Telephone drainage method and system based on machine learning, and storage medium

Abstract

The invention discloses a telephone drainage method and system based on machine learning, and a storage medium. The method comprises the following steps: constructing a sample feature library of harmful and normal numbers; preprocessing the feature data in the sample feature library, and dividing the feature data into a feature training set and a feature test set; constructing a decision tree based on the feature training set; based on the feature test set, screening the decision rules in the decision tree to obtain a feature combination with optimal performance on the test set and a segmentation threshold corresponding to the feature combination; collecting a new batch of calling numbers, acquiring feature data of the calling numbers, and identifying the feature data of the calling numbers based on the optimal feature combination and the segmentation threshold corresponding to the feature combination, thereby predicting whether the calling numbers are harmful numbers or normal numbers; and updating the optimal feature combination and the corresponding segmentation threshold value at regular time to ensure that a better drainage effect can be realized when the features of the harmful number are changed. According to the invention, the machine learning algorithm is utilized to classify the sample feature data, and the feature combination and the segmentation threshold with the best drainage effect are screened out, so that harmful calls can be identified more accurately, and misjudgment and missed judgment are reduced.

Description

Technical Field

[0001] The present invention relates to the field of telecommunication network security technology, and in particular to a telephone traffic diversion method, system and storage medium based on machine learning. Background Art

[0002] Harmful call diversion refers to filtering out high-risk calls from all calls based on the calling number or called number, and providing the subsequent intention analysis platform with call intention detection and analysis to detect whether the call involves fraud. If so, the call is promptly controlled to prevent the victim from being defrauded. The current harmful call diversion analysis methods mainly include: blacklist and whitelist diversion strategy, specific rule diversion strategy, and manual analysis and distribution of graylist number diversion strategy.

[0003] Among them, the method based on the black and white list diversion strategy has the advantages of simple implementation and fast identification speed, but it has the disadvantages of incomplete coverage of black and white list numbers and untimely updates. The advantage of the diversion strategy based on specific rules is that the corresponding rules can be flexibly configured according to the latest harmful call situation, but the disadvantage is that the coverage of specific rules is wide, and it is impossible to filter and eliminate the calls of normal users in the rules, which will cause a certain waste of diversion resources. The diversion strategy of gray list numbers issued based on manual analysis can realize the analysis of harmful number characteristics and accurate issuance of diversion numbers, but the manual gray list number analysis mechanism has a long analysis cycle, has high experience requirements for the personnel involved in the analysis, and cannot be updated automatically and iteratively in time. The effective gray list diversion strategy analyzed in the early stage will cause the diversion effect to deteriorate as the characteristics of harmful calls change. Therefore, how to accurately and efficiently build a smart phone diversion strategy, realize dynamic monitoring of calls, and actively discover harmful calls needs to be solved urgently. Summary of the invention

[0004] Purpose of the invention: The purpose of the present invention is to provide a telephone diversion method, system and storage medium based on machine learning, which can effectively identify harmful calls.

[0005] Technical solution: To achieve the above purpose, the present invention provides a telephone traffic diversion method based on machine learning, comprising the following steps:

[0006] S1: Build a sample feature library including harmful and normal numbers;

[0007] S2: preprocess the feature data in the sample feature library and divide it into a feature training set and a feature test set;

[0008] S3: Build a decision tree based on the feature training set;

[0009] S4: Based on the feature test set, the decision rules in the decision tree are screened to obtain the best feature combination on the test set and the segmentation threshold corresponding to the feature combination;

[0010] S5: collecting new batches of call numbers, obtaining feature data of the call numbers, identifying the feature data of the call numbers based on the optimal feature combination and the segmentation threshold corresponding to the feature combination, thereby predicting whether the call number is a harmful number or a normal number;

[0011] S6: Repeat steps S1-S5 to regularly update the optimal feature combination and its corresponding segmentation threshold.

[0012] Among them, the method for constructing the sample feature library in S1 is: complete the case system docking through the system interface or file synchronization method, extract the calling number and called number of harmful calls from the case system as harmful number samples and normal number samples respectively, so as to dynamically construct the sample feature library, and the sample feature library includes basic features based on communication behavior and statistical features obtained by analyzing the basic features.

[0013] Among them, the preprocessing methods in S2 include data cleaning and missing value processing.

[0014] The decision tree generated in S3 contains a series of paths from the root node to the leaf node. Each path represents a decision rule. Each decision rule contains multiple feature combinations, and each feature combination has a corresponding segmentation threshold.

[0015] The decision tree construction process includes:

[0016] S3.1: Feature selection, select the most discriminative feature from the feature training set as the root node or internal node;

[0017] S3.2: Threshold selection, determine a segmentation threshold for the most discriminative feature selected;

[0018] S3.3: Recursive splitting, starting from the root node, split the feature training set into several internal nodes based on the selected features and segmentation thresholds. For each internal node, select the most discriminative feature and the corresponding segmentation threshold from the remaining feature training set for further splitting, and repeat this feature selection and threshold selection process until the stopping condition is met; for each child node after the internal node is split, further perform feature selection and threshold selection from the remaining feature training set, and repeat this process until the stopping condition is met;

[0019] S3.4: Optimize decision tree pruning.

[0020] Among them, the feature with the lowest Gini index is selected as the most discriminative feature. The calculation formula of the Gini index is:

[0021]

[0022] Among them, m is the number of samples on the node, n is the number of categories, and the number of samples in category i is c i .

[0023] The stopping condition is that a predetermined maximum tree depth is reached, or the number of node samples is less than a certain set threshold, or the purity of samples in the node reaches a certain set standard.

[0024] Among them, the screening method in S4 is: through the cross-validation screening method, the feature combination with the best performance on multiple test sets is selected as the optimal feature combination, wherein each test data starts from the root node of the decision tree, and a path is selected according to the characteristics of the test data until it reaches a leaf node. The leaf node gives the final classification prediction result, such as normal or harmful. Based on the actual label of the test data, the accuracy of the prediction result of each path is calculated, and the optimal feature combination with high accuracy is screened out.

[0025] The present invention provides a telephone traffic diversion system based on machine learning, comprising the following modules:

[0026] Sample feature library construction module: constructs a sample feature library including harmful and normal numbers;

[0027] Data preprocessing module: preprocess the feature data in the sample feature library and divide it into feature training set and feature test set;

[0028] Decision tree construction module: build a decision tree based on the feature training set;

[0029] Decision rule screening module: Based on the feature test set, the decision rules in the decision tree are screened to obtain the best feature combination on the test set and the segmentation threshold corresponding to the feature combination;

[0030] Calling number identification module: collects new batches of calling numbers, obtains feature data of the calling numbers, identifies the feature data of the calling numbers based on the optimal feature combination and the segmentation threshold corresponding to the feature combination, and predicts whether the calling number is a harmful number or a normal number;

[0031] Feature timing update module: regularly updates the optimal feature combination and its corresponding segmentation threshold.

[0032] The present invention provides a computer-readable storage medium storing one or more programs, wherein the one or more programs include instructions, which, when executed by a computing device, enable the computing device to perform any of the above-mentioned machine learning-based telephone traffic diversion methods.

[0033] Beneficial effects: The present invention has the following advantages: 1. The present invention utilizes a machine learning algorithm to classify sample feature data, and screens out the feature combination and segmentation threshold with the best drainage effect, which can more accurately identify harmful calls and reduce misjudgments and missed judgments; 2. By regularly updating the optimal feature combination, etc., it ensures that when the characteristics of harmful numbers change, a better drainage effect can also be achieved, so as to detect as few calls as possible and discover as many harmful calls as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a schematic flow chart of the method;

[0035] Figure 2 A schematic diagram of a device for implementing the method. DETAILED DESCRIPTION

[0036] The technical solution of the present invention is described in detail below in conjunction with the embodiments and drawings.

[0037] like Figure 1 As shown, the telephone traffic diversion method based on machine learning of the present invention specifically comprises the following steps:

[0038] S1: Build a sample feature library including harmful and normal numbers;

[0039] The case system is connected through the system interface or file synchronization, and the calling number and called number of harmful calls are continuously extracted from the case system as harmful number samples and normal number samples respectively, so as to dynamically build a sample feature library. The sample feature library includes basic features based on communication behavior and statistical features obtained by analyzing the basic features.

[0040] Among them, basic features refer to feature dimensions that do not require statistical calculations based on user calls, such as calling number, calling location, called number, called location, call start time, ringing start time, answer time, call end time, etc. Statistical features refer to the results that need to be analyzed and calculated based on the user's communication behavior, such as the user's call connection rate, called connection rate, caller dispersion, called dispersion, and the total number of days with more than 50 outgoing calls per day within 30 days.

[0041] The sample feature library can automatically complete the construction of data features of corresponding dimensions through a written script code program, providing training and analysis data for subsequent steps.

[0042] S2: Preprocess the feature data in the sample feature library and divide it into feature training set and feature test set. The preprocessing includes cleaning data, processing missing values, etc. to ensure data quality.

[0043] S3: Build a decision tree based on the feature training set;

[0044] A decision tree consists of: root nodes, internal nodes, leaf nodes, and branches. Both the root node and the internal nodes are essentially split features. The root node is the starting point of the decision tree, and usually the most discriminative feature is selected; the internal node is the node after the root node is split. Each internal node selects a feature and a threshold to split into two child nodes, and the two child nodes correspond to the data subsets that meet and do not meet the threshold conditions respectively. The leaf node represents the category.

[0045] The decision tree construction process specifically includes:

[0046] S3.1: Feature selection: Select the most discriminative feature from the feature training set as the root node or internal node;

[0047] The most discriminative feature usually refers to the feature that is easiest to distinguish different categories. For each split feature, we hope that the data contained in its branches belong to the same category as much as possible, that is, the "purity" is getting higher and higher. "Purity" is usually measured by Gini index, information gain or information gain rate. In this embodiment, the feature with the lowest Gini index is selected as the most discriminative feature. For example, based on the preprocessed feature training set F, the Gini index of each feature is first calculated, and the feature with the lowest Gini index is selected as the root node; for a node, the calculation formula of the Gini index is:

[0048]

[0049] Among them, m is the number of samples on the node, n is the number of categories, and the number of samples in category i is c i .

[0050] S3.2: Threshold selection: Determine a segmentation threshold for the features selected in S3.1;

[0051] The segmentation threshold is determined to minimize the impurity of the child nodes. The impurity of the child nodes is measured by the Gini index. The threshold that reduces the impurity the most is the optimal segmentation threshold.

[0052] S3.3: Recursive splitting: Starting from the root node, based on the selected features and segmentation thresholds, the feature training set is split into several internal nodes. For each internal node, one of the most discriminative features and the corresponding segmentation threshold is selected from the remaining feature training set F for further splitting. This feature selection and threshold selection process is repeated until the stopping condition is met. For each child node after the internal node is split, further feature selection and threshold selection are performed from the remaining feature training set F, and this process is repeated until a certain stopping condition is met.

[0053] Stop condition: reaching the predetermined maximum tree depth, that is, the depth of the decision tree reaches the predetermined maximum value, or the number of node samples is less than a certain threshold, that is, the number of samples of a certain node is less than a predetermined threshold, or the purity of the samples in the node reaches a certain standard, that is, the sample purity of a certain node (such as the Gini index) reaches a predetermined standard.

[0054] S3.4: Optimize decision tree pruning, that is, remove some branches to prevent overfitting. The removal criteria include reaching a predetermined maximum tree depth, the number of node samples is less than a certain threshold, and the purity of samples within the node reaches a certain standard.

[0055] The resulting decision tree contains a series of paths from the root node to the leaf node. Each path represents a decision rule. Each decision rule contains multiple feature combinations. Each feature combination has its corresponding segmentation threshold. These combinations together determine the classification result of the data on this path. Specifically:

[0056] Root node: The starting point of the decision tree, usually the most discriminative feature is selected.

[0057] Internal nodes: Each internal node represents a feature and threshold, which is used to further split the data set.

[0058] Leaf node: The end point of the decision tree, indicating the final classification result.

[0059] S4: Based on the feature test set, the decision rules in the decision tree are screened to obtain the best feature combination on the test set and the segmentation threshold corresponding to the feature combination;

[0060] The screening process is as follows: Each test data starts from the root node of the decision tree and selects a path based on the features until it reaches a leaf node, which gives the final classification prediction result, such as normal or harmful. Based on the actual label of the test data, the accuracy of the prediction results of each path is calculated to screen out the optimal feature combination with high accuracy.

[0061] The accuracy is the ratio of the number of samples predicted correctly to the total number of samples. If the accuracy calculated by the decision rule exceeds the set threshold, the decision rule is considered to have a "high accuracy". In order to further improve the reliability of screening, the decision rule with the best performance on multiple test sets can be selected through methods such as cross-validation.

[0062] S5: Collect the calling number and obtain the feature data of the calling number, including basic features and statistical features, identify the feature data of the calling number based on the optimal feature combination and the segmentation threshold corresponding to the feature combination, so as to predict whether the calling number is a harmful number or a normal number.

[0063] S6: Repeat the above steps S1-S5 regularly to update the optimal feature combination and its corresponding segmentation threshold to ensure that when the characteristics of harmful numbers change, a good drainage effect can be achieved, so as to detect as few calls as possible and discover as many harmful calls as possible.

[0064] like Figure 2 As shown, the present invention further provides a telephone traffic diversion device based on machine learning, including a processor, a bus, a storage medium, an internal memory, a display screen, a network interface and an input device, wherein the memory stores an executable computer program, and when the processor executes the computer program through the system bus, it is used to implement the above-mentioned telephone traffic diversion method based on machine learning.

Claims

1. A telephone traffic diversion method based on machine learning, characterized in that: The following steps are involved: S1: Build a sample feature library including harmful and normal numbers; S2: preprocess the feature data in the sample feature library and divide it into a feature training set and a feature test set; S3: Build a decision tree based on the feature training set; S4: Based on the feature test set, the decision rules in the decision tree are screened to obtain the best feature combination on the test set and the segmentation threshold corresponding to the feature combination; S5: collecting new batches of call numbers, obtaining feature data of the call numbers, identifying the feature data of the call numbers based on the optimal feature combination and the segmentation threshold corresponding to the feature combination, thereby predicting whether the call number is a harmful number or a normal number; S6: Repeat steps S1-S5 to regularly update the optimal feature combination and its corresponding segmentation threshold.

2. The method for telephone traffic diversion based on machine learning according to claim 1, characterized in that: The method for constructing the sample feature library in S1 is: complete the case system docking through the system interface or file synchronization method, extract the calling number and called number of harmful calls from the case system as harmful number samples and normal number samples respectively, so as to dynamically construct the sample feature library, which includes basic features based on communication behavior and statistical features obtained by analyzing the basic features.

3. The telephone traffic diversion method based on machine learning according to claim 1 is characterized in that: The preprocessing methods in S2 include data cleaning and missing value processing.

4. The method for telephone traffic diversion based on machine learning according to claim 1, characterized in that: The decision tree generated in S3 contains a series of paths from the root node to the leaf node. Each path represents a decision rule. Each decision rule contains multiple feature combinations, and each feature combination has a corresponding segmentation threshold.

5. The method for telephone traffic diversion based on machine learning according to claim 4 is characterized in that: The decision tree construction process includes: S3.1: Feature selection, select the most discriminative feature from the feature training set as the root node or internal node; S3.2: Threshold selection, determine a segmentation threshold for the most discriminative feature selected; S3.3: Recursive splitting, starting from the root node, based on the selected features and segmentation thresholds, split the feature training set into several internal nodes. For each internal node, select the most discriminative feature and the corresponding segmentation threshold from the remaining feature training set for further splitting, and repeat this feature selection and threshold selection process until the stopping condition is met; for each child node after the internal node is split, further feature selection and threshold selection are performed from the remaining feature training set, and this process is repeated until the stopping condition is met; S3.4: Optimize decision tree pruning.

6. The method for telephone traffic diversion based on machine learning according to claim 5, characterized in that: The feature with the lowest Gini index is selected as the most discriminative feature. The calculation formula of the Gini index is: Among them, m is the number of samples on the node, n is the number of categories, and the number of samples in category i is c i .

7. The telephone traffic diversion method based on machine learning according to claim 5 is characterized in that: The stopping condition is that a predetermined maximum tree depth is reached, or the number of node samples is less than a certain set threshold, or the purity of samples in the node reaches a certain set standard.

8. The telephone traffic diversion method based on machine learning according to claim 1 is characterized in that: The screening method in S4 is: through the cross-validation screening method, the feature combination with the best performance on multiple test sets is selected as the optimal feature combination, where each test data starts from the root node of the decision tree, and a path is selected according to the characteristics of the test data until it reaches a leaf node. The leaf node gives the final classification prediction result, such as normal or harmful. Based on the actual label of the test data, the accuracy of the prediction result of each path is calculated to screen out the optimal feature combination with high accuracy.

9. A telephone traffic diversion system based on machine learning, characterized in that: Includes the following modules: Sample feature library construction module: constructs a sample feature library including harmful and normal numbers; Data preprocessing module: preprocess the feature data in the sample feature library and divide it into feature training set and feature test set; Decision tree construction module: build a decision tree based on the feature training set; Decision rule screening module: Based on the feature test set, the decision rules in the decision tree are screened to obtain the best feature combination on the test set and the segmentation threshold corresponding to the feature combination; Calling number identification module: collects new batches of calling numbers, obtains feature data of the calling numbers, identifies the feature data of the calling numbers based on the optimal feature combination and the segmentation threshold corresponding to the feature combination, and predicts whether the calling number is a harmful number or a normal number; Feature timing update module: regularly updates the optimal feature combination and its corresponding segmentation threshold.

10. A computer-readable storage medium storing one or more programs, characterized in that: The one or more programs include instructions which, when executed by a computing device, cause the computing device to perform any one of the methods according to claims 1 to 8.

Images