK file are integrated to uniformly establish feature vectors, and a variety of methods are used to extract features that can reflect the behavior of Android malicious programs, including sensitive permissions, sensitive API function call sequences, file name strings, so file names, file sizes, and file permission features. Random forests and XGBOOST are used for binary classification to determine black and white, convolutional neural networks and K-means clustering are used for multi-classification identification of families, and anomaly detection is used to discover black samples of unknown types. The results of multiple algorithms confirm each other. After the recognition results are verified, they can be added to the sample set for iterative training to achieve online updates of the model.

[0087] Among them, family identification is the identification of fraudulent APP families, that is, fraudulent APPs of the same type and attributes are called a family.

[0088] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0089] 1. Extract key features that are helpful for classification from the original call voice signal, and accurately extract the voiceprint features in the call voice signal, including spectral characteristics, fundamental frequency, resonance peak, speaking speed, intonation and other key information. This feature extraction method not only improves the accuracy of voiceprint recognition, but also ensures the stability and reliability of the feature vector, laying a solid foundation for subsequent high-risk voiceprint recognition. At the same time, the feature vector is normalized and binary encoded, which further improves the efficiency of comparison and recognition, making voiceprint recognition technology more efficient and convenient in practical applications.

[0090] 2. By combining high-risk voiceprint information with words in the sensitive word library, an innovative high-risk value calculation model is proposed. This model comprehensively considers the importance of sensitive words, the frequency of occurrence, and the overall situation of the call content, and can comprehensively and objectively evaluate the fraud risk of calls. The introduction of high-risk values ​​not only improves the accuracy of fraud identification, but also realizes accurate early warning and timely handling of fraudulent calls, effectively protecting the property safety and privacy rights of users. The implementation of this technical solution is of great significance to combating telecommunications fraud and maintaining social stability.

[0091] Embodiment 2:

[0092] The above-mentioned first embodiment realizes a complete set of identification methods for fraudulent phone calls by establishing a static and dynamic feature library of fraudulent APPs, combining voiceprint information feature extraction and high-risk voiceprint recognition technology, and a method for calculating high-risk values ​​by matching sensitive words, aiming to improve the accuracy of fraud identification and the timeliness of early warning, and effectively protect user safety. In order to further improve the accuracy of telecommunications fraud identification, further improvements are made to step S105 of the first embodiment, specifically:

[0093] S201, based on the voiceprint information comparison results and sensitive word analysis, calculate the high-risk value of each call and determine a high-risk value threshold.

[0094] Specifically, the voiceprint information in the call is compared with the known voiceprint database to obtain the voiceprint similarity. At the same time, sensitive words are detected in the call content, and the frequency and type of sensitive words are counted. Combining the voiceprint similarity and sensitive word analysis results, a preset algorithm is used to calculate the high-risk value of each call. A high-risk value threshold T is set for subsequent judgment.

[0095] The threshold T is initially set between 0.5 and 0.8 and is adjusted according to actual conditions.

[0096] S202: For the same voiceprint information, if the high-risk value is reached twice or more during a call and exceeds a set threshold, the voiceprint information is marked as a continuous high-risk value.

[0097] Specifically, for each call, the voiceprint information and high-risk value are recorded. For the same voiceprint information, it is checked whether there are two or more high-risk values ​​exceeding the threshold T in consecutive calls. If the conditions are met, the voiceprint information is marked as a continuous high-risk value.

[0098] S203, calculating the correspondence between the key speech semantic features in the continuous high-risk values ​​and the call time.

[0099] Specifically, in calls marked as continuous high-risk values, key speech semantic features are extracted, including pitch, timbre, speaking speed, emotion, etc. These features are matched with known fraud patterns or keywords, and the semantic feature matching degree is calculated using algorithms such as cosine similarity. A call time weight is set according to the length of the call, which can usually be set as a linear function of the call time.

[0100] The calculation formula for continuous high-risk values ​​is as follows:

[0101]

[0102] m is the number of consecutive calls with high risk values; HRV j is the high-risk value of the jth call, which can be calculated through voiceprint comparison and sensitive word analysis; semantic feature matching is a value between 0 and 1, indicating the degree of matching between the key voice semantic features in the call content and the known fraud patterns or keywords, and the value range is controlled between the similarity threshold of 0.65+0.1~0.3 during voiceprint comparison; call time weight is a weight coefficient adjusted according to the call time. Generally speaking, the longer the call time, the more information it may contain, and the higher the risk of fraud. Therefore, the call time weight can be set as a function proportional to the call time, and the specific form can be set according to the actual situation.

[0103] Among them, the key speech semantics are extracted together with pitch, timbre, speaking speed, emotion, etc. in voiceprint information extraction, and matched with the historical voiceprint information semantics when performing semantic feature matching, and cosine similarity is used to calculate the semantic feature matching degree. Since the cosine similarity calculation formula is an existing technology, it will not be described in detail in this article.

[0104] S204, using the continuous high-risk values ​​to correct the basic high-risk value of the voiceprint.

[0105] Specifically, the basic high-risk value BHRV of the voiceprint is obtained from the cloud database, and the correction coefficient α is set according to the actual application scenario and risk assessment requirements. The corrected basic high-risk value is calculated using the formula.

[0106] The correction formula is as follows:

[0107] Corrected basic high-risk value = BHRV×(1+α×CHRV)

[0108] BHRV is the basic high-risk value of the voiceprint in the cloud database. It is an initial risk assessment value that has not been corrected by continuous high-risk values. α is a correction coefficient used to adjust the impact of continuous high-risk values ​​on the basic high-risk value, which can be set according to actual conditions.

[0109] The 1+α×CHRV part is an adjustment factor, which is used to correct the basic high-risk value according to the continuous high-risk value. When the CHRV is higher, the adjustment factor will also increase accordingly, so that the corrected basic high-risk value is higher, reflecting the higher risk level of the voiceprint in continuous calls. Conversely, when the CHRV is low, the adjustment factor is close to 1, and the impact on the basic high-risk value is small;

[0110] It should be noted that the setting of the correction coefficient α should be done with caution to ensure that the corrected basic high-risk value can accurately reflect the actual risk level of the voiceprint. In addition, as new call data is continuously added, both the continuous high-risk value CHRV and the basic high-risk value BHRV need to be dynamically updated to maintain the accuracy and timeliness of the assessment.

[0111] S205, updating the corrected basic high-risk value to the cloud database as the new basic high-risk value of the voiceprint.

[0112] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0113] 1. Through the marking and calculation of continuous high-risk values, voiceprint information with continuous high risks is effectively identified and highlighted, providing a strong basis for timely security measures. In addition, the solution also considers the impact of call time on risk assessment, as well as the matching degree between key voice semantic features and fraud patterns, further improving the accuracy and pertinence of risk assessment. Finally, through the correction of the basic high-risk value of the voiceprint by continuous high-risk values, the dynamic update of risk assessment is achieved, ensuring the timeliness and reliability of the assessment results.

[0114] 2. Through the marking and calculation of continuous high-risk values, voiceprint information with continuous high risks is effectively identified and highlighted, providing a strong basis for timely security measures. In addition, the solution also considers the impact of call time on risk assessment, as well as the matching degree between key voice semantic features and fraud patterns, further improving the accuracy and pertinence of risk assessment. Finally, through the correction of the basic high-risk value of the voiceprint by continuous high-risk values, the dynamic update of risk assessment is achieved, ensuring the timeliness and reliability of the assessment results.

[0115] Embodiment 3: The above embodiment 2 combines multiple risk assessment methods such as voiceprint comparison, sensitive word analysis, and speech semantic feature extraction, and realizes accurate calculation and dynamic assessment of call high-risk values ​​through continuous high-risk value calculation and correction mechanism. If the voiceprint information involves multiple people's combined information, the calculation of the correlation of high-risk values ​​needs to consider the interaction between multiple voiceprints and their call patterns with specific groups of people. There is a positive correlation between the calculated correlation and the high-risk value, and the combined correlation is used through data analysis to further correct and optimize the high-risk value, thereby improving the accuracy and efficiency of fraud detection.

[0116] Now, step S201 of the second embodiment is further improved, specifically:

[0117] S301, collecting voiceprint information of multiple people in combination and when multiple people are talking, and defining different combination types.

[0118] Specifically, the same voiceprint-same group correlation (SS-SP) is defined to measure the frequency and voiceprint feature matching of the same voiceprint when talking to the same group of people (such as a specific group of victims) within a given time period (such as the voiceprint tone similarity of fraudster A to a group of people aged 20-30); the different voiceprint-same group correlation (DS-SP) is defined to evaluate the frequency and voiceprint feature matching of different voiceprints when talking to the same group of people (such as the voiceprint tone similarity of fraudster A, B, and C to a group of people aged 20-30); the same voiceprint-different group correlation (SS-DP) is defined to analyze the frequency and voiceprint feature matching of the same voiceprint when talking to different groups of people (such as the voiceprint tone similarity of fraudster A to two groups of people aged 20-30 and 40-50).

[0119] Among them, the same group of people can be clearly defined according to different ages, genders, regions, etc. under different types of fraud. The specific definition method can be distinguished according to the classification of historical fraudsters in terms of fraud rhetoric; the tone similarity adopts the cosine similarity calculation formula to convert the intonation and word style of the speech into a vector representation to obtain the tone similarity.

[0120] Among them, (SS-SP) correlation = (DS-SP) correlation = (SS-DP) correlation = 0.3×call frequency + 0.7×voiceprint feature matching degree. The calculated values ​​of (SS-SP) correlation, (DS-SP) correlation and (SS-DP) correlation must be normalized.

[0121] S302, calculating the same voiceprint-same group association degree, different voiceprint-same group association degree and the same voiceprint-different group association degree according to the definition.

[0122] The calculation formula of combined correlation is as follows:

[0123] CC=β1 ×(SS-SP)+β 2 ×(DS-SP)+β 3 ×(SS-DP)

[0124] β 1 , β 2 , β 3 is the weight coefficient and β 1 +β 2 +β 3 =1, used to adjust the contribution of different correlation indicators in the combined correlation.

[0125] S303, calculating the high-risk value of the voiceprint information matching degree based on the fused correlation information.

[0126] Specifically, if the voiceprint information collected during a call matches a certain type of associated voiceprint information in the combined correlation, and the calculated combined correlation exceeds the threshold value of 0.60 (it can be changed in specific applications. In this embodiment, if the combined correlation reaches 0.6 when the three correlation combinations exceed more than half of the matching degrees, it can be identified as associated voiceprint information), the voiceprint information of the call will be directly calculated as a high-risk value.

[0127] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0128] 1. By integrating multiple correlation information and calculating the combined correlation, this method can more effectively identify voiceprint features that are highly associated with specific fraud types or groups. When the combined correlation exceeds the set threshold, the voiceprint information of the call can be marked as a high-risk value, thereby achieving rapid and accurate detection of fraudulent behavior. This greatly reduces the false positive and false negative rates and improves the accuracy of fraud detection.

[0129] 2. This method is not only applicable to the voiceprint analysis of a single fraud type or group of people, but can also handle multiple fraud types and complex combinations of people. By adjusting the weight coefficient and threshold, the system can easily adapt to different application scenarios and data sets, showing strong adaptability and robustness. At the same time, multi-dimensional correlation analysis also provides strong support for subsequent fraud prediction and prevention.

[0130] Embodiment 4: The above-mentioned embodiment 3 performs correlation analysis on voiceprint information from multiple dimensions. This multi-dimensional method can comprehensively capture the distribution and change patterns of voiceprint features in different groups of people and fraud types, thereby improving the accuracy and reliability of the analysis.

[0131] Now, further improvements are made on the basis of the third embodiment, specifically:

[0132] S401, combining the combined correlation of the voiceprint information in the cloud, constructing a characteristic relationship between the voiceprint information and the continuous high-risk value.

[0133] S402, determining the change ratio of consecutive high-risk values ​​within a unit time window.

[0134] Among them, the unit time window is defined as 24 hours a day, and the hourly time period is a time window;

[0135] When the proportion of consecutive high-risk values ​​in a unit time window exceeds 30%, the time window is identified as a dangerous time window. Specifically, within the set time window, the number of high-risk values ​​is counted. The frequency of high-risk values ​​is calculated, that is, the number of high-risk values ​​divided by the length of the time window.

[0136] S403, directly matching sensitive words with cloud voiceprint information for incoming calls within the dangerous time window.

[0137] S404: If there are unrecorded voiceprint features and keywords in the cloud voiceprint information, update the cloud voiceprint information features and sensitive word library.

[0138] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0139] 1. By closely combining the voiceprint information in the cloud with continuous high-risk values, an innovative characteristic relationship is constructed that reflects the dynamic changes of voiceprints and the association with potential risk patterns. In particular, by setting a precise unit time window and stipulating that the high-risk value ratio exceeds 30%, it is a dangerous time window. This mechanism makes the capture of risk periods more accurate and provides strong support for subsequent risk identification and response. At the same time, the self-update mechanism in the solution ensures that the voiceprint information characteristics and sensitive word library keep pace with the times, so that the system can continue to adapt to complex and changing risk environments.

[0140] 2. Incoming calls within the dangerous time window can be quickly and accurately identified through sensitive word matching of cloud voiceprint information, greatly improving the efficiency and accuracy of fraud detection. This instant response capability is of great significance for timely blocking fraudulent behavior and protecting user property safety. At the same time, the system's adaptability and continuous optimization capabilities also ensure that it can maintain high efficiency and stability in long-term operation, providing long-term and reliable protection for user communication security.

[0141] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for identifying telecommunications fraud behavior, characterized in that: include: S101, establish APP collection specifications for fraud cases, conduct preliminary static detection, and build a preliminary feature library; S102, dynamically detect the APP, build a dynamic sandbox to capture the behavior characteristics of the APP when it is running, and form dynamic characteristic information of the fraudulent APP; S103, during the dynamic detection process, when there is a call function in the fraudulent APP, the voiceprint information of the call voice signal is collected, and the features are extracted and encoded; S104, comparing the voiceprint features with the cloud voiceprint database to identify high-risk voiceprints; S105, monitoring sensitive words in the call, and if the high-risk voiceprint information corresponds to a word in the sensitive word library, calculating a high-risk value; S106, after identifying the high-risk voiceprint and calculating the high-risk value, the call is determined to be a fraudulent call and an early warning is directly performed; S107, combining call voice signal analysis to integrate all fraud-related APP features for training and construct a fraud-related APP detection model.

2. A telecommunications fraud behavior identification method as claimed in claim 1, characterized in that: The voiceprint information in S103 includes: Spectral characteristics of speech, fundamental frequency, formant, speaking rate, and intonation.

3. A telecommunications fraud behavior identification method as claimed in claim 1, characterized in that: The S104, cloud voiceprint library, includes: What is stored is the voiceprint information characteristics of historical fraudsters. The comparison mainly compares the call frequency of the voice, the number of call recipients of the voice, and the characteristics of the call recipients of the voice. When comparing voiceprints, set the similarity threshold to 0.

65. When the similarity exceeds this threshold, it is considered a high-risk voiceprint.

4. A method for identifying telecommunications fraud behavior as claimed in claim 1, characterized in that: The S105 includes: Use speech recognition technology to convert call voice signals into text and match them with sensitive words in the sensitive word library; When the high-risk voiceprint information corresponds to a word in the sensitive word library, the high-risk value is calculated in combination with the sensitive word; This high-risk value is recorded as the basic high-risk value and serves as the initial high-risk value.

5. A telecommunications fraud behavior identification method as claimed in claim 4, characterized in that: The high-risk value calculation includes: the high-risk value calculation formula is as follows: Sensitive word weight i is the weight of the i-th sensitive word, indicating the degree of harm of the sensitive word in fraud calls; the frequency of occurrence of sensitive words i is the number of times the i-th sensitive word appears in the call; n is the total number of sensitive words, that is, the number of different sensitive words detected in the call.

6. A method for identifying telecommunications fraud behavior as claimed in claim 1, characterized in that: The S105 further includes: S201, calculating the high-risk value of each call based on the voiceprint information comparison result and sensitive word analysis, and determining a high-risk value threshold; S202, for the same voiceprint information, if the high-risk value is reached twice or more during a call, exceeding the set threshold, the voiceprint information is marked as a continuous high-risk value; S203, calculating the correspondence between the key speech semantic features in the continuous high-risk values ​​and the call time.

7. A telecommunications fraud behavior identification method as claimed in claim 6, characterized in that: The S202, continuous high-risk values, includes: The calculation formula for continuous high-risk values ​​is as follows: m is the number of consecutive calls with high risk values; HRV j It is the high-risk value of the j-th call, which can be calculated through voiceprint comparison and sensitive word analysis; the semantic feature matching degree is a value between 0 and 1, which indicates the matching degree between the key voice semantic features in the call content and the known fraud patterns and keywords. The value range is controlled between the similarity threshold of 0.65+0.1~0.3 during voiceprint comparison; the call time weight is the weight coefficient for call time adjustment.

8. A method for identifying telecommunications fraud behavior as claimed in claim 6, characterized in that: The S201 includes: S301, collecting voiceprint information of multiple people and multiple people speaking, and defining different combination types; S302, calculating the same voiceprint-same group correlation, different voiceprint-same group correlation and the same voiceprint-different group correlation according to the definition; S303, calculating the high-risk value of the voiceprint information matching degree based on the fused correlation information.

9. The method for identifying telecommunications fraud behavior as claimed in claim 8, characterized in that: The step S302, combining the degree of association, includes: Definition: Same Voiceprint-Same Group Correlation SS-SP measures the frequency of the same voiceprint talking to the same group of people in a given time period and the matching degree of voiceprint features; The DS-SP correlation between different voiceprints and the same group of people evaluates the frequency of calls between different voiceprints and the matching degree of voiceprint features for the same group of people; the SS-DP correlation between the same voiceprint and different groups of people analyzes the frequency of calls between the same voiceprint and different groups of people and the matching degree of voiceprint features; The formula for calculating the combined correlation degree is as follows: CC=β1×(SS-SP)+β2×(DS-SP)+β3×(SS-DP), β1, β2, β3 are weight coefficients and β1+β2+β3=1.

10. A telecommunications fraud behavior identification method as claimed in claim 8, characterized in that: The S301 includes: S401, combining the combined correlation of the voiceprint information in the cloud, constructing a characteristic relationship between the voiceprint information and the continuous high-risk value; S402, determining the change ratio of consecutive high-risk values ​​within a unit time window; S403, directly matching sensitive words with cloud voiceprint information for incoming calls within the dangerous time window; S404: If there are unrecorded voiceprint features and keywords in the cloud voiceprint information, update the cloud voiceprint information features and sensitive word library.

Images