Suspicious number identification method and device, equipment, medium and program product

Abstract

The invention provides a suspicious number identification method and device, equipment, a medium and a program product, and the method comprises the steps: obtaining a to-be-identified number, and determining the first base station information of the to-be-identified number, and the second base station information and user information of a called party corresponding to the to-be-identified number; determining an occupational influence value and a trust influence value of the called party according to the user information and the second base station information, and determining an influence possible value of the called party based on the occupational influence value and the trust influence value; determining a suspicious value of the number to be identified based on the influence possible value and the first base station information; and determining whether the to-be-identified number is a suspicious number based on the suspicious value. According to the technical scheme provided by the invention, the unlabeled suspicious number is identified according to the suspicious value.

Description

Technical Field

[0001] The present invention relates to the field of security technologies, and in particular, to a method, device, equipment, medium and program product for identifying suspicious numbers. Background Art

[0002] With the development of network technology, AI technology and the rapid popularization of intelligent multimedia terminals, intelligent terminals have become the preferred tools for lawbreakers to commit illegal acts. When people commit illegal acts based on the network or telephone, since most of them are individual calls with users, involving the privacy of normal users, the content thereof cannot be monitored. Therefore, the implementation of such illegal acts has strong concealment and is difficult to prompt. However, if a prompt can be made to the called party in a timely manner, it can, to a certain extent, reduce the losses of normal users. At present, the prompts for such illegal acts mainly come from user reports and the establishment of a list mechanism, in which the suspicious numbers reported by users who have committed violations are stored in the gray list, and when the number makes a call again, a risk of this number is prompted to the called party. However, the existing suspicious number identification solutions have serious lag, and they will only prompt a number after it is marked as a suspicious number by a user. If there is no user marking, it cannot be prompted. Therefore, the existing solutions have weak protection. Summary of the Invention

[0003] The present invention provides a method, device, equipment, medium and program product for identifying suspicious numbers to solve the defects in the prior art.

[0004] The present invention provides a method for identifying suspicious numbers, including: Obtaining a number to be identified, and determining first base station information of the number to be identified, as well as second base station information and user information of the called party corresponding to the number to be identified; Determining a professional influence value and a trust influence value of the called party according to the user information and the second base station information, and determining a possible influence value of the called party based on the professional influence value and the trust influence value; Determining a suspicious value of the number to be identified based on the possible influence value and the first base station information; Determining whether the number to be identified is a suspicious number based on the suspicious value.

[0005] According to the method for identifying suspicious numbers provided by the present invention, determining the professional influence value of the called party according to the user information and the second base station information includes: Based on the second base station information, determining points of interest within the coverage of the base stations connected by the called party within a plurality of target time ranges; If the user information includes an occupation, determine the relevance between the called party and each of the points of interest according to the occupation and the occupation types corresponding to each of the points of interest, or if the user information does not include an occupation, determine the number of occurrences of each of the points of interest, and calculate the relevance between the called party and each of the points of interest according to the number of occurrences; Determine the target occupation type corresponding to each of the target time ranges for the called party according to the relevance; Determine a corresponding first influence probability according to the target occupation type, and determine the occupation influence value according to each of the first influence probabilities.

[0006] According to a suspicious number identification method provided by the present invention, determining a trust influence value of the called party according to the user information and the second base station information includes: Determine the call objects of the called party within a preset time range according to the user information, and the number of calls and call durations corresponding to the called party and each of the call objects; Calculate a first ratio according to the number of calls, and calculate a second ratio according to the call duration; Determine a second influence probability according to the age in the user information, and calculate the trust influence value according to the second influence probability, the first ratio, and the second ratio.

[0007] According to a suspicious number identification method provided by the present invention, determining a suspicious value of the number to be identified based on the influence possible value and the first base station information includes: Determine a first base station trajectory curve corresponding to the number to be identified according to the first base station information; Obtain a set of abnormal numbers, where the set of abnormal numbers includes a plurality of abnormal numbers, and each of the abnormal numbers has a corresponding second base station trajectory curve; Calculate a first target similarity between the number to be identified and each of the abnormal numbers based on the first base station trajectory curve and the second base station trajectory curve; Calculate the suspicious value of the number to be identified according to the first target similarity and the influence possible value.

[0008] According to a suspicious number identification method provided by the present invention, calculating a first target similarity between the number to be identified and each of the abnormal numbers based on the first base station trajectory curve and the second base station trajectory curve includes: Based on a preset step size, select a plurality of trajectory points in the first base station trajectory curve and the second base station trajectory curve respectively, and determine the position information of each of the trajectory points; Calculate the position mean of the trajectory points of the first base station trajectory curve and the trajectory points of each of the second base station trajectory curves according to the position information; Obtain the call information of the number to be identified and each of the abnormal numbers, and calculate the behavior similarity between the number to be identified and each of the abnormal numbers according to the call information; Calculate the first target similarity between the number to be identified and each of the abnormal numbers based on the position mean and the behavior similarity.

[0009] According to a suspicious number identification method provided by the present invention, before obtaining the abnormal number set, the method further includes: Obtain a number gray list; wherein, the number gray list includes at least one suspicious number; Determine the third base station information of each of the suspicious numbers in the number gray list, and determine a plurality of candidate numbers corresponding to each of the suspicious numbers according to the third base station information; wherein, the candidate numbers do not exist in the number gray list; Determine the third base station trajectory curve of each of the suspicious numbers based on the third base station information, and determine the fourth base station trajectory curve of each of the candidate numbers; Calculate the second target similarity between each of the suspicious numbers and the corresponding candidate numbers respectively based on the third base station trajectory curve and the fourth base station trajectory curve; Determine a target candidate number from the candidate numbers according to the second target similarity, and use the target candidate number and the suspicious number in the number gray list as abnormal numbers to form an abnormal number set.

[0010] According to a suspicious number identification method provided by the present invention, the determining whether the number to be identified is a suspicious number based on the suspicious value includes: If the suspicious value is greater than or equal to a preset suspicious threshold, determine that the number to be identified is a suspicious number; If the suspicious value is less than the preset suspicious threshold, detect whether the number to be identified exists in the number gray list; If it exists, determine that the number to be identified is a suspicious number.

[0011] The present invention also provides a suspicious number identification device, including: A first determination module, configured to obtain a number to be identified, and determine the first base station information of the number to be identified, as well as the second base station information and user information of the called party corresponding to the number to be identified; A second determination module, configured to determine the occupation influence value and trust influence value of the called party according to the user information and the second base station information, and determine the influence possibility value of the called party based on the occupation influence value and the trust influence value; A third determination module, configured to determine a suspicious value of the number to be identified based on the influence probability value and the first base station information; A fourth determination module, configured to determine whether the number to be identified is a suspicious number based on the suspicious value.

[0012] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the suspicious number identification method as described in any one of the above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the suspicious number identification method as described in any one of the above is implemented.

[0014] The present invention also provides a computer program product, including a computer program. When the computer program is executed by a processor, the suspicious number identification method as described in any one of the above is implemented.

[0015] The suspicious number identification method, device, equipment, medium, and program product provided by the present invention determine a professional influence value and a trust influence value of the called party based on the second base station information and user information of the called party, and then determine an influence probability value based on the professional influence value and the trust influence value. Furthermore, the suspicious value of the number to be identified is determined through the first base station information and the influence probability value of the number to be identified, and the identification of unlabeled suspicious numbers is realized according to the suspicious value. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0017] Figure 1 It is a schematic flowchart of the suspicious number identification method provided by the present invention.

[0018] Figure 2 It is a schematic diagram of the base station trajectory curve provided by the present invention.

[0019] Figure 3 It is a schematic structural diagram of the suspicious number identification device provided by the present invention.

[0020] Figure 4 It is a schematic structural diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0021] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0022] The following will describe Figures 1 - 4 the suspicious number identification method, device, equipment, medium, and program product of the present invention.

[0023] The user information (including but not limited to user device information, base station information connected by the user, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of relevant countries and regions, and corresponding operation entrances are provided for users to choose to authorize or refuse.

[0024] Figure 1 is a flowchart of a suspicious number identification method shown according to an exemplary embodiment. As Figure 1 shown, in an exemplary embodiment, the suspicious number identification method includes steps 110 to 140, which are introduced in detail as follows.

[0025] Step 110: Obtain the number to be identified, and determine the first base station information of the number to be identified, as well as the second base station information and user information of the called party corresponding to the number to be identified.

[0026] In the embodiments of the present invention, when illegal personnel want to commit illegal acts, they will initiate a call actively, that is, initiate a call to the called party through the number to be identified. Even when the intelligent terminal is in standby, it will periodically contact the base station, and the base stations contacted by the intelligent terminal in each period can be obtained through the telephone number. Therefore, the first base station information of the number to be identified is obtained, and the second base station information and user information of the called party are determined. The user information is determined according to the telephone number of the called party. The identifier of the called party (such as the ID number) is determined according to the telephone number, and then it is determined whether there is information corresponding to the identifier in the maintained user information table.

[0027] For example, when a user applies for a phone number, real-name authentication is carried out and user identification is provided. If the user also applies for other value-added services at the business hall, other information such as education background and occupation will also be filled in. Each time user information is obtained, it is necessary to confirm whether there is information corresponding to the user identification in the currently maintained user information table. If it exists, it is determined whether there are the same attributes between the currently stored information and the newly obtained information. If the values of the same attributes are the same, no processing is performed. If the values of the same attributes are different, the attribute value is replaced with the newly obtained value. If there are no same attributes, the attribute is added to the stored information and the value of the attribute is stored. In this way, a user information table will be maintained. In actual applications, the user information table is not a single table, but a group of tables, and the tables are associated by user identification. For example, a user basic information table and a user value-added service table, etc. Different services can correspond to different tables.

[0028] Step 120: Determine the occupation influence value and trust influence value of the called party according to the user information and the second base station information, and determine the possible influence value of the called party based on the occupation influence value and the trust influence value.

[0029] In the embodiment of the present invention, according to the user information and the second base station information, the occupation influence value and the trust influence value of the called party are respectively determined, and the possible influence value of the called party is determined based on the occupation influence value and the trust influence value. Specifically, the possible influence value = occupation influence value × trust influence value.

[0030] The possible influence value mainly describes the degree of difficulty for relevant personnel to defraud a relatively large amount of public and private property of the called party by using the method of fabricating facts or concealing the truth when communicating with the called party through the number to be identified. The larger the possible influence value, the higher the possibility that the called party will be deceived.

[0031] Step 130: Determine the suspicious value of the number to be identified based on the possible influence value and the first base station information.

[0032] In the embodiment of the present invention, the suspicious value of the number to be identified is determined according to the possible influence value and the first base station information.

[0033] Step 140: Determine whether the number to be identified is a suspicious number based on the suspicious value.

[0034] In the embodiment of the present invention, it is determined whether the number to be identified is a suspicious number based on the suspicious value.

[0035] In the embodiments of the present invention, according to the second base station information and user information of the called party, the occupation influence value and trust influence value of the called party are determined. Then, based on the occupation influence value and trust influence value, the influence probability value is determined. Furthermore, based on the first base station information of the number to be identified and the influence probability value, the suspicious value of the number to be identified is determined, and the unlabeled suspicious numbers are identified according to the suspicious value.

[0036] In an exemplary embodiment of the present invention, determining the occupation influence value of the called party according to the user information and the second base station information includes: Based on the second base station information, determine the points of interest within the coverage of the base stations connected by the called party within multiple target time ranges; If the user information includes an occupation, according to the occupation and the occupation types corresponding to each of the points of interest, determine the relevance between the called party and each of the points of interest. Or if the user information does not include an occupation, determine the occurrence times of each of the points of interest, and calculate the relevance between the called party and each of the points of interest according to the occurrence times; According to the relevance, determine the target occupation types corresponding to each of the target time ranges of the called party; Determine the corresponding first influence probability according to the target occupation types, and determine the occupation influence value according to each of the first influence probabilities.

[0037] In the embodiments of the present invention, the base stations contacted in each period can be obtained through the telephone number, and according to the time (earlier or later) and the identifier of the base station to which the time belongs, such as the location area code LAC, the base station information as shown in Table 1 below is obtained. (The data in the following Table 1 and subsequent Table 2, such as time, are all examples and not real data): Table 1

[0038] Because a base station has a certain coverage area, within this coverage area, intelligent terminals will all communicate with this base station. Therefore, within a short period of time, intelligent terminals will all interact with the same base station. This feature can also be reflected in Table 1. For example, from serial number 1 to serial number SN are all under the same base station. Therefore, after obtaining Table 1, the data of adjacent identical base stations will be merged, and the time will be taken as the earliest time, forming the base station information as shown in Table 2. That is, Table 2 shows the start time when the user interacts with each base station within a period of time, and then the target time ranges when the user interacts with each base station are obtained. As shown in Table 2 below, within the target time range from 10:00 to 13:10, the intelligent terminal interacts with base station YYY1.

[0039] Table 2

[0040] Two pieces of information can be obtained from Table 2. One is the base station trajectory of the smart terminal over time, and the other is the residence time of the smart terminal under each base station, that is, the target time range.

[0041] In addition, the location of the base station can be obtained through the base station identifier, and then the location information of the area covered by the base station can be obtained.

[0042] If there is information corresponding to the user identifier of the number to be recognized in the user information table, obtain the occupation of the called party, and at the same time determine the age of the called party according to the ID number. If there is no information corresponding to the user identifier in the user information table, only determine the age of the called party according to the ID number.

[0043] For any target time range j, according to the electronic map information of the third party, determine the points of interest (POIs) within the coverage of the base station connected by the called party during this time range, such as cinemas, restaurants, office buildings, etc. The points of interest are the locations where the called party stays and has a certain interest. Determine the number of occurrences of each point of interest within each target time range. For example, if there are 5 restaurants within the target time range j, then the number of occurrences of the point of interest "restaurant" is 5.

[0044] If the user information includes the occupation, determine the relevance between the occupation of the called party and each point of interest within each target time range.

[0045] Specifically, pre-set the corresponding relationship between the occupation types corresponding to various points of interest. For example, the occupation type corresponding to a restaurant is catering. In this way, according to the user's occupation and the corresponding relationship, determine whether the occupation exists in the occupation types corresponding to the points of interest within each target time range. If it exists, the relevance between this point of interest and the occupation of the called party , if it does not exist, calculate the relevance through the following formula: ; where i is the point of interest identifier, j is the time period identifier, that is, the jth target time range, is the number of occurrences of point of interest i within the coverage of the base station corresponding to the jth target time range, is the total number of occurrences of point of interest i among all points of interest within the coverage of all base stations, is the normalized value of the duration of the jth target time range, , where, is the duration of the jth target time range, is the minimum duration among all target time ranges, is the maximum duration among all target time ranges.

[0046] That is to say, if the occupation of the called party corresponds to the interest point, then the two must correspond, so the correlation is 1. If the occupation of the called party does not correspond to the interest point, it cannot be said that the called party has no interest in the interest point. If the interest point appears more times in the user's trajectory and the longer the stay time at the location, then the called party is likely to be more interested in the interest point. Therefore, the correlation is determined to be 1. .

[0047] If the user information does not include occupation, determine the relevance between the called party and each point of interest within each target time range. The relevance calculation at this time is the same as the above same.

[0048] If within each target time range, there is If there is no interest point, it will be used as the target occupation type within the target time range. points of interest, the maximum relevance within the target time range The occupation type of the corresponding point of interest is used as the target occupation type within the target time range. There can be one or more target occupation types as long as the above conditions are met.

[0049] The pre-selection will obtain a large amount of sample data of the deceived party, and conduct big data learning based on the occupational types corresponding to the deceived party in each sample data of the deceived party to determine the first impact probability corresponding to each occupational type. And every once in a while, or whenever a new type of illegal behavior is discovered, a new first impact probability will be re-learned to obtain a new first impact probability, and then maintain a corresponding relationship between an occupational type and a first impact probability. The first impact probability corresponding to the target occupational type corresponding to each target time range is obtained, and the average of the first impact probabilities obtained is calculated as the occupational impact value.

[0050] In an exemplary embodiment of the present invention, determining the trust impact value of the called party according to the user information and the second base station information includes: Determine, according to the user information, the call objects of the called party within a preset time range, as well as the number of calls and call durations corresponding to the called party and each of the call objects; Calculating a first ratio according to the number of calls, and calculating a second ratio according to the call duration; A second influence probability is determined according to the age in the user information, and the trust influence value is calculated according to the second influence probability, the first ratio, and the second ratio.

[0051] In the embodiment of the present invention, the called party's call partners within a preset time range, ie, the call partners within a recent period of time, and the duration of each call are determined according to the called party's phone number.

[0052] Group the same call objects into one category, so as to obtain the number of calls between the called party and each call object. This number indicates how many different objects the user has called. The larger this value is, the greater the possibility that the user contacts strangers.

[0053] Arrange the number of calls in descending order, determine the number of calls in the middle position, and obtain the median value of the number of calls. This value represents the number of calls in the middle during the actual call process. Then calculate the average value of all the number of calls to obtain the average value of the number of calls. This value represents the average number of calls between the called party and one call object. Divide the median value of the number of calls by the average value of the number of calls to obtain the first ratio. The first ratio illustrates the gap between the median and the average of the actual calls. If the first ratio is 1, it indicates a normal call data. If the first ratio is greater than 1, it means the median is larger than the average, and the called party has more calls with the same call objects on the whole, indicating that the call volume involving new users is smaller. In this case, it is also considered normal. If the first ratio is less than 1, it means the median is smaller than the average, and the number of calls of most call objects of the called party is smaller, indicating that there are relatively more new call objects. At this time, it is abnormal, and the smaller the first ratio, the more abnormal it is.

[0054] Arrange the call duration in descending order, determine the call duration in the middle position, and obtain the median value of the call duration. This value represents the call duration in the middle during the actual call process. Then calculate the average value of all the call durations to obtain the average value of the call duration. This value represents the average call duration per time from the data perspective. Divide the median value of the call duration by the average value of the call duration to obtain the second ratio. The second ratio illustrates the gap between the median and the average of the actual call duration per time. If the second ratio is 1, it indicates a normal call data. If the second ratio is greater than 1, it means the median is larger than the average, and there are more calls with longer single - call durations, indicating that the conversation content is more and the possibility of being deceived during the call is greater. At this time, it is abnormal, and the longer the duration, the more abnormal it is. If the second ratio is less than 1, it means the median is smaller than the average, and there are more calls with shorter single - call durations, indicating that each call time is relatively short and the possibility of being deceived is smaller. Based on the above analysis, the larger the second ratio and the smaller the first ratio, the easier it is for the called party to trust the other party.

[0055] A large number of deceived sample data will be pre - selected. Based on the ages of the deceived parties in each deceived sample data, big data learning is carried out to determine the corresponding second influence probabilities for each age. And at regular intervals, or whenever a new type of illegal act is discovered, re - learning will be carried out to obtain new second influence probabilities, thereby maintaining a correspondence between age and the second influence probability.

[0056] Determine the trust influence value = second influence probability × second ratio / first ratio.

[0057] In an exemplary embodiment of the present invention, determining the suspicious value of the number to be identified based on the influence probability value and the first base station information includes: Determining the first base station trajectory curve corresponding to the number to be identified according to the first base station information; Obtaining a set of abnormal numbers, where the set of abnormal numbers includes a plurality of abnormal numbers, and each of the abnormal numbers has a corresponding second base station trajectory curve; Calculating a first target similarity between the number to be identified and each of the abnormal numbers based on the first base station trajectory curve and the second base station trajectory curve; Calculating the suspicious value of the number to be identified according to the first target similarity and the influence probability value.

[0058] In an embodiment of the present invention, the first base station trajectory curve corresponding to the number to be identified is determined according to the first base station information. As Figure 2 shown, Figure 2 is a curve graph drawn based on the foregoing Table 2. The abscissa of the base station trajectory curve is time, and the ordinate is the base station location (the coordinates of the base station can be obtained according to the base station identifier, such as longitude and latitude coordinates).

[0059] An abnormal number set is pre-created. The abnormal number set includes a plurality of abnormal numbers. The abnormal numbers are determined suspicious numbers or numbers with a high similarity to the suspicious numbers. Each abnormal number is drawn with a corresponding second base station trajectory curve according to the corresponding base station information.

[0060] Calculating a first target similarity between the number to be identified and each of the abnormal numbers based on the first base station trajectory curve and the second base station trajectory curve.

[0061] Based on the influence probability value, the first target similarity is enhanced to obtain the suspicious value of the number to be identified. Specifically, the first target similarity reflects the similarity degree of the two curves. However, different users have different susceptibilities to the illegal acts of lawbreakers. The influence probability value represents this susceptibility. The larger the influence probability value, the smaller the difficulty. Therefore, the two curves are not so similar, that is, the first target similarity is not so large, but there is still a risk to the user. Therefore, in an embodiment of the present invention, the suspicious value is determined as the first target similarity × (1 + influence probability value), so as to enhance the final first target similarity through the influence probability value and ensure that the suspicious value is an accurate value that matches the personality of the called party very well.

[0062] In an exemplary embodiment of the present invention, calculating the first target similarity between the number to be identified and each of the abnormal numbers based on the first base station trajectory curve and the second base station trajectory curve includes: Based on a preset step size, multiple trajectory points are respectively selected from the first base station trajectory curve and the second base station trajectory curve, and the position information of each of the trajectory points is determined; According to the position information, the position mean value of the trajectory points of the first base station trajectory curve and the trajectory points of each of the second base station trajectory curves is calculated; The call information of the number to be recognized and each of the abnormal numbers is obtained, and the behavior similarity between the number to be recognized and each of the abnormal numbers is calculated according to the call information; Based on the position mean value and the behavior similarity, the first target similarity between the number to be recognized and each of the abnormal numbers is calculated.

[0063] In the embodiment of the present invention, for each base station trajectory curve, starting from the coordinate origin, every preset step size (such as 1 hour, or half an hour, etc.) determines n trajectory points, where n is greater than or equal to 2, and the position information of each of the trajectory points is determined, such as longitude and latitude values. The position information of the trajectory points successively taken by the first base station trajectory curve is 、 、……、 . The position information of the trajectory points successively taken by the second base station trajectory curve is 、 、……、 .

[0064] Calculate the position difference between two trajectory points corresponding to the step size. For example, the first trajectory point of the first base station trajectory curve and the first trajectory point of the second base station trajectory curve, the position difference therebetween is .

[0065] Calculate the position mean value of all the position differences , where is the total number of the position differences.

[0066] The behavior similarity between the first base station trajectory curve and the first base station trajectory curve is calculated through the following formula: ; wherein, is the average duration between two adjacent outgoing calls of the telephone number corresponding to the first base station trajectory curve, is the minimum duration between two adjacent outgoing calls of the telephone number corresponding to the first base station trajectory curve, is the maximum duration between two adjacent outgoing calls of the telephone number corresponding to the first base station trajectory curve, is the average duration between two adjacent outgoing calls of the telephone number corresponding to the second base station trajectory curve, is the minimum duration between two consecutive outgoing calls of the phone number corresponding to the second base station trajectory curve, is the maximum duration between two consecutive outgoing calls of the phone number corresponding to the second base station trajectory curve, is the average number of outgoing calls per unit duration (such as 1 hour) of the phone number corresponding to the first base station trajectory curve, is the minimum number of outgoing calls per unit duration of the phone number corresponding to the first base station trajectory curve, is the maximum number of outgoing calls per unit duration of the phone number corresponding to the first base station trajectory curve, is the average number of outgoing calls per unit duration of the phone number corresponding to the second base station trajectory curve, is the minimum number of outgoing calls per unit duration of the phone number corresponding to the second base station trajectory curve, is the maximum number of outgoing calls per unit duration of the phone number corresponding to the second base station trajectory curve.

[0067] The behavior similarity characterizes the similarity degree of the behavior characteristics between the phone number corresponding to the first base station trajectory curve and the phone number corresponding to the second base station trajectory curve.

[0068] Through the formula calculate the first target similarity between the number to be recognized and each abnormal number.

[0069] In an exemplary embodiment of the present invention, before obtaining the abnormal number set, the method further includes: Obtain a number gray list; wherein, the number gray list includes at least one suspicious number; Determine the third base station information of each of the suspicious numbers in the number gray list, and determine a plurality of candidate numbers corresponding to each of the suspicious numbers according to the third base station information; wherein, the candidate numbers do not exist in the number gray list; Based on the third base station information, determine the third base station trajectory curve of each of the suspicious numbers, and determine the fourth base station trajectory curve of each of the candidate numbers; Based on the third base station trajectory curve and the fourth base station trajectory curve, calculate the second target similarity between each of the suspicious numbers and the corresponding candidate numbers respectively; According to the second target similarity, determine the target candidate numbers from the candidate numbers, and use the target candidate numbers and the suspicious numbers in the number gray list as abnormal numbers to form an abnormal number set.

[0070] In the embodiment of the present invention, the number gray list is adjusted in real time. Whenever a user marks a suspicious number, it is put into the number gray list to ensure that the current number gray list contains all the currently discovered suspicious numbers.

[0071] However, simply determining whether a number is in the gray list of numbers and then determining whether it is a suspicious call has a high latency. Therefore, the technical solution provided by the present invention does not simply compare with the gray list of numbers, but first expands the gray list of numbers to obtain a set of abnormal numbers, thus avoiding the latency problem caused by simply using the gray list of numbers, and then evaluating the suspicious value of the number to be identified based on the set of abnormal numbers.

[0072] Specifically, determine the roaming locations of each suspicious number in the gray list of numbers, obtain all the telephone numbers in the roaming locations, and form a number pool. Of course, it is also possible to obtain all the telephone numbers in the roaming location within a certain time range according to the registration time of the suspicious numbers in the gray list of numbers. That is to say, as long as the telephone numbers in the same location as the confirmed suspicious call are put into the number pool.

[0073] Because in the initial stage, lawbreakers will buy a large number of telephone numbers from card dealers. When a certain telephone number is reported, the reported telephone number enters the gray list of numbers, while other telephone numbers are not in the gray list of numbers because they have not been reported. However, other telephone numbers are registered in the same location as the suspicious numbers in the gray list of numbers. By determining the roaming locations of each suspicious number in the gray list of numbers and obtaining all the telephone numbers in the roaming locations, it can be ensured that the unreported telephone numbers also enter the number pool, ensuring the comprehensive coverage of possible abnormal numbers in the number pool.

[0074] Form a number pool with all the obtained numbers. Since only relevant abnormal numbers can be guaranteed to be in this number pool, but there are also many normal numbers, this number pool is not the final set of abnormal numbers and needs to be refined in order to leave the most accurate abnormal numbers and reduce the computational amount of subsequent suspicious value comparison.

[0075] The numbers in the number pool are divided into two categories. One category is the suspicious numbers in the gray list of numbers, and the other category is the numbers not in the gray list of numbers. Determine the third base station information of each suspicious number within a certain time range, and obtain a third base station trajectory curve similar to the aforementioned first base station trajectory curve and second base station trajectory curve based on the third base station information. For any suspicious number in the gray list of numbers, obtain the corresponding base station and the residence time at each base station through the aforementioned scheme. Select all the numbers in the number pool that also communicate with this base station during the residence time at each base station, and they are the candidate numbers corresponding to the suspicious numbers.

[0076] Determine the fourth base station information of each candidate number within a certain time. Obtain a fourth base station trajectory curve similar to the aforementioned first base station trajectory curve and second base station trajectory curve based on the fourth base station information of the candidate number.

[0077] Calculate the second target similarity between each suspicious number and the base station trajectory curve of the corresponding candidate number. The calculation of the second target similarity is the same as that of the aforementioned first target similarity, and will not be elaborated here. Determine the candidate number corresponding to the second base station trajectory line with the second target similarity greater than the preset similarity threshold as the target candidate number similar to the corresponding suspicious number. Form an abnormal number set with all suspicious numbers and target candidate numbers.

[0078] In an exemplary embodiment of the present invention, determining whether the number to be recognized is a suspicious number based on the suspicious value includes: If the suspicious value is greater than or equal to the preset suspicious threshold, determine that the number to be recognized is a suspicious number; If the suspicious value is less than the preset suspicious threshold, detect whether the number to be recognized exists in the number gray list; If it exists, determine that the number to be recognized is a suspicious number.

[0079] In the embodiment of the present invention, compare the calculated suspicious value with the preset suspicious threshold. If the suspicious value is greater than or equal to the preset suspicious threshold, it means that the number to be recognized is a suspicious number. If the suspicious value is less than the preset suspicious threshold, further determine whether the number to be recognized exists in the number gray list. If it does not exist in the number gray list, it means that the number to be recognized is a normal number. If it exists in the gray list, the number to be recognized is a suspicious number. For suspicious numbers, a warning needs to be given to the called party.

[0080] In the embodiment of the present invention, for some numbers to be recognized that are not very similar to abnormal numbers, if their suspicious values after being improved based on the influence possibility of the called party are greater than the preset suspicious threshold, they will also be determined as suspicious accounts and then warned. This can effectively prompt when users commit illegal acts. At the same time, it also enables personalized and accurate prompts suitable for user characteristics for different users.

[0081] The suspicious number recognition device provided by the present invention will be described below. The suspicious number recognition device described below can be correspondingly referred to the suspicious number recognition method described above. It should be noted that the device provided in the following embodiments and the method provided in the above embodiments belong to the same concept. The specific ways in which each module and unit perform operations have been described in detail in the method embodiments and will not be elaborated here.

[0082] In an exemplary embodiment of the present invention, please refer to Figure 3 , Figure 3 is a suspicious number recognition device shown according to an exemplary embodiment, including the following modules.

[0083] The first determination module 310 is configured to obtain the number to be recognized, and determine the first base station information of the number to be recognized, as well as the second base station information and user information of the called party corresponding to the number to be recognized; The second determination module 320 is configured to determine the occupation influence value and trust influence value of the called party according to the user information and the second base station information, and determine the influence possibility value of the called party based on the occupation influence value and the trust influence value; The third determination module 330 is configured to determine the suspicious value of the number to be recognized based on the influence possibility value and the first base station information; The fourth determination module 340 is configured to determine whether the number to be recognized is a suspicious number based on the suspicious value.

[0084] In an exemplary embodiment of the present invention, the second determination module 320 includes: The first determination sub-module is configured to determine the points of interest within the coverage range of the base stations connected by the called party within a plurality of target time ranges based on the second base station information; The second determination sub-module is configured to, if the user information includes an occupation, determine the relevance between the called party and each of the points of interest according to the occupation and the occupation types corresponding to each of the points of interest, or if the user information does not include an occupation, determine the number of occurrences of each of the points of interest, and calculate the relevance between the called party and each of the points of interest according to the number of occurrences; The third determination sub-module is configured to determine the target occupation type corresponding to each of the target time ranges according to the relevance; The fourth determination sub-module is configured to determine the corresponding first influence probability according to the target occupation type, and determine the occupation influence value according to each of the first influence probabilities.

[0085] In an exemplary embodiment of the present invention, the second determination module 320 includes: The fifth determination sub-module is configured to determine the call objects of the called party within a preset time range according to the user information, as well as the number of calls and call durations corresponding to each of the call objects of the called party; The first calculation sub-module is configured to calculate a first ratio according to the number of calls, and calculate a second ratio according to the call duration; The second calculation sub-module is configured to determine a second influence probability according to the age in the user information, and calculate the trust influence value according to the second influence probability, the first ratio, and the second ratio.

[0086] In an exemplary embodiment of the present invention, the third determination module 330 includes: The sixth determination sub-module is configured to determine the first base station trajectory curve corresponding to the number to be recognized according to the first base station information; The acquisition sub-module is configured to acquire a set of abnormal numbers, where the set of abnormal numbers includes a plurality of abnormal numbers, and each of the abnormal numbers has a corresponding second base station trajectory curve; The third calculation sub-module is configured to calculate the first target similarity between the number to be recognized and each of the abnormal numbers based on the first base station trajectory curve and the second base station trajectory curve; The fourth calculation sub-module is configured to calculate the suspicious value of the number to be recognized according to the first target similarity and the influence probability value.

[0087] In an exemplary embodiment of the present invention, the third calculation sub-module includes: The selection unit is configured to respectively select a plurality of trajectory points in the first base station trajectory curve and the second base station trajectory curve based on a preset step length, and determine the position information of each of the trajectory points; The first calculation unit is configured to calculate the position mean of the trajectory points of the first base station trajectory curve and the trajectory points of each of the second base station trajectory curves according to the position information; The second calculation unit is configured to acquire the call information between the number to be recognized and each of the abnormal numbers, and calculate the behavior similarity between the number to be recognized and each of the abnormal numbers according to the call information; The third calculation unit is configured to calculate the first target similarity between the number to be recognized and each of the abnormal numbers based on the position mean and the behavior similarity.

[0088] In an exemplary embodiment of the present invention, the suspicious number recognition device further includes: The acquisition module is configured to acquire a number grey list; where the number grey list includes at least one suspicious number; The fifth determination module is configured to determine the third base station information of each of the suspicious numbers in the number grey list, and determine a plurality of candidate numbers corresponding to each of the suspicious numbers according to the third base station information; where the candidate numbers do not exist in the number grey list; The sixth determination module is configured to determine the third base station trajectory curve of each of the suspicious numbers based on the third base station information, and determine the fourth base station trajectory curve of each of the candidate numbers; The calculation module is configured to calculate the second target similarity between each of the suspicious numbers and the corresponding candidate numbers respectively based on the third base station trajectory curve and the fourth base station trajectory curve; A seventh determination module, configured to determine a target candidate number from the candidate numbers according to the second target similarity, and use the target candidate number and the suspicious number in the number grey list as abnormal numbers to form an abnormal number set.

[0089] In an exemplary embodiment of the present invention, the fourth determination module 340 includes: A seventh determination sub-module, configured to determine that the number to be identified is a suspicious number if the suspicious value is greater than or equal to a preset suspicious threshold; A detection sub-module, configured to detect whether the number to be identified exists in the number grey list if the suspicious value is less than the preset suspicious threshold; An eighth determination sub-module, configured to determine that the number to be identified is a suspicious number if it exists.

[0090] Figure 4 An example of a schematic physical structure diagram of an electronic device is shown as Figure 4 shown. The electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440. Among them, the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call the logical instructions in the memory 430 to execute the suspicious number identification method, which includes: obtaining the number to be identified, and determining the first base station information of the number to be identified, as well as the second base station information and user information of the called party corresponding to the number to be identified; Determine the occupation influence value and trust influence value of the called party according to the user information and the second base station information, and determine the possible influence value of the called party based on the occupation influence value and the trust influence value; Determine the suspicious value of the number to be identified based on the possible influence value and the first base station information; Determine whether the number to be identified is a suspicious number based on the suspicious value.

[0091] In addition, when the logical instructions in the above-mentioned memory 430 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0092] On the other hand, the present invention also provides a computer program product. The computer program product includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the suspicious number identification method provided by the above-mentioned various methods. The method includes: obtaining a number to be identified, and determining the first base station information of the number to be identified, as well as the second base station information and user information of the called party corresponding to the number to be identified; According to the user information and the second base station information, determine the occupation influence value and trust influence value of the called party, and determine the possible influence value of the called party based on the occupation influence value and the trust influence value; Based on the possible influence value and the first base station information, determine the suspicious value of the number to be identified; Based on the suspicious value, determine whether the number to be identified is a suspicious number.

[0093] In yet another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is implemented to execute the suspicious number identification method provided by the above-mentioned various methods. The method includes: obtaining a number to be identified, and determining the first base station information of the number to be identified, as well as the second base station information and user information of the called party corresponding to the number to be identified; According to the user information and the second base station information, determine the occupation influence value and trust influence value of the called party, and determine the possible influence value of the called party based on the occupation influence value and the trust influence value; Based on the possible influence value and the first base station information, determine the suspicious value of the number to be identified; Based on the suspicious value, determine whether the number to be identified is a suspicious number.

[0094] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

[0095] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying suspicious numbers, characterized in that, Including: Obtain a number to be recognized, and determine the first base station information of the number to be recognized, as well as the second base station information and user information of the called party corresponding to the number to be recognized; Determine the occupation influence value and trust influence value of the called party according to the user information and the second base station information, and determine the possible influence value of the called party based on the occupation influence value and the trust influence value; Determine the suspicious value of the number to be recognized based on the possible influence value and the first base station information; Determine whether the number to be recognized is a suspicious number based on the suspicious value.

2. The suspicious number identification method according to claim 1, wherein Determine the occupation influence value of the called party according to the user information and the second base station information, including: Based on the second base station information, determine the points of interest within the coverage of the base stations connected by the called party within multiple target time ranges; If the user information includes an occupation, determine the relevance between the called party and each point of interest according to the occupation and the occupation types corresponding to each point of interest, or if the user information does not include an occupation, determine the number of occurrences of each point of interest, and calculate the relevance between the called party and each point of interest according to the number of occurrences; Determine the target occupation type corresponding to each target time range of the called party according to the relevance; Determine the corresponding first influence probability according to the target occupation type, and determine the occupation influence value according to each first influence probability.

3. The suspicious number identification method according to claim 1, wherein Determine the trust influence value of the called party according to the user information and the second base station information, including: Determine the call objects of the called party within a preset time range according to the user information, as well as the call times and call durations corresponding to the called party and each call object; Calculate a first ratio according to the call times, and calculate a second ratio according to the call durations; Determine a second influence probability according to the age in the user information, and calculate the trust influence value according to the second influence probability, the first ratio and the second ratio.

4. The suspicious number identification method according to claim 1, characterized in that, The determining the suspicious value of the number to be recognized based on the possible influence value and the first base station information includes: Determine the first base station trajectory curve corresponding to the number to be recognized according to the first base station information; Obtain a set of abnormal numbers, where the set of abnormal numbers includes multiple abnormal numbers, and each abnormal number has a corresponding second base station trajectory curve; Calculate the first target similarity between the number to be recognized and each abnormal number based on the first base station trajectory curve and the second base station trajectory curve; Calculate the suspicious value of the number to be recognized according to the first target similarity and the possible influence value.

5. The suspicious number identification method according to claim 4, wherein The calculating the first target similarity between the number to be recognized and each abnormal number based on the first base station trajectory curve and the second base station trajectory curve includes: Based on a preset step size, select multiple trajectory points in the first base station trajectory curve and the second base station trajectory curve respectively, and determine the position information of each trajectory point; Calculate the position mean of the trajectory points of the first base station trajectory curve and the trajectory points of each second base station trajectory curve according to the position information; Obtain the call information between the number to be identified and each of the abnormal numbers, and calculate the behavior similarity between the number to be identified and each of the abnormal numbers according to the call information; Based on the location mean value and the behavior similarity, calculate the first target similarity between the number to be identified and each of the abnormal numbers.

6. The suspicious number identification method according to claim 4, characterized in that, Before obtaining the abnormal number set, the method further includes: Obtain a number gray list; wherein, the number gray list includes at least one suspicious number; Determine the third base station information of each of the suspicious numbers in the number gray list, and determine a plurality of candidate numbers corresponding to each of the suspicious numbers according to the third base station information; wherein, the candidate numbers do not exist in the number gray list; Based on the third base station information, determine the third base station trajectory curve of each of the suspicious numbers, and determine the fourth base station trajectory curve of each of the candidate numbers; Based on the third base station trajectory curve and the fourth base station trajectory curve, calculate the second target similarity between each of the suspicious numbers and the corresponding candidate numbers respectively; According to the second target similarity, determine the target candidate numbers from the candidate numbers, and use the target candidate numbers and the suspicious numbers in the number gray list as abnormal numbers to form an abnormal number set.

7. The suspicious number identification method according to any one of claims 1 to 6, characterized in that, The determining, based on the suspicious value, whether the number to be identified is a suspicious number includes: If the suspicious value is greater than or equal to a preset suspicious threshold, determine that the number to be identified is a suspicious number; If the suspicious value is less than the preset suspicious threshold, detect whether the number to be identified exists in the number gray list; If it exists, determine that the number to be identified is a suspicious number.

8. A suspicious number identification device, characterized in that, including: A first determination module, configured to obtain a number to be identified, and determine the first base station information of the number to be identified, as well as the second base station information and user information of the called party corresponding to the number to be identified; A second determination module, configured to determine the occupation influence value and the trust influence value of the called party according to the user information and the second base station information, and determine the influence possibility value of the called party based on the occupation influence value and the trust influence value; A third determination module, configured to determine the suspicious value of the number to be identified based on the influence possibility value and the first base station information; A fourth determination module, configured to determine whether the number to be identified is a suspicious number based on the suspicious value.

9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, wherein, When the processor executes the computer program, it implements the suspicious number identification method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the suspicious number identification method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the suspicious number identification method according to any one of claims 1 to 7.

Images