A machine learning based telecommunications service risk control system and method

Abstract

The application relates to the technical field of data processing, in particular to a telecommunication service risk control system and method based on machine learning, which comprises a data acquisition module, a first determination module, a second determination module, a first judgment module, a second judgment module and an adjustment module. Through real-time acquisition and intelligent analysis of multiple key data, the application can timely identify potential abnormal accounts and accurately judge them, through dynamic adjustment of flow fluctuation threshold and secondary judgment based on a machine learning model, not only the sensitivity of the system to different account behavior changes is improved, but also the misjudgment or omission caused by too fixed threshold set by human is effectively reduced, in addition, according to the intelligent adjustment of the number and behavior characteristics of abnormal accounts, the response capability of the telecommunication operator to the account risk is significantly improved, and the problem that the response speed is low when responding to dynamic business scenarios due to the dependence on static operation data and judgment rules is effectively solved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a machine learning-based telecommunications service risk control system and method. Background Technology

[0002] With the rapid development of information technology, the telecommunications industry faces increasingly complex operating environments and diverse risk challenges. Telecommunications operators not only need to provide stable network services but also handle large amounts of user data and transaction activities, ensuring the security and legality of their business. However, due to the complexity and dynamic changes of telecommunications services, traditional risk control methods are often insufficient to effectively address emerging risk types, leading to numerous hidden dangers in operation and management.

[0003] Patent document CN118195297A discloses a risk control system for telecommunications operators. This system includes: a data interface module for acquiring operational data from telecommunications operators; a data storage module for packaging the operational data into corresponding storage objects; a format conversion module for converting the storage objects into collection objects according to configured conversion rules; a data integration module for integrating the collection objects into risk control objects; and a risk control management module for configuring judgment rules based on business scenarios, processing the risk control objects according to the judgment rules, and generating risk event instances.

[0004] Therefore, the aforementioned telecom operator risk control system has the following problems: the system obtains static operational data through a data interface module and goes through steps such as data landing and format conversion, resulting in low timeliness of data processing; the system integrates the collected objects into risk control objects and processes them according to the judgment rules configured according to the business scenario, resulting in a large processing complexity when dealing with complex business scenarios; the system relies on manual settings and is difficult to adjust quickly in dynamic environments. Summary of the Invention

[0005] To address this, the present invention provides a telecommunications service risk control system and method based on machine learning, which overcomes the problem of low response speed in dealing with dynamic business scenarios caused by the reliance on static operational data and judgment rules in the prior art through real-time data acquisition and machine learning-based anomaly detection.

[0006] To achieve the above objectives, in one aspect, the present invention provides a machine learning-based telecommunications service risk control system, comprising:

[0007] The data acquisition module is used to collect real-time traffic usage, real-time balance changes, and real-time call frequency of each account to be analyzed from the telecommunications service data source.

[0008] The first determining module is connected to the data acquisition module and is used to determine a number of first temporary accounts based on the real-time traffic usage and the preset traffic fluctuation threshold.

[0009] The second determining module is connected to the data acquisition module and the first determining module respectively, and is used to determine a number of second temporary accounts based on the real-time balance change value of each of the first temporary accounts and the real-time call frequency.

[0010] The first determination module is connected to the data acquisition module and the second determination module respectively, and is used to determine a number of first abnormal accounts based on the real-time traffic usage, the real-time balance change value and the real-time call frequency of any two second temporary accounts.

[0011] The second determination module is connected to the data acquisition module and the first determination module respectively, and is used to determine a number of second abnormal accounts based on a preset machine learning model, the real-time traffic usage of all the accounts to be analyzed, the real-time balance change value and the real-time call frequency.

[0012] An adjustment module, which is connected to the first determination module and the second determination module respectively, is used to adjust the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold.

[0013] A control module, which is connected to the adjustment module and the first determination module respectively, is used to control the permissions of the first abnormal account determined based on the adjusted traffic threshold.

[0014] Furthermore, the first determining module includes:

[0015] The traffic fluctuation calculation unit is used to calculate the standard deviation of the real-time traffic usage within a preset first determined time period to form a traffic fluctuation value;

[0016] The first determining unit is connected to the traffic fluctuation calculation unit and is used to determine the account to be analyzed as the first abnormal account when the traffic fluctuation value is greater than the preset traffic fluctuation threshold, thereby forming a number of first temporary accounts.

[0017] Furthermore, the second determining module includes:

[0018] The balance fluctuation calculation unit is used to calculate the standard deviation of the real-time balance change value within a preset second predetermined time period to form the balance change fluctuation value;

[0019] The frequency fluctuation calculation unit is used to calculate the standard deviation of the real-time call frequency within the preset second determined time period to form a frequency fluctuation value;

[0020] The second determining unit is used to determine a number of second temporary accounts based on the balance change fluctuation value and the frequency fluctuation value.

[0021] Further, the second determining unit includes:

[0022] The balance curve plotting sub-unit is used to plot the balance change curve based on the balance change fluctuation value;

[0023] The frequency curve plotting subunit is used to plot the frequency change curve based on the frequency fluctuation value;

[0024] A consistency calculation subunit is connected to the balance curve drawing subunit and the frequency curve drawing subunit respectively, and is used to calculate the cosine similarity between the balance change curve and the frequency change curve to form a consistency score.

[0025] The second determining subunit, which is connected to the consistency calculation subunit, is used to determine the first temporary account as the second temporary account when the consistency is less than a preset consistency threshold.

[0026] Furthermore, the first determination module includes:

[0027] An integration unit is used to integrate the real-time traffic usage, real-time balance change value, and real-time call frequency of a single second temporary account into a single three-dimensional vector, forming an integrated vector;

[0028] A normalization unit, which is connected to the integration unit, is used to normalize the integration vector to form a normalized vector;

[0029] The first determination unit, which is connected to the normalization unit, is used to determine a number of first abnormal accounts based on any two of the normalization vectors.

[0030] Furthermore, the first determination unit includes:

[0031] A similarity calculation subunit, which is connected to the normalization unit, is used to calculate the Euclidean distance between any two normalized vectors to form anomaly similarity.

[0032] The first determination subunit, which is connected to the similarity calculation subunit, is used to determine that when the abnormal similarity is greater than a preset similarity threshold, the two corresponding second temporary accounts are both first abnormal accounts, thus forming a plurality of first abnormal accounts.

[0033] Furthermore, the second determination module includes:

[0034] The probability prediction unit is used to use the preset machine learning model to predict the real-time traffic usage, real-time balance change value and real-time call frequency of each of the accounts to be analyzed, and to obtain several abnormal probability values.

[0035] The second determination unit is connected to the probability prediction unit and is used to determine the account to be analyzed as a second abnormal account when the abnormal probability value is greater than a preset probability value threshold, thereby forming a plurality of second abnormal accounts.

[0036] Furthermore, the adjustment module includes:

[0037] The deviation calculation unit is used to calculate the relative deviation between the number of the first abnormal accounts and the number of the second abnormal accounts, forming a quantity deviation;

[0038] An adjustment unit is used to adjust the preset flow fluctuation threshold according to the quantity deviation and the preset adjustment coefficient to form an adjusted flow threshold.

[0039] Furthermore, the adjustment unit includes:

[0040] The deviation fluctuation calculation subunit is used to calculate the standard deviation of the quantity deviation within a preset adjustment period to form the quantity deviation fluctuation value;

[0041] An adjustment subunit, connected to the deviation fluctuation calculation subunit, is used to reduce the preset flow fluctuation threshold based on the relative deviation between the quantity deviation fluctuation value and the preset quantity deviation fluctuation threshold, and the preset adjustment coefficient, when the quantity deviation fluctuation value is greater than the preset quantity deviation fluctuation threshold, thereby forming an adjusted flow threshold.

[0042] On the other hand, the present invention also provides a machine learning-based method for controlling telecommunications service risks, comprising:

[0043] Collect real-time traffic usage, real-time balance changes, and real-time call frequency of each account to be analyzed from the telecommunications service data source;

[0044] Several first temporary accounts are determined based on the real-time traffic usage and the preset traffic fluctuation threshold.

[0045] A number of second temporary accounts are determined based on the real-time balance change value of each of the first temporary accounts and the real-time call frequency;

[0046] Several first abnormal accounts are determined based on the real-time traffic usage, real-time balance change value, and real-time call frequency of any two second temporary accounts;

[0047] Based on a preset machine learning model, the real-time traffic usage, real-time balance change value, and real-time call frequency of all the accounts to be analyzed, several second abnormal accounts are identified.

[0048] The preset traffic fluctuation threshold is adjusted based on the number of the first abnormal account and the number of the second abnormal account to form an adjusted traffic threshold.

[0049] Control the permissions of the first abnormal account determined based on the adjusted traffic threshold.

[0050] Compared with existing technologies, the beneficial effects of this invention are that by collecting and intelligently analyzing multiple key data (such as data usage, balance changes, and call frequency) in real time, it can promptly identify and accurately determine potential abnormal accounts. By dynamically adjusting the data fluctuation threshold and making secondary determinations based on machine learning models, it not only improves the system's sensitivity to changes in the behavior of different accounts, but also effectively reduces misjudgments or omissions caused by manually setting overly fixed thresholds. In addition, the system makes intelligent adjustments based on the number and behavioral characteristics of abnormal accounts, significantly improving the telecom operator's ability to respond to account risks, reducing potential losses and operational risks, and effectively solving the problem of low response speed when dealing with dynamic business scenarios due to reliance on static operational data and judgment rules.

[0051] Furthermore, by calculating traffic fluctuations, accounts with abnormal fluctuations can be effectively screened out, thereby identifying potential risky accounts early and preventing the spread of traffic abuse or other abnormal behaviors. By using preset traffic fluctuation thresholds, the system's accuracy and flexibility are improved, allowing adjustments based on actual conditions and ensuring more precise risk control.

[0052] Furthermore, by comprehensively analyzing fluctuations in balance and call frequency, the second determination module can more comprehensively assess the risk characteristics of accounts, helping the system to more accurately screen out accounts with anomalies and improve risk control effectiveness. By considering multiple data dimensions simultaneously, it avoids misjudgments caused by a single indicator, thus improving the accuracy and reliability of risk identification.

[0053] Furthermore, by plotting balance change curves and frequency change curves and calculating their cosine similarity, the correlation between account behavior patterns can be identified more accurately, thereby effectively distinguishing between normal and abnormal accounts. This method improves the accuracy of identifying abnormal account behavior, avoids the bias of judging by a single parameter, and enhances the overall reliability and flexibility of the risk control system.

[0054] Furthermore, by integrating data from multiple dimensions into a unified three-dimensional vector and performing normalization processing, the first judgment module can effectively eliminate the dimensional differences between different data features, thereby improving the accuracy and stability of abnormal account judgment, ensuring accurate identification of account risks, and enhancing the reliability and response speed of the telecommunications business risk control system.

[0055] Furthermore, by calculating the Euclidean distance between accounts and comparing it with a preset similarity threshold, accounts that exhibit similar abnormal behavior across multiple indicators can be accurately identified. This improves the accuracy of abnormal account identification, effectively enhances the system's risk control capabilities, reduces the possibility of misjudgment or omission, and ensures the security and stability of telecommunications services.

[0056] Furthermore, by using machine learning models to predict the likelihood of account anomalies, potential risky accounts can be identified in advance. Compared to traditional rule-based judgments, probability-based judgment methods are better able to adapt to complex behavioral patterns, offering higher accuracy and flexibility, and effectively reducing false positive and false negative rates.

[0057] Furthermore, by dynamically optimizing the traffic fluctuation threshold based on changes in the number of abnormal accounts, the system's adaptability and accuracy to different situations can be improved, avoiding misjudgments or omissions caused by fixed thresholds, and further enhancing the flexibility and accuracy of the telecommunications business risk control system.

[0058] Furthermore, by dynamically adjusting the threshold to improve the system's adaptability and accuracy, it can respond more accurately to fluctuations in the number of abnormal accounts, effectively avoid misjudgments caused by fluctuations in the number of abnormal accounts, and enhance the flexibility and robustness of the risk control system in actual operation.

[0059] Furthermore, by adjusting the traffic fluctuation threshold in real time, the sensitivity and response speed to abnormal behavior are improved. With the help of machine learning models, high accuracy and reliability are maintained in dynamically changing environments, thereby achieving more precise risk control and resource management, effectively reducing the risk of misjudgment and missed judgment, and ensuring the stability and security of telecommunications networks. Attached Figure Description

[0060] Figure 1 This is a schematic diagram of the machine learning-based telecommunications service risk control system in this embodiment;

[0061] Figure 2 This is a logic diagram for the first determining unit to determine the first abnormal account in this embodiment;

[0062] Figure 3 This is a logic diagram for determining the second temporary account in the second determining subunit of this embodiment;

[0063] Figure 4This is a flowchart of the machine learning-based telecommunications service risk control method in this embodiment. Detailed Implementation

[0064] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0065] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0066] On the one hand, please refer to Figure 1 As shown, it is a schematic diagram of the telecommunications service risk control system based on machine learning in this embodiment;

[0067] This embodiment provides a machine learning-based telecommunications service risk control system, including:

[0068] The data acquisition module is used to collect real-time traffic usage, real-time balance changes, and real-time call frequency of each account to be analyzed from the telecommunications service data source.

[0069] The first determining module is connected to the data acquisition module and is used to determine a number of first temporary accounts based on the real-time traffic usage and the preset traffic fluctuation threshold.

[0070] The second determining module is connected to the data acquisition module and the first determining module respectively, and is used to determine a number of second temporary accounts based on the real-time balance change value of each of the first temporary accounts and the real-time call frequency.

[0071] The first determination module is connected to the data acquisition module and the second determination module respectively, and is used to determine a number of first abnormal accounts based on the real-time traffic usage, the real-time balance change value and the real-time call frequency of any two second temporary accounts.

[0072] The second determination module is connected to the data acquisition module and the first determination module respectively, and is used to determine a number of second abnormal accounts based on a preset machine learning model, the real-time traffic usage of all the accounts to be analyzed, the real-time balance change value and the real-time call frequency.

[0073] An adjustment module, which is connected to the first determination module and the second determination module respectively, is used to adjust the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts to form an adjusted traffic threshold.

[0074] A control module, which is connected to the adjustment module and the first determination module respectively, is used to control the permissions of the first abnormal account determined based on the adjusted traffic threshold.

[0075] The control module will restrict certain permissions of the first abnormal account, such as limiting high-traffic operations, suspending account services, or setting consumption limits, thereby preventing potential risk events from occurring.

[0076] Telecommunications service data sources include billing systems, network monitoring systems, telecommunications accounting systems, and data exchange platforms of communication networks. These data sources store and provide real-time information such as account traffic usage, balance changes, and call frequency. The data acquisition module connects to these data sources through interfaces to acquire real-time data on traffic usage, balance changes, and call frequency for each account to be analyzed. This data is collected in real-time via API or database queries, ensuring that data updates are synchronized with telecommunications services, thereby providing timely and accurate data support for the risk control system.

[0077] Real-time traffic usage refers to the actual network traffic consumed by a user within a unit of time (such as data transmission, video viewing, and web browsing). The data acquisition module tracks the traffic consumption of each account in real time by connecting to the billing system or network monitoring system in the telecommunications business system. The system updates traffic data periodically (e.g., every second or every minute) and timestamps the time of each update to ensure that traffic data for all accounts is collected on time.

[0078] Real-time balance change refers to the dynamic changes in account balances. The data acquisition module interfaces with the telecommunications billing system to periodically obtain information on account balance changes. Each time an account balance changes, the system records the amount and time of the change, ensuring that balance data for all accounts is updated synchronously. Real-time data accuracy and consistency are guaranteed through the use of timestamps or periodic polling.

[0079] Real-time call frequency refers to the number of calls and call duration made by a user within a unit of time. The data acquisition module monitors the call frequency of each account in real time through a data exchange platform connected to the communication network. The system periodically updates information such as the number of calls and call duration for each account and synchronously collects data according to a preset update cycle. Each time data is collected, it is synchronized with an accurate timestamp to correctly reflect changes in call frequency.

[0080] The preset traffic fluctuation threshold is a standard value used to determine whether the account traffic fluctuation is abnormal. It depends on historical data analysis, the normal range of traffic fluctuation and the characteristics of telecommunications services. It is usually set between 5% and 20%. In this embodiment, it is set to 10%, which can balance the sensitivity of risk control, accurately identify abnormal fluctuations, and avoid misjudging normal fluctuations.

[0081] The pre-defined machine learning model is a core component of this telecommunications service risk control system, used to intelligently analyze and predict the behavior of telecommunications accounts based on historical and real-time data. It primarily learns from patterns and abnormal behaviors in large amounts of account data (including parameters such as data usage, balance changes, and call frequency) to form a model capable of automatically determining whether an account poses an abnormal risk.

[0082] The preset machine learning models include:

[0083] Data Input Layer: This layer is responsible for receiving and processing input data from the data acquisition module, mainly including real-time traffic usage, real-time balance change value, and real-time call frequency;

[0084] Data input layer parameter settings: In the data input layer, the data needs to be preprocessed and standardized to ensure that the data range of all input features is relatively consistent.

[0085] Feature extraction layer: Enhances the expressive power of data by calculating a series of statistics or derived features. Features include:

[0086] Traffic fluctuation: This measures the fluctuation in account traffic usage by calculating the standard deviation of traffic over a period of time.

[0087] Balance fluctuations: These are measured by standard deviation or other volatility indicators to gauge the magnitude of changes in account balances.

[0088] Call frequency fluctuations: By analyzing changes in call frequency, it can be determined whether there are any abnormal fluctuations.

[0089] Feature extraction layer parameter settings: In the feature extraction layer, you can set a window period (such as the past 24 hours, 7 days, etc.) to calculate these fluctuation indicators, or calculate the dynamic changes over a period of time using a weighted average. In addition, different feature calculation methods can be selected according to business needs.

[0090] Training layer: In this layer, the machine learning model is trained on historical data to capture the relationship between account behavior and anomalies, using supervised learning algorithms, such as deep learning models, to capture more complex non-linear relationships;

[0091] Training layer parameter settings include:

[0092] Training set: Typically uses large-scale historical account data, including normal accounts and known abnormal accounts.

[0093] Prediction Layer: In this layer, the model makes predictions based on real-time input account data. The model calculates the probability of anomalies based on features such as real-time data usage, balance changes, and call frequency. The prediction process includes:

[0094] Anomaly probability calculation: The model outputs the anomaly probability for each account, representing the likelihood that the account is an anomalous account;

[0095] Feedback and Optimization Layer:

[0096] This layer is responsible for providing feedback based on the model's output and continuously optimizing the model based on actual results. The system evaluates the model's predictive performance and adjusts it through incremental learning or online learning. For example:

[0097] Model retraining: If new abnormal patterns or trends are detected, the model will be retrained on new data to improve its ability to identify new types of anomalies.

[0098] Adjusting thresholds: The anomaly probability threshold or other decision rules may be adjusted based on the actual operation of the system.

[0099] Feedback and optimization layer parameter settings:

[0100] Retraining cycle: Online learning is used to continuously adjust the model based on real-time data.

[0101] The data acquisition module acquires real-time data on traffic usage, balance changes, and call frequency for each account from the telecommunications service data source. The first determination module identifies the first temporary account based on real-time traffic usage and a preset traffic fluctuation threshold. The second determination module further filters for second temporary accounts based on balance changes and call frequency. The first judgment module determines the first abnormal account based on multiple data points of the second temporary account. The second judgment module uses a machine learning model to predict the data of all accounts to be analyzed and determine the second abnormal account. The adjustment module adjusts the traffic fluctuation threshold based on the number of abnormal accounts, and the final control module manages the permissions of abnormal accounts according to the adjusted threshold.

[0102] By collecting and intelligently analyzing multiple key data points in real time (such as data usage, balance changes, and call frequency), the system can promptly identify and accurately determine potential abnormal accounts. Through dynamic adjustment of data fluctuation thresholds and secondary determination based on machine learning models, the system not only improves its sensitivity to changes in the behavior of different accounts but also effectively reduces misjudgments or omissions caused by manually setting overly fixed thresholds. Furthermore, the system intelligently adjusts based on the number and behavioral characteristics of abnormal accounts, significantly enhancing telecom operators' ability to respond to account risks, reducing potential losses and operational risks, and effectively solving the problem of low response speed when dealing with dynamic business scenarios due to reliance on static operational data and judgment rules.

[0103] Please continue reading. Figure 2 As shown, this is the logic diagram for the first determining unit to determine the first abnormal account in this embodiment;

[0104] The first determining module includes:

[0105] The traffic fluctuation calculation unit is used to calculate the standard deviation of the real-time traffic usage within a preset first determined time period to form a traffic fluctuation value;

[0106] The first determining unit is connected to the traffic fluctuation calculation unit and is used to determine the account to be analyzed as the first abnormal account when the traffic fluctuation value is greater than the preset traffic fluctuation threshold, thereby forming a number of first temporary accounts.

[0107] The preset first defined duration is the time period used to calculate the standard deviation of real-time traffic usage. It depends on business needs, data update frequency, and the scope of risks to be analyzed. It is usually set between 1 hour and 24 hours. In this embodiment, it is set to 6 hours, which helps to balance real-time performance and stability, effectively captures short-term traffic fluctuations, and avoids excessively frequent fluctuation interference.

[0108] The traffic fluctuation calculation unit calculates the standard deviation of real-time traffic usage within a preset first defined time period to obtain the traffic fluctuation value. If this traffic fluctuation value exceeds a preset traffic fluctuation threshold, the first determination unit will identify the account as a first abnormal account and create several first temporary accounts. This process helps to quickly identify accounts with large traffic fluctuations within a preset time period.

[0109] By calculating traffic fluctuations, accounts exhibiting abnormal fluctuations can be effectively screened out, thereby identifying potentially risky accounts early and preventing the spread of traffic abuse or other abnormal behaviors. Pre-setting traffic fluctuation thresholds improves the system's accuracy and flexibility, allowing adjustments based on actual conditions and ensuring more precise risk control.

[0110] Specifically, the second determining module includes:

[0111] The balance fluctuation calculation unit is used to calculate the standard deviation of the real-time balance change value within a preset second predetermined time period to form the balance change fluctuation value;

[0112] The frequency fluctuation calculation unit is used to calculate the standard deviation of the real-time call frequency within the preset second determined time period to form a frequency fluctuation value;

[0113] The second determining unit is used to determine a number of second temporary accounts based on the balance change fluctuation value and the frequency fluctuation value.

[0114] The preset second time period refers to the time period used to calculate the changes in account balance and the fluctuations in call frequency. It depends on the usage pattern of telecommunications services and the frequency of data collection. It is usually set between 30 minutes and 24 hours. In this embodiment, it is set to 1 hour, which can balance the capture of data fluctuations and the real-time nature of business operations. It can detect abnormal changes in the account in a timely manner and avoid misjudgment of frequent fluctuations in a short period of time, thereby improving the accuracy of risk identification.

[0115] By comprehensively analyzing fluctuations in account balances and call frequency, the second determination module can more comprehensively assess the risk characteristics of accounts, helping the system to more accurately screen out accounts with anomalies and improve risk control effectiveness. By considering multiple data dimensions simultaneously, it avoids misjudgments caused by a single indicator, thus improving the accuracy and reliability of risk identification.

[0116] Two calculation units analyze real-time balance changes and real-time call frequency. First, the balance fluctuation calculation unit calculates the standard deviation of balance changes within a preset second predetermined time period to obtain the balance fluctuation value. Next, the frequency fluctuation calculation unit calculates the standard deviation of call frequency changes within the same time period to obtain the frequency fluctuation value. Finally, the second determination unit identifies several second temporary accounts based on these two fluctuation values ​​and a set threshold.

[0117] Please continue reading. Figure 3 As shown, this is the determination logic diagram of the second determining subunit for determining the second temporary account in this embodiment;

[0118] The second determining unit includes:

[0119] The balance curve plotting sub-unit is used to plot the balance change curve based on the balance change fluctuation value;

[0120] The frequency curve plotting subunit is used to plot the frequency change curve based on the frequency fluctuation value;

[0121] A consistency calculation subunit is connected to the balance curve drawing subunit and the frequency curve drawing subunit respectively, and is used to calculate the cosine similarity between the balance change curve and the frequency change curve to form a consistency score.

[0122] The second determining subunit, which is connected to the consistency calculation subunit, is used to determine the first temporary account as the second temporary account when the consistency is less than a preset consistency threshold.

[0123] The preset consistency threshold is a standard value used to judge the similarity between the account balance change curve and the call frequency change curve. It depends on the system's requirements for identifying abnormal accounts. Based on the results of past data analysis and the behavioral differences between normal and abnormal accounts, it is usually set between 0.7 and 0.9. In this embodiment, it is set to 0.8, which can balance sensitivity and accuracy, ensure a high accuracy rate when judging abnormal accounts, and avoid excessive removal of normal accounts.

[0124] The balance curve plotting subunit and frequency curve plotting subunit respectively plot the account's balance change curve and call frequency change curve based on the balance change fluctuation value and call frequency fluctuation value. Next, the consistency calculation subunit calculates the cosine similarity between these two curves to obtain a consistency index. If the consistency index is less than a preset threshold, the second determination subunit will determine that the account is a second temporary account, thereby further handling possible anomalies.

[0125] By plotting balance change curves and frequency change curves and calculating their cosine similarity, the correlation between account behavior patterns can be identified more accurately, thus effectively distinguishing between normal and abnormal accounts. This method improves the accuracy of identifying abnormal account behavior, avoids the bias of judging by a single parameter, and enhances the overall reliability and flexibility of the risk control system.

[0126] Specifically, the first determination module includes:

[0127] An integration unit is used to integrate the real-time traffic usage, real-time balance change value, and real-time call frequency of a single second temporary account into a single three-dimensional vector, forming an integrated vector;

[0128] A normalization unit, which is connected to the integration unit, is used to normalize the integration vector to form a normalized vector;

[0129] The first determination unit, which is connected to the normalization unit, is used to determine a number of first abnormal accounts based on any two of the normalization vectors.

[0130] First, the real-time data usage, real-time balance changes, and real-time call frequency of the second temporary account are integrated into a three-dimensional vector, forming an integrated vector. Next, a normalization unit normalizes the integrated vector to ensure that all data items have the same scale, thereby eliminating differences between different data dimensions. Finally, a first judgment unit compares the vectors of any two accounts using the normalized vector, calculates their similarity, and then identifies several first-order abnormal accounts, thus identifying potentially risky accounts.

[0131] By integrating data from multiple dimensions into a unified three-dimensional vector and performing normalization, the first judgment module can effectively eliminate the dimensional differences between different data features, thereby improving the accuracy and stability of abnormal account judgment, ensuring accurate identification of account risks, and enhancing the reliability and response speed of the telecommunications business risk control system.

[0132] Specifically, the first determination unit includes:

[0133] A similarity calculation subunit, which is connected to the normalization unit, is used to calculate the Euclidean distance between any two normalized vectors to form anomaly similarity.

[0134] The first determination subunit, which is connected to the similarity calculation subunit, is used to determine that when the abnormal similarity is greater than a preset similarity threshold, the two corresponding second temporary accounts are both first abnormal accounts, thus forming a plurality of first abnormal accounts.

[0135] The preset similarity threshold is a critical value used to determine whether two accounts exhibit similar abnormal behavior across multiple indicators. It depends on the account's normal behavior pattern, statistical analysis of historical data, and tolerance for anomaly detection. It is usually set between 0 and 1. In this embodiment, it is set to 0.75, which can effectively distinguish between normal accounts and potentially abnormal accounts, while reducing the risk of misjudgment caused by being too strict or too lenient, ensuring that the system can accurately identify abnormal accounts in most cases.

[0136] The similarity calculation subunit calculates the Euclidean distance between two normalized vectors to obtain an abnormal similarity value. This similarity value reflects the degree of similarity between the two accounts in terms of data usage, balance changes, and call frequency. If the abnormal similarity value exceeds a preset similarity threshold, the first determination subunit classifies both accounts as first abnormal accounts, thereby identifying potential abnormal accounts.

[0137] By calculating the Euclidean distance between accounts and comparing it with a preset similarity threshold, accounts that exhibit similar abnormal behavior across multiple indicators can be accurately identified. This improves the accuracy of abnormal account identification, effectively enhances the system's risk control capabilities, reduces the possibility of misjudgment or omission, and ensures the security and stability of telecommunications services.

[0138] Specifically, the second determination module includes:

[0139] The probability prediction unit is used to use the preset machine learning model to predict the real-time traffic usage, real-time balance change value and real-time call frequency of each of the accounts to be analyzed, and to obtain several abnormal probability values.

[0140] The second determination unit is connected to the probability prediction unit and is used to determine the account to be analyzed as a second abnormal account when the abnormal probability value is greater than a preset probability value threshold, thereby forming a plurality of second abnormal accounts.

[0141] The preset probability threshold is a standard value used to determine whether an account is an abnormal account. It depends on the risk tolerance, the acceptable probability range of abnormal behavior, and the actual performance of abnormal accounts in historical data. It is usually set between 0.5 and 0.9. In this embodiment, it is set to 0.75, which can balance the risks between false positives and false negatives, making the system more sensitive to the identification of abnormal accounts and able to discover potential risky accounts in a timely manner, while avoiding false negatives caused by overly lenient standards.

[0142] The probability prediction unit uses a preset machine learning model to predict the real-time data usage, real-time balance changes, and real-time call frequency of each account to be analyzed, generating anomaly probability values. Next, the second determination unit compares these anomaly probability values ​​with preset probability thresholds. If the anomaly probability value exceeds the threshold, the account is determined to be a second abnormal account.

[0143] By using machine learning models to predict the likelihood of account anomalies, potentially risky accounts can be identified in advance. Compared to traditional rule-based judgments, probability-based judgment methods are better able to adapt to complex behavioral patterns, offering higher accuracy and flexibility, and effectively reducing false positive and false negative rates.

[0144] Specifically, the adjustment module includes:

[0145] The deviation calculation unit is used to calculate the relative deviation between the number of the first abnormal accounts and the number of the second abnormal accounts, forming a quantity deviation;

[0146] An adjustment unit is used to adjust the preset flow fluctuation threshold according to the quantity deviation and the preset adjustment coefficient to form an adjusted flow threshold.

[0147] The deviation calculation unit calculates the relative deviation between the number of the first and second abnormal accounts to obtain the quantity deviation. Next, the adjustment unit uses this quantity deviation and a preset adjustment coefficient to adjust the preset traffic fluctuation threshold, generating a new adjusted traffic fluctuation threshold. This adjusted threshold will affect the detection of account anomalies, allowing the system to flexibly adjust the judgment criteria based on the actual situation of the current abnormal accounts.

[0148] By dynamically optimizing the traffic fluctuation threshold based on changes in the number of abnormal accounts, the system's adaptability and accuracy to different situations can be improved, avoiding misjudgments or omissions caused by fixed thresholds, and further enhancing the flexibility and accuracy of the telecommunications business risk control system.

[0149] Specifically, the adjustment unit includes:

[0150] The deviation fluctuation calculation subunit is used to calculate the standard deviation of the quantity deviation within a preset adjustment period to form the quantity deviation fluctuation value;

[0151] An adjustment subunit, connected to the deviation fluctuation calculation subunit, is used to reduce the preset flow fluctuation threshold based on the relative deviation between the quantity deviation fluctuation value and the preset quantity deviation fluctuation threshold, and the preset adjustment coefficient, when the quantity deviation fluctuation value is greater than the preset quantity deviation fluctuation threshold, to form an adjusted flow threshold. The relative deviation between the quantity deviation fluctuation value and the preset quantity deviation fluctuation threshold is positively correlated with the adjusted flow threshold.

[0152] The quantity deviation fluctuation threshold is used to determine whether the quantity deviation fluctuation exceeds a preset standard. It depends on the system's required fault tolerance range and the changes in the number of abnormal accounts, and is usually set between 5% and 10%. In this embodiment, it is set to 8%, which can balance the system's sensitivity and stability, and avoid frequent adjustments and over-responding to small fluctuations.

[0153] The preset adjustment coefficient is used to control the magnitude of the traffic fluctuation threshold adjustment. It depends on the impact of the fluctuation in the number of abnormal accounts and the system's tolerance for misjudgment. It is usually set between 0.1 and 0.5. In this embodiment, it is set to 0.3, which can ensure that the adjustment magnitude is neither too large, causing the fluctuation to be too violent, nor too small, so as not to effectively respond to abnormal fluctuations.

[0154] The deviation fluctuation calculation subunit calculates the standard deviation of the quantity deviation within a preset adjustment period to obtain the quantity deviation fluctuation value. If this fluctuation value is greater than the preset quantity deviation fluctuation threshold, the adjustment subunit reduces the preset flow fluctuation threshold based on the relative deviation between the quantity deviation fluctuation value and the threshold, as well as the preset adjustment coefficient, to form a new adjusted flow fluctuation threshold. This is done dynamically based on the deviation fluctuation, thereby optimizing the flow fluctuation threshold.

[0155] By dynamically adjusting thresholds to improve the system's adaptability and accuracy, it can respond more precisely to fluctuations in the number of abnormal accounts, effectively avoid misjudgments caused by fluctuations in the number of abnormal accounts, and enhance the flexibility and robustness of the risk control system in actual operation.

[0156] On the other hand, please continue reading Figure 4 As shown, it is a flowchart of the telecommunications service risk control method based on machine learning in this embodiment;

[0157] This embodiment also provides a machine learning-based method for controlling telecommunications service risks, including:

[0158] Collect real-time traffic usage, real-time balance changes, and real-time call frequency of each account to be analyzed from the telecommunications service data source;

[0159] Several first temporary accounts are determined based on the real-time traffic usage and the preset traffic fluctuation threshold.

[0160] A number of second temporary accounts are determined based on the real-time balance change value of each of the first temporary accounts and the real-time call frequency;

[0161] Several first abnormal accounts are determined based on the real-time traffic usage, real-time balance change value, and real-time call frequency of any two second temporary accounts;

[0162] Based on a preset machine learning model, the real-time traffic usage, real-time balance change value, and real-time call frequency of all the accounts to be analyzed, several second abnormal accounts are identified.

[0163] The preset traffic fluctuation threshold is adjusted based on the number of the first abnormal account and the number of the second abnormal account to form an adjusted traffic threshold.

[0164] Control the permissions of the first abnormal account determined based on the adjusted traffic threshold.

[0165] By collecting real-time data on data usage, balance changes, and call frequency of the accounts to be analyzed from telecommunications service data sources, a first temporary account is identified using a preset data fluctuation threshold. A second temporary account is then identified using balance change and call frequency data. Next, by comparing the relevant data of the second temporary account, the first abnormal account is identified. Simultaneously, a machine learning model is used to analyze all account data to identify the second abnormal account. Finally, based on the number of first and second abnormal accounts, the data fluctuation threshold is adjusted to more precisely control the permissions of abnormal accounts, achieving effective risk control.

[0166] By adjusting traffic fluctuation thresholds in real time, the sensitivity and response speed to abnormal behavior are improved. With the help of machine learning models, high accuracy and reliability are maintained in dynamically changing environments, thereby achieving more precise risk control and resource management, effectively reducing the risk of misjudgment and missed judgment, and ensuring the stability and security of telecommunications networks.

[0167] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A machine learning-based telecommunications service risk control system, characterized in that, include: The data acquisition module is used to collect real-time traffic usage, real-time balance changes, and real-time call frequency of each account to be analyzed from the telecommunications service data source. The first determining module is connected to the data acquisition module and is used to determine a number of first temporary accounts based on the real-time traffic usage and the preset traffic fluctuation threshold. The second determining module is connected to the data acquisition module and the first determining module respectively, and is used to determine a number of second temporary accounts based on the real-time balance change value of each of the first temporary accounts and the real-time call frequency. The first determination module is connected to the data acquisition module and the second determination module respectively, and is used to determine a number of first abnormal accounts based on the real-time traffic usage, the real-time balance change value and the real-time call frequency of any two second temporary accounts. The second determination module is connected to the data acquisition module and the first determination module respectively, and is used to determine a number of second abnormal accounts based on a preset machine learning model, the real-time traffic usage of all the accounts to be analyzed, the real-time balance change value and the real-time call frequency. An adjustment module, which is connected to the first determination module and the second determination module respectively, is used to adjust the preset traffic fluctuation threshold according to the number of the first abnormal accounts and the number of the second abnormal accounts, thereby forming an adjusted traffic threshold. A control module, which is connected to the adjustment module and the first determination module respectively, is used to control the permissions of the first abnormal account determined based on the adjusted traffic threshold.

2. The machine learning-based telecommunications service risk control system according to claim 1, characterized in that, The first determining module includes: The traffic fluctuation calculation unit is used to calculate the standard deviation of the real-time traffic usage within a preset first determined time period to form a traffic fluctuation value; The first determining unit is connected to the traffic fluctuation calculation unit and is used to determine the account to be analyzed as the first abnormal account when the traffic fluctuation value is greater than the preset traffic fluctuation threshold, thereby forming a plurality of first temporary accounts.

3. The machine learning-based telecommunications service risk control system according to claim 2, characterized in that, The second determining module includes: The balance fluctuation calculation unit is used to calculate the standard deviation of the real-time balance change value within a preset second predetermined time period to form the balance change fluctuation value; The frequency fluctuation calculation unit is used to calculate the standard deviation of the real-time call frequency within the preset second determined time period to form a frequency fluctuation value; The second determining unit is used to determine a number of second temporary accounts based on the balance change fluctuation value and the frequency fluctuation value.

4. The machine learning-based telecommunications service risk control system according to claim 3, characterized in that, The second determining unit includes: The balance curve plotting sub-unit is used to plot the balance change curve based on the balance change fluctuation value; The frequency curve plotting subunit is used to plot the frequency change curve based on the frequency fluctuation value; A consistency calculation subunit is connected to the balance curve drawing subunit and the frequency curve drawing subunit respectively, and is used to calculate the cosine similarity between the balance change curve and the frequency change curve to form a consistency score. The second determining subunit, which is connected to the consistency calculation subunit, is used to determine the first temporary account as the second temporary account when the consistency is less than a preset consistency threshold.

5. The machine learning-based telecommunications service risk control system according to claim 4, characterized in that, The first determination module includes: An integration unit is used to integrate the real-time traffic usage, real-time balance change value, and real-time call frequency of a single second temporary account into a single three-dimensional vector, forming an integrated vector; A normalization unit, which is connected to the integration unit, is used to normalize the integration vector to form a normalized vector; The first determination unit, which is connected to the normalization unit, is used to determine a number of first abnormal accounts based on any two of the normalization vectors.

6. The machine learning-based telecommunications service risk control system according to claim 5, characterized in that, The first determination unit includes: A similarity calculation subunit, which is connected to the normalization unit, is used to calculate the Euclidean distance between any two normalized vectors to form anomaly similarity. The first determination subunit, which is connected to the similarity calculation subunit, is used to determine that when the abnormal similarity is greater than a preset similarity threshold, the two corresponding second temporary accounts are both first abnormal accounts, thus forming a plurality of first abnormal accounts.

7. The machine learning-based telecommunications service risk control system according to claim 6, characterized in that, The second determination module includes: The probability prediction unit is used to use the preset machine learning model to predict the real-time traffic usage, real-time balance change value and real-time call frequency of each of the accounts to be analyzed, and to obtain several abnormal probability values. The second determination unit is connected to the probability prediction unit and is used to determine the account to be analyzed as a second abnormal account when the abnormal probability value is greater than a preset probability value threshold, thereby forming a plurality of second abnormal accounts.

8. The machine learning-based telecommunications service risk control system according to claim 7, characterized in that, The adjustment module includes: The deviation calculation unit is used to calculate the relative deviation between the number of the first abnormal accounts and the number of the second abnormal accounts, forming a quantity deviation; An adjustment unit is used to adjust the preset flow fluctuation threshold according to the quantity deviation and the preset adjustment coefficient to form an adjusted flow threshold.

9. The machine learning-based telecommunications service risk control system according to claim 8, characterized in that, The adjustment unit includes: The deviation fluctuation calculation subunit is used to calculate the standard deviation of the quantity deviation within a preset adjustment period to form the quantity deviation fluctuation value; An adjustment subunit, connected to the deviation fluctuation calculation subunit, is used to reduce the preset flow fluctuation threshold based on the relative deviation between the quantity deviation fluctuation value and the preset quantity deviation fluctuation threshold, and the preset adjustment coefficient, when the quantity deviation fluctuation value is greater than the preset quantity deviation fluctuation threshold, thereby forming an adjusted flow threshold.

10. A machine learning-based telecommunications service risk control method, based on the machine learning-based telecommunications service risk control system according to any one of claims 1-9, characterized in that, include: Collect real-time traffic usage, real-time balance changes, and real-time call frequency of each account to be analyzed from the telecommunications service data source; Several first temporary accounts are determined based on the real-time traffic usage and the preset traffic fluctuation threshold. A number of second temporary accounts are determined based on the real-time balance change value of each of the first temporary accounts and the real-time call frequency; Several first abnormal accounts are determined based on the real-time traffic usage, real-time balance change value, and real-time call frequency of any two second temporary accounts; Based on a preset machine learning model, the real-time traffic usage, real-time balance change value, and real-time call frequency of all the accounts to be analyzed, several second abnormal accounts are identified. The preset traffic fluctuation threshold is adjusted based on the number of the first abnormal account and the number of the second abnormal account to form an adjusted traffic threshold. Control the permissions of the first abnormal account determined based on the adjusted traffic threshold.

Images