High-risk roaming fraud number migration trend prediction method, device and medium

Abstract

The invention discloses a migration trend prediction method and device for a high-risk roaming fraud number and a medium. The method comprises the following steps: collecting registration signaling data of a fraud number; obtaining a plurality of historical high-risk places from the registration signaling data; analyzing a migration probability calculation rule of a historical high-risk site; and predicting a future high-risk place according to a migration probability calculation rule. According to the method, based on massive VOLTE roaming registration signaling data, the probability that the fraud number moves from each high-risk place to each adjacent region is macroscopically counted, and the probability that the fraud number moves from each high-risk place to each adjacent region in a future period of time is predicted by adopting an offline training mode and using a time sequence prediction algorithm. According to the method, the migration trend and probability of the fraud number in each high-risk place at the future moment can be predicted according to the migration direction of the fraud number in different time periods, so that the accurate prediction of the next fraud high-risk place is realized, related measures are taken in advance for pre-prevention, and the passive situation of fraud treatment is reversed.

Description

Technical Field

[0001] The present invention relates to the technical field of anti-fraud prediction, and in particular to a method, device and medium for predicting the migration trend of high-risk roaming fraud numbers. Background Art

[0002] Traditionally, governance measures for high-risk areas outside the province usually rely on post-event analysis. Specifically, these methods are mainly based on cluster analysis of the work order numbers involved provided by relevant departments to identify high-risk areas where fraud activities are concentrated, and build models based on this to strengthen the monitoring of call behavior of roaming users in these areas. However, such methods are essentially passive responses with significant time lags, which can easily put law enforcement agencies at a disadvantage when dealing with fraud gangs. Due to the time difference between positioning and taking action, fraud organizations are often able to quickly move to other areas to continue their crimes after being identified, resulting in limited governance effects.

[0003] Specifically, current methods rely on real-time collection of signaling call data and online machine learning training or manual rule modeling analysis to identify phone numbers that may be involved in fraud based on call behavior modeling. However, such methods have significant time delays in practical applications, making it difficult to achieve pre-emptive prevention. Due to the time lag between data collection and model update and analysis results, this method is unable to respond to emerging fraud activities in a timely manner, thus limiting its preventive effectiveness. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a migration trend prediction method, device and medium for high-risk roaming fraud numbers. A first aspect of the present invention provides a migration trend prediction method for high-risk roaming fraud numbers, comprising the following steps:

[0005] Collect registration signaling data of fraudulent numbers;

[0006] A plurality of historical high-risk areas are obtained from the registration signaling data; the high-risk areas represent areas where fraudulent numbers are concentrated;

[0007] Analyze the migration probability calculation rules of the historical high-risk areas;

[0008] Future high-risk areas are predicted based on the migration probability calculation rules.

[0009] Furthermore, the registration signaling data is collected between the proxy call session control function port and the query session control function port or the service session control function port;

[0010] The registration signaling data specifically includes: a user number, a user identification code, a proxy call session control function address and a tracking area code; wherein the user number and the user identification code are used to determine the fraudulent number to which the registration signaling data belongs, and the proxy call session control function address and the tracking area code are used to determine the region to which the fraudulent number to which the registration signaling data belongs is located.

[0011] Furthermore, obtaining a plurality of historical high-risk areas from the registration signaling data specifically includes the following steps:

[0012] Dividing the registration signaling data in time sequence to obtain registration signaling data at multiple time nodes;

[0013] At each time point, the registration signaling data is aggregated by region to obtain the fraudulent numbers in each region at the time point;

[0014] Areas where the number of fraudulent numbers is greater than a preset first threshold are considered historically high-risk areas.

[0015] Furthermore, the analysis of the migration probability calculation rules of the historical high-risk areas specifically includes the following steps:

[0016] Analyze the location relationship between regions and determine the areas adjacent to each historical high-risk area;

[0017] Determine the probability of fraud numbers in each historical high-risk area migrating to adjacent areas at each time node, and form a migration probability table for each time node;

[0018] The migration probability tables are connected in series in chronological order to form a migration probability calculation rule for each historical high-risk area.

[0019] Furthermore, the determination of the probability of the fraudulent number in each historical high-risk area migrating to an adjacent area at each time node specifically includes the following steps:

[0020] At each time node, call the data of the time nodes before and after the time node to determine the fraudulent numbers that have migrated in each historical high-risk area;

[0021] Determine the migration direction of the fraudulent number based on the data of the time nodes before and after the fraudulent number that has migrated; the migration direction points from the historical high-risk area to which the fraudulent number belongs to the adjacent area of ​​the historical high-risk area;

[0022] Summarize the migration direction of the fraudulent numbers in each historical high-risk area, and obtain the probability of the fraudulent numbers in each historical high-risk area migrating to the adjacent area at that time node;

[0023] The probability of fraudulent numbers in each historical high-risk area migrating to adjacent areas at multiple time nodes is summarized to obtain the probability of fraudulent numbers in each historical high-risk area migrating to adjacent areas at each time node.

[0024] Furthermore, predicting future high-risk areas according to the migration probability calculation rule specifically includes the following steps:

[0025] Establish a dynamic threshold benchmark value model for indicators;

[0026] The migration probability calculation rule is input into the indicator dynamic threshold reference value model, and the number of fraudulent numbers in each region in the future is predicted by the model;

[0027] Areas where the number of fraudulent numbers is greater than a preset second threshold are considered high-risk areas in the future.

[0028] Furthermore, the indicator dynamic threshold reference value model is expressed by the following formula:

[0029] y(t)=g(t)+s(t)+h(t)+∈ (t) ;

[0030] Among them, y(t) represents the number of fraudulent numbers at each time point in each region;

[0031] g(t) represents the growth trend, which is used to reflect the overall direction of the change in the number of fraudulent numbers in the time series;

[0032] s(t) represents the periodic trend, which is used to reflect the direction in which the number of fraudulent numbers in the time series changes with the period;

[0033] h(t) represents the holiday trend, which is used to reflect the direction of the change of the non-fixed characteristic of the number of fraudulent numbers in the time series; the holiday trend is obtained using the Fourier series;

[0034] ε (t) Represents an error term, which is used to reflect the direction of change in the number of fraudulent numbers in the time series that cannot be identified by the dynamic threshold benchmark value model of the indicator; the error term is determined by Gaussian distribution.

[0035] Furthermore, the method further comprises the following steps:

[0036] Anti-fraud operations are performed on numbers roaming to the future high-risk areas.

[0037] A second aspect of the present invention provides an electronic device, including a processor and a memory;

[0038] The memory is used to store programs;

[0039] The processor executes the program to implement the migration trend prediction method of a high-risk roaming fraud number.

[0040] A third aspect of the present invention provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the migration trend prediction method of a high-risk roaming fraud number.

[0041] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0042] The embodiments of the present invention have the following beneficial effects: The migration trend prediction method, device and medium of high-risk roaming fraud numbers of the present invention are based on massive VOLTE roaming registration signaling data, and macro statistics are made on the probability of fraud numbers moving from each high-risk area to its adjacent areas, and the probability of fraud numbers moving from each high-risk area to its adjacent areas in the future is predicted using a time series prediction algorithm in an offline training manner. The present invention can predict the migration trend and probability of fraud numbers in each high-risk area at a future moment according to the flow direction of fraud numbers in different time periods, so as to achieve accurate prediction of the next high-risk area for fraud, take relevant measures in advance for pre-emptive prevention, and reverse the passive situation of fraud governance.

[0043] Additional aspects and advantages of the present invention will be given in part in the following description, and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 It is a basic implementation flow chart of a migration trend prediction method for high-risk roaming fraud numbers of the present invention.

[0046] Figure 2 This is a schematic diagram of the IMS signaling registration process.

[0047] Figure 3 This is a schematic diagram of the migration probability of historical high-risk areas.

[0048] Figure 4 This is a schematic diagram of the model's prediction of future regional migration probabilities.

[0049] Figure 5 It is a structural schematic diagram of an electronic device of the present invention.

[0050] Figure 6 It is a schematic diagram of the structure of a computer-readable storage medium of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] Due to the network architecture of telecom operators, there is often a large delay in the transmission of signaling or call record data from roaming in other provinces back to the province. At the same time, in order to escape the crackdown by the public security bureau of the number’s location, fraudsters often roam in other provinces to carry out concentrated fraud. The areas where the fraud occurs are often referred to as “high-risk areas.”

[0053] Traditionally, governance measures for high-risk areas outside the province usually rely on post-event analysis. Specifically, these methods are mainly based on cluster analysis of the work order numbers involved provided by relevant departments to identify high-risk areas where fraud activities are concentrated, and build models based on this to strengthen the monitoring of call behavior of roaming users in these areas. However, such methods are essentially passive responses with significant time lags, which can easily put law enforcement agencies at a disadvantage when dealing with fraud gangs. Due to the time difference between positioning and taking action, fraud organizations are often able to quickly move to other areas to continue their crimes after being identified, resulting in limited governance effects.

[0054] Specifically, current methods rely on real-time collection of signaling call data and online machine learning training or manual rule modeling analysis to identify phone numbers that may be involved in fraud based on call behavior modeling. However, such methods have significant time delays in practical applications, making it difficult to achieve pre-emptive prevention. Due to the time lag between data collection and model update and analysis results, this method is unable to respond to emerging fraud activities in a timely manner, thus limiting its preventive effectiveness.

[0055] To overcome the above problems, an embodiment of the present invention provides a method, device and medium for predicting the migration trend of high-risk roaming fraud numbers.

[0056] The first embodiment of the present invention provides a method for predicting the migration trend of high-risk roaming fraud numbers. Figure 1 As shown, the following steps are included:

[0057] S1. Collect registration signaling data of fraudulent numbers;

[0058] S2. Obtain multiple historical high-risk areas from registration signaling data;

[0059] S3. Analyze the migration probability calculation rules of historical high-risk areas;

[0060] S4. Predict future high-risk areas based on migration probability calculation rules.

[0061] The embodiment of the present invention predicts the probability of fraud numbers moving from various high-risk areas to their adjacent areas in the future, and takes relevant measures in advance for pre-emptive prevention, which can effectively reverse the passive situation of fraud management and improve the timeliness of anti-fraud.

[0062] The implementation process of each step of the present invention is described in detail below.

[0063] S1. Collect registration signaling data of fraudulent numbers.

[0064] In the embodiment of the present invention, the registration signaling data of the fraudulent number comes from the telecom operator. The voice solutions of telecom operators under different mobile communication networks include GSM, UMTS, VoLTE, VoNR, etc. The embodiment of the present invention uses VoLTE under the 4G network as an example. VoLTE (Voice over Long-Term Evolution) uses the data transmission capability of the 4G LTE network and controls and manages voice calls through IMS (IP Multimedia Subsystem). The registration signaling of VoLTE includes initial registration signaling and re-registration signaling. The registration process is as follows: Figure 2 The initial registration signaling is sent when the fraudulent number connects to the 4G network, and the re-registration signaling is sent periodically while the fraudulent number is on the network (generally every 50 minutes, determined by a network-side timer). Therefore, the embodiment of the present invention can detect changes in the location of the fraudulent number through changes in the registration signaling.

[0065] In the embodiment of the present invention, the registration signaling data is collected between the proxy-call session control function port (P-CSCF) and the interrogating-call session control function port (I-CSCF) or the serving-call session control function port (S-CSCF). Specifically, a network sniffer (such as Wireshark) can be deployed on the network node to capture SIP messages by means of SIP signaling capture to obtain all signaling interactions between the P-CSCF and the I-CSCF / S-CSCF; or the operation log of the P-CSCF, I-CSCF or S-CSCF can be called to query the signaling events sent by each interface; the registration signaling data can also be obtained by means of third-party probes and the like.

[0066] The acquired registration signaling data includes the user number (MSISDN, Mobile Station Integrated Services Digital Network), the user identification code (IMSI, International Mobile Subscriber Identity), the proxy call session control function address (P-CSCF IP) and the tracking area code (TAC, Tracking area code). Among them, MSISDN and IMSI can determine the fraudulent number to which the registration signaling data belongs. For the area where the fraudulent number is located, the registration signaling data does not directly carry the regional information, so further data backfilling processing is required. Specifically, the P-CSCF IP can be associated with the specific province where the fraudulent number is located, but it cannot be accurate to every area in the province; and the TAC can be associated with a specific area in the province, but the TAC between different provinces may be repeated, so it cannot be used alone to determine the area. The embodiment of the present invention can uniquely determine the province and region where the fraudulent number is located through the combination of P-CSCF IP and TAC, identify the regional information associated in the VOLTE registration signaling data, and complete the identification of the area where the fraudulent number is located.

[0067] S2. Obtain multiple historical high-risk areas from the registration signaling data.

[0068] In the embodiment of the present invention, obtaining a plurality of historical high-risk areas from registration signaling data specifically includes the following steps:

[0069] S2-1. Divide the registration signaling data in time sequence to obtain registration signaling data at multiple time nodes.

[0070] In the embodiment of the present invention, the registration signaling data of the fraudulent numbers are divided by time, for example, by day as the granularity, and then the registration signaling data generated by all the fraudulent numbers on the same day will be aggregated under one time node.

[0071] S2-2. At each time node, the registration signaling data is aggregated by region to obtain the fraudulent numbers for each region at that time node.

[0072] After completing the collection of the registration signaling data in the time dimension, the embodiment of the present invention can obtain the region where the fraudulent number is located under each registration signaling data in step S1, so the registration signaling data corresponding to the fraudulent numbers in the same region can be collected to obtain the fraudulent numbers in each region at each time node.

[0073] S2-3. Regions where the number of fraudulent numbers is greater than a preset first threshold are considered historically high-risk areas.

[0074] After completing the collection of fraudulent numbers in the regional dimension, the embodiment of the present invention counts the number of fraudulent numbers in each region at each time node. If the number of fraudulent numbers in a certain region at a certain time node is greater than the set upper limit of fraudulent numbers, the region is marked as a historical high-risk area at that time node, indicating that there are many fraud-related personnel activities in the region, and even concentrated fraud may occur. The embodiment of the present invention can obtain multiple historical high-risk areas at multiple time nodes for subsequent analysis.

[0075] S3. Analyze the migration probability calculation rules of historical high-risk areas.

[0076] In the embodiment of the present invention, the migration probability calculation rule of the historical high-risk area is analyzed, which specifically includes the following steps:

[0077] S3-1. Analyze the location relationship between regions and determine the areas adjacent to each historical high-risk area.

[0078] The regions adjacent to the historical high-risk areas represent the areas where the fraudulent numbers may be transferred. The embodiment of the present invention obtains the positional relationship between each region by retrieving map data to obtain the regions adjacent to each historical high-risk area.

[0079] S3-2. Determine the probability of fraud numbers in each historical high-risk area migrating to adjacent areas at each time node, and form a migration probability table for each time node.

[0080] In the embodiment of the present invention, based on the massive amount of registration signaling data, the probability of fraudulent numbers migrating to each adjacent region can be analyzed. Specifically, step S3-2 includes the following steps:

[0081] S3-2-1. At each time node, call the data of the time nodes before and after the time node to determine the fraudulent numbers that have migrated in each historical high-risk area.

[0082] S3-2-2. Determine the migration direction of the fraudulent number based on the data of the time nodes before and after the migration of the fraudulent number; the migration direction is from the historical high-risk area to which the fraudulent number belongs to the adjacent area of ​​the historical high-risk area.

[0083] S3-2-3. Summarize the migration direction of the fraudulent numbers that have migrated to each historical high-risk area, and obtain the probability of the fraudulent numbers in each historical high-risk area migrating to the adjacent area at that time node.

[0084] S3-2-4. Summarize the probability of fraudulent numbers migrating to adjacent regions in each historical high-risk area at multiple time nodes, and obtain the probability of fraudulent numbers in each historical high-risk area migrating to adjacent regions at each time node.

[0085] As a specific embodiment, the following describes Figure 3 The calculation process of the probability of fraudulent numbers in city_0 migrating to surrounding cities is shown.

[0086] (1) Determine that the cities adjacent to city_0 include city_1, city_2, city_3, and city_4.

[0087] (2) Find the registration signaling data related to city_0 from the registration signaling data at the time node, and identify the fraudulent numbers in these registration signaling data.

[0088] (3) Obtain the registration signaling data of these fraudulent numbers at the time nodes before and after the time node, and filter out the fraudulent numbers whose regions have changed. Region changes include the previous time node being located in an adjacent city and the current time node being located in city_0 and the current time node being located in city_0 and the next time node being located in an adjacent city; the former indicates that the fraudulent number has moved from an adjacent city to city_0, and the latter indicates that the fraudulent number has moved from city_0 to an adjacent city. After obtaining the fraudulent numbers whose regions have changed, the migration trend of the numbers between city_0 and adjacent cities can be statistically analyzed, as shown in the following table:

[0089] Migration Probability Table

[0090] Time Node Migration routes to high-risk areas Migration probability November 1 Move from city_0 to city_1 20％ November 1 Move from city_0 to city_2 40％ November 1 Move from city_0 to city_3 35％ November 1 Move from city_0 to city_4 5％

[0091] In some embodiments, the migration probability of City_0 pointing to other cities may be a negative value, which means that the number of fraudulent numbers migrated from other cities to City_0 is greater than the number of fraudulent numbers migrated from City_0 to other cities, that is, fraudulent numbers have a greater tendency to migrate from other cities to City_0 under this event node, rather than migrating outward from City_0.

[0092] The same method is used to obtain the migration probability of historical high-risk areas at each time node. By summarizing the migration probability in the regional dimension, the probability of fraudulent numbers in each historical high-risk area migrating to adjacent regions at each time node can be obtained.

[0093] S3-3. Concatenate the migration probability tables in chronological order to form the migration probability calculation rules for each historical high-risk area.

[0094] After aggregating at the regional dimension, the aggregated probabilities are further connected in chronological order to form a calculation rule for the migration probability of each historical high-risk area.

[0095] S4. Predict future high-risk areas based on migration probability calculation rules.

[0096] In the embodiment of the present invention, Figure 4 As shown, predicting future high-risk areas according to the migration probability calculation rules specifically includes the following steps:

[0097] S4-1. Establish a dynamic threshold benchmark value model for indicators;

[0098] S4-2. Input the migration probability calculation rules into the indicator dynamic threshold benchmark value model, and the model predicts the number of fraud numbers in each region in the future;

[0099] S4-3. Regions where the number of fraudulent numbers is greater than a preset second threshold are considered high-risk areas in the future.

[0100] The dynamic threshold benchmark model used in the embodiment of the present invention is built based on the Prophet model, which is a library for time series prediction open sourced by Facebook. It is based on an interpretable model framework, focuses on providing high-quality predictions, and can handle issues such as holiday effects, trend change points, and long-term seasonality. The input of the Prophet model is the timestamp of the known time series and the corresponding historical migration probability of the region, as well as the length of the time series to be predicted; the output is the median value of the probability of each region migrating to its neighboring regions.

[0101] The Prophet model adopts the form of a decomposable model, which decomposes the time series into four main components. The mathematical principle of the algorithm model is as follows:

[0102] y(t)=g(t)+s(t)+h(t)+∈ (t) ;

[0103] Among them, y(t) represents the number of fraudulent numbers at each time point in each region;

[0104] g(t) represents the growth trend, which is used to reflect the overall direction of the change in the number of fraudulent numbers in the time series;

[0105] s(t) represents the periodic trend, which is used to reflect the direction in which the number of fraudulent numbers in the time series changes with the period;

[0106] h(t) represents the holiday trend, which is used to reflect the direction of the change of the non-fixed characteristics of the number of fraudulent numbers in the time series; the holiday trend is obtained using the Fourier series;

[0107] ε (t) Represents the error term, which is used to reflect the direction of change in the number of fraudulent numbers in the time series that cannot be identified by the indicator dynamic threshold benchmark value model; the error term is determined by Gaussian distribution.

[0108] The Prophet algorithm fits these items and then adds them up to get the predicted value of the input time series.

[0109] As a specific embodiment, the growth trend is constructed based on the following piecewise linear function:

[0110] g(t)=(k+a(t) T δ)·t+(m+a(t) T γ);

[0111] Among them, a(t) represents each time node, k represents the growth rate, δ represents the change in the growth rate, m represents the offset, and T represents the prediction time length.

[0112] The cycle trend is constructed based on the following logistic regression function:

[0113]

[0114] a(t)=(a1(t),…,a s (t)) T ; δ=(δ1,…,δ s ) T ; γ=(γ1,…,γ s ) T ;

[0115] Among them, C(t) represents the carrying capacity: it is a function that changes with time and limits the maximum value that can grow, and k represents the growth rate.

[0116] The holiday trend is based on the following formula:

[0117]

[0118] in

[0119] As a specific embodiment, the training of the Prophet model is based on the historical data of the previous 365 days of the current time (i.e., the probability of each region migrating to its adjacent regions in each period of each day in history) as a training set. After the model is trained, the Prophet model learns the regional migration probability of the fraudulent number sample for 365 days in history, and predicts the probability of each region moving to its adjacent regions every day in the future. The prediction of a period of time in the future here supports customization, and can be comprehensively considered based on factors such as the migration rules of fraudsters in the local area and whether there are new major events that affect the probability of movement. It is recommended that the prediction time period be controlled within 3 months to ensure the accuracy of the model and avoid the prediction of too long but the accuracy is reduced due to changes in the external environment.

[0120] In some embodiments, after the prediction of future high-risk areas is completed, the following steps are also included:

[0121] S5. Perform anti-fraud operations on numbers roaming to future high-risk areas.

[0122] After obtaining a probability list of fraud numbers in each future high-risk area moving to its neighboring areas every day over a period of time in the future, anti-fraud technical prevention strategies can be further deployed based on the prediction results.

[0123] For example, when anti-fraud technical prevention and control is implemented on a certain day, the anti-fraud system calculates and determines the top several potential high-risk areas in the list for anti-fraud control based on the system's confidence (probability of migration to high-risk areas) configuration, combined with the predicted migration probability of high-risk areas in the current period. For the local provincial numbers roaming to the high-risk areas, a comprehensive analysis is conducted based on other characteristics such as the network access channel, network access time, network access package value, cardholder's ID card age, cardholder's registered address, historical roaming trajectory, historical silence and other indicators, and the risky fraud numbers are promptly shut down and disposed of to prevent problems before they occur and achieve pre-emptive control.

[0124] The embodiment of the present invention is based on VoLTE registration data, and macro-statistically calculates the probability of fraud samples migrating from various regions to their adjacent regions. It adopts an offline training method and a time series prediction algorithm to predict the probability of migrating from various regions to their adjacent regions in the future. It fully considers the mobility trends of regions caused by holidays and long-term seasonal factors, and more accurately predicts the migration patterns of high-risk areas, thereby realizing accurate identification of high-risk roaming fraud-related users in advance.

[0125] At present, roaming fraud accounts for a high proportion of telecommunications network fraud in various places, and the average amount of fraud per fraud is about 60,000 yuan. The embodiments of the present invention can effectively prevent and control high-risk roaming fraud, protect the property safety of ordinary users, have huge economic and social benefits, and can be quickly and comprehensively promoted in the communications industry.

[0126] Figure 5: is a schematic diagram of the structure of the electronic device proposed in the second embodiment of the present invention. The memory of this embodiment stores program instructions for implementing the migration trend prediction method of high-risk roaming fraud numbers in any of the above embodiments. The processor is used to execute the program instructions stored in the memory to predict the migration trend of high-risk roaming fraud numbers. Among them, the processor can also be called a CPU (Central Processing Unit). The processor may be an integrated circuit chip with signal processing capabilities. The processor can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0127] The contents of the method in the first embodiment of the present invention are all applicable to the electronic device embodiment. The functions specifically implemented by the electronic device embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method.

[0128] Figure 6 The schematic diagram of the structure of the computer-readable storage medium of the third embodiment of the present invention. The computer-readable storage medium of the fourth embodiment of the present invention stores program instructions that can implement the above-mentioned migration trend prediction method of high-risk roaming fraud numbers, wherein the program instructions can be stored in the above-mentioned storage medium in the form of a software product, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks or optical disks, or terminal devices such as computers, servers, mobile phones, and tablets.

[0129] The contents of the method in the first embodiment of the present invention are all applicable to the computer-readable storage medium embodiment. The functions specifically implemented by the computer-readable storage medium embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method.

[0130] This embodiment also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement the migration trend prediction method of high-risk roaming fraud numbers provided in the above embodiment.

[0131] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0132] Those skilled in the art will appreciate that the modules in the devices in the embodiments of the present invention may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments of the present invention may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including corresponding claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including corresponding claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0133] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0134] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0135] In addition, each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. In particular, for embodiments such as devices and equipment, since they are basically similar to method embodiments, the relevant parts can refer to the partial description of the method embodiments. The embodiments of the devices and equipment described above are merely schematic, wherein the modules, units, etc. described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed in multiple places, such as nodes of a system network. Specifically, some or all of the modules and units may be selected according to actual needs to achieve the purpose of the above-mentioned embodiment scheme. Those skilled in the art can understand and implement it without paying creative labor.

[0136] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0137] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0138] In addition, the terms "first", "second", etc. used in the embodiments of the present invention are only used for descriptive purposes and should not be understood as indicating or implying relative importance, or implicitly indicating the number of technical features indicated in the present embodiment. Therefore, the features defined by the terms "first", "second", etc. in the embodiments of the present invention can explicitly or implicitly indicate that the embodiment includes at least one of the features. In the description of the present invention, the word "multiple" means at least two or two or more, such as two, three, four, etc., unless otherwise clearly and specifically defined in the embodiments.

[0139] In the embodiments of the present invention, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element. In addition, components, features, and elements with the same name in different embodiments of the present invention may have the same meaning or different meanings, and their specific meanings need to be determined by their explanation in the specific embodiment or further combined with the context in the specific embodiment.

[0140] Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and cannot be construed as limitations of the present invention, and those of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention. Those skilled in the art will readily come to think of other embodiments of the present invention after considering the specification and practicing the present invention. This application is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art that are not disclosed in the present invention. The specification and embodiments are intended to be exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

Claims

1. A method for predicting the migration trend of high-risk roaming fraud numbers, characterized in that: The following steps are involved: Collect registration signaling data of fraudulent numbers; A plurality of historical high-risk areas are obtained from the registration signaling data; the high-risk areas represent areas where fraudulent numbers are concentrated; Analyze the migration probability calculation rules of the historical high-risk areas; Future high-risk areas are predicted based on the migration probability calculation rules.

2. A method for predicting migration trends of high-risk roaming fraud numbers according to claim 1, characterized in that: The registration signaling data is collected between the proxy call session control function port and the query session control function port or the service session control function port; The registration signaling data specifically includes: a user number, a user identification code, a proxy call session control function address and a tracking area code; wherein the user number and the user identification code are used to determine the fraudulent number to which the registration signaling data belongs, and the proxy call session control function address and the tracking area code are used to determine the region to which the fraudulent number to which the registration signaling data belongs is located.

3. A method for predicting migration trends of high-risk roaming fraud numbers according to claim 2, characterized in that: The step of obtaining a plurality of historical high-risk areas from the registration signaling data specifically includes the following steps: Dividing the registration signaling data in time sequence to obtain registration signaling data at multiple time nodes; At each time point, the registration signaling data is aggregated by region to obtain the fraudulent numbers in each region at the time point; Areas where the number of fraudulent numbers is greater than a preset first threshold are considered historically high-risk areas.

4. The method for predicting migration trend of high-risk roaming fraud numbers according to claim 1, characterized in that: The analysis of the migration probability calculation rules of the historical high-risk areas specifically includes the following steps: Analyze the location relationship between regions and determine the areas adjacent to each historical high-risk area; Determine the probability of fraud numbers in each historical high-risk area migrating to adjacent areas at each time node, and form a migration probability table for each time node; The migration probability tables are connected in series in chronological order to form a migration probability calculation rule for each historical high-risk area.

5. A method for predicting migration trends of high-risk roaming fraud numbers according to claim 4, characterized in that: Determining the probability of fraud numbers in each historical high-risk area migrating to adjacent areas at each time node specifically includes the following steps: At each time node, call the data of the time nodes before and after the time node to determine the fraudulent numbers that have migrated in each historical high-risk area; Determine the migration direction of the fraudulent number based on the data of the time nodes before and after the fraudulent number that has migrated; the migration direction points from the historical high-risk area to which the fraudulent number belongs to the adjacent area of ​​the historical high-risk area; Summarize the migration direction of the fraudulent numbers in each historical high-risk area, and obtain the probability of the fraudulent numbers in each historical high-risk area migrating to the adjacent area at that time node; The probability of fraudulent numbers in each historical high-risk area migrating to adjacent areas at multiple time nodes is summarized to obtain the probability of fraudulent numbers in each historical high-risk area migrating to adjacent areas at each time node.

6. The method for predicting migration trend of high-risk roaming fraud numbers according to claim 1, characterized in that: The method of predicting future high-risk areas according to the migration probability calculation rule specifically includes the following steps: Establish a dynamic threshold benchmark value model for indicators; The migration probability calculation rule is input into the indicator dynamic threshold reference value model, and the number of fraudulent numbers in each region in the future is predicted by the model; Areas where the number of fraudulent numbers is greater than a preset second threshold are considered high-risk areas in the future.

7. A method for predicting migration trends of high-risk roaming fraud numbers according to claim 6, characterized in that: The indicator dynamic threshold reference value model is expressed by the following formula: y(t)=g(t)+s(t)+h(t)+∈ (t) ; Among them, y(t) represents the number of fraudulent numbers at each time point in each region; g(t) represents the growth trend, which is used to reflect the overall direction of the change in the number of fraudulent numbers in the time series; s(t) represents the periodic trend, which is used to reflect the direction in which the number of fraudulent numbers in the time series changes with the period; h(t) represents the holiday trend, which is used to reflect the direction of the change of the non-fixed characteristic of the number of fraudulent numbers in the time series; the holiday trend is obtained using the Fourier series; ε (t) Represents an error term, which is used to reflect the direction of change in the number of fraudulent numbers in the time series that cannot be identified by the dynamic threshold benchmark value model of the indicator; the error term is determined by Gaussian distribution.

8. The method for predicting migration trend of high-risk roaming fraud numbers according to claim 1, characterized in that: The following steps are also included: Anti-fraud operations are performed on numbers roaming to the future high-risk areas.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement a method for predicting the migration trend of high-risk roaming fraud numbers as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement a migration trend prediction method for high-risk roaming fraud numbers as described in any one of claims 1-8.

Images