A regional risk assessment method and system based on multiple features

Abstract

The present invention belongs to the field of privacy communication data processing technology, and provides a regional risk assessment method and system based on multiple features. The method includes: collecting signaling data generated by user calls in a specific historical time period, performing preprocessing, selecting features related to fraud, and performing calculation and analysis on the selected features to screen out fraud-related call features; selecting multiple static features and regional features; using static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, train a risk assessment model, and obtain a trained risk assessment model; inputting the behavior characteristics and location characteristics of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results, so as to further determine the fraud-related situation in the area where the user to be processed is located. The present invention can more accurately identify the user's fraudulent behavior and accurately determine the fraud-related situation in the area where the user is located.

Description

Technical Field

[0001] The present invention relates to the field of privacy communication data processing technology, and in particular to a regional risk assessment method and system based on multiple features. Background Art

[0002] The existing technology has the following problems: signaling features are single and rely on network operator data: signaling analysis requires the acquisition and analysis of network communication data, and the current signaling acquisition features are relatively single; the algorithms currently selected for machine learning have large deviations, and the accuracy and effectiveness of machine learning algorithms are limited by the quality and representativeness of training data. Due to data bias or imbalanced sample data (for example, certain types of fraud cases are rarely recorded or labeled), the model recognition ability is low.

[0003] Therefore, it is necessary to provide a new regional risk assessment method based on multiple features to solve the above problems. Summary of the Invention

[0004] The present invention aims to provide a regional risk assessment method and system based on multiple features to solve technical problems in the prior art, such as low model accuracy due to the single feature obtained from signaling data, and low model recognition ability due to data bias or imbalanced sample data (for example, certain types of fraud cases are rarely recorded or marked). The technical problems to be solved by the present invention are achieved through the following technical solutions.

[0005] The first aspect of the present invention proposes a regional risk assessment method based on multiple features, including: collecting signaling data generated by user calls in a specific historical time period, pre-processing the collected signaling data, and selecting the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information; performing calculation and analysis on the selected features to screen out fraud-related call features; collecting static information data, and selecting multiple static features therefrom, and also collecting risk area features as regional features; using static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and using automatic The static features, the fraudulent call features, and the regional features are sampled and processed by the convergence method, and the new samples obtained by the sampling process are used as training samples; based on the random forest algorithm, a risk assessment model is established, and the risk assessment model is trained with the training data set to obtain a trained risk assessment model; the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user's fraudulent behavior assessment results; regional risk categories are divided according to the user's fraudulent behavior assessment results and location information, and the risk value of each regional risk category is calculated according to the proportion of fraudulent numbers in each regional risk category, so as to further determine the fraud situation in the area where the user to be processed is located.

[0006] A second aspect of the present invention provides a regional risk assessment system based on multiple features, which adopts the regional risk assessment method based on multiple features described in the first aspect of the present invention. The regional risk assessment system includes: a first collection module for collecting signaling data generated by user calls within a specific historical time period, pre-processing the collected signaling data, and selecting the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information;

[0007] A screening module is used to perform calculations and analysis on the selected features to screen out features of fraudulent calls; a second collection module is used to collect static information data and select multiple static features therefrom, and also collect risk area features as regional features; a data processing module is used to use static features, fraudulent call features, and regional features marked with fraud labels to establish a training data set, and use the bootstrap aggregation method to sample the static features, the fraudulent call features, and the regional features, and use the new samples obtained from the sampling process as training samples; a model construction module is used to establish a risk assessment model based on the random forest algorithm, and use the training data set to train the risk assessment model to obtain a trained risk assessment model; a calculation module is used to input the behavior characteristics and location characteristics of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results; a determination module is used to divide the regional risk categories according to the user's fraudulent behavior assessment results and the regional location, and calculate the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category to further determine the fraud situation in the area where the user to be processed is located.

[0008] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the multi-feature-based regional risk assessment method described in the first aspect of the present invention.

[0009] A fourth aspect of the present invention provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the multi-feature-based regional risk assessment method described in the first aspect of the present invention.

[0010] The embodiments of the present invention include the following advantages:

[0011] Compared with the existing technology, the present invention collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features from it, and screens out fraud-related call features; collects static information data, and selects multiple static features from it, and also collects risk area features as regional features, which can obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained by sampling as training samples, which can accurately amplify the sample This method; based on the random forest algorithm, establishes a risk assessment model, uses the training data set to train the risk assessment model, obtains a trained risk assessment model, and can obtain a risk assessment model with higher accuracy; inputs the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results, divides the regional risk categories according to the user's fraudulent behavior assessment results and location information, calculates the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category, and further determines the fraudulent situation in the area where the user to be processed is located, which can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0012] In addition, through detailed analysis and identification of users and multiple features, we can more accurately judge the degree of risk and take corresponding anti-fraud measures, which can reduce user dissatisfaction and thus improve user experience. While protecting user safety, it also reduces interference and restrictions on normal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a flowchart of an example of the method for regional risk assessment based on multiple features of the present invention;

[0014] Figure 2 is a schematic diagram of an application example of the regional risk assessment method based on multiple features of the present invention;

[0015] Figure 3 It is a structural block diagram of the regional risk assessment system based on multiple features of the present invention;

[0016] Figure 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention;

[0017] Figure 5 is a schematic structural diagram of an embodiment of a computer-readable medium according to the present invention. DETAILED DESCRIPTION

[0018] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0019] In view of the above problems, the present invention proposes a method and device for regional risk assessment based on multiple features. The method collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features, and screens out fraud-related call features; collects static information data, selects multiple static features from it, and also collects risk area features as regional features, which can obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained from the sampling process as training samples, which can accurately amplify the samples; based on A random forest algorithm is used to establish a risk assessment model, and the training data set is used to train the risk assessment model to obtain a trained risk assessment model, which can obtain a risk assessment model with higher accuracy; the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user's fraudulent behavior assessment results, and regional risk categories are divided according to the user's fraudulent behavior assessment results and location information. According to the proportion of fraudulent numbers in each regional risk category, the risk value of each regional risk category is calculated to further determine the fraudulent situation in the area where the user to be processed is located, which can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0020] Example 1

[0021] Refer to the following Figure 1 、 Figure 2 、 Figure 3 , the contents of the present invention will be described in detail.

[0022] Figure 1 This is a flowchart of an example of the method for regional risk assessment based on multiple features of the present invention.

[0023] like Figure 1 As shown, in step S101, signaling data generated by user calls within a specific historical time period is collected, the collected signaling data is preprocessed, and the following call behavior features related to fraud are selected: calling number, called number, call time, call duration, province information, city information, base station information, and cell information.

[0024] Specifically, signaling data generated by user calls within a specific historical time period (e.g., six or twelve months from the current time) is collected. This refers to call records from a recent historical period. This signaling data contains call-related information, such as call location, call time, call direction, and call duration.

[0025] This signaling data is preprocessed, including data cleaning, filtering out null values ​​and erroneous data, and retaining valid call information. The cleaned data is used to create a feature dataset for model training and testing. The feature dataset contains the following features: calling number, called number, call time, call duration, province code, city code, base station code, cell code, etc.

[0026] By analyzing the above signaling data, characteristics of fraudulent activities can be obtained, and these data are timely, so as to better identify and respond to recent fraudulent activities.

[0027] It should be noted that the above description is merely provided as an optional example and should not be construed as a limitation to the present invention.

[0028] Next, in step S102, the selected features are calculated and analyzed to screen out features of fraudulent calls.

[0029] Filter fraudulent call features based on at least two of the following thresholds: dispersion, silence time threshold, number of calls per day threshold, and fraud threshold.

[0030] Specifically, the discreteness and the fraud threshold are both obtained through calculation. For example, the characteristics of fraudulent calls are screened by counting the discreteness of the calling and called numbers (e.g., greater than 0.8) and the number of calls. The recall rate of fraudulent numbers in the dataset within a specified historical time period is calculated (e.g., the recall rate of fraudulent numbers in the past six months, specifically, a recall rate > 90%), the fraud threshold is determined, and the fraudulent call characteristics are screened based on the determined threshold. The silence time threshold is 28 days, 30 days, or 45 days. The threshold for the number of calls per day is 30 to 80 times, for example, 30 times, 40 times, 60 times, 80 times, etc.

[0031] The current dispersion is calculated using the following expression:

[0032] L=C / H

[0033] L represents the current dispersion; C represents the number of calls made on the same day without duplicates for all privacy numbers providing private communications; H represents the call frequency of all privacy numbers providing private communications on the same day.

[0034] The discreteness of each private number is further calculated and compared with the calculated current discreteness (i.e., the discreteness used as the threshold). When the calculated discreteness is greater than the current discreteness, the fraudulent call features corresponding to the private number are screened.

[0035] When the current privacy number is silent for more than the silence time threshold, the fraud-related call features corresponding to the current privacy number are filtered.

[0036] In a preferred embodiment, the screened fraudulent call features are further calculated and analyzed to obtain the final fraudulent call features.

[0037] For the multiple types of fraudulent call features that have been screened out, the following expression is used to calculate the Gini coefficient of the risk distribution of the same type of fraudulent call features, so as to further screen the sample data of the same type of fraudulent call features:

[0038]

[0039] in, The Gini coefficient of the risk distribution of the fraudulent call features of the current sample is represented; K represents the total number of features of the fraudulent call features, and k represents the kth fraudulent call feature type. Indicates the risk weight of the current sample belonging to the kth fraud-related call feature type.

[0040] By using the Pearson correlation coefficient statistical method, we can obtain Weight value.

[0041] For the k feature values ​​of the call record of the current sample , ,…, , the risk target value y, the i-th feature is calculated using the following expression The Pearson correlation coefficient between the target variable Y :

[0042]

[0043] The calculated Pearson correlation coefficient , calculate the weight value of the i-th feature of the current sample :

[0044]

[0045] in, Indicates the weight value of the kth feature of the call record of the current sample , i=k; Represents the i-th feature Pearson correlation coefficient between and target variable Y; represents the hth feature The correlation coefficient with the target variable Y, h represents the index variable used in the summation symbol, which is used to traverse all features. When calculating the weight value, it means summing the absolute values ​​of the Pearson correlation coefficients of all features with the target variable; K represents the total number of features involved in fraudulent calls, which is used to determine the range of features and the upper limit of the summation.

[0046] It should be noted that for all fraudulent call features belonging to the same category, when the calculated Gini coefficient reaches 0 or approaches the minimum value of 0, it indicates that the data features within this category are relatively concentrated, indicating that this category of fraudulent call features does not meet the conditions for model training. For example, all devices used in the test set numbers belong to the same category. On the other hand, when the calculated Gini coefficient approaches the maximum value (e.g., 1), it indicates that the data features within this category of fraudulent call features are relatively balanced, with no or minimal feature deviation, making them suitable for model training. Therefore, when selecting features, features that maximize the Gini coefficient are selected to ensure that the data does not have feature deviation. Therefore, selecting features through the above feature screening method, specifically by calculating the Gini coefficient, can more effectively filter out the most valuable fraudulent call features for classification from a large number of features, thereby improving the accuracy and stability of the model. In other embodiments, other indicators such as entropy and information gain may be used in conjunction to ensure the comprehensiveness and accuracy of feature selection. The above is provided as an example only and is not to be construed as limiting the present invention.

[0047] Next, in step S103, static information data is collected, and a plurality of static features are selected therefrom, and risk area features are also collected as area features.

[0048] Specifically, static information data is collected and analyzed and screened. The static information data includes the number of cards opened by the user, the number of fraudulent numbers with the same ID, information about designated private communication services, traffic data, number of locations, card opening age, user's place of origin, roaming cities, and surviving base stations.

[0049] Furthermore, multiple static features are selected from the collected static information data: the number of cards opened by the user, whether there are fraudulent numbers and the number of fraudulent numbers under the same ID card, designated service information for private communications, average daily traffic, age of card opening, user's place of origin, province to which the number belongs, roaming city, surviving base stations and cells.

[0050] Optionally, risk regions (specifically, those identified based on historical fraudulent numbers) can be used as regional features (or additional features). These regional features can reflect the degree of risk within a region and help better distinguish different types of samples.

[0051] It should be noted that the above description is merely provided as an optional example and should not be construed as a limitation to the present invention.

[0052] Next, in step S104, static features, fraud-related call features, and regional features marked with fraud labels are used to establish a training data set, and the static features, the fraud-related call features, and the regional features are sampled using the bootstrap aggregation method, and the new samples obtained by the sampling process are used as training samples.

[0053] Specifically, we use static features labeled with fraudulent labels, features of fraudulent calls, and regional features to build a training dataset. For example, we use the number of fraudulent calls in a day (e.g., more than three fraudulent calls marked in a day) and the risk region (whether it is a risky area) to represent the fraud label and define positive and negative samples.

[0054] Optionally, the fraudulent numbers are determined by counting the discreteness and the number of calls of the calling numbers, and fraud labels are generated to define positive samples and negative samples.

[0055] The static features, the fraudulent call features, and the regional features are sampled using a bootstrapping method (i.e., Bagging), and new samples obtained through the sampling process are used as training samples.

[0056] Specifically, at least one of the static features, the fraudulent call features, and the regional features is recombined and resampled with replacement to obtain a new, expanded sample. For example, 10 to 30 fraudulent call features are manually identified. Using an ensemble technique to train a classifier using newly added combined data features with replacement, the sample is then expanded to a specific ratio (e.g., 1:2 to 1:5). Using a bootstrap aggregation method, the three features can be recombined into more features, thereby obtaining more sample data.

[0057] It should be noted that, in other embodiments, user feature information and call behavior features marked with fraud labels can also be used to establish a training data set. The above is only provided as an optional example and should not be construed as limiting the present invention.

[0058] In an optional embodiment, a test dataset is also established. For example, using a cross-validation method, the collected data is divided into multiple folds, with one portion serving as the test dataset and the remaining portion serving as the training dataset. A decision tree is constructed by randomly sampling features. This feature sampling method, known as the "random subspace method," reduces correlation between features and increases the variance between individual decision trees. A self-service sampling method is used to extract samples from the training set with replacement. Classification and identification of different user characteristics can be used to reduce accidental harm to legitimate users. Classification can be based on multiple factors, such as user behavior patterns, historical records, and geographic location. Through detailed analysis and identification of users and multiple features, the risk level can be more accurately determined, and appropriate anti-fraud measures can be implemented. This can reduce user dissatisfaction, thereby improving the user experience and protecting user safety while minimizing interference and restrictions on legitimate users.

[0059] Next, in step S105, a risk assessment model is established based on the random forest algorithm, and the risk assessment model is trained using the training data set to obtain a trained risk assessment model.

[0060] A risk assessment model is established by using a random forest algorithm of machine learning, and the risk assessment model is trained using the training data set obtained in step S104 to obtain a trained risk assessment model.

[0061] The risk assessment model will classify user call behaviors, and each user call behavior will be assigned to a category in the random forest.

[0062] Next, based on the proportion of fraudulent numbers in each category, we calculate the risk value of the category to which the user is assigned. For each category (high risk, medium risk, low risk), we calculate the proportion of trees that predict the category to which the user is assigned. In other words, the frequency of occurrence of the fraudulent category Ck (where k is the category number) is calculated using the following expression:

[0063] P(Ck|X)=Number of trees predicting Ck / m

[0064] Where P(Ck|X) represents the predicted probability of the fraud category Ck in all trees (i.e., the probability of the category); m represents the total number of tree branches (i.e., fraud categories); and Number of trees predicting Ck represents the number of fraud categories Ck to be predicted in all trees.

[0065] It should be noted that the above description is merely provided as an optional example and should not be construed as a limitation to the present invention.

[0066] Next, in step S106, the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user fraudulent behavior assessment result.

[0067] Specifically, the behavior characteristics and location information of the user to be processed are input into the risk assessment model to obtain the user's fraudulent behavior assessment result. The location information can be obtained through the signaling data of the user to be processed, for example, the location information of the private number of the user to be processed.

[0068] Furthermore, the user fraudulent behavior assessment result includes the risk level of the user to be processed (such as high risk, medium risk, low risk), whether the private number of the user to be processed is fraudulent, and the probability or confidence of the fraud type to which the private number of the user to be processed belongs.

[0069] It should be noted that the above description is merely provided as an optional example and should not be construed as a limitation to the present invention.

[0070] Next, in step S107, regional risk categories are divided according to the user's fraudulent behavior assessment results and location information. The risk value of each regional risk category is calculated based on the proportion of fraudulent numbers in each regional risk category to further determine the fraud situation in the area where the user to be processed is located.

[0071] In one embodiment, base stations or cells within a province or city are divided, and each base station or cell is assigned to a corresponding category. Based on the proportion of fraudulent numbers in each category, a risk value for each category is calculated to classify the risk of each region.

[0072] Specifically, regional risk categories are divided based on the user's fraudulent behavior assessment results and location information. Based on the proportion of fraudulent numbers in each regional risk category, the risk value of the regional risk category of the area to which the user to be processed belongs is calculated to further determine the fraud situation in the area where the user to be processed is located.

[0073] Furthermore, the number of fraudulent numbers in the user's region is collected, and the proportion of fraudulent numbers in the user's region is calculated.

[0074] A deep neural network algorithm is used to build a regional risk prediction model.

[0075] Specifically, the determined user fraud behavior assessment results, location information, and the proportion of fraudulent numbers in each regional risk category are labeled with fraud labels. For example, the number of fraud-related incidents occurring in a specified historical time period is greater than or equal to the specified number of the corresponding region (for example, 3 to 10 cases) to characterize the fraud label and define positive and negative samples. A training data set is thus established, and the established training data set is used to train the regional risk prediction model to obtain a trained regional risk model.

[0076] For the specified number, historical fraud-related incident data of different provinces and cities within a specific historical period (for example, the past 6 months, 12 months, 18 months, 24 months, 36 months, 48 ​​months, 60 months, etc.) are collected, and a trend forecast chart is drawn to determine the specified number of each region at the current time based on the drawn trend forecast chart.

[0077] The user fraud behavior assessment result of the user to be processed (i.e., the user fraud behavior assessment result determined in step S06), location information, and the calculated proportion of fraudulent numbers are input into the regional risk model to obtain the risk value of the regional risk category of the area to which the user to be processed belongs, that is, the risk value of the regional risk category of the area to which the user to be processed belongs is calculated (for example, a multi-dimensional vector, where each dimension corresponds to the number of risk assessments of the risk category), so as to further determine the fraud situation in the area where the user to be processed is located based on the calculated risk value.

[0078] The risk value range is divided into three intervals: low risk, medium risk, and high risk. The risk value is a numerical value ranging from 0 to 100. When the calculated risk value is less than 30, it is set as the low risk threshold interval; between 30 (inclusive) and 70, it is set as the medium risk threshold interval; and greater than 70, it is set as the high risk threshold interval.

[0079] For provinces with designated numbers, those near risk areas with more than five fraud incidents are considered high-risk. For provinces and cities not near risk areas, those with more than one fraud incident are considered high-risk, those with more than five are considered medium-risk, and those with more than two are considered low-risk. For example, cities A and B are high-risk areas.

[0080] The designated number for different provinces is determined by multiplying the designated number of users in different provinces and cities by the corresponding specific ratio (for example, 0.003% to 0.015%) to characterize the number of events involving fraud risks. For example, if Province C has one million users, then the designated number for Province C is one million multiplied by a specific ratio (for example, 0.005%) to get 5 events, that is, the designated number is 5. If the number of fraud-related events in Province C at the current time is greater than or equal to 5, it is a high-risk area.

[0081] Through this risk determination process, we can accurately determine the fraud-related status of the user's region. Based on the risk range, the region can be categorized as low-risk, medium-risk, or high-risk, allowing for the implementation of appropriate risk management measures.

[0082] By implementing hierarchical management of regions, different control measures are formulated for fraud-related numbers and risky numbers in areas with different risk levels.

[0083] In another optional embodiment, a machine learning model, such as a random forest algorithm, is used to establish a regional risk identification model. The fraudulent behavior data of users marked with risk labels (the proportion of fraudulent numbers is greater than a predetermined value), static information features, call time, and call area are used to establish a training data set. The training data set is used to train the regional risk identification model to identify fraudulent situations in the area where the user to be processed belongs.

[0084] The user fraudulent behavior assessment result and location information obtained in step S106 are input into the trained regional risk identification model to obtain the fraud situation of the area where the user to be processed is located. For example, a three-dimensional vector is output, and the output three-dimensional vector is represented by the probability that the area where the user to be processed is located is high-risk, the probability that the area where the user to be processed is located is medium-risk, and the probability that the area where the user to be processed is located is low-risk.

[0085] Specifically, the regional risk identification model divides base stations or cells within different regions (e.g., within a prefecture-level city). Each base station or cell is assigned to a risk category (e.g., high risk, medium risk, or low risk) in the random forest. The risk value for each risk category is then calculated based on the proportion of fraudulent numbers in that category. For each risk category, the proportion of trees that predict that risk category is calculated. That is, the frequency of occurrence of a risk category, Ck' (where k' is the risk category number), is expressed using the following expression:

[0086] P'(Ck'|X')=M / m'

[0087] Where P'(Ck'|X') represents the predicted probability of risk category Ck' in all trees (i.e., the probability of the risk category); m' represents the total number of tree branches (i.e., fraud-related categories); and M represents the number of risk categories Ck' to be predicted in all trees.

[0088] Risk areas are further identified based on the fraud-related status of the users in question, allowing for tailored control measures to be implemented for different risk levels. For low-risk areas, online authentication measures can be implemented to identify risky numbers. For high-risk areas, online and offline authentication may be suspended, secondary authentication may be implemented, or other more stringent measures may be implemented. This allows for more targeted control measures tailored to the risk profile of each region, improving both the effectiveness and accuracy of anti-fraud efforts.

[0089] It should be noted that the above description is merely provided as an optional example and should not be construed as a limitation to the present invention.

[0090] Furthermore, the accompanying drawings are merely illustrative of the processes involved in the method according to exemplary embodiments of the present invention and are not intended to be limiting. It should be understood that the processes illustrated in the accompanying drawings do not indicate or limit the temporal order of these processes. Furthermore, it should be understood that these processes can be executed synchronously or asynchronously, for example, in multiple modules.

[0091] Compared with the existing technology, the present invention collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features from it, and screens out fraud-related call features; collects static information data, and selects multiple static features from it, and also collects risk area features as regional features, which can obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained by sampling as training samples, which can accurately amplify the sample This method; based on the random forest algorithm, establishes a risk assessment model, uses the training data set to train the risk assessment model, obtains a trained risk assessment model, and can obtain a risk assessment model with higher accuracy; inputs the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results, divides the regional risk categories according to the user's fraudulent behavior assessment results and location information, calculates the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category, and further determines the fraudulent situation in the area where the user to be processed is located, which can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0092] In addition, through detailed analysis and identification of users and multiple features, we can more accurately judge the degree of risk and take corresponding anti-fraud measures, which can reduce user dissatisfaction and thus improve user experience. While protecting user safety, it also reduces interference and restrictions on normal users.

[0093] Example 2

[0094] The following are system embodiments of the present invention, which can be used to implement the method embodiments of the present invention. For details not disclosed in the system embodiments of the present invention, please refer to the method embodiments of the present invention.

[0095] Figure 3 It is a structural diagram of an example of the regional risk assessment system based on multiple features of the present invention.

[0096] Reference Figure 3In a second aspect, the present disclosure provides a multi-feature-based regional risk assessment system that employs the multi-feature-based regional risk assessment method described in the first aspect of the present disclosure. The regional risk assessment system 300 includes a first collection module 310, a screening module 320, a second collection module 330, a data processing module 340, a model building module 350, a calculation module 360, and a determination module 370.

[0097] Specifically, the first collection module 310 is used to collect signaling data generated by user calls within a specific historical time period, pre-process the collected signaling data, and select the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information. The screening module 320 is used to perform calculations and analysis on the selected features to screen out fraud-related call features. The second collection module 330 is used to collect static information data, select multiple static features therefrom, and also collect risk area features as regional features. The data processing module 340 is used to establish a training data set using static features marked with fraud labels, fraud-related call features, and regional features, and use the bootstrap convergence method to sample the static features, the fraud-related call features, and the regional features, and use the new samples obtained from the sampling process as training samples. The model construction module 350 establishes a risk assessment model based on the random forest algorithm, trains the risk assessment model using the training data set, and obtains a trained risk assessment model. Calculation module 360 ​​is used to input the behavior characteristics and location characteristics of the user to be processed into the risk assessment model to obtain an assessment result of the user's fraudulent behavior. Determination module 370 classifies the user's fraudulent behavior assessment results and regional location into regional risk categories. Based on the proportion of fraudulent numbers in each regional risk category, it calculates the risk value of each regional risk category to further determine the fraudulent status of the region where the user to be processed is located.

[0098] According to an optional implementation method, the selected features are calculated and analyzed to screen out fraudulent call features, including: screening fraudulent call features based on at least two of the following multiple thresholds: discreteness, silence time threshold, number of calls per day threshold, and fraud threshold.

[0099] According to an optional implementation manner, the recall rate of fraudulent numbers in a data set within a specified historical time period is calculated, a fraud threshold is determined, and fraudulent call features are screened based on the determined threshold.

[0100] The current dispersion is calculated using the following expression:

[0101] L=C / H

[0102] L represents the current dispersion; C represents the number of calls made on the same day without duplicates for all privacy numbers providing private communications; H represents the call frequency of all privacy numbers providing private communications on the same day.

[0103] According to an optional implementation manner, the discreteness of each private number is calculated and compared with the calculated current discreteness. When the calculated discreteness is greater than the current discreteness, the fraud-related call features corresponding to the private number are screened.

[0104] When the current privacy number is silent for more than the silence time threshold, the fraud-related call features corresponding to the current privacy number are filtered.

[0105] According to an optional implementation manner, the following expression is used to calculate the Gini coefficient of the risk distribution of the multiple types of fraudulent call features screened out, so as to further screen sample data of the same type of fraudulent call features:

[0106]

[0107] in, The Gini coefficient of the risk distribution of the fraudulent call features of the current sample is represented; K represents the total number of features of the fraudulent call features, and k represents the kth fraudulent call feature type. Indicates the risk weight of the current sample belonging to the kth fraud-related call feature type.

[0108] According to an optional embodiment, the weight value is calculated by using the Pearson correlation coefficient statistical method. .

[0109] For the k feature values ​​of the call record of the current sample , ,…, , the risk target value y, the i-th feature is calculated using the following expression The Pearson correlation coefficient between the target variable Y :

[0110]

[0111] The calculated Pearson correlation coefficient , calculate the weight value of the i-th feature of the current sample :

[0112]

[0113] in, Indicates the weight value of the kth feature of the call record of the current sample , i=k; Represents the i-th feature Pearson correlation coefficient between and target variable Y; represents the hth feature The correlation coefficient with the target variable Y, h represents the index variable used in the summation symbol, which is used to traverse all features. When calculating the weight value, it means summing the absolute values ​​of the Pearson correlation coefficients of all features with the target variable; K represents the total number of features involved in fraudulent calls, which is used to determine the range of features and the upper limit of the summation.

[0114] According to an optional implementation method, multiple static features are selected from the collected static information data: the number of cards opened by the user, whether there are fraudulent numbers and the number of fraudulent numbers under the same certificate, designated service information for private communications, average daily traffic, age of card opening, user's place of origin, province to which the number belongs, roaming city, surviving base stations and cells.

[0115] According to an optional implementation manner, the static features, the fraudulent call features, and the regional features are sampled and processed using the bootstrap aggregation method, and the new samples obtained from the sampling process are used as training samples, including: recombining at least one of the static features, the fraudulent call features, and the regional features, and putting them back and resampling to obtain new amplified samples.

[0116] According to an optional implementation method, base stations or cells within a province or city are divided, and each base station or cell is assigned to a corresponding category; the risk value of each category is calculated based on the proportion of fraudulent numbers in each category.

[0117] Compared with the existing technology, the present invention collects signaling data generated by user calls in a specific historical time period, pre-processes the collected signaling data, selects fraud-related features from it, and screens out fraud-related call features; collects static information data, and selects multiple static features from it, and also collects risk area features as regional features, which can obtain classification features with more dimensions; uses static features marked with fraud labels, fraud-related call features, and regional features to establish a training data set, and uses the bootstrap aggregation method to sample the static features, the fraud-related call features, and the regional features, and uses the new samples obtained by sampling as training samples, which can accurately amplify the sample This method; based on the random forest algorithm, establishes a risk assessment model, uses the training data set to train the risk assessment model, obtains a trained risk assessment model, and can obtain a risk assessment model with higher accuracy; inputs the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results, divides the regional risk categories according to the user's fraudulent behavior assessment results and location information, calculates the risk value of each regional risk category according to the proportion of fraudulent numbers in each regional risk category, and further determines the fraudulent situation in the area where the user to be processed is located, which can more accurately identify the user's fraudulent behavior and accurately determine the fraudulent situation in the user's area.

[0118] In addition, through detailed analysis and identification of users and multiple features, we can more accurately judge the degree of risk and take corresponding anti-fraud measures, which can reduce user dissatisfaction and thus improve user experience. While protecting user safety, it also reduces interference and restrictions on normal users.

[0119] It should be noted that the multi-feature-based regional risk assessment method executed by the system in Example 2 is the same as the multi-feature-based regional risk assessment method in Example 1, so the description of the same parts is omitted.

[0120] Figure 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

[0121] like Figure 4 As shown, the electronic device is implemented as a general-purpose computing device. The processor may be one or multiple processors working in concert. The present invention also does not exclude distributed processing, meaning that the processors may be dispersed across different physical devices. The electronic device of the present invention is not limited to a single entity but may also be the sum of multiple physical devices.

[0122] The memory stores a computer executable program, typically a machine-readable code, which can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least some of the steps in the method.

[0123] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0124] Optionally, in this embodiment, the electronic device further includes an I / O interface for exchanging data with an external device. The I / O interface may represent one or more of several types of bus structures, including a storage unit bus or storage unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus structures.

[0125] It should be understood that Figure 4 The electronic device shown is merely an example of the present invention. The electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as screens, and some electronic devices also include human-computer interaction elements such as buttons and keyboards. As long as the electronic device can execute a computer-readable program stored in its memory to implement the method of the present invention or at least some of the steps of the method, it is considered an electronic device covered by the present invention.

[0126] Through the above description of the embodiments, it is easy for those skilled in the art to understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Figure 5 As shown, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of commands to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the embodiment of the present invention.

[0127] The software product may utilize any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0128] The computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. The data signal propagated may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, device, or component. The program code contained on the readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0129] Program code for performing the operations of the present invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0130] The computer-readable medium carries one or more programs (eg, computer-executable programs). When the one or more programs are executed by a device, the computer-readable medium implements the method of the present disclosure.

[0131] Those skilled in the art will appreciate that the modules described above can be distributed in the device according to the description of the embodiment, or can be modified accordingly to be used in one or more devices that are different from the embodiment. The modules of the above embodiment can be combined into one module or further divided into multiple submodules.

[0132] From the above description of the embodiments, those skilled in the art will readily appreciate that the exemplary embodiments described herein can be implemented via software or via a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present invention can be embodied in the form of a software product, which can be stored on a non-volatile storage medium (such as a CD-ROM, USB flash drive, or mobile hard drive) or on a network and includes commands that cause a computing device (such as a personal computer, server, mobile terminal, or network device) to execute the methods according to the embodiments of the present invention.

[0133] The exemplary embodiments of the present invention are specifically shown and described above. It should be understood that the present invention is not limited to the detailed structure, configuration or implementation described herein; on the contrary, the present invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A regional risk assessment method based on multiple features, characterized in that: include: Collect signaling data generated by user calls within a specific historical time period, pre-process the collected signaling data, and select the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information; Perform computational analysis on the selected features to screen out fraudulent call features; Collect static information data, select multiple static features from it, and also collect risk area features as regional features; Using static features, fraudulent call features, and regional features that are labeled with fraud labels to establish a training data set, and using a bootstrap aggregation method to sample the static features, the fraudulent call features, and the regional features, and using new samples obtained from the sampling process as training samples; Establishing a risk assessment model based on a random forest algorithm, and using the training data set to train the risk assessment model to obtain a trained risk assessment model; Inputting the behavior characteristics and location information of the user to be processed into the risk assessment model to obtain the user's fraudulent behavior assessment results; Regional risk categories are divided based on the user's fraudulent behavior assessment results and location information. The risk value of each regional risk category is calculated based on the proportion of fraudulent numbers in each regional risk category to further determine the fraud situation in the area where the user to be processed is located.

2. The regional risk assessment method based on multiple features according to claim 1, characterized in that: The computational analysis of the selected features to screen out fraudulent call features includes: Screen fraudulent call features based on at least two of the following thresholds: Discreteness, silence time threshold, number of calls per day threshold, fraud threshold.

3. The regional risk assessment method based on multiple features according to claim 2, characterized in that: Further including: Calculate the recall rate of fraudulent numbers in the dataset within a specified historical time period, determine the fraud threshold, and filter fraudulent call features based on the determined threshold; The current dispersion is calculated using the following expression: L = C / H; L represents the current dispersion; C represents the number of calls made on the same day without duplicates for all privacy numbers providing private communications; H represents the call frequency of all privacy numbers providing private communications on the same day.

4. The method for regional risk assessment based on multiple features according to claim 3, characterized in that: Further including: Calculate the dispersion of each private number and compare it with the calculated current dispersion. When the calculated dispersion is greater than the current dispersion, filter out the fraudulent call features corresponding to the private number; When the current privacy number is silent for more than the silence time threshold, the fraud-related call features corresponding to the current privacy number are filtered.

5. The regional risk assessment method based on multiple features according to claim 1, characterized in that: include: For the multiple types of fraudulent call features that have been screened out, the following expression is used to calculate the Gini coefficient of the risk distribution of the same type of fraudulent call features, so as to further screen the sample data of the same type of fraudulent call features: ； in, The Gini coefficient of the risk distribution of the fraudulent call features of the current sample is represented; K represents the total number of features of the fraudulent call features, and k represents the kth fraudulent call feature type. Indicates the risk weight of the current sample belonging to the kth fraud-related call feature type; The weight value is calculated by using the Pearson correlation coefficient statistical method .

6. The regional risk assessment method based on multiple features according to claim 5, For the k feature values ​​of the call record of the current sample , ,…, , the risk target value y, the i-th feature is calculated using the following expression The Pearson correlation coefficient between the target variable Y : ； The calculated Pearson correlation coefficient , calculate the weight value of the i-th feature of the current sample : ； in, Indicates the weight value of the kth feature of the call record of the current sample , i=k; Represents the i-th feature Pearson correlation coefficient between and target variable Y; represents the hth feature The correlation coefficient with the target variable Y, h represents the index variable used in the summation symbol, which is used to traverse all features. When calculating the weight value, it means summing the absolute values ​​of the Pearson correlation coefficients of all features with the target variable; K represents the total number of features involved in fraudulent calls, which is used to determine the range of features and the upper limit of the summation.

7. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: Further including: Multiple static features are selected from the collected static information data: the number of cards opened by the user, whether there are fraudulent numbers and the number of fraudulent numbers under the same ID card, designated service information for private communications, average daily traffic, age of card opening, user's place of origin, province to which the number belongs, roaming city, surviving base stations and cells.

8. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: The method of sampling the static features, the fraudulent call features, and the regional features using the bootstrap aggregation method, and using new samples obtained from the sampling process as training samples, includes: At least one of the static features, the fraudulent call features, and the regional features is recombined, put back and resampled to obtain a new amplified sample.

9. The method for regional risk assessment based on multiple features according to claim 1, characterized in that: Further including: Base stations or cells within provinces and cities are divided, and each base station or cell is assigned to a corresponding category; Calculate the risk value of each category based on the proportion of fraudulent numbers in each category.

10. A regional risk assessment system based on multiple features, characterized in that: The method for regional risk assessment based on multiple features according to any one of claims 1 to 9 is implemented, comprising: The first collection module is used to collect signaling data generated by user calls within a specific historical time period, pre-process the collected signaling data, and select the following features related to fraud: calling number, called number, call time, call duration, province information, city information, base station information, and cell information; A screening module is used to perform computational analysis on the selected features to screen out features of fraudulent calls; The second collection module is used to collect static information data, select multiple static features from it, and collect risk area features as regional features; a data processing module for establishing a training data set using static features, fraudulent call features, and regional features labeled with fraud labels, and performing sampling processing on the static features, the fraudulent call features, and the regional features using a bootstrap aggregation method, and using new samples obtained from the sampling processing as training samples; A model building module, based on a random forest algorithm, establishes a risk assessment model, and uses the training data set to train the risk assessment model to obtain a trained risk assessment model; A calculation module, configured to input the behavior characteristics and location characteristics of the user to be processed into the risk assessment model to obtain an assessment result of the user's fraudulent behavior; The determination module divides regional risk categories according to the user's fraudulent behavior assessment results and regional location. Based on the proportion of fraudulent numbers in each regional risk category, the risk value of each regional risk category is calculated to further determine the fraud situation in the area where the user to be processed is located.

Images