Multi-dimensional anomaly detection method and system for operator-level short message charging system

Abstract

The invention discloses a multi-dimensional anomaly detection method and system for an operator-level short message charging system, and relates to the technical field of charging system detection. The method comprises the following steps: after analyzing a charging file of an operator, extracting a six-dimensional tensor structure; after the short message event arrives, extracting an attribute six-tuple of the short message event as a tensor index, accessing a tensor unit corresponding to the six-dimensional tensor structure, executing matching calculation of an actual charging result and a tensor return result, and generating a matching calculation result; establishing a feature time window weight of the short message event by using the short message sample; executing feature extraction of the short message event, and respectively calculating the feature deviation degree of each feature by using a feature extraction result; constructing a dynamic feature score by using the feature deviation degree and the feature time window weight; and generating a total abnormal score by using the matching calculation result and the dynamic feature score. The technical problem that in the prior art, short message charging anomaly detection accuracy is low is solved, and the technical effect of improving the short message charging anomaly detection accuracy is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of billing system detection, and in particular to a multi-dimensional anomaly detection method and system for operator-level SMS billing systems. Background Art

[0002] Operator-level SMS billing systems are mainly responsible for accurately billing SMS services to ensure the accuracy of user consumption records. However, traditional SMS billing systems in the prior art often have problems such as low data processing efficiency and insufficient anomaly detection capabilities when faced with the increasing volume of SMS services, resulting in a decline in billing accuracy and the possibility that anomaly events cannot be detected in a timely manner, thus affecting the user experience and the economic benefits of operators. Most existing anomaly detection methods focus on single-dimensional analysis, such as the basic information of the sender and the receiver, lacking comprehensive analysis and processing of multi-dimensional data, resulting in the inability to identify complex billing anomalies in a timely manner. In addition, traditional billing anomaly detection methods generally rely on static rules or simple statistical analysis and are difficult to cope with changing SMS service scenarios and constantly changing network environments. Summary of the Invention

[0003] This application provides a multi-dimensional anomaly detection method and system for operator-level SMS billing systems, which solves the technical problem of low accuracy in detecting SMS billing anomalies in the prior art.

[0004] In the first aspect of this application, a multi-dimensional anomaly detection method for operator-level SMS billing systems is provided. The method includes: After parsing the operator's billing file, extract a six-dimensional tensor structure, which includes the sender operator, the receiver operator, the sending location, the receiving location, the SMS type, and the user package type; when an SMS event arrives, extract the attribute six-tuple of the SMS event as a tensor index, access the corresponding tensor unit of the six-dimensional tensor structure, perform a matching calculation between the actual billing result of the SMS event and the tensor return result, and generate a matching calculation result; take the SMS event as the extraction center, create a time window, and call the SMS samples within the time window, and use the SMS samples to establish the characteristic time window weight of the SMS event; perform feature extraction of the SMS event, and calculate the feature deviation degree of each feature respectively using the feature extraction result; construct a dynamic feature score using the feature deviation degree and the characteristic time window weight; generate a total anomaly score using the matching calculation result and the dynamic feature score.

[0005] In the second aspect of this application, a multi-dimensional anomaly detection system for operator-level SMS billing systems is provided. The system includes: A data extraction module is used to extract a six - dimensional tensor structure after parsing the billing file of the operator. The six - dimensional tensor structure includes the sending operator, the receiving operator, the sending location, the receiving location, the SMS type, and the user package type. A matching module is used to, when an SMS event arrives, extract the attribute six - tuple of the SMS event as a tensor index, access the corresponding tensor unit of the six - dimensional tensor structure, perform a matching calculation between the actual billing result of the SMS event and the tensor return result, and generate a matching calculation result. A weight establishment module is used to create a time window with the SMS event as the extraction center, call the SMS samples within the time window, and establish the characteristic time - window weight of the SMS event using the SMS samples. A calculation module is used to perform the feature extraction of the SMS event and calculate the feature deviation degree of each feature using the feature extraction result. A feature score construction module is used to construct a dynamic feature score using the feature deviation degree and the characteristic time - window weight. A score generation module is used to generate a total anomaly score using the matching calculation result and the dynamic feature score.

[0006] One or more technical solutions provided in this application have at least the following technical effects or advantages: After parsing the billing file of the operator, a six - dimensional tensor structure is extracted. The six - dimensional tensor structure includes the sending operator, the receiving operator, the sending location, the receiving location, the SMS type, and the user package type. When an SMS event arrives, the attribute six - tuple of the SMS event is extracted as a tensor index, the corresponding tensor unit of the six - dimensional tensor structure is accessed, and a matching calculation between the actual billing result of the SMS event and the tensor return result is performed to generate a matching calculation result. Then, with the SMS event as the extraction center, a time window is created, the SMS samples within the time window are called, and the characteristic time - window weight of the SMS event is established using the SMS samples. Next, the feature extraction of the SMS event is performed, and the feature deviation degree of each feature is calculated using the feature extraction result. Further, a dynamic feature score is constructed using the feature deviation degree and the characteristic time - window weight. Finally, a total anomaly score is generated using the matching calculation result and the dynamic feature score. This solves the technical problem of low accuracy in detecting SMS billing anomalies in the prior art and achieves the technical effect of improving the accuracy of detecting SMS billing anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following described drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0008] Figure 1 It is a schematic flow chart of a multi - dimensional anomaly detection method for an operator - level SMS billing system provided by an embodiment of this application; Figure 2 It is a schematic structural diagram of a multi-dimensional anomaly detection system for an operator-level SMS billing system provided by an embodiment of the present application.

[0009] Explanation of reference numerals: data extraction module 11, matching module 12, weight establishment module 13, calculation module 14, feature score construction module 15, score generation module 16. Detailed implementation manners

[0010] By providing a multi-dimensional anomaly detection method and system for an operator-level SMS billing system, the present application solves the technical problem of low accuracy in anomaly detection of SMS billing in the prior art.

[0011] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0012] It should be noted that the terms "include" and "have" are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server including a series of steps or units does not necessarily have to be limited to those clearly listed steps or units, but may include other steps or modules not clearly listed or inherent to these processes, methods, products or devices.

[0013] Embodiment 1, as Figure 1 shown, the present application provides a multi-dimensional anomaly detection method for an operator-level SMS billing system, where the method includes: After parsing the billing file of the operator, a six-dimensional tensor structure is extracted, and the six-dimensional tensor structure includes the sender operator, the receiver operator, the sending location, the receiving location, the SMS type, and the user package type.

[0014] The billing file of the operator is usually stored in a specific format (such as CSV, XML, etc.) and contains a large amount of data related to SMS billing.

[0015] For billing files in different formats, select appropriate parsing methods. For example, for a CSV format file, a parsing method based on a delimiter (such as a comma) can be used to split each line of data in the file into multiple fields; for an XML format file, an XML parsing library (such as Python's ElementTree library) can be used to parse according to the XML hierarchical structure to extract the values of each node and attribute.

[0016] After parsing the charging files of the operator, extract and preprocess the data in the charging files to obtain the basic information related to the SMS events. Through the structured analysis of the data, construct a six-dimensional tensor structure, which includes the sender operator, the receiver operator, the sending location, the receiving location, the SMS type, and the user package type. Specifically, the sender operator and the receiver operator respectively represent the operator identifiers for sending and receiving SMS, reflecting the types of operators to which the sender and receiver of the SMS belong; the sending location and the receiving location record the geographical locations where the SMS is sent and received, usually in units of provinces and cities or more detailed geographical information, in order to identify the geographical distribution of the SMS; the SMS type indicates the specific category of the SMS, such as ordinary SMS, MMS, verification code SMS, etc.; the user package type refers to the charging package selected by the user, which determines the SMS charging rules, fee standards, and possible preferential policies.

[0017] Furthermore, after parsing the charging files of the operator, extract the six-dimensional tensor structure, including: Conduct a rule duration evaluation and a general comparison evaluation of the charging rules according to the parsing results; use the rule duration evaluation results and the general comparison evaluation results to determine the reference tensor structure; after determining the reference tensor structure, perform incremental learning of all the parsing results relative to the reference tensor structure, and extract the six-dimensional tensor structure according to the incremental learning results and the reference tensor structure.

[0018] In the embodiment of the present application, conduct a rule duration evaluation on the charging rule-related fields in the parsing results to analyze the stability and duration of each charging rule in the historical data; specifically, the system calculates the duration of the rule by statistically analyzing the start time and end time (if the rule is still in use, the end time is the current time) of each charging rule in the charging files. At the same time, in combination with the historical charging file data, analyze the usage frequency and changes of the rule in different time periods. For example, if a certain charging rule has been continuously used in the past year and the usage frequency is stable, it is considered that the rule has a high rule duration evaluation score; on the contrary, if the rule changes frequently or the usage time is short, the score is low.

[0019] The general comparison evaluation is to compare the current charging rule with the standard charging rules generally recognized in the industry to evaluate its compliance and universality. The system compares each parsed charging rule with the corresponding rule in the preset standard charging rule library, where the standard charging rule library contains the standard charging rules for various SMS services in different scenarios; calculate the general comparison evaluation score according to the comparison results. If the current rule is highly consistent with the standard rule, the score is high; if there are significant differences, the score is low.

[0020] After completing the above evaluations, determine the benchmark tensor structure based on the results of the rule duration evaluation and the general comparison evaluation. The benchmark tensor structure serves as a standard template, representing the regular patterns of the billing rules in various dimensions, providing basic reference values and expected behaviors, and ensuring that subsequent billing calculations can be carried out according to a unified standard.

[0021] Specifically, the system comprehensively ranks each billing rule according to the scores of the rule duration evaluation and the general comparison evaluation; selects the combination of billing rules with higher scores, better stability, and stronger compliance as the initial construction basis of the benchmark tensor structure; maps these combinations of billing rules into a six-dimensional tensor structure, that is, determines the benchmark value range for each dimension according to six dimensions: the sender operator, the receiver operator, the sending location, the receiving location, the SMS type, and the user package type. For example, in the dimension of the sender operator, select the operator with a higher usage frequency and stable rules as the benchmark value; in the dimension of the SMS type, select the common SMS service types as the benchmark values, etc.

[0022] After determining the benchmark tensor structure, the system performs incremental learning on all parsing results with respect to the benchmark tensor structure to improve and update the six-dimensional tensor structure. Specifically, the system compares the billing rule information of each parsed SMS record with the benchmark tensor structure; for records that are consistent with the benchmark tensor structure, it is considered that they conform to the normal billing rules and are included in the normal data set; for records that are different from the benchmark tensor structure, they are further analyzed as abnormal data or potential new rule data.

[0023] During the incremental learning process, machine learning algorithms (such as clustering algorithms, classification algorithms, etc.) are used to process the abnormal data and potential new rule data. Through the clustering algorithm, similar abnormal data or new rule data are grouped together to form different data clusters; then, the classification algorithm is used to classify each data cluster to determine whether it belongs to a new billing rule or a real abnormal situation. Based on the results of the incremental learning, the benchmark tensor structure is updated and extended to extract the final six-dimensional tensor structure.

[0024] For the data clusters determined to be new billing rules, by analyzing the dimension information such as the sender operator, the receiver operator, the sending location, the receiving location, the SMS type, and the user package type corresponding to them, these new rule combinations are incorporated into the six-dimensional tensor structure to expand the value range of the tensor structure. For example, if a new SMS service type appears in a certain region and its billing rule is different from the existing rules in the benchmark tensor structure, then the value of this new service type will be added in the dimension of the SMS type and the corresponding sending location and receiving location dimensions.

[0025] For the data clusters determined to be abnormal situations, further analyze their characteristics to determine the type and degree of the abnormality. Mark these abnormal situations in the six-dimensional tensor structure so that subsequent anomaly detection algorithms can focus on monitoring and analyzing these anomalies. For example, an anomaly identification bit can be set in the tensor unit, or information such as the frequency and scope of influence of the anomaly occurrence can be recorded.

[0026] When a short message event arrives, extract the six-tuple of the attributes of the short message event as the tensor index, access the corresponding tensor unit of the six-dimensional tensor structure, perform the matching calculation between the actual charging result of the short message event and the tensor return result, and generate the matching calculation result.

[0027] When a short message event arrives at the operator's charging system, parse the short message event, extract the various attributes of the short message, and organize these attributes into a six-tuple, including the sending operator, receiving operator, sending location, receiving location, short message type, and user package type. These attributes represent the basic information of the short message event and constitute the unique identifier of the short message event.

[0028] After extracting the six-tuple of the attributes of the short message event, the system uses it as an index to access the pre-constructed six-dimensional tensor structure. The six-dimensional tensor structure is a multi-dimensional data storage structure, and each dimension corresponds to an attribute of the short message event. The tensor unit stores the charging-related information corresponding to the attribute combination. The system locates step by step in the six-dimensional tensor structure according to each attribute value in the six-tuple, and finally finds the tensor unit corresponding to the short message event. For example, determine the index positions of the first two dimensions of the tensor according to the sending operator and the receiving operator, and then sequentially determine the index positions of the subsequent dimensions according to the sending location, receiving location, short message type, and user package type, so as to accurately locate the target tensor unit. After accessing the corresponding tensor unit, the system extracts the charging return result related to the short message event from this unit, that is, the corresponding expected charging data.

[0029] The system compares the actual charging information (such as short message fee, sending volume, etc.) of the short message event with the predicted charging value returned by the tensor unit; by calculating the difference between the two, the matching calculation result is generated.

[0030] Exemplarily, the attributes of the SMS event include that the sender operator is Operator A, the recipient operator is Operator B, the sending location is Beijing, the receiving location is Shanghai, the SMS type is a normal SMS, and the user package type is Package X. For this SMS event, the actual billing information shows that the actual cost is 0.1 yuan and the sending volume is 100 messages. According to the historical data stored in the six-dimensional tensor structure, the predicted billing information returns a predicted cost of 0.12 yuan and a predicted sending volume of 95 messages. During the matching calculation process, the system first calculates the cost difference. The difference between the actual cost and the predicted cost is 0.02 yuan (0.12 yuan - 0.1 yuan). Secondly, it calculates the sending volume difference. The difference between the actual sending volume and the predicted sending volume is 5 messages (100 messages - 95 messages). Finally, the system generates a matching calculation result, showing a cost difference of 0.02 yuan and a sending volume difference of 5 messages.

[0031] Furthermore, perform a matching calculation on the actual billing result of the SMS event and the tensor return result to generate a matching calculation result, including: Invoke the historical deviation between the actual billing of the SMS event and the tensor mapping value; use a lightweight regression model to perform local residual trend learning on the historical deviation to generate a tensor residual prediction term; correct the matching calculation result according to the tensor residual prediction term.

[0032] By analyzing the historical deviation between the actual billing result of the SMS event and the tensor return result, using a lightweight regression model to learn the local residual trend of the historical deviation, thereby generating a tensor residual prediction term, and correcting the matching calculation result based on this prediction term to improve the accuracy of the matching calculation.

[0033] Specifically, obtain the actual billing result data and tensor return result data of the SMS event; match the actual billing result data and tensor return result data, and calculate the deviation between the actual billing result of each SMS event and the tensor mapping value. The formula is: Deviation = Actual billing result - Tensor mapping value; Extract relevant features from the historical deviation data, such as time features (hours, weeks, months, etc.), SMS type features, user features (such as user level, user region, etc.); Encode and normalize the extracted features for model training; Select a lightweight regression model, such as linear regression, decision tree regression, support vector machine regression (SVM regression), etc.; Divide the historical deviation data into a training set and a test set, use the training set to train the selected regression model, and optimize the performance of the model by adjusting the model parameters; Use the test set to evaluate the trained model, and use metrics such as mean squared error (MSE) and mean absolute error (MAE) to measure the prediction accuracy of the model. After the model training is completed, use the trained model to predict new SMS events to obtain tensor residual prediction terms. The tensor residual prediction term represents the deviation between the predicted actual billing result of the SMS event and the tensor mapping value. Combine the generated tensor residual prediction term with the matching calculation result to correct the matching calculation result. The correction formula is: Corrected matching calculation result = Preliminary matching calculation result + Tensor residual prediction term; Check the rationality of the corrected matching calculation result to ensure that the corrected result is within a reasonable range. For example, the corrected billing amount cannot be negative.

[0034] Taking the SMS event as the extraction center, create a time window and call the SMS samples within the time window to establish the feature time window weight of the SMS event using the SMS samples.

[0035] In the embodiment of the present application, taking the SMS event as the center, set a time window, and the time window covers the time range related to the current SMS event. The size of the time window can be dynamically adjusted according to actual needs. For example, the start and end times of the time window can be set according to the time period of SMS sending or the billing cycle.

[0036] From the SMS service database of the operator, call the SMS samples within the set time window according to the set time window. Using these SMS samples, the system will extract features related to the SMS event, such as the sending volume of SMS, sending time period, user behavior pattern, billing amount, etc. Through comprehensive analysis of these features, the system will assign a weight to each feature, and this weight reflects the relative importance of the feature within the current time window.

[0037] Exemplarily, a time window of 24 hours is created, and SMS samples within 24 hours are extracted. Each SMS sample contains information such as the sender operator, recipient operator, SMS type, user package type, and the number of sent messages, etc.; the features of the SMS samples are extracted, such as the number of sent messages, sending time period, and user package type. The range of the number of sent messages within this time window is from 90 to 120. The sending time period is mainly concentrated between 12:00 noon and 2:00 pm, and all SMS samples belong to Package X. Based on these features, the system assigns weights to each feature. For example, the weight of the number of sent messages is relatively high (0.4), because most SMS samples within the time window are concentrated around 100; the weight of the sending time period is 0.35, because the peak period from noon to afternoon has a greater impact; while the weight of the package type is relatively low (0.25).

[0038] Furthermore, establishing the feature time window weight of the SMS event by using the SMS samples includes: Performing six - tuple dimension embedding coding on historical SMS samples to establish a dense vector representation; combining the dense vector representations pairwise to construct cross - feature terms; inputting the cross - feature terms into an attention network to perform weight influence learning on the contribution of cross - combination to anomaly detection; generating a combined dynamic feature weighted tensor according to the weight influence learning result; compensating the feature time window weight according to the combined dynamic feature weighted tensor.

[0039] Extract six - tuple dimension information from historical SMS samples, including the sender operator, recipient operator, sending location, receiving location, SMS type, and user package type. For example, for an SMS, its sender operator is "China Mobile", recipient operator is "China Unicom", sending location is "Beijing", receiving location is "Shanghai", SMS type is "ordinary SMS", and user package type is "Chat Package".

[0040] Adopt embedding technology to convert discrete categorical variables in the six - tuple dimension into continuous vector representations. For each dimension, determine the dimension size of the embedding vector according to the number of its categories. For example, for the sender operator dimension, if there are 3 different operators, the embedding vector dimension can be set to 2 or 3. Concatenate the vectors obtained after embedding coding of the six - tuple dimension to obtain the dense vector representation of each SMS sample.

[0041] The system combines these dense vector representations pairwise to construct cross - feature terms. By combining all the dense vectors of the six - tuple dimension, multiple cross - feature terms are generated, reflecting the mutual relationship between different features. For example, the combination of the sender operator and the recipient operator may reveal the difference in billing rules between the two, while the combination of the sending location and the SMS type may reflect regional charging differences, etc.

[0042] The system inputs these cross - feature terms into the attention network to perform the learning of the weight impact of cross - combinations on anomaly detection. The attention mechanism can automatically assign a weight to each cross - feature term according to the frequency of its appearance in historical data and its impact on anomaly detection. This weight reflects the importance of the cross - feature in anomaly detection. The system can identify which feature combinations contribute more to the prediction of billing anomalies and accordingly enhance their weights, reducing the attention to irrelevant feature combinations. After the learning is completed, the system generates a combined dynamic feature - weighted tensor based on the weight - impact learning result. This tensor contains the weighted results of all cross - feature terms and can dynamically reflect the contribution of each cross - feature to anomaly detection within the current time window. Finally, the system compensates the feature time - window weights according to the generated combined dynamic feature - weighted tensor. By dynamically adjusting the features within the time window, the system can optimize the influence of each feature according to the learned feature combinations and weights, making anomaly detection more accurate and efficient.

[0043] Preferably, an attention network is constructed to learn the weight impact of cross - combinations on anomaly detection. The attention network usually consists of multiple neural network layers, including an input layer, a hidden layer, and an output layer. Among them, the input layer receives cross - feature terms as inputs, and the hidden layer can adopt structures such as fully - connected layers, convolutional layers, recurrent neural network layers, etc., to extract high - level features from cross - feature terms. The output layer outputs the weight of each cross - feature term. Specifically, a training data set is prepared, including cross - feature terms and corresponding anomaly - detection labels. The anomaly - detection labels can be generated through manual annotation or rule - based methods. The attention network is trained using the training data set, and a suitable loss function (such as the cross - entropy loss function) and optimization algorithm (such as the stochastic gradient descent algorithm) are used to minimize the prediction error. During the training process, the attention network automatically adjusts the weight of each cross - feature term by learning the relationship between cross - feature terms and anomaly - detection labels, so that cross - feature terms with a greater contribution to anomaly detection have higher weights.

[0044] According to the weights of each cross - feature term output by the attention network, all cross - feature terms are weighted and aggregated. The weighted average method can be used, that is, each cross - feature term is multiplied by its corresponding weight and then added together to obtain a combined dynamic feature vector. The combined dynamic feature vector is organized according to the order of SMS samples to construct a combined dynamic feature - weighted tensor. The dimensions of the tensor can be set according to specific requirements. For example, it can be set as a three - dimensional tensor, where the first dimension represents the index of the SMS sample, and the second and third dimensions represent the dimensions of the combined dynamic feature vector.

[0045] When constructing the weights of the feature time window, methods such as average weights and weights based on time distance can be used to calculate the initial weights of the feature time window. Then, ways such as element-wise multiplication and weighted summation are adopted to fuse the combined dynamic feature weighted tensor with the initial weights of the feature time window to achieve compensation for the weights of the feature time window. For example, in the way of weighted summation, each element in the combined dynamic feature weighted tensor is multiplied by the corresponding element in the initial weights of the feature time window and then added together to obtain the compensated weights of the feature time window.

[0046] Furthermore, with the text message event as the extraction center, a time window is created, including: Perform situation awareness analysis on the text message event to establish situation awareness constraints; use the situation awareness constraints to reconstruct the time window and adjust the weights of the time points within the time window.

[0047] In the embodiments of the present application, multi-dimensional situation elements are extracted. Specifically, the historical behavior patterns of the text message sender and receiver are analyzed, including the text message sending frequency, sending time preferences (such as weekdays, weekends, daytimes, nights, etc.), common contacts, etc. For example, if a user usually communicates frequently with a specific contact from 8 pm to 10 pm at night, this time period can be regarded as the active situation of the user's text message communication. Identify the business scenario to which the text message belongs, such as marketing promotion, customer service, social interaction, etc. Different types of business scenarios have different time rules and characteristics. For example, marketing promotion text messages may be concentrated during specific promotional activities, while customer service text messages may be sent immediately after the user encounters a problem. Users in different regions may have different text message usage habits due to factors such as time differences and cultural habits. For example, users across time zones may communicate via text messages at different time periods.

[0048] Based on the extracted multi-dimensional situation elements, data mining techniques such as clustering analysis and association rule mining are used to identify common situation patterns. For example, identify situation patterns such as "users have social interactions with friends on weekend nights" and "users receive customer service text messages during weekdays during the day". According to the identified situation patterns, situation awareness constraint conditions are established, including time range constraints, event occurrence order constraints, associated event constraints, etc. For example, for the situation pattern of "users have social interactions with friends on weekend nights", the time range constraint can be from 7 pm to 11 pm on weekends; the event occurrence order constraint can be to send a greeting text message first and then have multiple interactive text message exchanges; the associated event constraint can be that this situation pattern is usually associated with the user's social activities.

[0049] Set an initial time window according to the occurrence time of the SMS event. The size of the initial time window can be set according to business requirements and experience. For example, it can be set to 1 hour before and after the occurrence of the SMS event. Apply the situation awareness constraint conditions to the initial time window to reconstruct the time window; if the SMS event meets a certain situation awareness constraint condition, adjust the range and time point weights of the time window according to this constraint condition. Expand or shrink the initial time window according to the time range constraint in the situation awareness constraint. For example, if the SMS event belongs to the scenario mode of "the user has social interactions with friends on weekend evenings", adjust the time window to 7 pm to 11 pm on weekends. Adjust the weights of each time point within the time window according to the event occurrence order constraint and associated event constraint in the situation awareness constraint. For example, in the scenario mode of "the user has social interactions with friends on weekend evenings", the time point weight of sending a greeting SMS is relatively high, while the time point weights of subsequent interactive SMS exchanges are relatively low.

[0050] Preferably, according to the situation awareness constraint conditions, formulate a series of rules to adjust the time point weights. For example, if a certain time point belongs to the occurrence time of an important event clearly specified in the situation awareness constraint, set the weight of this time point to a higher value; if a certain time point is associated with the associated events in the situation awareness constraint, adjust its weight according to the degree of association. Collect a large amount of historical SMS data, label the scenario mode and time point weights to which each SMS event belongs. Use machine learning algorithms (such as decision trees, neural networks, support vector machines, etc.) to train the labeled data and establish a time point weight prediction model. Input the new SMS event into the trained model, and the model predicts the weights of each time point within the time window according to the situation awareness characteristics of the SMS event.

[0051] Perform the feature extraction of the said SMS event, and calculate the feature deviation degree of each feature respectively by using the feature extraction result.

[0052] The system extracts relevant features from each SMS event, such as the sender operator, the receiver operator, the sending location, the receiving location, the SMS type, the user package type, the sending period, the billing amount, the SMS length, the sending volume, etc.

[0053] After feature extraction is completed, the system calculates the feature deviation degree for each extracted feature. The feature deviation degree refers to the degree of difference between the value of a certain feature in the current SMS event and its historical data or expected standard value. Specifically, the system calculates the deviation degree of each feature based on historical data or benchmark values. For example, if within a certain time window, the sending volume of SMS is much higher than the average value in historical data, the system will calculate the deviation degree of the sending volume at this time point. The larger the deviation degree, the more likely it means that the sending volume of this event is abnormal. Similarly, if the billing amount of an SMS is usually around 0.1 yuan, but the billing amount of a certain event is 0.2 yuan, the system will calculate the deviation degree of this billing amount to determine whether there is a billing error or abnormality. If the sending time period of an SMS occurs at night, while historical data is usually concentrated during the day, the system will also calculate the deviation degree of this sending time period.

[0054] Construct a dynamic feature score using the feature deviation degree and the feature time window weight.

[0055] The feature deviation degree measures the degree of deviation between the value of a feature at the current moment and its historical average value or expected value. The greater the degree of deviation, the more abnormal the performance of this feature at the current moment. The feature time window weight is dynamically calculated based on SMS samples within the time window, reflecting the relative importance of a certain feature in the current time window.

[0056] Combine the feature deviation degree and the time window weight through weighted averaging to generate a dynamic feature score. This score comprehensively considers the deviation degree of the feature and the weight of the time window, and obtains the importance and abnormality degree of each feature in the current event.

[0057] Exemplarily, the features of a certain SMS event include that the sending operator is Operator A, the receiving operator is Operator B, the sending location is Beijing, the receiving location is Shanghai, the SMS type is a normal SMS, and the user package type is Package X. The actual billing cost of this SMS event is 0.15 yuan, and the sending volume is 150 messages. According to historical data, the system calculates that the historical average value of the sending volume is 100 messages, and the historical average value of the billing cost is 0.10 yuan. By comparing the actual billing information of the current event with historical data, the system calculates that the deviation degree of the sending volume is 50 messages (150 messages - 100 messages), and the deviation degree of the billing cost is 0.05 yuan (0.15 yuan - 0.10 yuan). Then, the system adjusts based on the feature weights of the time window. Assume that the current event occurs during peak hours (such as holidays or night peaks), so the system assigns a higher time window weight (0.6) to the sending volume, while the weight of the billing cost is lower (0.4). Then, the system calculates the dynamic feature score of each feature: the dynamic feature score of the sending volume is 50 * 0.6 = 30, and the dynamic feature score of the billing cost is 0.05 * 0.4 = 0.02.

[0058] Generate a total anomaly score using the matching calculation result and the dynamic feature score.

[0059] The system will calculate the total anomaly score by weighting the dynamic feature scores and the matching calculation results of each feature. For example, assume that the system calculates that the dynamic feature score of the sending volume is 30, the dynamic feature score of the billing cost is 0.02, and the matching calculation result (i.e., the difference between the actual billing and the predicted billing) is 0.03 yuan. The system will combine these scores through weighted summation to obtain a total anomaly score, which reflects the overall anomaly degree of the SMS event. The total anomaly score takes into account the anomaly impacts of each feature and the matching situation between the actual billing and the predicted billing, making the final anomaly score more comprehensive and accurate. The higher the value of the total anomaly score, the greater the anomaly degree of the SMS event; if the total anomaly score exceeds the set threshold, the system will trigger an alarm or conduct a detailed investigation to promptly handle possible billing errors or other abnormal situations.

[0060] Furthermore, generating a total anomaly score using the matching calculation result and the dynamic feature score includes: Perform associated backtracking with the SMS event as the backtracking starting point to establish an associated SMS set; extract the behavior track using the associated SMS to establish a behavior track sequence; perform joint track development analysis of the SMS event based on the behavior track sequence to generate track perception anomalies; use the track perception anomalies for compensating the total anomaly score.

[0061] In the embodiment of the present application, perform associated backtracking with the current SMS event as the backtracking starting point. The system establishes an associated SMS set by backtracking the historical SMS samples related to this SMS event; extracts the behavior track using these associated SMS, and constructs a behavior track sequence by analyzing features such as the SMS sending pattern, billing situation, and sending time period. The behavior track sequence reflects the evolution process and trend of the SMS event in the historical data; based on the behavior track sequence, the system performs joint track development analysis, evaluates the relationship between the current SMS event and the historical track, identifies potential abnormal behaviors, and generates track perception anomalies; the system uses the generated track perception anomalies to compensate the total anomaly score; if the track perception anomalies indicate that the behavior pattern of the current event is significantly deviated from the historical track, the system will adjust the total anomaly score according to this abnormal information, thereby making the score more accurate and ensuring the accurate identification and handling of abnormal events.

[0062] Furthermore, performing associated backtracking with the SMS event as the backtracking starting point to establish an associated SMS set includes: Perform short message event analysis under six - dimensional attributes, and establish event semantic vectors; use the event semantic vectors to perform association matching under the backtracking starting point to generate a first association result; obtain the spatio - temporal position data of the short message event, and perform association matching under the backtracking starting point according to the spatio - temporal position data to generate a second association result; use the first association result and the second association result to perform short message screening and establish an associated short message set.

[0063] Preferably, the system uses the short message event as the backtracking starting point for association backtracking. By performing short message event analysis under six - dimensional attributes, it constructs event semantic vectors, converts the six main attributes of the short message event (such as the sender operator, the receiver operator, the sending location, the receiving location, the short message type, and the user package type) into high - dimensional vector representations to capture the basic information of the event and its internal relevance. Then, the system uses these event semantic vectors to perform association matching under the backtracking starting point to generate a first association result, identifying the historical short message events that are semantically most similar to the current short message event. At the same time, the system also obtains the spatio - temporal position data of the short message event, such as the sending time and geographical location, and performs association matching under the backtracking starting point based on this information to generate a second association result, revealing the historical short message events that are spatio - temporally similar to the current event. Finally, the system integrates the first association result and the second association result for short message screening and establishes the final associated short message set, and these associated short message sets reflect the historical events that are similar to the current short message event in semantic and spatio - temporal characteristics.

[0064] Furthermore, after generating the total anomaly score using the matching calculation result and the dynamic feature score, it includes: Perform anomaly level matching according to the total anomaly score, and establish an early warning plan with the anomaly level matching result and the anomaly item. Among them, the early warning plan includes an early warning reporting plan and a control response plan; manage the account subject of the corresponding user according to the early warning plan and feedback an early warning notice.

[0065] In the embodiment of the present application, after generating the total anomaly score by using the matching calculation result and the dynamic feature score, the system performs anomaly level matching according to the total anomaly score; according to the level of the score, the system divides the SMS events into different anomaly levels, such as low risk, medium risk, and high risk, etc., and sets corresponding countermeasures according to the anomaly level matching result. The system formulates an early warning plan in combination with the anomaly level matching result and the anomaly item, including an early warning reporting plan and a control response plan. Among them, the early warning reporting plan defines how to issue an alarm to relevant personnel or systems when the anomaly level reaches the set threshold; the control response plan stipulates the specific control measures to be taken when an anomaly occurs, such as suspending charging, re-auditing charging rules, or taking other intervention measures. According to the early warning plan, the system manages the account entity of the corresponding user to ensure that the anomaly event is processed in a timely manner. If the anomaly event is related to a certain user's account, the system will take measures such as freezing the account or suspending the service. In addition, the system will also feedback the early warning notice, and notify the relevant staff or system of the anomaly detection result in a timely manner to ensure that subsequent processing measures can be taken quickly.

[0066] Furthermore, generating the total anomaly score by using the matching calculation result and the dynamic feature score further includes: Setting a dynamic density threshold, and using the dynamic density threshold to evaluate the anomaly significance of the SMS event; correcting the total anomaly score according to the anomaly significance evaluation result.

[0067] In the process of generating the total anomaly score by using the matching calculation result and the dynamic feature score, the system also sets a dynamic density threshold and uses this threshold to evaluate the anomaly significance of the SMS event. The dynamic density threshold is dynamically calculated according to the historical data and the characteristics of the real-time SMS events, and reflects the density of event anomalies within a given time window. When the anomaly degree of the SMS event exceeds this threshold, the system will regard it as a significant anomaly and give it priority for processing. Based on the anomaly significance evaluation result, the system corrects the total anomaly score. If the anomaly significance of a certain SMS event is high, the system will increase its anomaly score to better reflect the risk of the event; if the significance is low, the anomaly score will be correspondingly reduced.

[0068] In summary, the embodiment of the present application has at least the following technical effects: After parsing the charging files of the operator, a six-dimensional tensor structure is extracted. The six-dimensional tensor structure includes the sending operator, the receiving operator, the sending location, the receiving location, the SMS type, and the user package type. When an SMS event arrives, the six-tuple of the attributes of the SMS event is extracted as the tensor index, the corresponding tensor unit of the six-dimensional tensor structure is accessed, and the matching calculation between the actual charging result of the SMS event and the tensor return result is performed to generate a matching calculation result. Then, with the SMS event as the extraction center, a time window is created, and the SMS samples within the time window are called, and the characteristic time window weight of the SMS event is established using the SMS samples. Next, the feature extraction of the SMS event is performed, and the feature deviation degree of each feature is calculated using the feature extraction result. Further, a dynamic feature score is constructed using the feature deviation degree and the characteristic time window weight. Finally, a total anomaly score is generated using the matching calculation result and the dynamic feature score. This solves the technical problem of low accuracy in SMS charging anomaly detection in the prior art and achieves the technical effect of improving the accuracy of SMS charging anomaly detection.

[0069] Embodiment 2, based on the same inventive concept as the multi-dimensional anomaly detection method for the operator-level SMS charging system in the foregoing embodiment, as Figure 2 shown, the present application provides a multi-dimensional anomaly detection system for an operator-level SMS charging system, wherein the system includes: A data extraction module 11, configured to extract a six-dimensional tensor structure after parsing the charging files of the operator, where the six-dimensional tensor structure includes the sending operator, the receiving operator, the sending location, the receiving location, the SMS type, and the user package type; a matching module 12, configured to, when an SMS event arrives, extract the six-tuple of the attributes of the SMS event as the tensor index, access the corresponding tensor unit of the six-dimensional tensor structure, perform the matching calculation between the actual charging result of the SMS event and the tensor return result, and generate a matching calculation result; a weight establishment module 13, configured to create a time window with the SMS event as the extraction center, call the SMS samples within the time window, and establish the characteristic time window weight of the SMS event using the SMS samples; a calculation module 14, configured to perform the feature extraction of the SMS event and calculate the feature deviation degree of each feature using the feature extraction result; a feature score construction module 15, configured to construct a dynamic feature score using the feature deviation degree and the characteristic time window weight; and a score generation module 16, configured to generate a total anomaly score using the matching calculation result and the dynamic feature score.

[0070] Further, the data extraction module 11 is configured to execute the following method: Perform the rule duration evaluation and general comparison evaluation of the billing rules according to the parsing results; use the rule duration evaluation results and general comparison evaluation results to determine the benchmark tensor structure; after determining the benchmark tensor structure, perform incremental learning of all parsing results relative to the benchmark tensor structure, and extract the six-dimensional tensor structure according to the incremental learning results and the benchmark tensor structure.

[0071] Further, the weight establishment module 13 is used to execute the following method: Perform six-tuple dimensional embedding encoding on historical short message samples to establish a dense vector representation; combine the dense vector representations in pairs to construct cross feature terms; input the cross feature terms into an attention network to perform weight influence learning on the contribution of cross combination to anomaly detection; generate a combined dynamic feature weighted tensor according to the weight influence learning results; compensate the feature time window weights according to the combined dynamic feature weighted tensor.

[0072] Further, the weight establishment module 13 is used to execute the following method: Perform scenario awareness analysis on the short message event to establish scenario awareness constraints; use the scenario awareness constraints to reconstruct the time window and adjust the time point weights within the time window.

[0073] Further, the matching module 12 is used to execute the following method: Call the historical deviation between the actual billing of the short message event and the tensor mapping value; use a lightweight regression model to perform local residual trend learning on the historical deviation to generate a tensor residual prediction term; correct the matching calculation results according to the tensor residual prediction term.

[0074] Further, the scoring generation module 16 is used to execute the following method: Perform association backtracking with the short message event as the backtracking starting point to establish an associated short message set; use the associated short messages to extract behavior trajectories and establish a behavior trajectory sequence; perform joint trajectory development analysis of the short message event according to the behavior trajectory sequence to generate trajectory-aware anomalies; use the trajectory-aware anomalies to perform total anomaly score compensation.

[0075] Further, the scoring generation module 16 is used to execute the following method: Perform short message event analysis under six-dimensional attributes to establish an event semantic vector; use the event semantic vector to perform association matching under the backtracking starting point to generate a first association result; obtain the spatio-temporal position data of the short message event, and perform association matching under the backtracking starting point according to the spatio-temporal position data to generate a second association result; use the first association result and the second association result to perform short message screening to establish an associated short message set.

[0076] Further, the scoring generation module 16 is used to execute the following method: Match the exception level according to the total exception score, and establish a warning plan based on the exception level matching result and the exception item, where the warning plan includes a warning reporting plan and a control response plan; manage the account entity of the corresponding user according to the warning plan, and feedback a warning notice.

[0077] Further, the scoring generation module 16 is used to execute the following method: Set a dynamic density threshold, and use the dynamic density threshold to evaluate the abnormality significance of the SMS event; correct the total exception score according to the abnormality significance evaluation result.

[0078] It should be noted that the above sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above description of specific embodiments of this specification has been made. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0079] The above are only the preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0080] This specification and the drawings are only exemplary descriptions of the present application and are considered to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalent technologies, the present application is intended to include these changes and modifications.

Claims

1. A multi-dimensional anomaly detection method for a carrier-level SMS billing system, characterized in that: The method comprises: After parsing the operator's billing file, extract a six-dimensional tensor structure, which includes the sender operator, the receiver operator, the sending location, the receiving location, the SMS type, and the user package type; When a text message event arrives, extract the attribute six-tuple of the text message event as a tensor index, access the tensor unit corresponding to the six-dimensional tensor structure, perform matching calculation between the actual billing result of the text message event and the tensor return result, and generate a matching calculation result; Taking the SMS event as the extraction center, creating a time window, calling SMS samples within the time window, and using the SMS samples to establish the characteristic time window weight of the SMS event; Execute feature extraction of the SMS event, and use the feature extraction results to calculate the feature deviation of each feature; Constructing a dynamic feature score using the feature deviation and the feature time window weight; The matching calculation result and the dynamic feature score are used to generate a total anomaly score.

2. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 1, characterized in that: After parsing the operator's billing file, a six-dimensional tensor structure is extracted, including: Conduct rule duration evaluation and general comparison evaluation of billing rules based on the analysis results; Determine the benchmark tensor structure using the rule duration evaluation results and the general comparison evaluation results; After determining the reference tensor structure, incremental learning of all analytical results relative to the reference tensor structure is performed, and the six-dimensional tensor structure is extracted based on the incremental learning results and the reference tensor structure.

3. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 1, characterized in that: The step of using the SMS sample to establish the characteristic time window weight of the SMS event includes: Perform six-tuple dimension embedding encoding of historical SMS samples to build a dense vector representation; Combining the dense vector representations in pairs to construct cross-feature items; Inputting the cross-feature items into the attention network to perform weighted learning of the contribution of the cross-combination to anomaly detection; Generate a combined dynamic feature weighted tensor based on the weight impact learning results; The feature time window weight is compensated according to the combined dynamic feature weighted tensor.

4. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 1, characterized in that: The process of using the SMS event as an extraction center and creating a time window includes: Performing situation-aware analysis on the SMS event and establishing situation-aware constraints; The time window is reconstructed using the context-aware constraints, and the weights of time points within the time window are adjusted.

5. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 1, characterized in that: The actual billing result of the SMS event is executed and the matching calculation is performed on the tensor return result to generate the matching calculation result, including: Call the historical deviation between the actual billing of SMS events and the tensor mapping value; Using a lightweight regression model to perform local residual trend learning of the historical deviation to generate a tensor residual prediction item; The matching calculation result is corrected according to the tensor residual prediction item.

6. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 1, characterized in that: The generating a total anomaly score by using the matching calculation result and the dynamic feature score includes: Perform associated backtracking using the SMS event as the backtracking starting point to establish an associated SMS set; Extracting behavior trajectories using the associated short messages to establish a behavior trajectory sequence; Performing a joint trajectory development analysis of the SMS events according to the behavior trajectory sequence to generate a trajectory perception anomaly; The trajectory-aware anomaly is used to perform total anomaly score compensation.

7. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 5, characterized in that: The process of performing associated backtracking with the SMS event as the backtracking starting point to establish an associated SMS set includes: Perform SMS event analysis under six-dimensional attributes and establish event semantic vectors; Using the event semantic vector to perform association matching at the backtracking starting point to generate a first association result; Acquire the spatiotemporal location data of the SMS event, and perform correlation matching at the backtracking starting point according to the spatiotemporal location data to generate a second correlation result; The first association result and the second association result are used to screen short messages and establish a set of associated short messages.

8. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 1, characterized in that: After the total anomaly score is generated by using the matching calculation result and the dynamic feature score, the method includes: Performing abnormality level matching according to the total abnormality score, and establishing an early warning plan based on the abnormality level matching result and the abnormal item, wherein the early warning plan includes a pre-alarm plan and a control response plan; The corresponding user's account subject management is performed according to the warning plan, and warning notifications are fed back.

9. The multi-dimensional anomaly detection method for a carrier-level SMS billing system according to claim 1, characterized in that: The generating of the total anomaly score by using the matching calculation result and the dynamic feature score also includes: Setting a dynamic density threshold, and using the dynamic density threshold to evaluate the abnormal significance of SMS events; The total anomaly score is corrected according to the anomaly significance assessment results.

10. A multi-dimensional anomaly detection system for carrier-grade SMS billing systems, characterized in that: A multi-dimensional anomaly detection method for a carrier-level SMS billing system for implementing any one of claims 1 to 9, the system comprising: A data extraction module, for extracting a six-dimensional tensor structure after parsing the operator's billing file, wherein the six-dimensional tensor structure includes a sender operator, a receiver operator, a sending location, a receiving location, a text message type, and a user package type; The matching module is used to extract the attribute six-tuple of the SMS event as the tensor index when the SMS event arrives, access the tensor unit corresponding to the six-dimensional tensor structure, perform the matching calculation between the actual billing result of the SMS event and the tensor return result, and generate the matching calculation result; A weight establishment module, used to create a time window with the SMS event as the extraction center, and call SMS samples within the time window to establish the characteristic time window weight of the SMS event using the SMS samples; A calculation module, used to perform feature extraction of the SMS event, and calculate the feature deviation of each feature using the feature extraction result; A feature scoring construction module, used to construct a dynamic feature score using the feature deviation and the feature time window weight; The scoring generation module is used to generate a total anomaly score using the matching calculation result and the dynamic feature score.

Images