Method and device for identifying fraudulent behaviors and electronic equipment

Abstract

The invention belongs to the field of information security, and discloses a method and a device for identifying fraudulent behaviors, and electronic equipment, and the method comprises the steps: carrying out the multi-modal data fusion processing of historical communication data of an Internet of Vehicles card; training the initial model by using the obtained training data to obtain a fraud-related behavior recognition model; and inputting the real-time communication data of the car networking card into the fraud-related behavior identification model to obtain an identification result output by the fraud-related behavior identification model. According to the method, historical communication data of the car networking card is deeply integrated through a multi-modal data fusion processing technology, and complementarity of the data is enhanced, so that more accurate and comprehensive data support is provided for constructing a fraud-related behavior identification model, and the accuracy of fraud-related behavior identification of the car networking card is greatly improved. And meanwhile, the communication data of the car networking card is acquired in real time and analyzed, so that the efficiency of identifying fraud-related behaviors is improved, and powerful technical support is provided for the safety protection of the car networking card.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method, device, electronic device and computer-readable storage medium for identifying fraudulent behavior. Background Art

[0002] With the rapid development of Internet of Vehicles technology, the level of vehicle intelligence and networking continues to improve. As a key component for realizing vehicle networking, the security and stability of Internet of Vehicles cards are crucial to protecting user safety and privacy. However, while providing convenience, Internet of Vehicles cards also face the threat of fraud.

[0003] At present, the identification of fraudulent behavior of Internet of Vehicles cards mainly relies on a single or limited data source, such as call data and signaling data, which cannot fully cover all communication behaviors of Internet of Vehicles cards, resulting in blind spots in the identification of fraudulent behavior. Moreover, the limited data sources are insufficient in terms of information richness and diversity, making it difficult to capture complex fraudulent behavior patterns, which greatly affects the accuracy of fraudulent behavior identification.

[0004] Therefore, how to improve the accuracy of fraudulent behavior identification of Internet of Vehicles cards is a technical problem that technicians in this field need to solve. Summary of the invention

[0005] In order to solve the problem of low accuracy in identifying fraudulent behavior of Internet of Vehicles cards in the prior art, the present invention provides a method, device, electronic device and computer-readable storage medium for identifying fraudulent behavior.

[0006] A method for identifying fraudulent behavior, comprising:

[0007] Acquire historical communication data of the Internet of Vehicles card; the type of the historical communication data of the Internet of Vehicles card includes at least one of call bill data, signaling data, Internet access log, real-name authentication information, and black, white, and gray list data;

[0008] Performing multimodal data fusion processing on the historical communication data to obtain training data;

[0009] Using the training data to train the initial model, to obtain a fraud-related behavior recognition model;

[0010] The real-time communication data of the Internet of Vehicles card is obtained, and the real-time communication data is input into the fraud-related behavior recognition model to obtain the recognition result output by the fraud-related behavior recognition model.

[0011] Optionally, performing multimodal data fusion processing on the historical communication data to obtain training data includes:

[0012] Preprocessing the historical communication data to obtain preprocessed data; the preprocessing includes at least one of data cleaning, formatting, and normalization;

[0013] Determine first weight values ​​of different types of data in the preprocessed data according to preset risk types; the risk types include at least one of abnormal access, high-frequency calls, abnormal data transmission, multiple cards in one vehicle, vehicle-card separation, and abnormal SMS sending and receiving;

[0014] Performing orthogonal sequential fusion processing on different types of data in the preprocessed data according to the first weight value to obtain training data corresponding to the risk type;

[0015] Orthogonality enhancement processing is performed on the training data corresponding to the risk type.

[0016] Optionally, the using the training data to train the initial model to obtain a fraudulent behavior recognition model includes:

[0017] Performing feature extraction processing on the training data to obtain data features corresponding to different types of data in the training data;

[0018] Performing feature fusion processing on the data features corresponding to the different types of data to obtain feature fusion data;

[0019] Determining second weight values ​​of different types of data in the training data according to the occurrence frequencies of different types of data in the training data;

[0020] Determine a decision output result according to the feature fusion data corresponding to the different types of data and the second weight value;

[0021] The initial model is trained using the BalanceMLA framework in combination with the training data and the decision output results to obtain the fraud-related behavior identification model.

[0022] Optionally, the initial model is an adaptive machine learning model;

[0023] The using the BalanceMLA framework in combination with the training data and the decision output result to train the initial model includes:

[0024] In the model initialization stage, different initial weights and biases are set for neurons in the adaptive machine learning model according to the preset risk types;

[0025] During the model training phase, the model structure of the adaptive machine learning model is dynamically adjusted according to changes in the distribution of the training data.

[0026] Optionally, after dynamically adjusting the model structure of the adaptive machine learning model according to the distribution change of the training data, the method further includes:

[0027] Determine a corresponding parameter adjustment strategy according to the risk type and the distribution characteristics of the training data;

[0028] The parameters in the adaptive machine learning model are adjusted according to the parameter adjustment strategy.

[0029] Optionally, after obtaining the recognition result output by the fraudulent behavior recognition model, the method further includes:

[0030] When the identification result indicates that there is fraudulent behavior, the identification result is uploaded to the security center.

[0031] Optionally, the method further includes:

[0032] Determine the fraud level corresponding to the identification result according to a preset classification and grading strategy;

[0033] Execute the processing strategy corresponding to the fraud level.

[0034] A device for identifying fraudulent behavior, comprising:

[0035] An acquisition module, used to acquire historical communication data of the Internet of Vehicles card; the types of the historical communication data of the Internet of Vehicles card include at least one of call list data, signaling data, Internet access log, real-name authentication information, and black, white, and gray list data;

[0036] A data fusion module, used for performing multimodal data fusion processing on the historical communication data to obtain training data;

[0037] A model training module, used to train the initial model using the training data to obtain a fraud-related behavior recognition model;

[0038] The fraudulent behavior identification module is used to obtain the real-time communication data of the Internet of Vehicles card, and input the real-time communication data into the fraudulent behavior identification model to obtain the identification result output by the fraudulent behavior identification model.

[0039] An electronic device, comprising:

[0040] A processor and a memory, wherein the memory is used to store at least one instruction, and when the instruction is loaded and executed by the processor, it implements the method for identifying fraudulent behavior as described in any one of the above.

[0041] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method for identifying fraudulent behavior as described in any one of the above.

[0042] The method for identifying fraudulent behavior provided in an embodiment of the present invention performs multimodal data fusion processing on the historical communication data of the Internet of Vehicles card, then uses the obtained training data to train the initial model to obtain a fraudulent behavior identification model, and finally inputs the real-time communication data of the Internet of Vehicles card into the fraudulent behavior identification model to obtain the identification result output by the fraudulent behavior identification model. The present invention deeply integrates the historical communication data of the Internet of Vehicles card through multimodal data fusion processing technology, improves the utilization efficiency of data, and enhances the complementarity of data, thereby providing more accurate and comprehensive data support for the construction of a fraudulent behavior identification model, and greatly improves the accuracy of fraudulent behavior identification of the Internet of Vehicles card. At the same time, by acquiring and analyzing the communication data of the Internet of Vehicles card in real time, the efficiency of fraudulent behavior identification is improved, providing strong technical support for the security protection of the Internet of Vehicles card. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0044] Figure 1 A flowchart of a method for identifying fraudulent behavior provided by an embodiment of the present invention;

[0045] Figure 2 for Figure 1 A flowchart of a practical expression of S02 in a method for identifying fraudulent behavior provided;

[0046] Figure 3 for Figure 1 A flowchart of a practical expression of S03 in a method for identifying fraudulent behavior provided;

[0047] Figure 4 A schematic diagram of the structure of a fraudulent behavior identification device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to better understand the technical solution of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0049] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0051] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0052] With the rapid development of Internet of Vehicles technology, the level of vehicle intelligence and networking continues to improve. As a key component for realizing vehicle networking, the security and stability of Internet of Vehicles cards are crucial to protecting user safety and privacy. However, while providing convenience, Internet of Vehicles cards also face the threat of fraud.

[0053] At present, the identification of fraudulent behavior of Internet of Vehicles cards mainly relies on a single or limited data source, such as call data, signaling data, etc., which cannot fully cover all communication behaviors of Internet of Vehicles cards, resulting in blind spots in the identification of fraudulent behavior. Moreover, the limited data sources are insufficient in the richness and diversity of information, making it difficult to capture complex fraudulent behavior patterns, which greatly affects the accuracy of fraudulent behavior identification. Therefore, the present invention provides a method for identifying fraudulent behavior to solve the above problems.

[0054] Please refer to Figure 1 , which is a flow chart of a method for identifying fraudulent behavior provided by an embodiment of the present invention, comprising the following steps:

[0055] Step S01, obtaining historical communication data of the Internet of Vehicles card.

[0056] In this embodiment, obtaining the historical communication data of the Internet of Vehicles card refers to the process of collecting and storing all communication records and related information of the Internet of Vehicles card in the past time period. The collected data is used for multimodal data fusion processing to provide support for the security management of the Internet of Vehicles card and the identification of fraudulent behaviors under the premise of protecting user privacy and complying with relevant laws and regulations. These historical communication data are of great value in understanding the usage patterns of the Internet of Vehicles card and preventing and combating telecommunications network fraud activities.

[0057] The fraudulent behavior recognition model constructed can learn the characteristics of normal and abnormal communication behaviors, so as to quickly and accurately identify fraudulent behaviors in real-time monitoring. In this way, early warning can be given and measures can be taken to prevent or mitigate the impact of possible fraudulent behaviors on users.

[0058] In this embodiment, the type of historical communication data of the Internet of Vehicles card may include at least one of call bill data, signaling data, Internet access log, real-name authentication information, and black, white, and gray list data, wherein:

[0059] The call record data records the detailed information of the call such as the call time, duration and the other party number;

[0060] Signaling data involves control information during network communication;

[0061] The Internet access log contains the record of the vehicle accessing the Internet through the vehicle networking card;

[0062] Real-name authentication information is used to confirm the user's identity;

[0063] The black, white and gray list data records known legitimate or illegal users and behavior patterns.

[0064] Step S02: Perform multimodal data fusion processing on historical communication data to obtain training data.

[0065] In this embodiment, various types of historical communication data generated by the Internet of Vehicles card are integrated together through specific algorithms and technical means, with the aim of constructing a comprehensive data set that can include and utilize complementary information from different data sources, thereby improving the ability to understand and analyze the communication behavior of the Internet of Vehicles card.

[0066] In multimodal data fusion processing, various data types are converted into formats that can be compared and integrated with each other to facilitate the extraction of key features and the identification of potential patterns. These features and patterns are then used to construct training data sets, which are the basis for training fraud-related behavior recognition models. In this way, the training data set can provide the model with rich information, enabling it to learn the characteristics of various normal and abnormal behaviors, thereby improving the recognition accuracy and efficiency of the model in real-time monitoring.

[0067] Step S03: Use the training data to train the initial model to obtain a fraud-related behavior recognition model.

[0068] In this embodiment, the pre-designed initial model is trained by using the training data obtained through multimodal data fusion processing, so that the model learns and grasps the characteristics of normal and abnormal communication modes of the Internet of Vehicles card. By analyzing various patterns and behaviors in historical communication data, the model can identify specific patterns and signals of fraudulent behavior, thereby quickly and accurately identifying potential fraudulent behavior in future real-time data monitoring.

[0069] During the training process, the model parameters are constantly adjusted to minimize the difference between the predicted results and the actual labels. This process can be achieved through forward propagation and back propagation algorithms. Ultimately, the fully trained model can accurately identify fraudulent behavior from real-time communication data, providing security for the Internet of Vehicles card.

[0070] Step S04, acquiring the real-time communication data of the Internet of Vehicles card, and inputting the real-time communication data into the fraud-related behavior recognition model to obtain the recognition result output by the fraud-related behavior recognition model.

[0071] In this embodiment, the data generated by the Internet of Vehicles card during the communication process is collected in real time and input into a trained fraud-related behavior recognition model. The model will analyze the data and output recognition results based on the learned patterns and features.

[0072] The purpose of this process is to achieve real-time monitoring and rapid response to the communication behavior of the Internet of Vehicles card. By inputting real-time communication data into the model, possible fraudulent behavior can be immediately identified, such as abnormal call patterns, unusual data transmission behavior, or activities that match known fraudulent behavior patterns. This real-time monitoring and identification mechanism can improve the overall security of the Internet of Vehicles, protect the personal information and property safety of users, and also help maintain the reputation of Internet of Vehicles services and the trust of users. Through this proactive defense measure, the impact of fraud on Internet of Vehicles users can be effectively reduced, and the security of the entire Internet of Vehicles ecosystem can be improved.

[0073] Based on the hysteresis of the response mechanism in the prior art, that is, after discovering fraudulent behavior, the prior art lacks a fast and effective response mechanism, resulting in delayed handling and failure to prevent or mitigate the impact of fraudulent behavior in a timely manner. Therefore, based on the above embodiments, in some embodiments, after executing step S04 to obtain the identification result output by the fraudulent behavior identification model, the following steps may also be performed:

[0074] When the identification result indicates that there is fraudulent behavior, the identification result will be uploaded to the security center.

[0075] This embodiment uploads the identification results of fraudulent behavior to the security center to ensure that the security center can quickly obtain the latest fraud intelligence and provide an information basis for subsequent rapid response. For example, the security center can update its fraud intelligence database in real time through the received identification results, and the regulatory unit cooperating with the security center can take prompt action based on the uploaded identification results. For example, it can include shutting down the fraudulent Internet of Vehicles card to prevent further fraudulent behavior, and initiating emergency disposal procedures, such as notifying users and investigating the source of fraud.

[0076] Through this quick response mechanism, this embodiment significantly improves the efficiency of handling fraudulent behavior. Compared with the traditional delayed response, this mechanism can respond to fraudulent behavior in a short time, thereby timely preventing or reducing the impact of fraudulent behavior and protecting the property safety of users.

[0077] Based on the above embodiments, in some embodiments, the method may further include:

[0078] Determine the fraud level corresponding to the identification result according to the preset classification and grading strategy;

[0079] Execute the processing strategy corresponding to the fraud level.

[0080] In this embodiment, the system will evaluate the identification results output by the fraudulent behavior identification model according to the pre-defined classification and grading strategies to determine the severity or type of fraudulent behavior. These preset strategies may be based on factors such as the characteristics, frequency, and potential impact of the fraudulent behavior. For example, the strategy may classify fraudulent behavior into three levels: "low risk", "medium risk" and "high risk", and each level corresponds to different processing priorities and measures.

[0081] Once the fraud level is determined, the system will automatically execute the corresponding processing strategy for that level. These strategies may include but are not limited to:

[0082] Low risk: Send a warning notification to the user to alert them to possible fraud and provide safety advice.

[0083] Medium risk: Based on the notification to the user, certain functions of the car networking card are restricted until the risk is further assessed.

[0084] High risk: Take immediate action, such as temporarily freezing the car networking card service to prevent further fraud, and notify the regulatory authorities for investigation.

[0085] These processing strategies are designed to take appropriate preventive and response measures based on the severity of the fraudulent behavior to minimize users' losses and risks.

[0086] In this embodiment, by introducing classification and grading strategies and corresponding processing measures, the fraud risk of Internet of Vehicles cards can be managed more finely and effectively. This hierarchical response mechanism not only improves the accuracy of identifying fraudulent behavior, but also ensures the rational allocation of resources and rapid response, thereby providing users with a higher level of protection.

[0087] In some embodiments, the identification results output by the fraudulent behavior identification model may include whether there is fraudulent behavior and the corresponding risk type, such as abnormal access, high-frequency calls, abnormal data transmission, multiple cards in one vehicle, vehicle-card separation, abnormal SMS sending and receiving, etc., where:

[0088] Abnormal access refers to when an unnamed vehicle network card performs typical human Internet application access behavior, telecommunications companies should discover it in a timely manner and output relevant abnormal access records.

[0089] High-frequency calls refer to the behavior of Internet of Vehicles cards making high-frequency calls within a period of time. Telecom companies should discover them in a timely manner and output relevant high-frequency call records.

[0090] Cross-border data transmission refers to the behavior of the Internet of Vehicles card accessing abnormal or overseas URLs or IP addresses and transmitting data. Telecom companies should discover this in a timely manner and output relevant cross-border data transmission records.

[0091] Multiple cards in one vehicle means that when the same vehicle VIN code or vehicle terminal equipment IMEI code corresponds to three or more Internet of Vehicles cards, telecommunications companies should discover it in a timely manner and output the record of multiple cards in one vehicle.

[0092] Vehicle-card separation refers to the act of removing the Internet of Vehicles card from one vehicle terminal and using it in another terminal. Telecommunications companies should bind the Internet of Vehicles card to the vehicle terminal in accordance with the Internet of Vehicles card security management requirements. When the binding relationship between the current Internet of Vehicles card and the vehicle terminal changes, telecommunications companies should be able to detect it in a timely manner and output the relevant vehicle-card separation records.

[0093] Abnormal SMS sending and receiving refers to the Internet of Vehicles card sending and receiving SMS with numbers marked as abnormal, and generating high-frequency call records.

[0094] Based on the above technical solution, the method for identifying fraudulent behavior provided by the embodiment of the present invention performs multimodal data fusion processing on the historical communication data of the Internet of Vehicles card, and then uses the obtained training data to train the initial model to obtain a fraudulent behavior identification model, and finally inputs the real-time communication data of the Internet of Vehicles card into the fraudulent behavior identification model to obtain the identification result output by the fraudulent behavior identification model. The present invention deeply integrates the historical communication data of the Internet of Vehicles card through multimodal data fusion processing technology, improves the utilization efficiency of the data, and enhances the complementarity of the data, thereby providing more accurate and comprehensive data support for the construction of the fraudulent behavior identification model, and greatly improves the accuracy of the fraudulent behavior identification of the Internet of Vehicles card. At the same time, by acquiring and analyzing the communication data of the Internet of Vehicles card in real time, the efficiency of fraudulent behavior identification is improved, providing strong technical support for the security protection of the Internet of Vehicles card.

[0095] Please refer to Figure 2 ,for Figure 1 A flowchart of an actual performance of S02 in a method for identifying fraudulent behavior is provided. In some embodiments, step S02 mentioned that multimodal data fusion processing is performed on historical communication data to obtain training data, which may specifically include the following steps:

[0096] Step S11, preprocessing the historical communication data to obtain preprocessed data.

[0097] The preprocessing includes at least one of data cleaning, formatting, and normalization.

[0098] In this embodiment, before the IoV card fraud behavior identification model is trained, a series of processing steps are required for the collected historical communication data to ensure the quality and consistency of the data. This process includes at least one operation of data cleaning, formatting and normalization, where: data cleaning aims to remove erroneous, incomplete or irrelevant data; formatting ensures that all data follows a unified format for easy analysis; and normalization scales the data to a standard range to eliminate the impact of different dimensions.

[0099] The reason for preprocessing in this embodiment is that the original communication data may contain noise, outliers or inconsistent formats, which may affect the effect of model training and the final recognition accuracy. Through preprocessing, the quality and reliability of the data can be improved, so that the model can more accurately learn the characteristics of normal and abnormal communication behaviors. In addition, preprocessing also helps to reduce deviations and overfitting in the model training process and improve the generalization ability of the model.

[0100] Step S12: determining first weight values ​​of different types of data in the preprocessed data according to preset risk types.

[0101] Among them, the risk types include at least one of abnormal access, high-frequency calls, abnormal data transmission, multiple cards in one vehicle, vehicle-card separation, and abnormal SMS sending and receiving.

[0102] The purpose of this embodiment is to identify and evaluate the importance of data features related to a specific risk type. For example, if a risk type is "abnormal data transmission", then features related to data transmission may be assigned a higher weight value. Such weight distribution helps the model pay more attention to data features related to a specific risk type during training, thereby improving recognition accuracy.

[0103] Data based on different modalities have different contributions to identifying different risk types. This embodiment assigns different weight values ​​to different types of data to ensure that the model can pay more attention to data that is more indicative of specific risk types during the identification process. This method enables the model to more effectively extract key information from a large amount of data and improve the efficiency and accuracy of identifying fraudulent behavior. In addition, this method also helps to optimize model performance, making it more accurately adapt to different risk scenarios, thereby better serving the security protection of Internet of Vehicles cards in practical applications.

[0104] Step S13, performing orthogonal sequential fusion processing on different types of data in the preprocessed data according to the first weight value to obtain training data corresponding to the risk type.

[0105] In the context of multimodal data fusion, this embodiment integrates various types of data according to a predetermined first weight value. The first weight value reflects the importance of each data type in identifying a specific risk type. Orthogonal sequential fusion ensures that during the fusion process, data of different modalities maintain their independence while allowing the model to capture complementary information between them.

[0106] The purpose of this embodiment is to create a comprehensive training data set that accurately represents the communication behavior of the Internet of Vehicles card and highlights the features associated with specific risk types. In this way, the training data set can provide rich information for building a fraudulent behavior recognition model, allowing the model to learn the subtle differences between normal and abnormal behaviors. By adopting orthogonal sequential fusion processing, it is possible to effectively combine information from different data sources while retaining the orthogonality of the data. This method helps to improve the generalization ability of the model, reduce the risk of overfitting, and ensure that the model can accurately identify various fraudulent behaviors in practical applications. Through this fusion process, high-quality training data can be obtained, laying a solid foundation for training efficient and accurate fraudulent behavior recognition models.

[0107] Step S14: performing orthogonality enhancement processing on the training data corresponding to the risk type.

[0108] After multimodal data fusion, this embodiment takes additional steps to ensure that the various modes in the training data remain statistically independent, that is, orthogonal. This process involves using specific algorithms or techniques, such as principal component analysis (PCA) or other orthogonalization methods, to adjust the data so that the correlation between different modes is reduced, thereby enhancing the model's ability to recognize single modality features.

[0109] Orthogonality enhancement of training data can improve the generalization ability and prediction accuracy of the model. In multimodal learning, data from different modalities may be redundant or interdependent, which may cause the model to over-rely on certain modalities during training and ignore important information from other modalities. By enhancing orthogonality, it can be ensured that the model can consider data from all modalities more evenly during learning and prediction, thereby improving the robustness and effectiveness of the model in identifying fraudulent behavior. In addition, orthogonality enhancement can also help reduce data dimensions, simplify models, and improve computational efficiency, making the model more efficient and reliable in practical applications.

[0110] Based on the above technical solution, this embodiment ensures the quality and consistency of the data by performing refined data preprocessing on historical communication data, eliminates noise data and inconsistencies, and makes model training more stable and reliable. At the same time, combined with orthogonal sequential fusion and orthogonality enhancement processing, it ensures the information complementarity and independence between different data types, thereby optimizing the training effect of the model, enabling the model to more accurately capture the characteristics of fraudulent behavior, and greatly improving the model's ability to identify fraudulent behavior.

[0111] Please refer to Figure 3 ,for Figure 1 A flowchart of an actual performance of S03 in a method for identifying fraudulent behavior is provided. In some embodiments, step S03 mentioned that the initial model is trained using training data to obtain a fraudulent behavior identification model, which may specifically include the following steps:

[0112] Step S21, performing feature extraction processing on the training data to obtain data features corresponding to different types of data in the training data.

[0113] In the process of machine learning model training, this embodiment identifies and extracts key information that can represent the essential attributes of the data, namely data features, from the original training data. The purpose is to convert complex original data into a form that is easier for the model to process while retaining information that is useful for predicting the target.

[0114] Feature extraction directly affects the performance of the model. High-quality features can more accurately capture patterns and trends in the data related to the target variable, which can significantly improve the prediction accuracy of the model. At the same time, feature extraction also helps to reduce the dimension of the data, reduce the computational burden during model training and prediction, and improve the operating efficiency of the model. Through feature extraction, the model can focus on the information that is most valuable for identifying fraudulent behavior, thereby achieving more accurate monitoring and identification in practical applications.

[0115] Step S22, performing feature fusion processing on data features corresponding to different types of data to obtain feature fusion data.

[0116] In this embodiment, the process is to integrate the feature sets obtained from different data sources or different feature extraction methods. This process can combine the features of different modalities through a fusion function to form feature fusion data. Feature fusion data can more comprehensively represent the complexity and diversity of the original data set. The purpose of feature fusion is to merge the independent feature information into a unified representation in order to better capture the correlation and pattern in the data, thereby improving the performance and generalization ability of the model.

[0117] Step S23, determining second weight values ​​of different types of data in the training data according to the occurrence frequencies of different types of data in the training data.

[0118] In this embodiment, by evaluating the distribution of each type of data in the overall data set and assigning a second weight value accordingly, the purpose is to ensure that the model is not overly affected simply because of the excessive appearance of certain data types, thereby ignoring those data types that appear less frequently but may be equally important. By assigning second weight values ​​to different data types, the model can learn from all types of data more fairly, which helps to improve the prediction accuracy and generalization ability of the model, especially when dealing with unbalanced data sets. Such a weighting mechanism helps the model capture all relevant features and avoid bias caused by uneven data distribution, so as to make more comprehensive and accurate decisions in practical applications.

[0119] Step S24, determining a decision output result according to the feature fusion data corresponding to the different types of data and the second weight value.

[0120] Since different data types may contribute differently to model decisions, this embodiment comprehensively considers the fused feature data and the second weight values ​​of each type of data during the model decision process. This process calculates the final decision output by combining the feature fusion data and the second weight value through the decision fusion function. By assigning different weight values, it can be ensured that the model can pay more attention to those data types that have a greater impact on the results when making decisions.

[0121] This process allows the model to make more accurate and fair predictions when faced with imbalanced or unequally important data. In this way, the model not only takes advantage of all available information, but also adjusts its decision-making strategy based on the actual importance of the data, thereby improving the accuracy and efficiency of identifying fraudulent behavior.

[0122] Step S25, using the BalanceMLA framework in combination with the training data and the decision output results to train the initial model, and obtain a fraud-related behavior recognition model.

[0123] In this embodiment, by using the advanced machine learning framework BalanceMLA (Balanced Multimodal Learning Framework), the training data and the decision output results based on the above steps are used as input, and the initial model is trained and optimized through the built-in algorithms and strategies of the framework. The BalanceMLA framework can handle the imbalance problem in multimodal data and improve the performance of the model in complex data environments. Through the BalanceMLA framework, the model can automatically adjust the learning process to adapt to the importance and complexity of different data types, thereby improving the accuracy and robustness of fraudulent behavior identification. Such a model training method ensures that in practical applications, the fraudulent behavior identification model can more reliably identify and predict fraudulent behavior, providing strong technical support for the security of the Internet of Vehicles.

[0124] In some embodiments, the initial model may specifically be an adaptive machine learning model;

[0125] On this basis, as mentioned in step S25, the initial model is trained using the BalanceMLA framework in combination with the training data and the decision output results, which may specifically include:

[0126] Step S31, in the model initialization stage, different initial weights and biases are set for neurons in the adaptive machine learning model according to preset risk types.

[0127] In this embodiment, by customizing the initial parameters of the neurons, the model can better capture the features related to specific risk types from the beginning, thereby accelerating the learning process and improving the initial prediction performance of the model. This process enables the model to be initialized more accurately for different risk types, reducing the blindness of model training and improving training efficiency.

[0128] In this way, the model can pay more attention to certain known risk features at the beginning of training, which helps to converge to the optimal solution faster in the subsequent training process. Especially when dealing with complex and changeable fraud-related behavior identification tasks, this preset initialization strategy can significantly improve the model's response speed and recognition accuracy.

[0129] Step S32, during the model training phase, dynamically adjust the model structure of the adaptive machine learning model according to changes in the distribution of training data.

[0130] In this embodiment, during the model training phase, the model can automatically optimize its internal structure according to changes in the characteristics and distribution of the input data. This dynamic adjustment includes adding, deleting or modifying neurons, layers or connection methods to adapt to changes in data, thereby improving the adaptability and prediction accuracy of the model.

[0131] Since data in the real world often changes dynamically, a fixed model structure may not be able to effectively cope with such changes. Therefore, this embodiment can ensure that the model is always consistent with the latest data distribution by dynamically adjusting the model structure, so as to better capture patterns and trends in the data. This adaptive capability enables the model to maintain high performance when facing new or unseen data, especially in areas such as fraud identification. This capability is particularly important because fraud methods often change, and the model needs to be able to quickly adapt and identify new fraud patterns.

[0132] Based on the above embodiments, in some embodiments, after executing step S32 to dynamically adjust the model structure of the adaptive machine learning model according to the distribution change of the training data, the following steps may also be performed:

[0133] Step S33: determining a corresponding parameter adjustment strategy according to the risk type and the distribution characteristics of the training data.

[0134] In this embodiment, during the machine learning model training process, the model parameters are customized and adjusted according to the characteristics of the data and the potential risk types. The purpose is to identify and respond to specific patterns and anomalies in the data so as to more effectively identify and prevent different types of risks.

[0135] This embodiment allows the model to be optimized according to the unique needs of different risk scenarios. By analyzing the distribution characteristics of the training data, it is possible to identify which parameters are most critical to improving the performance of the model on a specific risk detection task. These parameters can then be adjusted in a targeted manner to make the model more sensitive to those data features associated with specific risk types. Such customized adjustments help improve the predictive accuracy and robustness of the model, especially in the face of complex and changing risk environments, enabling the model to more accurately identify potential fraud.

[0136] Step S34, adjusting the parameters in the adaptive machine learning model according to the parameter adjustment strategy.

[0137] In this embodiment, the parameters within the model are optimized and updated according to a pre-set strategy or model performance feedback, including fine-tuning the model's weights, biases, or other hyperparameters, to improve the model's predictive ability and adaptability.

[0138] This process enables the model to respond more flexibly to changes in data and performance feedback during training. By dynamically adjusting parameters, the model can converge to the optimal solution faster, improve its adaptability to new data, and remain efficient and accurate in the face of evolving risk types.

[0139] Based on the above technical solution, this embodiment can deeply mine the multi-dimensional information in the training data and enhance the model's ability to understand different types of data by adopting feature extraction and feature fusion processing. At the same time, by considering the frequency of data occurrence to determine the second weight value, it is ensured that the model can pay more attention to the data type that has a greater impact on the recognition result, thereby improving the accuracy of the decision output. Finally, the initial model is trained using the BalanceMLA framework in combination with the training data and the decision output results. The resulting fraud-related behavior recognition model shows higher robustness and accuracy in processing modal imbalance and noise data, effectively improving the efficiency and effectiveness of fraud-related behavior recognition.

[0140] Please refer to Figure 4 , is a schematic diagram of the structure of a fraudulent behavior identification device provided by an embodiment of the present invention, and the fraudulent behavior identification device may include:

[0141] The acquisition module 100 is used to acquire the historical communication data of the Internet of Vehicles card; the types of the historical communication data of the Internet of Vehicles card include at least one of call list data, signaling data, Internet access log, real-name authentication information, and black, white, and gray list data;

[0142] The data fusion module 200 is used to perform multi-modal data fusion processing on historical communication data to obtain training data;

[0143] The model training module 300 is used to train the initial model using the training data to obtain a fraudulent behavior recognition model;

[0144] The fraudulent behavior identification module 400 is used to obtain the real-time communication data of the Internet of Vehicles card, and input the real-time communication data into the fraudulent behavior identification model to obtain the identification result output by the fraudulent behavior identification model.

[0145] Based on the above embodiments, in a specific embodiment, the data fusion module 200 can be specifically used for:

[0146] Preprocessing the historical communication data to obtain preprocessed data; the preprocessing includes at least one of data cleaning, formatting, and normalization;

[0147] Determine first weight values ​​of different types of data in the preprocessed data according to preset risk types; the risk types include at least one of abnormal access, high-frequency calls, abnormal data transmission, multiple cards in one vehicle, vehicle-card separation, and abnormal SMS sending and receiving;

[0148] Performing orthogonal sequential fusion processing on different types of data in the preprocessed data according to the first weight value to obtain training data corresponding to the risk type;

[0149] Orthogonality enhancement is performed on the training data corresponding to the risk type.

[0150] Based on the above embodiments, in a specific embodiment, the model training module 300 can be specifically used for:

[0151] Perform feature extraction on the training data to obtain data features corresponding to different types of data in the training data;

[0152] Perform feature fusion processing on data features corresponding to different types of data to obtain feature fusion data;

[0153] Determining second weight values ​​of different types of data in the training data according to the occurrence frequencies of different types of data in the training data;

[0154] Determine the decision output result according to the feature fusion data corresponding to the different types of data and the second weight value;

[0155] The BalanceMLA framework is used to combine training data and decision output results to train the initial model and obtain a fraudulent behavior identification model.

[0156] Based on the above embodiment, in a specific embodiment, the initial model is an adaptive machine learning model;

[0157] The model training module 300 can also be used to:

[0158] In the model initialization phase, different initial weights and biases are set for neurons in the adaptive machine learning model according to the preset risk types;

[0159] During the model training phase, the model structure of the adaptive machine learning model is dynamically adjusted according to changes in the distribution of training data.

[0160] Based on the above embodiment, in a specific embodiment, the model training module 300 can also be used for:

[0161] Determine the corresponding parameter adjustment strategy based on the risk type and the distribution characteristics of the training data;

[0162] Tune parameters in an adaptive machine learning model according to a parameter tuning strategy.

[0163] Based on the above embodiment, in a specific embodiment, the fraudulent behavior identification module 400 can also be used for:

[0164] When the identification result indicates that there is fraudulent behavior, the identification result will be uploaded to the security center.

[0165] Based on the above embodiment, in a specific embodiment, the fraudulent behavior identification module 400 can also be used for:

[0166] Determine the fraud level corresponding to the identification result according to the preset classification and grading strategy;

[0167] Execute the processing strategy corresponding to the fraud level.

[0168] This embodiment provides an electronic device, including a processor and a memory, the memory is used to store at least one instruction, and when the instruction is loaded and executed by the processor, it implements the above-mentioned method of identifying fraudulent behavior. Its execution method and beneficial effects are similar and will not be repeated here.

[0169] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for identifying fraudulent behavior described above is implemented. The execution method and beneficial effects are similar and will not be repeated here.

[0170] It should be noted that although the above describes the various steps in a specific order, it does not mean that the various steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently or even in a different order as long as the required functions can be achieved.

[0171] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for identifying fraudulent behavior, characterized in that: include: Acquire historical communication data of the Internet of Vehicles card; the type of the historical communication data of the Internet of Vehicles card includes at least one of call bill data, signaling data, Internet access log, real-name authentication information, and black, white, and gray list data; Performing multimodal data fusion processing on the historical communication data to obtain training data; Using the training data to train the initial model, to obtain a fraud-related behavior recognition model; The real-time communication data of the Internet of Vehicles card is obtained, and the real-time communication data is input into the fraud-related behavior recognition model to obtain the recognition result output by the fraud-related behavior recognition model.

2. The method according to claim 1, characterized in that The performing multimodal data fusion processing on the historical communication data to obtain training data includes: Preprocessing the historical communication data to obtain preprocessed data; the preprocessing includes at least one of data cleaning, formatting, and normalization; Determine first weight values ​​of different types of data in the preprocessed data according to preset risk types; the risk types include at least one of abnormal access, high-frequency calls, abnormal data transmission, multiple cards in one vehicle, vehicle-card separation, and abnormal SMS sending and receiving; Performing orthogonal sequential fusion processing on different types of data in the preprocessed data according to the first weight value to obtain training data corresponding to the risk type; Orthogonality enhancement processing is performed on the training data corresponding to the risk type.

3. The method according to claim 1, characterized in that The initial model is trained using the training data to obtain a fraud-related behavior recognition model, including: Performing feature extraction processing on the training data to obtain data features corresponding to different types of data in the training data; Performing feature fusion processing on the data features corresponding to the different types of data to obtain feature fusion data; Determining second weight values ​​of different types of data in the training data according to the occurrence frequencies of different types of data in the training data; Determine a decision output result according to the feature fusion data corresponding to the different types of data and the second weight value; The initial model is trained using the BalanceMLA framework in combination with the training data and the decision output results to obtain the fraud-related behavior identification model.

4. The method according to claim 3, characterized in that The initial model is an adaptive machine learning model; The using the BalanceMLA framework in combination with the training data and the decision output result to train the initial model includes: In the model initialization stage, different initial weights and biases are set for neurons in the adaptive machine learning model according to the preset risk types; During the model training phase, the model structure of the adaptive machine learning model is dynamically adjusted according to changes in the distribution of the training data.

5. The method according to claim 4, characterized in that After dynamically adjusting the model structure of the adaptive machine learning model according to the distribution change of the training data, the method further includes: Determine a corresponding parameter adjustment strategy according to the risk type and the distribution characteristics of the training data; The parameters in the adaptive machine learning model are adjusted according to the parameter adjustment strategy.

6. The method according to claim 1, characterized in that After obtaining the recognition result output by the fraudulent behavior recognition model, the method further includes: When the identification result indicates that there is fraudulent behavior, the identification result is uploaded to the security center.

7. The method according to claim 6, characterized in that The method further comprises: Determine the fraud level corresponding to the identification result according to a preset classification and grading strategy; Execute the processing strategy corresponding to the fraud level.

8. A device for identifying fraudulent behavior, characterized in that: include: An acquisition module, used to acquire historical communication data of the Internet of Vehicles card; the types of the historical communication data of the Internet of Vehicles card include at least one of call list data, signaling data, Internet access log, real-name authentication information, and black, white, and gray list data; A data fusion module, used for performing multimodal data fusion processing on the historical communication data to obtain training data; A model training module, used to train the initial model using the training data to obtain a fraud-related behavior recognition model; The fraudulent behavior identification module is used to obtain the real-time communication data of the Internet of Vehicles card, and input the real-time communication data into the fraudulent behavior identification model to obtain the identification result output by the fraudulent behavior identification model.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory is used to store at least one instruction, and when the instruction is loaded and executed by the processor, the method for identifying fraudulent behavior as described in any one of claims 1-7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying fraudulent behavior as described in any one of claims 1 to 7 is implemented.

Images