Telecommunication service risk control system and method based on machine learning

Abstract

The invention relates to the technical field of data processing, in particular to a telecommunication service risk control system and method based on machine learning, and the system comprises a data collection module, a first determination module, a second determination module, a first judgment module, a second judgment module and an adjustment module. Through real-time acquisition and intelligent analysis of multiple key data, potential abnormal accounts can be identified in time and accurately judged, through dynamic adjustment of a flow fluctuation threshold and secondary judgment based on a machine learning model, the sensitivity of the system to behavior changes of different accounts is improved, and the accuracy of the system is improved. In addition, intelligent adjustment is carried out according to the number of abnormal accounts and behavior characteristics, the capability of telecom operators to cope with account risks is remarkably improved, and the safety of telecom operators is improved. The problem that the response speed is low when a dynamic service scene is dealt with due to dependence on static operation data and judgment rules is effectively solved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular, to a telecommunications service risk control system and method based on machine learning. Background Art

[0002] With the rapid development of information technology, the telecommunications industry is facing an increasingly complex operating environment and diverse risk challenges. Telecommunications operators not only need to provide stable network services, but also handle a large amount of user data and transaction activities to ensure the security and legality of their services. However, due to the complexity and dynamic changes of telecommunications services, traditional risk control measures are often difficult to effectively cope with emerging risk types, resulting in many hidden dangers in operation and management.

[0003] The patent document with the publication number CN118195297A discloses a telecommunications operator risk control system, which includes: a data interface module for obtaining the operation data of a telecommunications operator; a data landing module for packing the operation data into corresponding storage objects; a format conversion module for converting the storage objects into acquisition objects according to configured conversion rules; a data integration module for integrating the acquisition objects into risk control objects; and a risk control management module for configuring judgment rules according to business scenarios and processing the risk control objects according to the judgment rules to generate risk event instances.

[0004] It can be seen that the telecommunications operator risk control system has the following problems: the system obtains static operation data through the data interface module and goes through steps such as data landing and format conversion, resulting in low timeliness of data processing; the system integrates the collected objects into risk control objects and processes them according to judgment rules configured according to business scenarios, resulting in a large processing complexity when the system copes with complex business scenarios; the system relies on manual settings and is difficult to quickly adjust in a dynamic environment. Summary of the Invention

[0005] To this end, the present invention provides a telecommunications service risk control system and method based on machine learning, which are used to overcome the problem of low response speed in dealing with dynamic business scenarios in the prior art due to relying on static operation data and judgment rules through real-time data collection and anomaly detection based on machine learning.

[0006] To achieve the above object, on the one hand, the present invention provides a telecommunications service risk control system based on machine learning, including:

[0007] A data collection module for collecting the real-time traffic usage, real-time balance change value, and real-time call frequency of each account to be analyzed in the telecommunications service data source;

[0008] A first determination module, connected to the data acquisition module, for determining a number of first temporary accounts according to the real-time traffic usage and a preset traffic fluctuation threshold;

[0009] A second determination module, respectively connected to the data acquisition module and the first determination module, for determining a number of second temporary accounts according to the real-time balance change value and the real-time call frequency of each of the first temporary accounts;

[0010] A first determination module, respectively connected to the data acquisition module and the second determination module, for determining a number of first abnormal accounts according to the real-time traffic usage, the real-time balance change value, and the real-time call frequency of any two of the second temporary accounts;

[0011] A second determination module, respectively connected to the data acquisition module and the first determination module, for determining a number of second abnormal accounts according to a preset machine learning model, the real-time traffic usage, the real-time balance change value, and the real-time call frequency of all the accounts to be analyzed;

[0012] An adjustment module, respectively connected to the first determination module and the second determination module, for adjusting the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold;

[0013] A control module, respectively connected to the adjustment module and the first determination module, for controlling the permissions of the first abnormal accounts determined based on the adjusted traffic threshold.

[0014] Further, the first determination module includes:

[0015] A traffic fluctuation calculation unit, for calculating the standard deviation of the real-time traffic usage within a preset first determination duration to form a traffic fluctuation value;

[0016] A first determination unit, connected to the traffic fluctuation calculation unit, for determining the account to be analyzed as a first abnormal account when the traffic fluctuation value is greater than the preset traffic fluctuation threshold to form a number of first temporary accounts.

[0017] Further, the second determination module includes:

[0018] A balance fluctuation calculation unit, for calculating the standard deviation of the real-time balance change value within a preset second determination duration to form a balance change fluctuation value;

[0019] A frequency fluctuation calculation unit, for calculating the standard deviation of the real-time call frequency within the preset second determination duration to form a frequency fluctuation value;

[0020] A second determination unit, configured to determine a plurality of second temporary accounts according to the balance change fluctuation value and the frequency fluctuation value.

[0021] Further, the second determination unit includes:

[0022] A balance curve drawing subunit, configured to draw a balance change curve according to the balance change fluctuation value;

[0023] A frequency curve drawing subunit, configured to draw a frequency change curve according to the frequency fluctuation value;

[0024] A consistency calculation subunit, which is respectively connected to the balance curve drawing subunit and the frequency curve drawing subunit, and is configured to calculate the cosine similarity between the balance change curve and the frequency change curve to form a consistency;

[0025] A second determination subunit, which is connected to the consistency calculation subunit, and is configured to determine the first temporary account as the second temporary account when the consistency is less than a preset consistency threshold.

[0026] Further, the first determination module includes:

[0027] An integration unit, configured to integrate the real-time traffic usage, the real-time balance change value, and the real-time call frequency of a single second temporary account into a single three-dimensional vector to form an integration vector;

[0028] A normalization unit, which is connected to the integration unit, and is configured to perform normalization processing on the integration vector to form a normalized vector;

[0029] A first determination unit, which is connected to the normalization unit, and is configured to determine a plurality of first abnormal accounts according to any two of the normalized vectors.

[0030] Further, the first determination unit includes:

[0031] A similarity calculation subunit, which is connected to the normalization unit, and is configured to calculate the Euclidean distance between any two of the normalized vectors to form an abnormal similarity;

[0032] A first determination subunit, which is connected to the similarity calculation subunit, and is configured to determine that the corresponding two second temporary accounts are both first abnormal accounts when the abnormal similarity is greater than a preset similarity threshold, to form a plurality of first abnormal accounts.

[0033] Further, the second determination module includes:

[0034] A probability prediction unit, which is used to use the preset machine learning model to predict the real-time traffic usage, the real-time balance change value, and the real-time call frequency of each account to be analyzed, and obtain a number of anomaly probability values;

[0035] A second determination unit, which is connected to the probability prediction unit, and is used to determine the account to be analyzed as a second abnormal account when the anomaly probability value is greater than a preset probability value threshold, and form a number of second abnormal accounts.

[0036] Further, the adjustment module includes:

[0037] A deviation calculation unit, which is used to calculate the relative deviation between the number of the first abnormal accounts and the number of the second abnormal accounts, and form a quantity deviation;

[0038] An adjustment unit, which is used to adjust the preset traffic fluctuation threshold according to the quantity deviation and a preset adjustment coefficient, and form an adjusted traffic threshold.

[0039] Further, the adjustment unit includes:

[0040] A deviation fluctuation calculation sub-unit, which is used to calculate the standard deviation of the quantity deviation within a preset adjustment duration, and form a quantity deviation fluctuation value;

[0041] An adjustment sub-unit, which is connected to the deviation fluctuation calculation sub-unit, and is used to reduce the preset traffic fluctuation threshold according to the relative deviation between the quantity deviation fluctuation value and a preset quantity deviation fluctuation threshold and the preset adjustment coefficient when the quantity deviation fluctuation value is greater than the preset quantity deviation fluctuation threshold, and form an adjusted traffic threshold.

[0042] On the other hand, the present invention also provides a machine learning-based telecommunication service risk control method, including:

[0043] Collect the real-time traffic usage, the real-time balance change value, and the real-time call frequency of each account to be analyzed in the telecommunication service data source;

[0044] Determine a number of first temporary accounts according to the real-time traffic usage and a preset traffic fluctuation threshold;

[0045] Determine a number of second temporary accounts according to the real-time balance change value and the real-time call frequency of each of the first temporary accounts;

[0046] Determine a number of first abnormal accounts according to the real-time traffic usage, the real-time balance change value, and the real-time call frequency of any two of the second temporary accounts;

[0047] Determine a number of second abnormal accounts according to a preset machine learning model, the real-time traffic usage of all the accounts to be analyzed, the real-time balance change value, and the real-time call frequency;

[0048] Adjust the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold;

[0049] Control the permissions of the first abnormal accounts determined based on the adjusted traffic threshold.

[0050] Compared with the prior art, the beneficial effects of the present invention are as follows: by collecting and intelligently analyzing multiple key data in real time (such as traffic usage, balance change, and call frequency), potential abnormal accounts can be identified in a timely manner and accurately determined. Through dynamically adjusting the traffic fluctuation threshold and secondary determination based on the machine learning model, not only the sensitivity of the system to the behavior changes of different accounts is improved, but also the misjudgment or missed judgment caused by overly fixed thresholds set manually can be effectively reduced. In addition, the system makes intelligent adjustments according to the number of abnormal accounts and their behavior characteristics, significantly improving the ability of telecom operators to respond to account risks, reducing potential losses and operation risks, and effectively solving the problem of low response speed in dealing with dynamic business scenarios due to relying on static operation data and judgment rules.

[0051] Furthermore, by calculating the volatility of traffic, accounts with abnormal fluctuations are effectively screened out, so as to identify potential risk accounts early and avoid the spread of traffic abuse or other abnormal behaviors. By judging according to the preset traffic fluctuation threshold, the accuracy and flexibility of the system are improved, and it can be adjusted according to the actual situation to ensure more accurate risk control.

[0052] Furthermore, by comprehensively analyzing the fluctuation situations of the balance change and the call frequency, the second determination module can more comprehensively evaluate the risk characteristics of the accounts, help the system more accurately screen out the accounts with abnormalities, and improve the risk control effect. By considering multiple data dimensions simultaneously, the misjudgment caused by a single indicator is avoided, and the accuracy and reliability of risk identification are improved.

[0053] Furthermore, by drawing the balance change curve and the frequency change curve and calculating their cosine similarity, the correlation between account behavior patterns can be more accurately identified, so as to effectively distinguish normal and abnormal accounts. This method improves the identification accuracy of account abnormal behaviors, avoids the deviation of single-parameter judgment, and enhances the overall reliability and flexibility of the risk control system.

[0054] Furthermore, by integrating data from multiple dimensions into a unified three-dimensional vector and performing normalization processing, the first determination module can effectively eliminate the dimensional differences between different data features, thereby improving the accuracy and stability of abnormal account determination, ensuring the precise identification of account risks, and enhancing the reliability and response speed of the telecommunications service risk control system.

[0055] Furthermore, by calculating the Euclidean distance between accounts and comparing it with a preset similarity threshold, it is possible to accurately identify those accounts that exhibit similar abnormal behaviors in multiple indicators, thereby improving the accuracy of abnormal account identification, effectively enhancing the risk control ability of the system, reducing the possibility of misjudgment or missed judgment, and ensuring the security and stability of telecommunications services.

[0056] Furthermore, by predicting the abnormal possibility of an account through a machine learning model, it is possible to identify potential risk accounts in advance. Compared with traditional rule-based judgments, the probability-based judgment method is more adaptable to complex behavior patterns, providing higher accuracy and flexibility, and can effectively reduce the misjudgment rate and missed judgment rate.

[0057] Furthermore, by dynamically optimizing the traffic fluctuation threshold according to the change in the number of abnormal accounts, it is possible to improve the adaptability and accuracy of the system to different situations, avoid misjudgment or missed judgment caused by a fixed threshold, and further enhance the flexibility and precision of the telecommunications service risk control system.

[0058] Furthermore, by dynamically adjusting the threshold to improve the adaptability and precision of the system, it is possible to more accurately respond to the fluctuation in the number of abnormal accounts, effectively avoid misjudgment caused by the fluctuation in the number of abnormal accounts, and enhance the flexibility and robustness of the risk control system in actual operation.

[0059] Furthermore, by real-time adjusting the traffic fluctuation threshold, improving the sensitivity and response speed to abnormal behaviors, and relying on a machine learning model to maintain high accuracy and reliability in a dynamically changing environment, it is possible to achieve more precise risk control and resource management, effectively reduce the risk of misjudgment and missed judgment, and ensure the stability and security of the telecommunications network. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 is a schematic diagram of the telecommunications service risk control system based on machine learning in this embodiment;

[0061] Figure 2 is a determination logic diagram of the first abnormal account determined by the first determination unit in this embodiment;

[0062] Figure 3 is a determination logic diagram of the second temporary account determined by the second determination subunit in this embodiment;

[0063] Figure 4This is a flowchart of the method for controlling the risk of telecommunications services based on machine learning in this embodiment. Detailed implementation manners

[0064] In order to make the objectives and advantages of the present invention clearer, the present invention will be further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0065] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are only used to explain the technical principles of the present invention and do not limit the protection scope of the present invention.

[0066] On the one hand, please refer to Figure 1 as shown, which is a schematic diagram of the system for controlling the risk of telecommunications services based on machine learning in this embodiment;

[0067] This embodiment provides a system for controlling the risk of telecommunications services based on machine learning, including:

[0068] A data acquisition module for acquiring the real-time traffic usage, real-time balance change value, and real-time call frequency of each account to be analyzed in the telecommunications service data source;

[0069] A first determination module, connected to the data acquisition module, for determining a number of first temporary accounts according to the real-time traffic usage and a preset traffic fluctuation threshold;

[0070] A second determination module, respectively connected to the data acquisition module and the first determination module, for determining a number of second temporary accounts according to the real-time balance change value and the real-time call frequency of each of the first temporary accounts;

[0071] A first determination module, respectively connected to the data acquisition module and the second determination module, for determining a number of first abnormal accounts according to the real-time traffic usage, the real-time balance change value, and the real-time call frequency of any two of the second temporary accounts;

[0072] A second determination module, respectively connected to the data acquisition module and the first determination module, for determining a number of second abnormal accounts according to a preset machine learning model, the real-time traffic usage, the real-time balance change value, and the real-time call frequency of all the accounts to be analyzed;

[0073] An adjustment module, respectively connected to the first determination module and the second determination module, for adjusting the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold;

[0074] A control module, which is respectively connected to the adjustment module and the first determination module, is used to control the permissions of the first abnormal accounts determined based on the adjusted traffic threshold.

[0075] The control module will restrict certain permissions of the first abnormal accounts, such as restricting high-traffic operations, suspending account services, or setting consumption limits, so as to prevent potential risk events from occurring.

[0076] The telecommunications service data sources include the billing system, network monitoring system, telecommunications accounting system, and data exchange platform of the communication network. These data sources store and provide real-time information such as the traffic usage, balance changes, and call frequencies of accounts. The data acquisition module is connected to these data sources through interfaces to obtain in real time the traffic usage amounts, balance change values, and call frequency data of each account to be analyzed. These data are collected in real time through API or database query methods, and it is ensured that the data updates are synchronized with the telecommunications services, thereby providing timely and accurate data support for the risk control system.

[0077] The real-time traffic usage amount refers to the network traffic actually consumed by a user within a unit time period (such as data transmission, video viewing, and web page browsing). The data acquisition module accesses the billing system or network monitoring system in the telecommunications service system to track the traffic consumption of each account in real time. The system updates the traffic data regularly (for example, every second or minute), and marks the time of each update with a timestamp to ensure that the traffic data of all accounts is collected on time.

[0078] The real-time balance change value refers to the dynamic change situation of the account balance. The data acquisition module docks with the telecommunications accounting system to obtain the change situation of the account balance at regular intervals. Each time the account balance changes, the system records the changed amount and the change time, and ensures that the balance data of all accounts is updated synchronously. By using timestamps or periodic polling methods, the real-time nature and consistency of the data are ensured.

[0079] The real-time call frequency refers to the number of calls and call durations of a user within a unit time period. The data acquisition module accesses the data exchange platform of the communication network to monitor the call frequency of each account in real time. The system will update the call times, call durations, etc. of each account regularly, and collect data synchronously according to the preset update cycle. Each time data is collected, the data will be synchronized with an accurate timestamp to correctly reflect the change in call frequency.

[0080] The preset traffic fluctuation threshold is a standard value used to judge whether the traffic fluctuation of an account is abnormal. It depends on historical data analysis, the normal traffic fluctuation range, and the characteristics of the telecommunications service. It is usually set between 5% and 20%. In this embodiment, it is set to 10%, which can balance the sensitivity of risk control, accurately identify abnormal fluctuations, and avoid misjudging normal fluctuations.

[0081] The pre-set machine learning model is a core component in this telecommunications service risk control system, which is used to intelligently analyze and predict the behaviors of telecommunications accounts based on historical data and real-time data. It mainly forms a model that can automatically judge whether there are abnormal risks in an account by learning the patterns and abnormal behaviors in a large amount of account data (including parameters such as traffic usage, balance change value, and call frequency).

[0082] The pre-set machine learning model includes:

[0083] Data input layer: This layer is responsible for receiving and processing the input data from the data collection module, mainly including real-time traffic usage, real-time balance change value, and real-time call frequency;

[0084] Data input layer parameter setting: In the data input layer, the data needs to be pre-processed and standardized to ensure that the data ranges of all input features are relatively consistent.

[0085] Feature extraction layer: Enhance the data representation ability by calculating a series of statistics or derived features. The features include:

[0086] Traffic fluctuation: Measure the fluctuation of the traffic used by an account by calculating the standard deviation of the traffic within a certain period of time;

[0087] Balance change fluctuation: Measure the change range of the account balance by the standard deviation or other volatility indicators;

[0088] Call frequency fluctuation: Judge whether there is abnormal fluctuation by analyzing the change of the call frequency.

[0089] Feature extraction layer parameter setting: In the feature extraction layer, a window period (such as the past 24 hours, 7 days, etc.) can be set to calculate these fluctuation indicators, or the dynamic change within a certain period of time can be calculated by weighted average. In addition, different feature calculation methods can be selected according to business requirements.

[0090] Training layer: In this layer, the machine learning model trains on historical data to capture the relationship between account behaviors and anomalies, using supervised learning algorithms, such as using deep learning models to capture more complex non-linear relationships;

[0091] Training layer parameter settings include:

[0092] Training set: Usually, a large amount of historical account data is adopted, including normal accounts and known abnormal accounts.

[0093] Prediction layer: In this layer, the model makes predictions on the real-time input account data. The model calculates the anomaly probability based on features such as real-time traffic usage, balance change value, and call frequency. The prediction process includes:

[0094] Abnormal probability calculation: The model outputs the abnormal probability of each account, indicating the likelihood that the account is an abnormal account;

[0095] Feedback and optimization layer:

[0096] This layer is responsible for providing feedback based on the output results of the model and continuously optimizing the model through actual effects. The system will evaluate the prediction effect of the model and adjust the model through incremental learning or online learning. For example:

[0097] Model retraining: If certain new abnormal patterns or trends are detected, the model will retrain on new data to improve its ability to identify new types of abnormalities.

[0098] Adjusting the threshold: According to the actual operation of the system, the abnormal probability threshold or other decision rules may be adjusted;

[0099] Feedback and optimization layer parameter settings:

[0100] Retraining cycle: Adopt online learning to continuously adjust the model according to real-time data.

[0101] The data acquisition module obtains the traffic usage, balance change value, and call frequency of each account in the telecommunications service data source in real time. The first determination module identifies the first temporary account based on the real-time traffic usage and the preset traffic fluctuation threshold, and the second determination module further screens the second temporary account according to the balance change and call frequency. The first judgment module determines the first abnormal account based on multiple data of the second temporary account, and the second judgment module uses a machine learning model to predict all the account data to be analyzed and determines the second abnormal account. The adjustment module adjusts the traffic fluctuation threshold according to the number of abnormal accounts, and the final control module manages the permissions of abnormal accounts according to the adjusted threshold.

[0102] By collecting and intelligently analyzing multiple key data in real time (such as traffic usage, balance change, and call frequency), potential abnormal accounts can be identified in a timely manner and accurately determined. Through dynamically adjusting the traffic fluctuation threshold and secondary determination based on the machine learning model, not only the sensitivity of the system to changes in different account behaviors is improved, but also misjudgments or missed judgments caused by overly fixed thresholds set manually can be effectively reduced. In addition, the system makes intelligent adjustments according to the number of abnormal accounts and their behavioral characteristics, significantly enhancing the telecommunications operator's ability to respond to account risks, reducing potential losses and operational risks, and effectively solving the problem of low response speed when dealing with dynamic business scenarios due to relying on static operation data and judgment rules.

[0103] Please continue to refer to Figure 2 as shown, which is the determination logic diagram of the first determination unit in this embodiment for determining the first abnormal account;

[0104] The first determination module includes:

[0105] A traffic fluctuation calculation unit, configured to calculate the standard deviation of the real-time traffic usage within a preset first determination duration, and form a traffic fluctuation value;

[0106] A first determination unit, connected to the traffic fluctuation calculation unit, configured to determine the account to be analyzed as a first abnormal account when the traffic fluctuation value is greater than the preset traffic fluctuation threshold, and form a number of first temporary accounts.

[0107] The preset first determination duration is the time period for calculating the standard deviation of the real-time traffic usage, which depends on business requirements, data update frequency, and the risk range to be analyzed. It is usually set between 1 hour and 24 hours. In this embodiment, it is set to 6 hours, which helps to balance real-time performance and stability, can effectively capture traffic fluctuations in the short term, and avoid interference from overly frequent fluctuations.

[0108] The standard deviation of the real-time traffic usage within the preset first determination duration is calculated by the traffic fluctuation calculation unit to obtain a traffic fluctuation value. If the traffic fluctuation value is greater than the preset traffic fluctuation threshold, the first determination unit will determine the account as a first abnormal account and form a number of first temporary accounts. This process helps to quickly identify accounts with large traffic fluctuations within the preset time period.

[0109] By calculating the volatility of traffic, abnormal fluctuation accounts are effectively screened out, thereby identifying potential risk accounts early and avoiding the spread of traffic abuse or other abnormal behaviors. Through the judgment of the preset traffic fluctuation threshold, the accuracy and flexibility of the system are improved, and it can be adjusted according to the actual situation to ensure more accurate risk control.

[0110] Specifically, the second determination module includes:

[0111] A balance fluctuation calculation unit, configured to calculate the standard deviation of the real-time balance change within a preset second determination duration, and form a balance change fluctuation value;

[0112] A frequency fluctuation calculation unit, configured to calculate the standard deviation of the real-time call frequency within the preset second determination duration, and form a frequency fluctuation value;

[0113] A second determination unit, configured to determine a number of second temporary accounts according to the balance change fluctuation value and the frequency fluctuation value.

[0114] The preset second determination duration refers to the time period used to calculate the change value of the account balance and the fluctuation value of the call frequency, which depends on the usage pattern of the telecommunications service and the data collection frequency. It is usually set between 30 minutes and 24 hours. In this embodiment, it is set to 1 hour, which can balance the capture of data fluctuations and the real-time performance of business operations. It can not only detect abnormal changes in the account in a timely manner but also avoid misjudgment of frequent fluctuations in a short period, thereby improving the accuracy of risk identification.

[0115] By comprehensively analyzing the balance change and the fluctuation of the call frequency, the second determination module can more comprehensively evaluate the risk characteristics of the account, help the system more accurately screen out abnormal accounts, and improve the risk control effect. By considering multiple data dimensions simultaneously, it avoids misjudgment caused by a single indicator and improves the accuracy and reliability of risk identification.

[0116] The real-time balance change value and the real-time call frequency are analyzed by two calculation units. First, the balance fluctuation calculation unit calculates the standard deviation of the balance change within the preset second determination duration to obtain the balance fluctuation value. Then, the frequency fluctuation calculation unit calculates the standard deviation of the call frequency change within the same time period to obtain the frequency fluctuation value. Finally, the second determination unit identifies a number of second temporary accounts based on these two fluctuation values and in combination with the set threshold.

[0117] Please continue to refer to Figure 3 as shown, which is the decision logic diagram for the second determination subunit of this embodiment to determine the second temporary account;

[0118] The second determination unit includes:

[0119] A balance curve drawing subunit for drawing a balance change curve according to the balance change fluctuation value;

[0120] A frequency curve drawing subunit for drawing a frequency change curve according to the frequency fluctuation value;

[0121] A consistency calculation subunit, which is respectively connected to the balance curve drawing subunit and the frequency curve drawing subunit, for calculating the cosine similarity of the balance change curve and the frequency change curve to form a consistency;

[0122] A second determination subunit, which is connected to the consistency calculation subunit, for determining the first temporary account as the second temporary account when the consistency is less than the preset consistency threshold.

[0123] The preset consistency threshold is a standard value used to judge the similarity between the account balance change curve and the call frequency change curve. It depends on the system's identification requirements for abnormal accounts, the results of past data analysis, and the behavioral differences between normal and abnormal accounts. It is usually set between 0.7 and 0.9. In this embodiment, it is set to 0.8, which can balance sensitivity and accuracy, ensure a high accuracy rate when judging account anomalies, and avoid over-excluding normal accounts.

[0124] The balance curve drawing subunit and the frequency curve drawing subunit respectively draw the account balance change curve and the call frequency change curve according to the balance change fluctuation value and the call frequency fluctuation value. Then, the consistency calculation subunit calculates the cosine similarity between these two curves to obtain a consistency index. If the consistency is less than the preset threshold, the second determination subunit will determine that the account is a second temporary account, so as to further process possible abnormal situations.

[0125] By drawing the balance change curve and the frequency change curve and calculating their cosine similarity, the correlation between account behavior patterns can be more accurately identified, so as to effectively distinguish normal and abnormal accounts. This method improves the recognition accuracy of account abnormal behaviors, avoids the deviation of single-parameter judgment, and enhances the overall reliability and flexibility of the risk control system.

[0126] Specifically, the first determination module includes:

[0127] An integration unit for integrating the real-time traffic usage, the real-time balance change value, and the real-time call frequency of a single second temporary account into a single three-dimensional vector to form an integration vector;

[0128] A normalization unit connected to the integration unit for performing normalization processing on the integration vector to form a normalized vector;

[0129] A first determination unit connected to the normalization unit for determining a number of first abnormal accounts according to any two of the normalized vectors.

[0130] First, integrate the real-time traffic usage, the real-time balance change value, and the real-time call frequency of the second temporary account into a three-dimensional vector to form an integration vector. Then, perform normalization processing on the integration vector through the normalization unit to ensure that each data item has the same scale, thereby eliminating the differences between different data dimensions. Finally, through the first determination unit, use the normalized vectors to compare the vectors of any two accounts, calculate their similarity, and then determine a number of first abnormal accounts to identify accounts that may have risks.

[0131] By integrating data from multiple dimensions into a unified three-dimensional vector and performing normalization processing, the first determination module can effectively eliminate the dimensional differences between different data features, thereby improving the accuracy and stability of abnormal account determination, ensuring the precise identification of account risks, and enhancing the reliability and response speed of the telecommunications service risk control system.

[0132] Specifically, the first determination unit includes:

[0133] A similarity calculation sub-unit, which is connected to the normalization unit and is used to calculate the Euclidean distance between any two of the normalized vectors to form an abnormal similarity.

[0134] A first determination sub-unit, which is connected to the similarity calculation sub-unit and is used to determine that the corresponding two second temporary accounts are both first abnormal accounts when the abnormal similarity is greater than a preset similarity threshold, thereby forming a number of first abnormal accounts.

[0135] The preset similarity threshold is a critical value used to determine whether two accounts exhibit similar abnormal behaviors in multiple indicators. It depends on the normal behavior patterns of the accounts, the statistical analysis of historical data, and the tolerance for anomaly detection. It is usually set between 0 and 1. In this embodiment, it is set to 0.75, which can effectively distinguish normal accounts from potential abnormal accounts, while reducing the risk of misjudgment caused by being too strict or too loose, ensuring that the system can accurately identify abnormal accounts in most cases.

[0136] By calculating the Euclidean distance between two normalized vectors through the similarity calculation sub-unit, an abnormal similarity value is obtained. This similarity value reflects the similarity degree between two accounts in terms of traffic usage, balance change, call frequency, etc. If this abnormal similarity value exceeds the preset similarity threshold, then through the first determination sub-unit, these two accounts are both determined to be first abnormal accounts, thereby identifying potential abnormal accounts.

[0137] By calculating the Euclidean distance between accounts and comparing it with the preset similarity threshold, it is possible to accurately identify those accounts that exhibit similar abnormal behaviors in multiple indicators, thereby improving the accuracy of abnormal account identification, effectively enhancing the risk control ability of the system, reducing the possibility of misjudgment or missed judgment, and ensuring the security and stability of the telecommunications service.

[0138] Specifically, the second determination module includes:

[0139] A probability prediction unit, which is used to use the preset machine learning model to predict the real-time traffic usage, the real-time balance change value, and the real-time call frequency of each of the accounts to be analyzed, and obtain a number of abnormal probability values.

[0140] A second determination unit, which is connected to the probability prediction unit, is configured to determine the account to be analyzed as a second abnormal account when the abnormal probability value is greater than a preset probability value threshold, and form a number of second abnormal accounts.

[0141] The preset probability value threshold is a standard value used to determine whether an account is an abnormal account, which depends on the risk tolerance, the acceptable probability range of abnormal behaviors, and the actual performance of abnormal accounts in historical data. It is usually set between 0.5 and 0.9. In this embodiment, it is set to 0.75, which can balance the risks between misjudgment and missed judgment, make the system more sensitive to the identification of abnormal accounts, be able to detect potential risk accounts in a timely manner, and avoid the missed judgment problem caused by too loose a standard.

[0142] The probability prediction unit uses a preset machine learning model to predict the real-time traffic usage, real-time balance change value, and real-time call frequency of each account to be analyzed, and generate an abnormal probability value. Then, the second determination unit compares these abnormal probability values with the preset probability value threshold. If the abnormal probability value exceeds the threshold, it determines that the account is a second abnormal account.

[0143] Predicting the abnormal possibility of an account through a machine learning model can thus identify potential risk accounts in advance. Compared with traditional rule-based judgments, the probability-based judgment method can better adapt to complex behavior patterns, provide higher accuracy and flexibility, and can effectively reduce the misjudgment rate and missed judgment rate.

[0144] Specifically, the adjustment module includes:

[0145] A deviation calculation unit, which is configured to calculate the relative deviation between the number of the first abnormal accounts and the number of the second abnormal accounts, and form a quantity deviation;

[0146] An adjustment unit, which is configured to adjust the preset traffic fluctuation threshold according to the quantity deviation and a preset adjustment coefficient, and form an adjusted traffic threshold.

[0147] The deviation calculation unit calculates the relative deviation between the number of the first abnormal accounts and the number of the second abnormal accounts to obtain a quantity deviation. Then, the adjustment unit uses this quantity deviation and the preset adjustment coefficient to adjust the preset traffic fluctuation threshold to generate a new adjusted traffic fluctuation threshold. This adjusted threshold will affect the abnormal detection of the account, enabling the system to flexibly adjust the determination criteria according to the actual situation of the current abnormal accounts.

[0148] By dynamically optimizing the traffic fluctuation threshold according to the change in the number of abnormal accounts, the adaptability and accuracy of the system to different situations can be improved, the misjudgment or missed judgment caused by a fixed threshold can be avoided, and the flexibility and precision of the telecommunications service risk control system can be further enhanced.

[0149] Specifically, the adjustment unit includes:

[0150] The deviation fluctuation calculation subunit is used to calculate the standard deviation of the quantity deviation within a preset adjustment period to form a quantity deviation fluctuation value;

[0151] An adjustment subunit is connected to the deviation fluctuation calculation subunit and is used to reduce the preset flow fluctuation threshold value according to the relative deviation between the quantity deviation fluctuation value and the preset quantity deviation fluctuation threshold value and the preset adjustment coefficient to form an adjusted flow threshold value when the quantity deviation fluctuation value is greater than the preset quantity deviation fluctuation threshold value, wherein the relative deviation between the quantity deviation fluctuation value and the preset quantity deviation fluctuation threshold value is positively correlated with the adjusted flow threshold value.

[0152] The quantity deviation fluctuation threshold is used to determine whether the quantity deviation fluctuation exceeds the preset standard value, which depends on the fault tolerance range required by the system and the change in the number of abnormal accounts, and is usually set between 5% and 10%. In this embodiment, it is set to 8%, which can balance the sensitivity and stability of the system and avoid frequent adjustments and over-response to small fluctuations.

[0153] The preset adjustment coefficient is used to control the adjustment amplitude of the traffic fluctuation threshold, which depends on the impact of the fluctuation in the number of abnormal accounts and the system's tolerance for misjudgment. It is usually set between 0.1-0.5. In this embodiment, it is set to 0.3, which can ensure that the adjustment amplitude is neither too large to cause excessive fluctuations, nor too small to effectively respond to abnormal fluctuations.

[0154] The standard deviation of the quantity deviation within the preset adjustment time is calculated by the deviation fluctuation calculation subunit to obtain the quantity deviation fluctuation value. If the fluctuation value is greater than the preset quantity deviation fluctuation threshold, the preset flow fluctuation threshold is reduced by the adjustment subunit according to the relative deviation between the quantity deviation fluctuation value and the threshold and the preset adjustment coefficient to form a new adjusted flow fluctuation threshold, which is dynamically adjusted according to the deviation fluctuation, thereby optimizing the flow fluctuation threshold.

[0155] By dynamically adjusting the threshold to improve the adaptability and accuracy of the system, it is possible to respond more accurately to fluctuations in the number of abnormal accounts, effectively avoid misjudgments caused by fluctuations in the number of abnormal accounts, and enhance the flexibility and robustness of the risk control system in actual operations.

[0156] On the other hand, please continue to see Figure 4 As shown, it is a flow chart of the telecommunication business risk control method based on machine learning in this embodiment;

[0157] This embodiment also provides a telecommunication service risk control method based on machine learning, including:

[0158] Collect the real-time traffic usage, real-time balance change value, and real-time call frequency of each account to be analyzed in the telecommunications service data source;

[0159] Determine a number of first temporary accounts according to the real-time traffic usage and a preset traffic fluctuation threshold;

[0160] Determine a number of second temporary accounts according to the real-time balance change value and the real-time call frequency of each of the first temporary accounts;

[0161] Determine a number of first abnormal accounts according to the real-time traffic usage, the real-time balance change value, and the real-time call frequency of any two of the second temporary accounts;

[0162] Determine a number of second abnormal accounts according to a preset machine learning model, the real-time traffic usage, the real-time balance change value, and the real-time call frequency of all the accounts to be analyzed;

[0163] Adjust the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold;

[0164] Control the permissions of the first abnormal accounts determined based on the adjusted traffic threshold.

[0165] By collecting the real-time traffic usage, real-time balance change value, and real-time call frequency data of the accounts to be analyzed in the telecommunications service data source, using the preset traffic fluctuation threshold to determine the first temporary accounts, and further determining the second temporary accounts through the balance change and call frequency data. Then, by comparing the relevant data of the second temporary accounts, identify the first abnormal accounts; at the same time, analyze all account data with the help of a machine learning model to identify the second abnormal accounts. Finally, according to the number of the first and second abnormal accounts, adjust the traffic fluctuation threshold to more precisely control the permissions of abnormal accounts and achieve effective risk control.

[0166] By adjusting the traffic fluctuation threshold in real time, improve the sensitivity and response speed to abnormal behaviors, and with the help of a machine learning model, maintain high accuracy and reliability in a dynamically changing environment, so as to achieve more precise risk control and resource management, effectively reduce the risks of misjudgment and missed judgment, and ensure the stability and security of the telecommunications network.

[0167] So far, the technical solution of the present invention has been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A telecommunications service risk control system based on machine learning, characterized in that Including: A data acquisition module for acquiring the real-time traffic usage, real-time balance change value, and real-time call frequency of each account to be analyzed in the telecommunications service data source; A first determination module connected to the data acquisition module for determining a number of first temporary accounts according to the real-time traffic usage and a preset traffic fluctuation threshold; A second determination module respectively connected to the data acquisition module and the first determination module for determining a number of second temporary accounts according to the real-time balance change value and the real-time call frequency of each of the first temporary accounts; A first determination module respectively connected to the data acquisition module and the second determination module for determining a number of first abnormal accounts according to the real-time traffic usage, the real-time balance change value, and the real-time call frequency of any two of the second temporary accounts; A second determination module respectively connected to the data acquisition module and the first determination module for determining a number of second abnormal accounts according to a preset machine learning model, the real-time traffic usage, the real-time balance change value, and the real-time call frequency of all the accounts to be analyzed; An adjustment module respectively connected to the first determination module and the second determination module for adjusting the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold; A control module respectively connected to the adjustment module and the first determination module for controlling the permissions of the first abnormal accounts determined based on the adjusted traffic threshold.

2. The risk control system for telecommunications services based on machine learning according to claim 1, wherein The first determination module includes: A traffic fluctuation calculation unit for calculating the standard deviation of the real-time traffic usage within a preset first determination duration to form a traffic fluctuation value; A first determination unit connected to the traffic fluctuation calculation unit for determining the account to be analyzed as a first abnormal account when the traffic fluctuation value is greater than the preset traffic fluctuation threshold to form a number of first temporary accounts.

3. The risk control system for telecommunications services based on machine learning according to claim 2, characterized in that, The second determination module includes: A balance fluctuation calculation unit for calculating the standard deviation of the real-time balance change value within a preset second determination duration to form a balance change fluctuation value; A frequency fluctuation calculation unit for calculating the standard deviation of the real-time call frequency within the preset second determination duration to form a frequency fluctuation value; A second determination unit for determining a number of second temporary accounts according to the balance change fluctuation value and the frequency fluctuation value.

4. The risk control system for telecommunications services based on machine learning according to claim 3, wherein, The second determination unit includes: A balance curve drawing sub-unit for drawing a balance change curve according to the balance change fluctuation value; A frequency curve drawing sub-unit for drawing a frequency change curve according to the frequency fluctuation value; A consistency calculation sub-unit respectively connected to the balance curve drawing sub-unit and the frequency curve drawing sub-unit for calculating the cosine similarity of the balance change curve and the frequency change curve to form a consistency; A second determination sub-unit connected to the consistency calculation sub-unit for determining the first temporary account as the second temporary account when the consistency is less than a preset consistency threshold.

5. The risk control system for telecommunications services based on machine learning according to claim 4, characterized in that, The first determination module includes: An integration unit for integrating the real-time traffic usage, the real-time balance change value, and the real-time call frequency of a single said second temporary account into a single three-dimensional vector to form an integration vector; A normalization unit connected to the integration unit for performing normalization processing on the integration vector to form a normalized vector; A first determination unit connected to the normalization unit for determining a number of first abnormal accounts according to any two of the normalized vectors; 6. The risk control system for telecommunications services based on machine learning according to claim 5, characterized in that, The first determination unit includes: A similarity calculation sub-unit connected to the normalization unit for calculating the Euclidean distance between any two of the normalized vectors to form an abnormal similarity; A first determination sub-unit connected to the similarity calculation sub-unit for determining that the corresponding two said second temporary accounts are both first abnormal accounts when the abnormal similarity is greater than a preset similarity threshold to form a number of first abnormal accounts; 7. The risk control system for telecommunications services based on machine learning according to claim 6, characterized in that, The second determination module includes: A probability prediction unit for using the preset machine learning model to predict the real-time traffic usage, the real-time balance change value, and the real-time call frequency of each said account to be analyzed to obtain a number of abnormal probability values; A second determination unit connected to the probability prediction unit for determining that the account to be analyzed is a second abnormal account when the abnormal probability value is greater than a preset probability value threshold to form a number of second abnormal accounts; 8. The machine learning-based telecommunication service risk control system according to claim 7, wherein The adjustment module includes: A deviation calculation unit for calculating the relative deviation between the number of the first abnormal accounts and the number of the second abnormal accounts to form a quantity deviation; An adjustment unit for adjusting the preset traffic fluctuation threshold according to the quantity deviation and a preset adjustment coefficient to form an adjusted traffic threshold; 9. The risk control system for telecommunications services based on machine learning according to claim 8, characterized in that, The adjustment unit includes: A deviation fluctuation calculation sub-unit for calculating the standard deviation of the quantity deviation within a preset adjustment duration to form a quantity deviation fluctuation value; An adjustment sub-unit connected to the deviation fluctuation calculation sub-unit for reducing the preset traffic fluctuation threshold according to the relative deviation between the quantity deviation fluctuation value and a preset quantity deviation fluctuation threshold and the preset adjustment coefficient when the quantity deviation fluctuation value is greater than the preset quantity deviation fluctuation threshold to form an adjusted traffic threshold; 10. A risk control method for telecommunications services based on machine learning, based on the risk control system for telecommunications services based on machine learning according to any one of claims 1-9, characterized in that, Includes: Collecting the real-time traffic usage, the real-time balance change value, and the real-time call frequency of each account to be analyzed in the telecommunications service data source; Determining a number of first temporary accounts according to the real-time traffic usage and a preset traffic fluctuation threshold; Determining a number of second temporary accounts according to the real-time balance change value and the real-time call frequency of each said first temporary account; Determining a number of first abnormal accounts according to the real-time traffic usage, the real-time balance change value, and the real-time call frequency of any two of the second temporary accounts; Determining a number of second abnormal accounts according to the preset machine learning model, the real-time traffic usage, the real-time balance change value, and the real-time call frequency of all the accounts to be analyzed; Adjusting the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold; Controlling the permissions of the first abnormal accounts determined based on the adjusted traffic threshold.

Images