Intelligent charging settlement method and system based on BOSS system

Abstract

This application relates to the technical field of communication data processing technology, and discloses an intelligent billing and settlement method and system based on a BOSS system, including: acquiring user communication data in real time through a distributed acquisition module; inputting the user communication data into a dynamic rule engine to generate real-time billing coefficients based on a weighted factor library; when abnormal usage behavior is detected, calling a multimodal detection model to determine fraud; completing cross-operator settlement through a blockchain smart contract, and achieving ledger consistency using a specified PBFT consensus algorithm; the user communication data includes user plane traffic throughput, base station location, and timestamp; the weighted factor library contains time factors, location factors, and network load factors trained by machine learning; the multimodal detection model is composed of an LSTM time series prediction module and an isolated forest algorithm in parallel, providing operators with more accurate and efficient billing and settlement capabilities, while creating a fairer and more transparent billing experience for users.

Description

Technical Field

[0001] This application relates to the technical field of communication data processing technology, and in particular to an intelligent billing and settlement method and system based on the BOSS system. Background Technology

[0002] In the Business Support System (BOSS) architecture of telecom operators, billing and settlement functions, as core modules, have long faced the dual challenges of business agility and system stability. Traditional BOSS systems adopt a layered architecture design, and their billing modules are usually implemented based on static rule engines, but this has shown significant limitations in current new business scenarios such as 5G network slicing and massive IoT connections.

[0003] Operators have found in practice that when faced with complex billing requirements such as dynamic resource scheduling and on-demand QoS adjustment for network slicing in edge computing scenarios, existing systems often require cumbersome rule configuration processes, taking an average of 7-15 working days from requirement submission to final deployment, severely hindering the speed of business innovation. With the deepening of digital transformation, intelligent billing and settlement methods based on traditional BOSS architecture are facing multidimensional challenges.

[0004] At the technical level, existing systems are not capable of supporting real-time services. For example, cloud gaming and 8K ultra-high-definition video require millisecond-level billing responses, while the traditional batch processing mode based on CDR (call detail record) has a delay window of at least 5-15 minutes.

[0005] At the operational level, the settlement pain points in multi-operator collaborative scenarios are particularly prominent. Due to issues such as asynchronous network probe data and inconsistent metering standards among the parties, the credibility of the settlement data is questioned.

[0006] In addition, the existing BOSS system has limited intelligence. Although some operators have introduced machine learning algorithms to detect abnormal call details, it is still in a passive "post-event processing" mode and lacks the ability to proactively manage the entire lifecycle of the business. Summary of the Invention

[0007] To provide a more responsive and efficient intelligent billing and settlement architecture, this application provides an intelligent billing and settlement method and system based on the BOSS system.

[0008] Firstly, this application provides an intelligent billing and settlement method based on a BOSS system, employing the following technical solution:

[0009] A smart billing and settlement method based on the BOSS system includes:

[0010] User communication data is acquired in real time through a distributed acquisition module;

[0011] The user communication data is input into the dynamic rule engine, and real-time billing coefficients are generated based on the weighted factor library;

[0012] When abnormal usage behavior is detected, the multimodal detection model is invoked to determine fraud.

[0013] Cross-carrier settlements are completed through blockchain smart contracts, and ledger consistency is achieved using the specified PBFT consensus algorithm.

[0014] The user communication data includes user plane traffic throughput, base station location, and timestamp; the weighting factor library contains time factors, location factors, and network load factors trained by machine learning; and the multimodal detection model is composed of an LSTM time series prediction module and an isolated forest algorithm connected in parallel.

[0015] By adopting the above technical solutions and constructing an end-to-end intelligent billing and settlement system, the accuracy of billing and settlement for operators in complex business environments has been significantly improved. Its distributed acquisition module enables real-time acquisition and processing of user communication data, providing a highly timely data foundation for subsequent analysis. The dynamic rule engine, based on a multi-dimensional weighted factor library, can intelligently adapt to different network conditions and business scenarios, enabling flexible adjustment and optimization of billing strategies. For potential abnormal usage behavior, the multimodal detection model, by combining time-series analysis and anomaly detection algorithms, effectively improves the accuracy of fraud identification and reduces operational risks. In the cross-operator settlement process, the application of blockchain technology not only simplifies the traditionally cumbersome reconciliation process but also ensures the transparency and reliability of the settlement process through smart contracts and consensus mechanisms. The entire solution, by organically integrating key technologies such as real-time data acquisition, intelligent rule engine, multimodal fraud detection, and blockchain settlement, forms a complete closed loop from user behavior perception to fee settlement, providing operators with more accurate and efficient billing and settlement capabilities while creating a fairer and more transparent billing experience for users.

[0016] Optionally, the dynamic rule engine includes:

[0017] ;

[0018] in, Based on the benchmark rate, The time factor is... The position factor, The network load factor is... The real-time billing coefficient is... , , for The variance of the results Preset a threshold for factor variance.

[0019] Optionally, the time factor Configuration methods include:

[0020] Extract user usage data for the same time period over the past 30 days;

[0021] The weights for each time period are calculated using the XGBoost model.

[0022] The hyperparameters of the XGBoost model satisfy the following conditions: learning rate ≤ 0.1, and maximum depth ≤ 8.

[0023] Optionally, the network load factor The configuration methods include:

[0024] The PRB utilization rate of the corresponding base station and the signaling plane CPU utilization rate provided by the DPI device are obtained according to the specified time period.

[0025] The first factor of network load is determined based on the PRB utilization rate. ;

[0026] The second factor of network load is determined based on the signaling plane CPU utilization and the user plane traffic throughput. ;

[0027] The third factor for determining network load is based on base station location and timestamp. ;

[0028] The network load factor is obtained by weighting the first network load factor, the second network load factor, and the third network load factor according to the specified weight allocation.

[0029] By adopting the above technical solutions, the dynamic rule engine's billing coefficient calculation process employs an intelligent, multi-dimensional decision-making mechanism, bringing significant optimization effects to the operator's billing system. This engine can calculate differentiated billing coefficients in real time based on dynamic parameters such as user packages, network type, time period, and geographical location, enabling precise personalized billing strategies. For example, in high-density scenarios (such as sporting events or concerts), the system can automatically reduce the unit traffic cost, ensuring user experience while optimizing network resource allocation and avoiding congestion. Simultaneously, the engine supports hot rule updates, allowing operators to dynamically adjust pricing strategies without downtime, such as quickly launching holiday promotional packages or temporarily adjusting international roaming rates, significantly improving service response speed. This not only enhances the operator's refined operational capabilities but also strengthens user stickiness through flexible pricing strategies, ultimately achieving a win-win situation for both revenue and user experience.

[0030] Optionally, the process of invoking a multimodal detection model to determine fraud when abnormal usage behavior is detected includes:

[0031] Continuous feature extraction is performed on the user communication data to obtain corresponding feature data; the feature data includes temporal features and statistical features.

[0032] The sliding interquartile range method is used for preliminary screening of basic flow indicators. When the following conditions are met simultaneously, the multimodal detection model is triggered to determine fraud:

[0033] The current user traffic throughput is more than 1.5 times the 75th percentile of the same period in history;

[0034] The KL divergence of the request packet length distribution differs from the baseline distribution by more than 0.4;

[0035] The concentration of target IPs increased by more than 40% within 10 minutes;

[0036] After the trigger signal is generated, the feature data of the current time window is immediately sent in parallel to the LSTM module and the Isolation Forest module.

[0037] Optionally, the operation of the LSTM time series prediction module includes:

[0038] The LSTM time-series prediction module receives the standardized time-series feature sequence;

[0039] Forward / backward time dependencies are extracted using bidirectional LSTM layers to capture specified non-scale expressions;

[0040] Automatically focus on abnormal time points and generate importance scores for each time step;

[0041] By combining the prediction biases of multiple historical windows, the abnormal confidence level of the current window is calculated.

[0042] Output the instantaneous anomaly probability of the current window's anomaly level and the trend anomaly index reflecting the persistence of the anomaly.

[0043] Optionally, the parallel detection process of the isolated forest algorithm includes:

[0044] The Isolation Forest algorithm employs a dynamic dimension selection strategy during the feature space construction phase:

[0045] Automatically select the detection dimension based on the current traffic type;

[0046] The sample is segmented into multiple levels by a specified number of isolation trees, and the path length from the root node to the isolated node is recorded.

[0047] The path length is converted into a 0-1 standardized score, and the closer the score is to 1, the more likely it is to be an anomaly.

[0048] Optionally, for sessions confirmed as fraudulent, tiered handling is implemented, and a source tracing analysis process is initiated to locate the attack entry point by correlating with other probe data and updating the firewall rule base.

[0049] Optionally, the specified PBFT consensus algorithm includes:

[0050] In the pre-preparation phase: Select the node with the lowest network latency among the current top 3 nodes by weight as the master node. The master node's proposals will carry its own weight value.

[0051] During the preparation phase, node votes are calculated based on weights.

[0052] Secondly, this application provides an intelligent billing and settlement system based on the BOSS system, which adopts the following technical solution:

[0053] A smart billing and settlement system based on a BOSS system includes a processor, wherein the processor runs a program of any one of the smart billing and settlement methods based on a BOSS system described above.

[0054] In summary, this application includes at least one of the following beneficial technical effects:

[0055] This application significantly improves the billing accuracy and settlement efficiency of operators in complex business environments by constructing an end-to-end intelligent billing and settlement system. Its distributed acquisition module realizes real-time acquisition and processing of user communication data, providing a highly timely data foundation for subsequent analysis. The dynamic rule engine, based on a multi-dimensional weighted factor library, can intelligently adapt to different network conditions and business scenarios, enabling flexible adjustment and optimization of billing strategies. For potential abnormal usage behavior, the multimodal detection model, by combining time series analysis and anomaly detection algorithms, effectively improves the accuracy of fraud identification and reduces operational risks. In the cross-operator settlement process, the application of blockchain technology not only simplifies the traditional cumbersome reconciliation process but also ensures the transparency and reliability of the settlement process through smart contracts and consensus mechanisms. The entire solution, by organically integrating key technologies such as real-time data acquisition, intelligent rule engine, multimodal fraud detection, and blockchain settlement, forms a complete closed loop from user behavior perception to fee settlement, providing operators with more accurate and efficient billing and settlement capabilities while creating a fairer and more transparent billing experience for users. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating the intelligent billing and settlement method in this application. Detailed Implementation

[0057] The embodiments of this application are described in detail below, and examples of the embodiments are shown in the accompanying drawings.

[0058] In the description of this specification, the references to "certain embodiments," "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples" refer to specific features, structures, materials, or characteristics described in connection with the described embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0059] This application discloses an intelligent billing and settlement method based on a BOSS system, referring to... Figure 1 ,include:

[0060] User communication data is acquired in real time through a distributed acquisition module;

[0061] User communication data is input into the dynamic rule engine, which generates real-time billing coefficients based on the weighted factor library;

[0062] When abnormal usage behavior is detected, the multimodal detection model is invoked to determine fraud.

[0063] Cross-carrier settlements are completed through blockchain smart contracts, and ledger consistency is achieved using the specified PBFT consensus algorithm.

[0064] In this embodiment of the application, the distributed acquisition module adopts a lightweight data acquisition system deployed at the edge of the operator's network, distributed at network nodes such as base stations and gateways, to collect user communication data (such as traffic, call duration, base station location, etc.) nearby, reducing data transmission latency and central node load; the weighted factor library contains time factors, location factors and network load factors trained by machine learning; the multimodal detection model is composed of an LSTM time series prediction module and an isolated forest algorithm in parallel.

[0065] Optionally, the dynamic rule engine includes:

[0066] ;

[0067] in, The base rate is preset by the operator (e.g., 0.1 yuan / MB), and is a static parameter. The time factor reflects the differences in time periods (e.g., α=0.8 at night, α=1.2 during peak hours). To reflect regional cost differences, the location factor is configured to vary with the distance of the user from the nearest base station (e.g., in remote areas, the distance to the nearest base station is far, so β=1.2; in central cities, the distance to the nearest base station is relatively closer, so β=0.9). This is a network load factor that can dynamically respond to network congestion (e.g., when base station utilization > 80%). =1.15), This is the real-time billing factor. , , for The variance of the results A preset threshold for factor variance can be set, which can be configured to 0.9, to ensure smooth rate fluctuations and avoid billing jitter.

[0068] Optionally, time factor Configuration methods include:

[0069] Extract user usage data from the same time period over the past 30 days, including communication behavior metrics such as call duration, data usage, and number of text messages;

[0070] Data cleaning: handling missing values, outliers, and duplicate data;

[0071] Perform feature engineering: extract time-period features (such as morning peak, evening peak, late night, etc.) and usage pattern features (such as average usage, fluctuation, etc.);

[0072] The data was divided into a training set (70%, stratified sampling by user, taking days 1-21), a validation set (20%, data from days 22-25), and a test set (10%, data from days 26-30). The validation set used a sliding window, further dividing the training set into multiple time segments, with each segment retaining the time order, and gradually expanding the training window to validate subsequent time periods.

[0073] The weights for each time period are calculated using the XGBoost model.

[0074] In the XGBoost model training process, the first tree is created to predict the initial values ​​of all samples (usually the mean of the target variable, such as the average usage over a historical period).

[0075] The decision tree is built iteratively by calculating the gradient (first derivative) and Hessian matrix (second derivative) between the current model's predicted value and the true value. The optimal split point is found based on the gradient information to build a new decision tree. The mean squared error (MSE) is commonly used as the loss function for regression tasks. After each iteration, the residual between the current model's predicted value and the true value is calculated and used as the optimization target for the next tree. The performance is monitored on the validation set, and training stops when the performance no longer improves after several consecutive iterations.

[0076] The hyperparameters of the XGBoost model satisfy the following: learning rate ≤ 0.1 to avoid getting stuck in local optima during the periodic fluctuations of telecommunications data; maximum depth ≤ 8 to control tree complexity and prevent oversensitivity to sudden traffic; and n_estimators set to a fixed value between 100 and 1000, depending on the size of the dataset.

[0077] Optionally, network load factor The configuration methods include:

[0078] Obtain the PRB utilization rate of the corresponding base station and the signaling plane CPU utilization rate provided by the DPI device according to the specified time period (sampled every 15 seconds);

[0079] Determine the first factor of network load based on PRB utilization. Specifically:

[0080] Calculate the 1-minute sliding window mean : ;

[0081] in, Let t be the number of physical resource blocks used. This represents the total number of PRBs per base station.

[0082] Segmented mapping network load first factor :

[0083] ;

[0084] According to the signaling plane CPU utilization and user plane traffic throughput Determine the second factor of network load Specifically:

[0085] If satisfied Greater than 70% and Greater than 80% of link capacity, ,otherwise ;

[0086] The third factor for determining network load is based on base station location and timestamp. Specifically:

[0087] ,in, This is the benchmark value for non-hotspot areas. This is the peak time for daily business volume. In this embodiment, the smoothing coefficient is used. This reflects the rate of decay during peak hours;

[0088] Finally, the first factor of network load was assigned weights of 0.6, 0.3, and 0.1. Network load second factor and the third factor of network load The network load factor is obtained by weighting.

[0089] In this embodiment, the dynamic rule engine employs an intelligent multi-dimensional decision-making mechanism in its billing coefficient calculation process, resulting in significant optimization for the operator's billing system. This engine can calculate differentiated billing coefficients in real time based on dynamic parameters such as user packages, network type, time period, and geographical location, enabling precise and personalized billing strategies. For example, in high-density scenarios (such as sporting events or concerts), the system can automatically reduce the unit traffic cost, ensuring user experience while optimizing network resource allocation and avoiding congestion. Simultaneously, the engine supports hot rule updates, allowing operators to dynamically adjust pricing strategies without downtime, such as quickly launching holiday promotional packages or temporarily adjusting international roaming rates, significantly improving service response speed. This not only enhances the operator's refined operational capabilities but also strengthens user stickiness through flexible pricing strategies, ultimately achieving a win-win situation for both revenue and user experience.

[0090] Optionally, when abnormal usage behavior is detected, the process of invoking the multimodal detection model for fraud determination includes:

[0091] After the raw data is normalized by a sliding window, the historical data of the most recent 60 minutes is retained as a short-term memory cache for real-time calculation of the subsequent model.

[0092] Continuous feature extraction is performed on user communication data, and the data is aggregated every 5 seconds to form a time window to obtain the corresponding feature data. The feature data includes time-series features and statistical features. The time-series features include the long sequence of traffic packets over 30 consecutive time windows, the standard deviation of the request interval, and the frequency of protocol type switching. The statistical features include the entropy value of the destination IP within the current window (measures the dispersion of distribution), the concentration of TCP / UDP port usage, and the ratio of uplink to downlink traffic.

[0093] The sliding interquartile range method is used for preliminary screening of basic flow indicators. When the following conditions are met simultaneously, the multimodal detection model is triggered to determine fraud:

[0094] The current user traffic throughput is more than 1.5 times the 75th percentile of the same period in history;

[0095] The KL divergence of the request packet length distribution differs from the baseline distribution by more than 0.4; the request packet length distribution describes the probability distribution characteristics of packet size in network traffic, and the KL divergence is used to quantify the degree of difference between the current packet length distribution and the baseline distribution;

[0096] The concentration of destination IPs increased by more than 40% within 10 minutes; the destination IP is the logical address of the device to which the data packet will eventually arrive, and it is a key focus in anomaly detection;

[0097] After the trigger signal is generated, the feature data of the current time window is immediately sent in parallel to the LSTM time series prediction module and the isolated forest module.

[0098] For example:

[0099] The following combinations may be considered malicious behavior:

[0100] The target IP concentration suddenly increased from 0.2 to 0.6;

[0101] Packet length distribution KL divergence > 0.4 (a large number of atypical 512-byte packets appear);

[0102] In the basic traffic metrics, the number of connections increased by 300%, but the throughput only increased by 50%.

[0103] It meets the characteristics of a botnet wake-up call (a large number of devices connect to the C2 server and send heartbeat packets of fixed length).

[0104] Using these combined metrics can improve the detection rate of scanning attacks while keeping the false alarm rate within a reasonable range.

[0105] Optionally, the operation of the LSTM time series prediction module includes:

[0106] The standardized time-series feature sequence is received through a pre-trained LSTM time-series prediction module;

[0107] By extracting forward / backward time dependencies through bidirectional LSTM layers, we can capture extraordinary events such as "sudden access in the early morning" or "sudden interruption of long connections".

[0108] Automatically focus on abnormal time points, generate importance scores for each time step, and calculate attention weights;

[0109] By combining the prediction biases of multiple historical windows, the abnormal confidence level of the current window is calculated.

[0110] Output the instantaneous anomaly probability of the current window's anomaly level and the trend anomaly index reflecting the persistence of the anomaly.

[0111] The pre-training process of the LSTM time series prediction module is as follows:

[0112] Dataset partitioning and preprocessing: Input data can integrate multi-dimensional features, including historical observations of user communication behavior (such as data usage, call duration, network load, etc.) as well as device status and network latency. It must meet the requirements of temporal continuity and be arranged according to a fixed time step (such as minute / hour granularity). It needs to be divided into training set, validation set and test set in chronological order. The test set time must be later than the training set to prevent future information leakage. Preprocessing is to eliminate trends and seasonality by difference (such as the current value minus the previous value) and transform it into a stationary sequence. MinMaxScaler is used to scale the data to the [-1,1] interval to complete normalization and adapt it to the tanh activation function of LSTM.

[0113] The basic architecture of the LSTM time series prediction module is a single-layer LSTM with an initial number of 32 hidden layer neurons. The output layer is a fully connected (Dense) layer that outputs univariate prediction values. A regularization mechanism is used, and Dropout is added after the LSTM layer to prevent overfitting and to limit the L2 norm of the LSTM weight matrix. The loss function can be the mean squared error (MSE) to enhance robustness to outliers.

[0114] Optionally, the parallel detection process of the Isolation Forest algorithm includes:

[0115] The Isolation Forest algorithm employs a dynamic dimension selection strategy during the feature space construction phase:

[0116] Automatically select the detection dimension based on the current traffic type (e.g., video traffic focuses on packet variance, and control signaling focuses on request frequency).

[0117] The samples were segmented in multiple levels using 200 isolation trees, and the path length from the root node to the isolated node was recorded.

[0118] The path length is converted into a 0-1 normalized score, with scores closer to 1 indicating a higher likelihood of an anomaly. This method excels at detecting "low-density outliers," such as suddenly emerging new attack patterns or device spoofing.

[0119] Optionally, for sessions confirmed as fraudulent, tiered handling is implemented, and a source tracing analysis process is initiated to locate the attack entry point by correlating with other probe data and updating the firewall rule base; the specific content of the tiered handling includes:

[0120] Real-time interception: Immediately terminate TCP connections and blacklist the source IP for high-risk behaviors such as DDoS attacks;

[0121] Traffic shaping: Limit the rate at which new connections are established for suspected scanning activities;

[0122] Digital forensics: Save complete data packets within the abnormal time window and record attack feature vectors for threat intelligence generation.

[0123] In this embodiment, the outputs of the LSTM time series prediction module and the Isolation Forest algorithm can be fused through a dynamic weighting mechanism:

[0124] The weights are dynamically adjusted based on the model's recent accuracy (0.6 for LSTM and 0.4 for Isolation Forest).

[0125] Conflict Arbitration Rules:

[0126] The connection is immediately blocked when both are >0.9; when LSTM >0.7 and Isolation Forest <0.4, the connection is entered into the manual review queue; when Isolation Forest >0.8 but LSTM <0.3, device fingerprint verification is triggered.

[0127] The final decision is fed back to the model training pipeline. LSTM updates its parameters through backpropagation in time (BPTT), while Isolation Forest uses incremental learning to adjust the tree structure, enabling online learning feedback.

[0128] Optionally, the specified PBFT consensus algorithm includes:

[0129] In the pre-preparation phase: Select the node with the lowest network latency among the current top 3 nodes by weight as the master node. The master node's proposals will carry its own weight value.

[0130] During the preparation phase, node votes are calculated based on weight; for example, the "agreement" of a node with a weight of 0.3 is equivalent to the votes of three nodes with a weight of 0.1, requiring that ∑(weight of agreeing nodes) > 2 / 3 × total weight, rather than simply the number of nodes. This allows the network resource investment of large operators to directly translate into consensus power, while preventing collusion among smaller operators. If a node is proven to have acted maliciously (such as through double signatures), its weight is immediately reduced by 50% and redistributed as a penalty for malicious behavior. Penalized nodes can gradually restore their weight by correctly participating in consensus 10 times consecutively, with the restoration amount decreasing each time.

[0131] During the confirmation phase, once a node collects more than 2 / 3 of the total weight verification messages, it binds the confirmation message with the operator identifier of the corresponding time period and writes it into a temporary block, triggering the smart contract state to transition to "settlement-ready". If the master node does not issue a valid proposal within 10 seconds, the next candidate node is automatically switched according to the weight ranking. Nodes with malicious behavior will have their staked funds deducted and their weight reduced.

[0132] During the multi-level settlement and clearing phase, smart contracts execute atomic operations after consensus is reached:

[0133] Calculate the net receivables and payables of each operator based on the traffic matrix;

[0134] On-chain token transfer: Settlement is made using stablecoins pegged to fiat currencies (such as digital RMB), and the wallet contracts of various operators are automatically invoked to complete batch transfers, with 5% frozen as a dispute reserve for the next cycle;

[0135] Evidence archiving: Store the complete settlement proof (including all signatures) in IPFS and store the content addressing hash on the blockchain to ensure auditability;

[0136] This embodiment deeply couples carrier-grade traffic measurement with blockchain consensus. It balances the power of large and small operators through the dynamic weighted PBFT algorithm. At the same time, the automated execution of smart contracts eliminates the manual reconciliation step in traditional cross-operator settlement, meeting the needs of micro-payment scenarios for massive IoT devices in the 5G era.

[0137] This application also discloses an intelligent billing and settlement system based on the BOSS system, including a processor, in which a program of any one of the above-mentioned intelligent billing and settlement methods based on the BOSS system is running.

[0138] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A smart billing and settlement method based on a BOSS system, characterized in that, include: User communication data is acquired in real time through a distributed acquisition module; The user communication data is input into the dynamic rule engine, and real-time billing coefficients are generated based on the weighted factor library; When abnormal usage behavior is detected, the multimodal detection model is invoked to determine fraud. Cross-carrier settlements are completed through blockchain smart contracts, and ledger consistency is achieved using the specified PBFT consensus algorithm. The user communication data includes user plane traffic throughput, base station location, and timestamp; the weighting factor library contains time factors, location factors, and network load factors trained by machine learning; the multimodal detection model is composed of an LSTM time series prediction module and an isolated forest algorithm in parallel. The dynamic rule engine includes: ； in, Based on the benchmark rate, The time factor is... For the position factor, The network load factor is... The real-time billing coefficient is... , , for The variance of the results Preset a threshold for factor variance; The time factor Configuration methods include: Extract user usage data for the same time period over the past 30 days; The weights for each time period are calculated using the XGBoost model. The hyperparameters of the XGBoost model satisfy the following conditions: learning rate ≤ 0.1, maximum depth ≤ 8. The network load factor The configuration methods include: The PRB utilization rate of the corresponding base station and the signaling plane CPU utilization rate provided by the DPI device are obtained according to the specified time period. The first factor of network load is determined based on the PRB utilization rate. ; The second factor of network load is determined based on the signaling plane CPU utilization and the user plane traffic throughput. ; The third factor for determining network load is based on base station location and timestamp. ; The network load factor is obtained by weighting the first network load factor, the second network load factor, and the third network load factor according to the specified weight allocation.

2. The intelligent billing and settlement method based on the BOSS system according to claim 1, characterized in that, The process of calling the multimodal detection model to determine fraud when abnormal usage behavior is detected includes: Continuous feature extraction is performed on the user communication data to obtain corresponding feature data; the feature data includes temporal features and statistical features. The sliding interquartile range method is used for preliminary screening of basic flow indicators. When the following conditions are met simultaneously, the multimodal detection model is triggered to determine fraud: The current user traffic throughput is more than 1.5 times the 75th percentile of the same period in history; The KL divergence of the request packet length distribution differs from the baseline distribution by more than 0.4; The concentration of target IPs increased by more than 40% within 10 minutes; After the trigger signal is generated, the feature data of the current time window is immediately sent in parallel to the LSTM module and the Isolation Forest module.

3. The intelligent billing and settlement method based on the BOSS system according to claim 1, characterized in that, The operation of the LSTM time series prediction module includes: The LSTM time-series prediction module receives the standardized time-series feature sequence; Forward / backward time dependencies are extracted using bidirectional LSTM layers to capture specified non-scale expressions; Automatically focus on abnormal time points and generate importance scores for each time step; By combining the prediction biases of multiple historical windows, the abnormal confidence level of the current window is calculated. Output the instantaneous anomaly probability of the current window's anomaly level and the trend anomaly index reflecting the persistence of the anomaly.

4. The intelligent billing and settlement method based on the BOSS system according to claim 1, characterized in that, The parallel detection process of the isolated forest algorithm includes: The Isolation Forest algorithm employs a dynamic dimension selection strategy during the feature space construction phase: Automatically select the detection dimension based on the current traffic type; The sample is segmented into multiple levels by a specified number of isolation trees, and the path length from the root node to the isolated node is recorded. The path length is converted into a 0-1 standardized score, and the closer the score is to 1, the more likely it is to be an anomaly.

5. The intelligent billing and settlement method based on the BOSS system according to claim 1, characterized in that, For sessions confirmed as fraudulent, tiered handling is implemented, and a source tracing analysis process is initiated to locate the attack entry point by correlating with other probe data and updating the firewall rule base.

6. The intelligent billing and settlement method based on the BOSS system according to claim 1, characterized in that, The specified PBFT consensus algorithm includes: In the pre-preparation phase: Select the node with the lowest network latency among the current top 3 nodes by weight as the master node. The master node's proposals will carry its own weight value. During the preparation phase, node votes are calculated based on weights.

7. An intelligent billing and settlement system based on the BOSS system, characterized in that, Includes a processor, wherein the processor runs a program for an intelligent billing and settlement method based on a BOSS system as described in any one of claims 1-6.

Images