Fraud suspicion identification method based on APP list analysis

Abstract

The invention discloses a fraud suspicion identification method based on APP list analysis, and the method comprises the steps: collecting, cleaning and processing data, the collected data being user identification data, software use frequency data, software use duration data, software use combination duration data, software property data and timestamp data; calculating a software use frequency score according to the collected software use frequency data; calculating a software use duration score and a software use combination duration score according to the software use duration data and the software use combination duration data; calculating a suspicion score according to the software use frequency score, the software use duration score and the software use combination duration score; and optimizing and iterating the system. By introducing new concepts such as a behavior combination chain and a switching mode, the fraud suspicion value of the user can be evaluated more accurately, the accuracy and efficiency of anti-fraud work are improved, and potential fraud behaviors are found and early warned in time.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method for identifying suspected fraud based on APP list analysis. Background Art

[0002] Traditional anti-fraud methods, such as rule-matching-based filtering systems or simple user behavior analysis, are no longer effective in dealing with complex and ever-changing fraud methods. Therefore, it is particularly important to develop an efficient and accurate method for identifying suspected fraudsters. With the popularization of smart phones and mobile Internet, user behavior data has become increasingly rich and diverse, which provides a valuable data basis for the development of new anti-fraud technologies. By analyzing the software usage behavior of users on their mobile phones, many behavioral patterns related to fraudulent activities can be revealed. For example, fraudsters often frequently use certain specific software (such as niche chat software, loan software, etc.) to conduct fraudulent activities, or cover up by switching between different software at a high frequency.

[0003] For example, Chinese patent announcement number CN112613888 discloses a method and device for identifying suspected fraudsters based on APP list analysis. Through the empirical model obtained by studying and analyzing the APP list of online fraudsters, the APP list is divided into several positive suspected categories and several negative suspected categories, and each category is assigned a certain classification threshold according to the importance of each category on the analysis result. Finally, the final suspected fraud score is obtained by weighted statistics and the suspected fraud is determined. This can effectively solve the defects of confusion and lag in the identification and determination of suspected fraudsters in the existing technology.

[0004] Among the existing patented technologies, advanced technologies such as machine learning and data mining are applied to the anti-fraud field. By building complex algorithm models, users' behavioral data can be deeply analyzed, features related to fraudulent activities can be extracted, and the user's fraud suspicion score can be calculated accordingly. However, these technologies also face many challenges, such as deficiencies in model accuracy, stability, and interpretability, as well as how to deal with issues such as user privacy protection and data security. Summary of the invention

[0005] This application provides a method for identifying suspected fraud based on APP list analysis. By introducing usage behavior data, it can distinguish between real high-risk users and misjudged users. As the user's usage behavior changes, the suspicion score will also be dynamically adjusted to reflect the user's risk status more promptly.

[0006] This application provides a method for identifying suspected fraud based on APP list analysis, including:

[0007] S101, collecting, cleaning and processing data, the collected data includes user identification data, software usage frequency data, software usage duration data, software usage combined duration data, software property data and timestamp data;

[0008] S102, calculating a software usage frequency score based on the collected software usage frequency data;

[0009] S103, calculating a software usage time score and a software usage combination time score according to the software usage time data and the software usage combination time data;

[0010] S104, calculating a suspicion score based on the software usage frequency score, the software usage duration score, and the software usage combined duration score;

[0011] S105, based on the machine learning algorithm, feature recognition is performed on the fraud-related software calculated in step 104, and the software marked as suspected fraud is detected.

[0012] Preferably, user identification data includes user ID and device information, and the device information is the device type and operating system version; software usage frequency data includes software ID and usage times, and the usage times indicate the number of times the user uses the software within a set time period; software usage time data includes the usage time of each time and the cumulative usage time; software usage combination time data includes a combination software ID list and combined usage time, and the combination software ID list is used to record the situation where the user uses multiple software combinations at the same time, and the combined usage time is the total time the user uses the software at the same time; software property data includes software classification and software weight, and software classification divides software into positive and negative categories.

[0013] Preferably, based on the collected software usage frequency data, the frequency score formula is calculated as follows: frequency score = software weight score × software usage frequency, wherein the software weight score is a score for the weight of the software based on the nature of the software, frequency of use and expert advice.

[0014] Preferably, the formula for calculating the software usage time score is: time score = software nature coefficient × time weight coefficient × software usage time, wherein the software nature coefficient is a quantitative indicator determined according to the software nature and expert advice; the time weight coefficient is determined according to the software nature and expert advice;

[0015] The basic combined duration score is determined based on the software usage time and the combined weight coefficient. The basic combined duration score formula is: Where n is the number of software in the combination, T i represents the time a user uses software i in a specific time period, W i represents the weight of software i in the combination, S 基represents the basic combined duration score, and the final combined duration score formula is: S 终 =S 基 +F×max(0,T totai -T)×ΔS, where is the total usage time of the combination; T is the combination usage time threshold; F is a Boolean value, which is the sign of a negative combination. If the combination is judged to be negative, F = 1, otherwise, F = 0; ΔS is the adjustment amount; max(0, T totai -T) is the condition for score adjustment.

[0016] Preferably, the formula for calculating the suspicion score is: SS = W f ×F+W t ×T+W c ×C, where F represents the software usage frequency score, T represents the software usage time score, C represents the software usage combined time score, and W f , W t and W c They are the weight coefficients of these three dimensions, which are used to adjust the influence of each dimension in the final score. SS represents the suspicion score.

[0017] Preferably, the specific steps of grouping the software based on the software usage time are:

[0018] S201, classifying the software, and dividing the software into a high-relevance group, a medium-relevance group, and a low-relevance group based on the classified software;

[0019] S202, calculating a combined score of each group of software according to the usage time, frequency and correlation degree of the software, where the usage time, frequency and correlation degree of the software are obtained from the software usage data of the user;

[0020] S203, analyzing the application purpose of each set of software, and calculating the behavior pattern score according to the analysis score.

[0021] Preferably, the steps of constructing a behavior combination chain according to the user's software usage data are as follows:

[0022] S301, constructing a behavior combination chain in chronological order according to the user's software usage data;

[0023] S302, according to the constructed behavior combination chain, collecting the switching mode of the behavior combination chain, the switching mode includes the time interval, the usage duration and the switching frequency, and the behavior combination chain also includes a special mode of high-frequency switching behavior;

[0024] S303, calculating the behavior pattern value based on the time interval, usage duration and switching frequency.

[0025] Preferably, the step of combining and integrating the high frequency switching behavior is:

[0026] S401, collecting high-frequency switching behaviors through real-time collected user data;

[0027] S402, performing integral calculation on the collected high-frequency switching behaviors, and modifying the behavior pattern value according to the calculated integral;

[0028] S403, based on the corrected behavior pattern value obtained in step S402, adjust the weighting coefficient, integral and threshold.

[0029] Preferably, high-frequency switching behavior is used as a special mode in the behavior combination chain, and sliding time window technology is used to identify high-frequency switching behavior. High-frequency switching behavior means that within a continuous time window, the number of software switches on the user's mobile phone exceeds the set threshold, and among these switches, the number of switches involving high-risk software accounts for more than half.

[0030] Preferably, the formula for the behavior pattern value is: behavior pattern value = time interval weight × time interval score + usage time weight × usage time score + switching frequency weight × switching frequency score, wherein the time interval score, usage time score and switching frequency score are obtained by comparing with the benchmark time interval, benchmark usage time and benchmark switching frequency, and the time interval weight, usage time weight and switching frequency weight are all obtained based on expert advice and historical data.

[0031] One or more technical solutions provided in this application have at least the following technical effects or advantages: by comprehensively considering the list of software installed by the user, the frequency of use, the duration of use, and the combined duration of software use, the possibility of whether the user is a fraud suspect can be more accurately assessed, reducing misjudgments and missed judgments; by introducing usage behavior data, it is possible to distinguish between real high-risk users and misjudged users. As the user's usage behavior changes, the suspicion score will also be dynamically adjusted to reflect the user's risk status more promptly. By comprehensively considering data from multiple dimensions, it is possible to more effectively identify real fraud suspects and improve the accuracy and efficiency of combating fraud;

[0032] The software grouping and scoring mechanism can more accurately reflect the user's behavior patterns and potential risks when using different software. By introducing software combination points and group application purpose scoring, the problem of using low-suspicion apps for a long period of time and high frequency to reduce the overall score is solved. The comprehensive calculation formula and threshold setting provide a quantitative basis for evaluating the user's fraud suspicion, improving the accuracy and objectivity of the evaluation.

[0033] By introducing new concepts such as behavioral combination chains and switching modes, we can more accurately assess users' fraud suspicion values, improve the accuracy and efficiency of anti-fraud work, and promptly detect and warn of potential fraudulent behaviors. By refining the analysis dimensions of user behavior patterns (such as time intervals, usage duration, switching frequency, etc.), the evaluation results are more comprehensive and accurate, which helps us more accurately identify potential high-risk users. By setting reasonable thresholds and calculation formulas, we can achieve real-time monitoring and dynamic evaluation of user behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flow chart of a method for identifying suspected fraud based on APP list analysis according to the present invention;

[0035] Figure 2 A schematic diagram of a process of grouping software based on software usage time according to an embodiment of the present invention;

[0036] Figure 3 A schematic diagram of a flow chart of building a behavior combination chain according to a user's software usage data according to an embodiment of the present invention;

[0037] Figure 4 It is a schematic diagram of a flow chart of combining and integrating high-frequency switching behaviors according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] To facilitate the understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0039] It should be noted that the terms “vertical”, “horizontal”, “up”, “down”, “left”, “right” and similar expressions used in this document are only for illustrative purposes and do not represent the only implementation method.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more related listed items.

[0041] Embodiment 1: Figure 1 The flowchart of a method for identifying suspected fraud based on APP list analysis according to an embodiment of the present invention includes the following steps:

[0042] S101, collecting, cleaning and processing data, the collected data includes user identification data, software usage frequency data, software usage duration data, software usage combined duration data, software property data and timestamp data;

[0043] Furthermore, user identification data includes user ID and device information. User ID is used to uniquely identify each user. Device information is device type and operating system version, which is used to collect the user's device environment. Software usage frequency data includes software ID and usage times. Software ID is used to identify each software. The usage times indicate the number of times a user uses a certain software within a specific time period. Software usage time data includes each usage time and cumulative usage time. Each usage time is the duration for each time a user opens and uses a certain software. The cumulative usage time is the total usage time of a certain software by the user within a period of time. Software usage combined time data includes a combined software ID list and combined usage time. The combined software ID list is used to record the situation where a user uses multiple software or a specific software combination at the same time. The combined usage time is the total time the user uses these software at the same time. Software nature data includes software classification and software weight. Software classification is to classify software into positive and negative categories based on its security, legality and benefits. For timestamp data, the time point of each data collection is recorded.

[0044] Set the frequency and scope of data collection. Set the frequency of data collection to every hour. Set the scope of data collection based on user groups and business needs. For example, for an online education platform, it is necessary to monitor users' learning behaviors on the platform, including watching videos, completing homework, and participating in discussions.

[0045] S102, calculating a software usage frequency score based on the collected software usage frequency data;

[0046] Specifically, the initial suspicion score is set to 0, and the frequency score of each software is calculated based on the software usage frequency data collected in step S101 and the software weight score. The weight of the software is scored based on the nature of the software, the frequency of use and the expert's advice. The weight score of negative software is higher than the weight score of positive software, and the weight score of high-frequency use is higher than the weight score of low-frequency use. A preliminary weight score range is given based on the nature and frequency of use of the software. Then, the weight score of the software is determined according to the expert's advice, and the frequency score is obtained by combining the above software weight score and usage frequency. The frequency score = software weight score × software usage frequency. The frequency scores of all software are added up to obtain the user's total software usage frequency score.

[0047] S103, calculating a software usage time score and a software usage combination time score according to the software usage time data and the software usage combination time data;

[0048] Furthermore, the usage time score of each software is calculated according to the nature of the software and the time weight coefficient. The time weight coefficient is determined according to the nature of the software and expert advice. The time weight coefficient of negative software is greater than the time weight coefficient of positive software. The time score = software nature coefficient × time weight coefficient × software usage time, where the software nature coefficient is a quantitative indicator determined according to the nature of the software and expert advice; the basic combined time score is determined according to the software usage time and the combined weight coefficient. The basic combined time score formula is: Where n is the number of software in the combination, T i represents the time that the user uses software i in a specific period of time, represents the weight of software i in the combination, and S 基 S represents the basic combination duration score. By setting the threshold, negative combination flag and adjusting the score, the final combination duration score formula is: 终 =S 基 +F×max(0,T totai -T)×ΔS, where is the total usage time of the combination; T is the combination usage time threshold; F is a Boolean value, which is the sign of a negative combination. If the combination is judged to be negative, F = 1, otherwise, F = 0; ΔS is the score adjustment for the combination that exceeds the threshold and is negative, and ΔS is the adjustment amount; max(0, T totai -T) ensures that the score adjustment is made only when the total usage time exceeds the threshold; F×max(0, T totai -T)×ΔS means that when the combination is negative and the usage time exceeds the threshold, a negative score adjustment is made according to the degree of excess.

[0049] In some embodiments, there are three softwares: A (positive software, such as office software), B (neutral software, such as a video player), and C (negative software, such as a known fraud tool). The user used these three softwares in a certain period of time, and the usage time was T A =60 minutes, T B =90 minutes and T C = 120 minutes. Based on the nature of the software and expert advice, the nature coefficient of A is set to 0.5 (positive software, lower risk), the nature coefficient of B is set to 1 (neutral software, medium risk), and the nature coefficient of C is set to 2 (negative software, higher risk). Based on the nature of the software and expert advice, the duration weight coefficient of A is set to 0.8 (positive software, small impact of duration), the duration weight coefficient of B is set to 1 (neutral software, moderate impact of duration), and the duration weight coefficient of C is set to 1.5 (negative software, large impact of duration). The duration score of software A is S A =0.5×0.8×60=24, the duration score of software B is S B=1×1×90=90, the duration score of software C is S C =2×1.5×120=360;

[0050] The basic combination duration score is the sum of the duration scores of each software: S 基 =S A +S B+ S C =24+90+360=474, total duration of combination: T totai =T A +T B +T C =60+90+120=270 minutes, combined usage time threshold T=180 minutes, since the combination includes negative software C, the negative combination flag F=1, and the set adjustment amount ΔS=-10 minutes / minute, S 终 =S 基 +F×max(0,T totai -T)×ΔS=474+1×max(0,270-180)×(-10)=474+1×90×(-10)=474-900=-426, and finally the software usage combined time score is -426.

[0051] S104, calculating a suspicion score based on the software usage frequency score, the software usage duration score, and the software usage combined duration score.

[0052] Specifically, the suspicion score is calculated by the formula: SS = W f ×F+W t ×T+W c ×C, where F represents the software usage frequency score, T represents the software usage time score, C represents the software usage combined time score, and W f , W t and W c They are the weight coefficients of these three dimensions, which are used to adjust the influence of each dimension in the final score. SS represents the suspicion score. Set the suspicion score threshold. If the suspicion score exceeds the preset suspicion score threshold, it will be marked as a fraudulent suspected software. Otherwise, it is not a suspected software.

[0053] S105, performing feature recognition on the fraudulent software calculated in step 104 based on a machine learning algorithm, and detecting the software marked as suspected fraudulent software;

[0054] Furthermore, the xgboost algorithm was selected as the base classifier, and the algorithm parameters were optimized through grid search, random search and other strategies to improve the model performance. Cross-validation was used to evaluate the model performance to ensure that the model was stable and reliable. The features extracted by different algorithms were fused, and the complementarity between algorithms was used to improve the recognition effect. The weighted average learning method was adopted to combine the prediction results of multiple models to improve the accuracy of the final recognition. Text data such as codes, descriptions, and comments of fraudulent APPs were collected, and irrelevant characters and stop words were removed. Word segmentation and stem extraction were performed, and the text data was converted into vector form. Word2Vec was used to train word vectors to capture the semantic relationship between words. A large amount of fraudulent APP code data was used to train the word vector model to ensure the accuracy and generalization ability of the word vector. The preprocessed text data was converted into word vector representation. The deep neural network (DNN) algorithm was used to classify the text and identify the family characteristics of fraudulent APPs. The text classification results and the features extracted by the machine learning algorithm were combined to perform feature fusion to improve the accuracy of model classification detection.

[0055] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: by comprehensively considering the list of software installed by the user, the frequency of use, the duration of use, and the combined duration of software use, the possibility of whether the user is a suspected fraudster can be more accurately assessed, thereby reducing misjudgments and missed judgments; by introducing usage behavior data, it is possible to distinguish between truly high-risk users and misjudged users. As the user's usage behavior changes, the suspicion score will also be dynamically adjusted to reflect the user's risk status more promptly. By comprehensively considering data from multiple dimensions, it is possible to more effectively identify truly suspected fraudsters and improve the accuracy and efficiency of combating fraud.

[0056] Embodiment 2: Based on the solution in Embodiment 1, this embodiment continuously combines the usage time of various software to form software high-association groups, medium-association groups, and low-association groups, which can more effectively identify potential fraudulent behaviors, improve the accuracy and efficiency of anti-fraud work, and protect user property safety. Figure 2 shown.

[0057] S201, classifying the software, and dividing the software into a high-relevance group, a medium-relevance group, and a low-relevance group based on the classified software;

[0058] Furthermore, according to the main functions of the software and the usage habits of the users, the software is divided into chat software, financial software, shopping software, entertainment software and other categories. On the basis of the software classification, according to the frequency and duration of software use and the degree of correlation with other software, the software is divided into high correlation group, medium correlation group and low correlation group. The software in the high correlation group has a high correlation with fraudulent behavior, such as niche chat software (especially those frequently used by fraudsters), loan software (which can easily become a tool for fraudsters to make false loans or defraud personal information), and certain specific transfer software. The grouping criteria of the high correlation group are high frequency of use of the software, long usage time, and high correlation with other high-risk software. At the same time, those software that frequently appear in fraud cases are also included in this group; the software in the medium correlation group The correlation between software and fraudulent behavior is moderate, such as shopping software and food delivery software. These software themselves provide regular services, but may also be used by fraudsters to carry out fraudulent activities. The grouping criteria for the medium correlation group are that the frequency and duration of software use are relatively high, but the correlation with high-risk software is low, or, although the software itself does not directly involve financial transactions, users may leak personal information or encounter fraud risks during use; the software in the low correlation group has a low correlation with fraudulent behavior, such as entertainment software such as Douyin and Kuaishou, as well as most daily-used tool software. The grouping criteria for the low correlation group are that the frequency and duration of software use may be high, but the correlation with other high-risk software is extremely low. These software usually do not involve users' financial information or sensitive data, so the risk of being used by fraudsters is relatively low.

[0059] S202, calculating a combined score of each group of software according to the usage time, frequency and correlation degree of the software;

[0060] Specifically, the combined score of each software group is calculated based on the usage time, frequency and correlation degree of the software. Among them, T i is the total usage time of software i, F i is the usage frequency of software i, R i is the correlation degree of software i. The correlation degree is a value between 0 and 1, which indicates the correlation degree between the software and fraudulent behavior. It is determined based on expert experience and historical data. α, β and γ are weight coefficients used to adjust the relative importance of usage time, frequency and correlation degree in the combined score. These weight coefficients should be set based on actual conditions and expert experience.

[0061] S203, evaluating the application purpose of each set of software, and calculating the behavior pattern score according to the evaluation score;

[0062] Furthermore, the application purpose of each set of software is obtained, including normal use, functional characteristics, user groups, and potential abuse methods or risk points. Scoring standards are set according to the software's correlation with fraud cases and expert advice. A five-level scoring system is set (1-5 points, 1 point indicates extremely low risk, and 5 points indicates extremely high risk). Each set of software is scored one by one according to the established scoring standards.

[0063] The behavior pattern score is calculated based on the combined score of each group of software, the group application purpose score, and the score of the software in the group calculated in step S104. Among them, SS is the behavior pattern score, W i is the weight of the i-th group of software, C i is the combined score of the i-th group of software, P i Score the group application purpose of the i-th group of software, preset a threshold, and set the threshold based on historical data and expert experience. Compare the obtained behavior pattern score with the threshold. The higher the score, the greater the suspicion of fraud of the user; the lower the score, the less suspicious the user.

[0064] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: through the software grouping and scoring mechanism, it can more accurately reflect the user's behavior patterns and potential risks when using different software; by introducing software combination points and group application purpose scoring, it solves the problem of using low-suspicion apps for a long period of time and high frequency to lower the overall score; the comprehensive calculation formula and threshold setting provide a quantitative basis for evaluating the user's fraud suspicion, thereby improving the accuracy and objectivity of the evaluation.

[0065] Example 3: Based on the software grouping in Example 2, this example introduces a behavior combination chain and a switching mode, which can more accurately assess the user's fraud suspicion value and improve the accuracy and efficiency of anti-fraud work. Figure 3 shown.

[0066] S301, constructing a behavior combination chain in chronological order according to the user's software usage data;

[0067] Specifically, the usage data of all software are extracted from the software usage records of the user, including the software name, opening time, closing time, etc. The extracted usage data are sorted in chronological order, and a behavior combination chain is constructed based on the sorted data to determine the starting point and end point of the behavior combination chain. The starting point of the behavior combination chain is the first software opened by the user. In the sorted data, this is the earliest record in time, indicating that the user has started to use a certain software on the mobile phone. The end point of the behavior combination chain is the last software closed by the user. In the sorted data, this is the latest closing record in time, indicating that the user has ended the use of a certain software. Starting from the starting point, the user's software usage records are added to the behavior combination chain one by one in chronological order. The software usage records include software name, opening time, closing time and stay time. If the user opens another software immediately after closing one software, the usage records of the two software are closely connected in the behavior combination chain. If the user closes all software at a certain point in time, or does not perform any software operations for a long time, this time point can be used as the segmentation point of the behavior combination chain to divide the user's overall behavior into multiple independent behavior combination chains.

[0068] S302, collecting the switching mode of the behavior combination chain according to the constructed behavior combination chain;

[0069] Furthermore, the switching mode includes time interval, usage time and switching frequency. The time interval is the time span between the user exiting one software and starting another software. The time interval reflects the user's software switching speed. An extremely short time interval indicates that the user is dissatisfied with a certain software or has encountered a problem, and quickly turns to other software for alternatives; on the contrary, a longer time interval indicates a choice made by the user after careful consideration, or a natural pause when performing a task; usage time is an indicator to measure the user's involvement in the software, and usage time records the entire time period from the user opening the software to the user closing the software; switching frequency is the number of times the user switches software within a specific time. A high switching frequency indicates that the user is in a highly active state; while a low switching frequency indicates that the user's behavior is relatively stable and tends to focus on a few software. The collected switching mode data is preprocessed to make the data more accurate.

[0070] Set a time interval threshold. If the time interval exceeds the preset threshold, it is a different behavior pattern. Otherwise, it is considered a continuous behavior. Set a usage time threshold. If the user's stay on a certain software exceeds the threshold of the software type, his fraud suspicion score will increase. Set a switching frequency threshold. If the user's switching frequency exceeds the threshold, it will be considered an abnormal behavior and his fraud suspicion score will increase.

[0071] S303, calculating a behavior pattern value based on the time interval, usage duration, and switching frequency;

[0072] Specifically, based on the collected time interval, usage duration and switching frequency, the collected time interval, usage duration and switching frequency are compared with the benchmark time interval, benchmark usage duration and benchmark switching frequency respectively, and scored according to the degree of deviation to obtain the time interval score, usage duration score and switching frequency score, and the behavior pattern value = time interval weight × time interval score + usage duration weight × usage duration score + switching frequency weight × switching frequency score, among which the time interval weight, usage duration weight and switching frequency weight are all derived based on expert advice and historical data.

[0073] Based on historical data and actual conditions, a threshold range for the behavior pattern value is set. According to the calculated behavior pattern scores, users are divided into three categories of fraud suspicion: high, medium, and low. Scores over 80 are considered high fraud suspicions, scores between 60-80 are considered medium fraud suspicions, and scores below 60 are considered low fraud suspicions.

[0074] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: by introducing new concepts such as behavior combination chains and switching modes, it is possible to more accurately evaluate the user's fraud suspicion value, improve the accuracy and efficiency of anti-fraud work, and timely discover and warn of potential fraudulent behaviors. By refining the analysis dimensions of user behavior patterns (such as time intervals, usage duration, switching frequency, etc.), the evaluation results are more comprehensive and accurate, which helps us to more accurately identify potential high-risk users, and by setting reasonable thresholds and calculation formulas, we can achieve real-time monitoring and dynamic evaluation of user behavior.

[0075] Embodiment 4: Based on the behavior combination chain constructed in Embodiment 3, high-frequency software usage will cause the behavior chain to be unrecognizable. In this embodiment, high-frequency switching behaviors are combined and integrated to identify such high-frequency switching behaviors. Using it as a dimension of the scoring criteria can more accurately assess the user's fraud suspicion value and improve the accuracy and efficiency of anti-fraud work.

[0076] like Figure 4 As shown in the figure, the specific steps of combining and integrating high-frequency switching are:

[0077] S401, collecting high-frequency switching behaviors through real-time collected user data;

[0078] Specifically, high-frequency switching behavior is a special pattern in the behavior combination chain, and sliding time window technology is used to identify high-frequency switching behavior. High-frequency switching behavior means that within any continuous 10-minute time window, the user switches software on the mobile phone more than 5 times, and among these switches, the number of switches involving high-risk software (such as niche chat software, loan software, collection software, etc.) accounts for more than 50%.

[0079] S402. Integrate the collected high-frequency switching behaviors, and correct the behavior pattern value according to the calculated integral.

[0080] Furthermore, within any continuous 10-minute time window, count the number of software switches of the user to obtain the switching frequency F. Within the same time window, calculate the proportion of the number of switches involving high-risk software in the total number of switches to obtain the high-risk software ratio R. Calculate the integral of the high-frequency switching behavior according to the obtained switching frequency F and high-risk software ratio R. The formula for the integral is: Integral = F × R × weight coefficient, where the weight coefficient is adjusted according to the actual software scenario and effect. Calculate the integral for each identified high-frequency switching behavior and accumulate the integral into the user's total integral to form the high-frequency switching behavior integral H. Combine the calculated high-frequency switching behavior integral H with the behavior pattern value to form a comprehensive calculation formula: S = B + α × H, where B represents the score corresponding to the user's behavioral characteristics in other aspects, which is a comprehensive score calculated based on multi-dimensional data such as the user's historical behavior, trading habits, and social relationships, reflecting the user's overall behavior pattern; α is the weighting coefficient of the high-frequency switching behavior integral. The weighting coefficient is not fixed but is dynamically optimized according to historical data and actual effects. The role of the weighting coefficient is to reasonably adjust the importance of the high-frequency switching behavior in the comprehensive evaluation; S represents the corrected behavior pattern value obtained by correcting the behavior pattern value with the high-frequency switching behavior integral H.

[0081] According to historical data and actual situations, divide the S value into different intervals, and each interval corresponds to a fraud suspicion level. When S > 90, it means that the user's behavior pattern is highly similar to known fraud behaviors and has a very high fraud suspicion; when 70 < S ≤ 90, it means that the user's behavior pattern has certain abnormalities and has a medium fraud suspicion; when S ≤ 70, it means that the user's behavior pattern is relatively normal, with a low fraud suspicion or no obvious fraud suspicion. Set a specific value (20) of the high-frequency switching behavior integral as the judgment criterion for abnormal high-frequency switching behaviors. When the user's H value exceeds this specific value, even if the comprehensive score S has not reached the threshold of high fraud suspicion, the system will immediately trigger an alarm.

[0082] S403. Based on the corrected behavior pattern value obtained in step S402, continuously adjust the weighting coefficient, integral, and threshold.

[0083] Furthermore, through in-depth analysis of historical alarm data, the weighting coefficient α is adjusted so that in the comprehensive calculation formula S=B+α×H, the contribution of the high-frequency switching behavior score H is more in line with the actual situation; user feedback is an important basis for evaluating the effectiveness of the anti-fraud system. By collecting and analyzing user complaints, suggestions and usage experience, the integration formula is fine-tuned according to user feedback, such as adjusting the scoring criteria for different behavioral characteristics to ensure the fairness and accuracy of the system; regularly adjust the thresholds of the comprehensive score S and the high-frequency switching behavior score H according to the alarm triggering situation and user feedback, as well as changes in the market environment and legal policies, to ensure that the system can identify potential fraud risks in a timely and accurate manner.

[0084] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: by introducing high-frequency switching behaviors and combining them with quantitative relationships for calculations, the analysis of user behavior patterns is further refined, and the user's fraud suspicion value can be more accurately evaluated, thereby improving the accuracy and efficiency of anti-fraud work. By setting reasonable thresholds and calculation formulas, real-time monitoring and dynamic evaluation of user behaviors can be achieved, and potential fraud behaviors can be discovered and warned in a timely manner. The high-frequency switching characteristics of user behaviors help to identify those seemingly normal behavior patterns that actually use high-risk behaviors to cover up through high-frequency switching, thereby further improving the effectiveness of anti-fraud work.

[0085] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A fraud suspicion identification method based on APP list analysis, characterized in that: include: S101, collecting, cleaning and processing data, the collected data includes user identification data, software usage frequency data, software usage duration data, software usage combined duration data, software property data and timestamp data; S102, calculating a software usage frequency score based on the collected software usage frequency data; S103, calculating a software usage time score and a software usage combination time score according to the software usage time data and the software usage combination time data; S104, calculating a suspicion score based on the software usage frequency score, the software usage duration score, and the software usage combined duration score; S105, based on the machine learning algorithm, feature recognition is performed on the fraud-related software calculated in step 104, and the software marked as suspected fraud is detected.

2. A fraud suspicion identification method based on APP list analysis as claimed in claim 1, characterized in that: User identification data includes user ID and device information. The device information is the device type and operating system version. Software usage frequency data includes software ID and usage times. The usage times indicate the number of times the user uses the software within a set time period. Software usage duration data includes the duration of each usage and the cumulative usage duration. Software usage combination duration data includes the combination software ID list and the combination usage duration. The combination software ID list is used to record the situation where users use multiple software combinations at the same time. The combination usage duration is the total duration of users using the software at the same time. Software nature data includes software classification and software weight. Software classification divides software into positive and negative categories.

3. The method for identifying suspected fraud based on APP list analysis as claimed in claim 1, characterized in that: Based on the collected software usage frequency data, the frequency score is calculated as follows: Frequency score = software weight score × software usage frequency, where the software weight score is a score for the weight of the software based on the nature of the software, frequency of use and expert advice.

4. The method for identifying suspected fraud based on APP list analysis as claimed in claim 1, characterized in that: The formula for calculating the software usage time score is: time score = software nature coefficient × time weight coefficient × software usage time, where the software nature coefficient is a quantitative indicator determined based on the software nature and expert advice; the time weight coefficient is determined based on the software nature and expert advice; The basic combined duration score is determined based on the software usage time and the combined weight coefficient. The basic combined duration score formula is: Where n is the number of software in the combination, T i represents the time a user uses software i in a specific time period, W i represents the weight of software i in the combination, S 基 represents the basic combined duration score, and the final combined duration score formula is: S 终 =S 基 +F×max(0,T totai -T)×ΔS, where is the total usage time of the combination; T is the combination usage time threshold; F is a Boolean value, which is the sign of a negative combination. If the combination is judged to be negative, F = 1, otherwise, F = 0; ΔS is the adjustment amount; max(0, T totai -T) is the condition for score adjustment.

5. The method for identifying suspected fraud based on APP list analysis as claimed in claim 1, characterized in that: Formula for calculating suspicion score: SS = W f ×F+W t ×T+W c ×C, where F represents the software usage frequency score, T represents the software usage time score, C represents the software usage combined time score, and W f , W t and W c They are the weight coefficients of these three dimensions, which are used to adjust the influence of each dimension in the final score. SS represents the suspicion score.

6. A fraud suspicion identification method based on APP list analysis as claimed in claim 5, characterized in that: The specific steps to group software based on software usage time are as follows: S201, classifying the software, and dividing the software into a high-relevance group, a medium-relevance group, and a low-relevance group based on the classified software; S202, calculating a combined score of each group of software according to the usage time, frequency and correlation degree of the software, where the usage time, frequency and correlation degree of the software are obtained from the software usage data of the user; S203, analyzing the application purpose of each set of software, and calculating the behavior pattern score according to the analysis score.

7. A fraud suspicion identification method based on APP list analysis as claimed in claim 6, characterized in that: Steps to build a behavior combination chain based on the user's software usage data: S301, constructing a behavior combination chain in chronological order according to the user's software usage data; S302, according to the constructed behavior combination chain, collecting the switching mode of the behavior combination chain, the switching mode includes the time interval, the usage duration and the switching frequency, and the behavior combination chain also includes a special mode of high-frequency switching behavior; S303, calculating the behavior pattern value based on the time interval, usage duration and switching frequency.

8. A fraud suspicion identification method based on APP list analysis as claimed in claim 7, characterized in that: Steps to perform combinatorial integration of high frequency switching behavior: S401, collecting high-frequency switching behaviors through real-time collected user data; S402, performing integral calculation on the collected high-frequency switching behaviors, and modifying the behavior pattern value according to the calculated integral; S403, based on the corrected behavior pattern value obtained in step S402, adjust the weighting coefficient, integral and threshold.

9. A fraud suspicion identification method based on APP list analysis as claimed in claim 8, characterized in that: High-frequency switching behavior is a special pattern in the behavior combination chain. Sliding time window technology is used to identify high-frequency switching behavior. High-frequency switching behavior means that within a continuous time window, the number of software switches on the user's mobile phone exceeds the set threshold, and among these switches, the number of switches involving high-risk software accounts for more than half.

10. A fraud suspicion identification method based on APP list analysis as claimed in claim 8, characterized in that: The formula for the behavior pattern value is: Behavior pattern value = time interval weight × time interval score + usage time weight × usage time score + switching frequency weight × switching frequency score, among which the time interval score, usage time score and switching frequency score are obtained by comparing with the benchmark time interval, benchmark usage time and benchmark switching frequency, and the time interval weight, usage time weight and switching frequency weight are all obtained based on expert advice and historical data.

Images