Regional risk assessment method and system based on multiple features

Abstract

The invention belongs to the technical field of privacy communication data processing, and provides a regional risk assessment method and system based on multiple features. The method comprises the following steps: collecting signaling data generated by a user call in a specific historical time period, preprocessing the signaling data, selecting characteristics related to fraud, and calculating and analyzing the selected characteristics to screen out fraud-related call characteristics; selecting a plurality of static features and regional features; establishing a training data set and training a risk assessment model by adopting the static features marked with the fraud labels, the fraud-related call features and the regional features to obtain a trained risk assessment model; and inputting to-be-processed user behavior features and position features into the risk assessment model to obtain a user fraud-related behavior assessment result so as to further determine a fraud-related situation of a region where the to-be-processed user is located. According to the invention, the fraud-related behavior of the user can be identified more accurately, and the fraud-related situation of the region where the user is located can be determined accurately.

Description

Technical Field

[0001] The present invention relates to the field of privacy communication data processing technology, and in particular to a regional risk assessment method and system based on multiple features. Background Art

[0004] The existing technology has the following problems: the signaling features are single and rely on network operator data: signaling analysis requires the acquisition and analysis of network communication data, and the current signaling acquisition features are relatively single; the algorithms currently selected for machine learning have large deviations, and the accuracy and effectiveness of machine learning algorithms are limited by the quality and representativeness of training data. Due to data bias or imbalanced sample data (for example, certain types of fraud cases are less recorded or marked), the model recognition ability is low.

[0005] Therefore, it is necessary to provide a new regional risk assessment method based on multiple features to solve the above problems. Summary of the invention

[0006] The present invention aims to provide a regional risk assessment method and system based on multiple features to solve the technical problems in the prior art such as low model accuracy due to the single feature obtained from signaling data, and low model recognition ability due to data bias or imbalanced sample data (for example, certain types of fraud cases are rarely recorded or marked). The technical problems to be solved by the present invention are achieved through the following technical solutions.

[0007] The first aspect of the present invention proposes a regional risk assessment method based on multiple features, including: collecting signaling data generated by user calls in a specific historical time period, pre-processing the collected signaling data, and selecting the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information; performing calculation and analysis on the selected features to screen out fraud-related call features; collecting static information data, and selecting multiple static features therefrom, and also collecting risk area features as regional features; using static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and using self- The static features, the fraudulent call features, and the regional features are sampled and processed by the convergence method, and the new samples obtained by the sampling process are used as training samples; based on the random forest algorithm, a risk assessment model is established, and the risk assessment model is trained with the training data set to obtain a trained risk assessment model; the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user's fraudulent behavior assessment results; regional risk categories are divided according to the user's fraudulent behavior assessment results and location information, and the risk value of each regional risk category is calculated according to the proportion of fraudulent numbers in each regional risk category, so as to further determine the fraud situation in the area where the user to be processed is located.

[0008] The second aspect of the present invention proposes a regional risk assessment system based on multiple features, which adopts the regional risk assessment method based on multiple features described in the first aspect of the present invention. The regional risk assessment system includes: a first collection module, which is used to collect signaling data generated by user calls within a specific historical time period, pre-process the collected signaling data, and select the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information; A screening module is used to perform calculations and analysis on the selected features to screen out features of fraudulent calls; a second collection module is used to collect static information data, select multiple static features therefrom, and also collect risk area features as regional features; a data processing module is used to use static features, fraudulent call features, and regional features marked with fraud labels to establish a training data set, and use the bootstrap aggregation method to sample the static features, the fraudulent call features, and the regional features, and use the new samples obtained from the sampling process as training samples; a model construction module is used to establish a risk assessment model based on the random forest algorithm, and use the training data set to train the risk assessment model to obtain a trained risk assessment model; a calculation module is used to input the behavior characteristics and location characteristics of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results; a determination module is used to divide the regional risk categories according to the user's fraudulent behavior assessment results and the regional location, and calculate the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category to further determine the fraudulent situation in the area where the user to be processed is located.

[0009] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the multi-feature-based regional risk assessment method described in the first aspect of the present invention.

[0010] A fourth aspect of the present invention provides a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for regional risk assessment based on multiple features as described in the first aspect of the present invention is implemented.

[0011] The embodiments of the present invention include the following advantages: Compared with the prior art, the present invention collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features therefrom, and screens out fraud-related call features; collects static information data, selects multiple static features therefrom, and also collects risk area features as regional features, so as to obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained by the sampling process as training samples, so as to accurately amplify the sample data. This method; based on the random forest algorithm, establish a risk assessment model, use the training data set to train the risk assessment model, obtain a trained risk assessment model, and obtain a risk assessment model with higher accuracy; input the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment result, divide the regional risk category according to the user's fraudulent behavior assessment result and location information, calculate the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category, so as to further determine the fraudulent situation in the area where the user to be processed is located, and can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0012] In addition, through detailed analysis and identification of users and multiple features, we can more accurately judge the degree of risk and take corresponding anti-fraud measures, which can reduce user dissatisfaction and thus improve user experience, while protecting user safety and reducing interference and restrictions on normal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a flowchart of an example of a method for regional risk assessment based on multiple features of the present invention; Figure 2 is a schematic diagram of an application example of the regional risk assessment method based on multiple features of the present invention; Figure 3 It is a structural block diagram of the regional risk assessment system based on multiple features of the present invention; Figure 4 is a schematic structural diagram of an electronic device embodiment according to the present invention; Figure 5 It is a schematic diagram of the structure of a computer-readable medium embodiment according to the present invention. DETAILED DESCRIPTION

[0014] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0015] In view of the above problems, the present invention proposes a method and device for regional risk assessment based on multiple features. The method collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features, and screens out fraud-related call features; collects static information data, selects multiple static features from it, and also collects risk area features as regional features, so as to obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained from the sampling process as training samples, so as to accurately amplify the samples; based on A random forest algorithm is used to establish a risk assessment model, and the training data set is used to train the risk assessment model to obtain a trained risk assessment model, which can obtain a risk assessment model with higher accuracy; the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user's fraudulent behavior assessment results, and regional risk categories are divided according to the user's fraudulent behavior assessment results and location information. According to the proportion of fraudulent numbers in each regional risk category, the risk value of each regional risk category is calculated to further determine the fraudulent situation in the area where the user to be processed is located, which can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0016] Example 1 Refer to the following Figure 1 , Figure 2 , Figure 3 , the contents of the present invention will be described in detail.

[0017] Figure 1 It is a flowchart of an example of the method for regional risk assessment based on multiple features of the present invention.

[0018] like Figure 1 As shown, in step S101, signaling data generated by user calls within a specific historical time period is collected, and the collected signaling data is pre-processed to select the following call behavior features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information.

[0019] Specifically, the signaling data generated by user calls within a specific historical time period (e.g., 6 months or 12 months from the current time in the past) is collected, that is, the call records within a recent historical time period. The signaling data contains information related to the call, such as the call location, call time, call direction, call duration, etc.

[0020] The above signaling data is preprocessed, including data cleaning, filtering of null values ​​and erroneous data, and retaining valid call information. The cleaned result data is used to establish a feature data set for model training and testing. The feature data set contains the following features: calling number, called number, call time, call duration, province code, city code, base station code, cell code, etc.

[0021] By analyzing the above signaling data, the characteristics of fraudulent activities can be obtained, and these data are timely, so as to better identify and respond to recent fraudulent activities.

[0022] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0023] Next, in step S102, the selected features are calculated and analyzed to screen out features of fraudulent calls.

[0024] The fraudulent call features are screened based on at least two of the following thresholds: dispersion, silence time threshold, number of calls per day threshold, and fraud threshold.

[0025] Specifically, the discreteness and the fraud threshold are obtained by calculation. For example, the features of fraudulent calls are screened by counting the discreteness (for example, greater than 0.8) and the number of calls of the calling and called numbers. The recall rate of fraudulent numbers in the data set within a specified historical time period is calculated (for example, the recall rate of fraudulent numbers in the past six months is counted, specifically the recall rate>90%), the fraud threshold is determined, and the features of fraudulent calls are screened according to the determined threshold. The silent time threshold is 28 days, 30 days or 45 days. The threshold of the number of calls in one day is 30 to 80 times, for example, 30 times, 40 times, 60 times, 80 times, etc.

[0026] The current dispersion is calculated using the following expression: L=C / H L represents the current dispersion; C represents the number of calls deduplicated on the same day for all privacy numbers providing privacy communications; H represents the call frequency on the same day for all privacy numbers providing privacy communications.

[0027] The discreteness of each private number is further calculated and compared with the calculated current discreteness (i.e., the discreteness used as a threshold). When the calculated discreteness is greater than the current discreteness, the fraudulent call features corresponding to the private number are screened.

[0028] When the current privacy number is silent for more than the silence time threshold, the fraud-related call features corresponding to the current privacy number are filtered.

[0029] In a preferred embodiment, the screened fraudulent call features are further calculated and analyzed to obtain the final fraudulent call features.

[0030] For the multiple types of fraudulent call features that have been screened out, the following expression is used to calculate the Gini coefficient of the risk distribution of the same type of fraudulent call features, so as to further screen the sample data of the same type of fraudulent call features:

[0031] in, represents the Gini coefficient of the risk distribution of the fraudulent call features of the current sample; K represents the total number of features of the fraudulent call features, k represents the kth type of fraudulent call features, Indicates the risk weight of the current sample belonging to the kth fraud-related call feature type.

[0032] By using the Pearson correlation coefficient statistical method, we can obtain Weight value.

[0033] For the k feature values ​​of the call record of the current sample , ,…, , the risk target value y, the i-th feature is calculated using the following expression The Pearson correlation coefficient between :

[0034] The Pearson correlation coefficient calculated , calculate the weight value of the i-th feature of the current sample :

[0035] in, Indicates the weight value of the kth feature of the call record of the current sample , i=k; represents the i-th feature The Pearson correlation coefficient between and the target variable Y; represents the hth feature The correlation coefficient with the target variable Y, h represents the index variable used in the summation symbol, which is used to traverse all features. When calculating the weight value, it means summing the absolute values ​​of the Pearson correlation coefficients of all features with the target variable; K represents the total number of features of fraudulent calls, which is used to determine the range of features and the upper limit of the summation.

[0036] It should be noted that for all fraudulent call features belonging to the same category, when the calculated Gini coefficient reaches 0 or is close to the minimum value of 0, it means that the data features in this type of fraudulent call features are relatively concentrated, indicating that this type of fraudulent call features do not meet the conditions for being used as a training model, such as the devices used by all test set numbers belong to the same type of devices; and when the calculated Gini coefficient is close to the maximum value (for example, 1), it means that the data features in this type of fraudulent call features are relatively balanced, there is no feature deviation or a small feature deviation, and it is suitable for model training. Therefore, when selecting features, select features that can maximize the Gini coefficient to ensure that there is no feature deviation in the data. Therefore, by selecting features through the above feature screening method, specifically by calculating the Gini coefficient, it is possible to more effectively screen out the most valuable fraudulent call features for classification from many features, thereby improving the accuracy and stability of the model. In other embodiments, it can also be combined with other indicators such as entropy and information gain to ensure the comprehensiveness and accuracy of feature selection. The above is only explained as an optional example and cannot be understood as a limitation of the present invention.

[0037] Next, in step S103, static information data is collected, and a plurality of static features are selected therefrom, and risk area features are also collected as area features.

[0038] Specifically, static information data is collected and analyzed and screened, including the number of cards opened by users, the number of fraudulent numbers in other numbers under the same ID, designated service information for private communications, traffic data, number location, card opening age, user's native place, roaming cities, surviving base stations, etc.

[0039] Furthermore, multiple static features are selected from the collected static information data: the number of cards opened by the user, whether there are fraudulent numbers and the number of fraudulent numbers under the same ID card, designated service information for privacy communications, average daily traffic, card opening age, user's native place, province to which the number belongs, roaming city, and surviving base stations and cells.

[0040] Optionally, risk regions (specifically, risk regions determined based on historical fraudulent numbers) are used as regional features (or additional features). These regional features can reflect the risk level within the region and help better distinguish samples of different categories.

[0041] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0042] Next, in step S104, static features, fraudulent call features, and regional features marked with fraud labels are used to establish a training data set, and the static features, the fraudulent call features, and the regional features are sampled using the bootstrap aggregation method, and the new samples obtained by the sampling process are used as training samples.

[0043] Specifically, static features marked with fraud labels, fraud call features, and regional features are used to establish a training data set. For example, the number of fraud calls in a day (for example, the number of fraud calls marked in a day exceeds three times) and the risk area (whether it is a risky area) are used to characterize the fraud label to define positive samples and negative samples.

[0044] Optionally, the fraudulent numbers are determined by counting the discreteness of the calling number and the number of calls, and a fraud label is generated to define positive samples and negative samples.

[0045] The static features, the fraudulent call features, and the regional features are sampled using a bootstrapping aggregation method (i.e., Bagging), and new samples obtained through the sampling process are used as training samples.

[0046] Specifically, at least one of the static features, the fraudulent call features, and the regional features is recombined, replaced and resampled to obtain a new sample. For example, 10 to 30 fraudulent call features are manually found, and the integrated technology of training classifiers with newly added combined data features is adopted and processed to expand the sample at a specific ratio (for example, 1:2 to 1:5). The three types of features can be recombined into more features through the bootstrap aggregation method, thereby obtaining more sample data.

[0047] It should be noted that in other implementations, user feature information and call behavior features marked with fraud labels may also be used to establish a training data set. The above is only described as an optional example and cannot be understood as a limitation of the present invention.

[0048] In an optional embodiment, a test data set is also established. For example, a cross-validation method is used to divide the collected data into multiple folds, wherein a part is used as a test data set and the rest is used as a training data set. A decision tree is constructed by randomly sampling features. This feature sampling method is called the "random subspace method", which can reduce the correlation between features and increase the differences between decision trees. A self-service sampling method is used to extract samples from the training set with replacement. Different features of users are classified and identified to reduce accidental injuries to normal users. Classification can be based on multiple factors, such as user behavior patterns, historical records, geographic locations, etc. By carefully analyzing and identifying users and multiple features, the risk level can be more accurately judged and corresponding anti-fraud measures can be taken. As a result, user dissatisfaction can be reduced, thereby improving user experience, and while protecting user safety, interference and restrictions on normal users can be reduced.

[0049] Next, in step S105, a risk assessment model is established based on a random forest algorithm, and the risk assessment model is trained using the training data set to obtain a trained risk assessment model.

[0050] A risk assessment model is established by using a random forest algorithm of machine learning, and the risk assessment model is trained using the training data set obtained in step S104 to obtain a trained risk assessment model.

[0051] The risk assessment model will classify user call behaviors, and each user call behavior will be assigned to a category in the random forest.

[0052] Next, the risk value of the category to which the pending user belongs is calculated based on the proportion of fraudulent numbers in each category. For each category (high risk, medium risk, low risk), the proportion of trees that predict the category to which the pending user belongs is calculated among all trees. That is, the frequency of occurrence of the fraudulent category Ck (where k is the category number) is calculated using the following expression:

[0053] P(Ck|X)=Number of trees predicting Ck / m Among them, P(Ck|X) represents the predicted probability of the fraud category Ck in all trees (that is, the probability of this category); m represents the total number of tree branches (that is, fraud categories); Number of trees predicting Ck represents the number of fraud categories Ck to be predicted in all trees.

[0054] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0055] Next, in step S106, the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user fraudulent behavior assessment result.

[0056] Specifically, the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user's fraudulent behavior assessment result. The location information can be obtained through the signaling data of the user to be processed, for example, the location information of the privacy number of the user to be processed.

[0057] Furthermore, the user fraudulent behavior assessment result includes the risk level of the user to be processed (e.g., high risk, medium risk, low risk), whether the private number of the user to be processed is fraudulent, and the probability or confidence of the fraud type to which the private number of the user to be processed belongs.

[0058] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0059] Next, in step S107, regional risk categories are divided according to the user fraud behavior assessment results and location information, and the risk value of each regional risk category is calculated according to the proportion of fraudulent numbers in each regional risk category to further determine the fraud situation in the area where the user to be processed is located.

[0060] In a specific implementation, the base stations or cells in the province or city are divided, and each base station or cell is assigned to a corresponding category. According to the proportion of fraudulent numbers in each category, the risk value of each category is calculated to classify the risk of each area.

[0061] Specifically, regional risk categories are divided according to the user's fraudulent behavior assessment results and location information. According to the proportion of fraudulent numbers in each regional risk category, the risk value of the regional risk category of the area to which the user to be processed belongs is calculated to further determine the fraud situation in the area where the user to be processed is located.

[0062] Furthermore, the number of fraudulent numbers in the user's region is collected, and the proportion of fraudulent numbers in the user's region is calculated.

[0063] A deep neural network algorithm is used to build a regional risk prediction model.

[0064] Specifically, the determined user fraud behavior assessment results, location information, and the proportion of fraudulent numbers in each regional risk category are annotated with fraudulent labels. For example, the number of fraud-related incidents in a specified historical time period is greater than or equal to a specified number in the corresponding area (for example, 3 to 10 cases) to characterize the fraud-related label and define positive and negative samples. A training data set is thus established, and the established training data set is used to train the regional risk prediction model to obtain a trained regional risk model.

[0065] For the specified quantity, historical data on fraud-related incidents in different provinces and cities within a specific historical period (for example, the past 6 months, 12 months, 18 months, 24 months, 36 months, 48 ​​months, 60 months, etc.) are collected, and a trend forecast chart is drawn to determine the specified quantity of each region at the current time based on the drawn trend forecast chart.

[0066] The user fraud behavior assessment result of the user to be processed (i.e., the user fraud behavior assessment result determined in step S06), location information, and the calculated proportion of fraudulent numbers are input into the regional risk model to obtain the risk value of the regional risk category of the area to which the user to be processed belongs, that is, the risk value of the regional risk category of the area to which the user to be processed belongs is calculated (for example, a multi-dimensional vector, where each dimension corresponds to the number of risk assessments of the risk category), so as to further determine the fraud situation in the area where the user to be processed is located based on the calculated risk value.

[0067] The risk value range is divided into three intervals: low risk, medium risk and high risk. The risk value is a value ranging from 0 to 100. When the calculated risk value is less than 30, it is set as the low risk threshold interval; between 30 (including 30) and 70 is set as the medium risk threshold interval; and greater than 70 is set as the high risk threshold interval.

[0068] For the designated number of different provinces, for provinces and cities close to risk areas, more than 5 fraud-related incidents are high-risk areas. For provinces and cities not close to risk areas, more than 100 fraud-related incidents are high-risk areas, more than 5 fraud-related incidents are medium-risk areas, and more than 2 fraud-related incidents are low-risk areas. For example, City A and City B are high-risk areas.

[0069] The designated number for different provinces is determined by multiplying the designated number of users in different provinces and cities by the corresponding specific ratio (for example, 0.003% to 0.015%) to characterize the number of events involving fraud risks. For example, if Province C has one million users, then the designated number for Province C is one million multiplied by a specific ratio (for example, 0.005%) to get 5 events, that is, the designated number is 5 events. The number of fraud-related events in Province C at the current time is greater than or equal to 5, which means it is a high-risk area.

[0070] Through the above risk determination process, the fraud situation in the area where the user to be processed is located can be accurately obtained. Specifically, according to the range of risk values, the area can be divided into low-risk area, medium-risk area, and high-risk area, so as to further take corresponding risk management measures.

[0071] By implementing hierarchical management of regions, different control measures are formulated for fraud-related numbers and risky numbers in areas with different risk levels.

[0072] In another optional embodiment, a machine learning model, such as a random forest algorithm, is used to establish a regional risk identification model. The fraudulent behavior data of users marked with risk labels (the proportion of fraudulent numbers is greater than a predetermined value), static information features, call time, and call area are used to establish a training data set. The training data set is used to train the regional risk identification model to identify fraud-related situations in the area where the user to be processed belongs.

[0073] The user fraud behavior assessment result and location information obtained in step S106 are input into the trained regional risk identification model to obtain the fraud situation of the area where the user to be processed is located, for example, a three-dimensional vector is output, and the output three-dimensional vector is characterized by the probability that the area where the user to be processed is located is high-risk, the probability that the user to be processed is located is medium-risk, and the probability that the user to be processed is located is low-risk.

[0074] Specifically, the regional risk identification model divides base stations or cells in different regions (such as cities). Each base station or cell is assigned to a risk category in the random forest (such as high risk, medium risk, and low risk). Then, based on the proportion of fraudulent numbers in each risk category, the risk value of the category is calculated. For each risk category, the proportion of trees that predict the risk category among all trees is calculated. That is, the frequency of occurrence of the risk category Ck' (where k' is the risk category number) is expressed using the following expression:

[0075] P'(Ck'|X')=M / m' Among them, P'(Ck'|X') represents the predicted probability of risk category Ck' in all trees (i.e., the probability of the risk category); m' represents the total number of tree branches (i.e., fraud-related categories); and M represents the number of risk categories Ck' to be predicted in all trees.

[0076] Further, based on the fraud situation in the area where the user to be processed is located, the risk area is determined, so that different control measures can be taken for areas with different risk levels. For low-risk areas, online authentication measures can be taken to identify risky numbers. For high-risk areas, online and offline authentication, secondary authentication or other more stringent measures are taken. In this way, corresponding control measures can be taken in a targeted manner according to the risk situation in different regions, thereby improving the anti-fraud effect and accuracy.

[0077] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0078] In addition, the drawings are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the drawings do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0079] Compared with the prior art, the present invention collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features therefrom, and screens out fraud-related call features; collects static information data, selects multiple static features therefrom, and also collects risk area features as regional features, so as to obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained by the sampling process as training samples, so as to accurately amplify the sample data. This method; based on the random forest algorithm, establish a risk assessment model, use the training data set to train the risk assessment model, obtain a trained risk assessment model, and obtain a risk assessment model with higher accuracy; input the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment result, divide the regional risk category according to the user's fraudulent behavior assessment result and location information, calculate the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category, so as to further determine the fraudulent situation in the area where the user to be processed is located, and can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0080] In addition, through detailed analysis and identification of users and multiple features, we can more accurately judge the degree of risk and take corresponding anti-fraud measures, which can reduce user dissatisfaction and thus improve user experience, while protecting user safety and reducing interference and restrictions on normal users.

[0081] Example 2 The following is a system embodiment of the present invention, which can be used to implement the method embodiment of the present invention. For details not disclosed in the system embodiment of the present invention, please refer to the method embodiment of the present invention.

[0082] Figure 3 It is a structural diagram of an example of a regional risk assessment system based on multiple features of the present invention.

[0083] Reference Figure 3The second aspect of the present disclosure provides a regional risk assessment system based on multiple features, which adopts the regional risk assessment method based on multiple features described in the first aspect of the present disclosure. The regional risk assessment system 300 includes a first collection module 310, a screening module 320, a second collection module 330, a data processing module 340, a model building module 350, a calculation module 360, and a determination module 370.

[0084] Specifically, the first collection module 310 is used to collect signaling data generated by user calls within a specific historical time period, pre-process the collected signaling data, and select the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information. The screening module 320 is used to perform calculations and analysis on the selected features to screen out fraud-related call features. The second collection module 330 is used to collect static information data, select multiple static features from them, and also collect risk area features as regional features. The data processing module 340 is used to use static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and use the bootstrap convergence method to sample the static features, the fraud-related call features, and the regional features, and use the new samples obtained by the sampling process as training samples. The model construction module 350 establishes a risk assessment model based on the random forest algorithm, trains the risk assessment model using the training data set, and obtains a trained risk assessment model. The calculation module 360 ​​is used to input the behavior characteristics and location characteristics of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results. The determination module 370 divides the regional risk categories according to the user's fraudulent behavior assessment results and regional location, and calculates the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category to further determine the fraudulent situation in the area where the user to be processed is located.

[0085] According to an optional implementation, the selected features are calculated and analyzed to screen out features of fraudulent calls, including: screening out features of fraudulent calls based on at least two of the following multiple thresholds: discreteness, silence time threshold, number of calls per day threshold, fraud threshold.

[0086] According to an optional implementation manner, the recall rate of fraud-related numbers in a data set within a specified historical time period is calculated, a fraud-related threshold is determined, and fraud-related call features are screened based on the determined threshold.

[0087] The current dispersion is calculated using the following expression: L=C / H L represents the current dispersion; C represents the number of calls deduplicated on the same day for all privacy numbers providing privacy communications; H represents the call frequency on the same day for all privacy numbers providing privacy communications.

[0088] According to an optional implementation manner, the discreteness of each private number is calculated and compared with the calculated current discreteness. When the calculated discreteness is greater than the current discreteness, the fraudulent call features corresponding to the private number are screened.

[0089] When the current privacy number is silent for more than the silence time threshold, the fraud-related call features corresponding to the current privacy number are filtered.

[0090] According to an optional implementation manner, for the multiple types of fraudulent call features screened out, the following expression is used to calculate the Gini coefficient of the risk distribution of the same type of fraudulent call features, so as to further screen the sample data of the same type of fraudulent call features:

[0091] in, represents the Gini coefficient of the risk distribution of the fraudulent call features of the current sample; K represents the total number of features of the fraudulent call features, k represents the kth type of fraudulent call features, Indicates the risk weight of the current sample belonging to the kth fraud-related call feature type.

[0092] According to an optional embodiment, the weight value is calculated by using the Pearson correlation coefficient statistical method. .

[0093] For the k feature values ​​of the call record of the current sample , ,…, , the risk target value y, the i-th feature is calculated using the following expression The Pearson correlation coefficient between :

[0094] The Pearson correlation coefficient calculated , calculate the weight value of the i-th feature of the current sample :

[0095] in, Indicates the weight value of the kth feature of the call record of the current sample , i=k; represents the i-th feature The Pearson correlation coefficient between and the target variable Y; represents the hth feature The correlation coefficient with the target variable Y, h represents the index variable used in the summation symbol, which is used to traverse all features. When calculating the weight value, it means summing the absolute values ​​of the Pearson correlation coefficients of all features with the target variable; K represents the total number of features of fraudulent calls, which is used to determine the range of features and the upper limit of the summation.

[0096] According to an optional implementation method, multiple static features are selected from the collected static information data: the number of cards opened by the user, whether there are fraudulent numbers and the number of fraudulent numbers under the same certificate, designated service information for privacy communications, average daily traffic, card opening age, user's place of origin, province to which the number belongs, roaming city, and surviving base stations and cells.

[0097] According to an optional implementation manner, the static features, the fraudulent call features, and the regional features are sampled using the bootstrap aggregation method, and the new samples obtained from the sampling process are used as training samples, including: recombining at least one of the static features, the fraudulent call features, and the regional features, and putting them back for resampling to obtain new amplified samples.

[0098] According to an optional implementation method, base stations or cells within a province or city are divided, and each base station or cell is assigned to a corresponding category; based on the proportion of fraudulent numbers in each category, the risk value of each category is calculated.

[0099] Compared with the prior art, the present invention collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features therefrom, and screens out fraud-related call features; collects static information data, selects multiple static features therefrom, and also collects risk area features as regional features, so as to obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained by the sampling process as training samples, so as to accurately amplify the sample data. This method; based on the random forest algorithm, establish a risk assessment model, use the training data set to train the risk assessment model, obtain a trained risk assessment model, and obtain a risk assessment model with higher accuracy; input the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment result, divide the regional risk category according to the user's fraudulent behavior assessment result and location information, calculate the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category, so as to further determine the fraudulent situation in the area where the user to be processed is located, and can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0100] In addition, through detailed analysis and identification of users and multiple features, we can more accurately judge the degree of risk and take corresponding anti-fraud measures, which can reduce user dissatisfaction and thus improve user experience, while protecting user safety and reducing interference and restrictions on normal users.

[0101] It should be noted that the multi-feature-based regional risk assessment method executed by the system in Example 2 is the same as the multi-feature-based regional risk assessment method in Example 1, and therefore, the description of the same parts is omitted.

[0102] Figure 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

[0103] like Figure 4 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0104] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0105] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0106] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0107] It should be understood that Figure 4 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0108] Through the above description of the implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by combining software with necessary hardware. Figure 5 As shown, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of commands to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the embodiment of the present invention.

[0109] The software product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0110] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0111] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0112] The computer-readable medium carries one or more programs (eg, computer-executable programs). When the one or more programs are executed by a device, the computer-readable medium implements the method of the present disclosure.

[0113] Those skilled in the art will appreciate that the above modules can be distributed in the device according to the description of the embodiment, or can be changed accordingly and only used in one or more devices different from the embodiment. The modules of the above embodiments can be combined into one module, or further divided into multiple sub-modules.

[0114] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the exemplary embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several commands to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiment of the present invention.

[0115] The exemplary embodiments of the present invention are specifically shown and described above. It should be understood that the present invention is not limited to the detailed structure, configuration or implementation method described herein; on the contrary, the present invention is intended to cover various modifications and equivalent configurations included in the spirit and scope of the appended claims.

Claims

1. A regional risk assessment method based on multiple features, characterized in that: include: Collect signaling data generated by user calls within a specific historical period, pre-process the collected signaling data, and select the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information; Perform calculation and analysis on the selected features to screen out the features of fraudulent calls; Collect static information data, select multiple static features from it, and collect risk area features as regional features; Using static features, fraudulent call features, and regional features marked with fraud labels to establish a training data set, and using the bootstrap aggregation method to sample the static features, the fraudulent call features, and the regional features, and using new samples obtained by the sampling process as training samples; Based on the random forest algorithm, a risk assessment model is established, and the risk assessment model is trained using the training data set to obtain a trained risk assessment model; Inputting the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment result; Regional risk categories are divided based on the user's fraudulent behavior assessment results and location information. The risk value of each regional risk category is calculated based on the proportion of fraudulent numbers in each regional risk category to further determine the fraud situation in the area where the user to be processed is located.

2. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: The calculation and analysis of the selected features to screen out fraudulent call features includes: Screen fraudulent call features based on at least two of the following thresholds: Discreteness, silent time threshold, number of calls per day threshold, fraud threshold.

3. The method for regional risk assessment based on multiple features according to claim 2, characterized in that: Further including: Calculate the recall rate of fraudulent numbers in the data set within a specified historical period, determine the fraud threshold, and filter fraudulent call features based on the determined threshold; The current dispersion is calculated using the following expression: L = C / H; L represents the current dispersion; C represents the number of calls deduplicated on the same day for all privacy numbers providing privacy communications; H represents the call frequency on the same day for all privacy numbers providing privacy communications.

4. The method for regional risk assessment based on multiple features according to claim 3 is characterized in that: Further including: Calculate the discreteness of each private number and compare it with the calculated current discreteness. When the calculated discreteness is greater than the current discreteness, filter the fraudulent call features corresponding to the private number; When the current privacy number is silent for more than the silence time threshold, the fraud-related call features corresponding to the current privacy number are filtered.

5. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: include: For the multiple types of fraudulent call features that have been screened out, the following expression is used to calculate the Gini coefficient of the risk distribution of the same type of fraudulent call features, so as to further screen the sample data of the same type of fraudulent call features: ； in, represents the Gini coefficient of the risk distribution of the fraudulent call features of the current sample; K represents the total number of features of the fraudulent call features, k represents the kth type of fraudulent call features, Indicates the risk weight of the current sample belonging to the kth fraud-related call feature type; The weight value is calculated by using the Pearson correlation coefficient statistical method. .

6. The method for regional risk assessment based on multiple features according to claim 5, For the k feature values ​​of the call record of the current sample , ,…, , the risk target value y, the i-th feature is calculated using the following expression The Pearson correlation coefficient between : ； The Pearson correlation coefficient calculated , calculate the weight value of the i-th feature of the current sample : ； in, Indicates the weight value of the kth feature of the call record of the current sample , i=k; represents the i-th feature The Pearson correlation coefficient between and the target variable Y; represents the hth feature The correlation coefficient with the target variable Y, h represents the index variable used in the summation symbol, which is used to traverse all features. When calculating the weight value, it means summing the absolute values ​​of the Pearson correlation coefficients of all features with the target variable; K represents the total number of features of fraudulent calls, which is used to determine the range of features and the upper limit of the summation.

7. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: Further including: Multiple static features are selected from the collected static information data: the number of cards opened by users, whether there are fraudulent numbers and the number of fraudulent numbers under the same ID card, designated service information for private communications, average daily traffic, age of card opening, user's place of origin, province to which the number belongs, roaming city, surviving base stations and cells.

8. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: The method of using the bootstrap aggregation method to perform sampling processing on the static features, the fraudulent call features, and the regional features, and using new samples obtained by the sampling processing as training samples, includes: At least one of the static features, the fraudulent call features, and the regional features is recombined, put back and resampled to obtain a new amplified sample.

9. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: Further including: Base stations or cells within provinces and cities are divided, and each base station or cell is assigned to a corresponding category; Calculate the risk value of each category based on the proportion of fraudulent numbers in each category.

10. A regional risk assessment system based on multiple features, characterized in that: The method for regional risk assessment based on multiple features according to any one of claims 1 to 9 is implemented, comprising: The first collection module is used to collect signaling data generated by user calls within a specific historical time period, pre-process the collected signaling data, and select the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information; A screening module is used to perform calculation and analysis on the selected features to screen out the features of fraudulent calls; The second collection module is used to collect static information data, select multiple static features from it, and collect risk area features as regional features; A data processing module, for establishing a training data set using static features, fraudulent call features, and regional features that are labeled with fraud labels, and performing sampling processing on the static features, the fraudulent call features, and the regional features using a bootstrap aggregation method, and using new samples obtained by the sampling processing as training samples; A model building module, based on a random forest algorithm, establishes a risk assessment model, and uses the training data set to train the risk assessment model to obtain a trained risk assessment model; A calculation module, used to input the behavior characteristics and location characteristics of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment result; The determination module divides regional risk categories according to the user's fraudulent behavior assessment results and regional location, and calculates the risk value of each regional risk category based on the proportion of fraudulent numbers in each regional risk category to further determine the fraud situation in the area where the user to be processed is located.

Images