Virtual reality-based telecommunications network fraud case investigation training system and method

Abstract

The application relates to the technical field of police tactics training, and particularly discloses a virtual-reality-based telecom network fraud case investigation training system, which comprises a server and a database module, a teacher end module, a scene editing unit, a case editing unit, a data management and release unit, a student end module, a case receiving and displaying unit, a scene investigation unit, a dialogue simulation unit, a virtual platform unit, a simulation process unit, an event progress unit and a training data recording unit; the teacher end module is used for independently editing the scene and the case by the teacher; the editing mode is simple and efficient; multiple cases used for training can be quickly created; the overall training process is improved; the problems of single scene case and incomplete process in the prior art are solved; and the actual training requirements are met.

Description

Technical Field

[0001] This invention relates to the field of case investigation training technology, and in particular to a virtual reality-based training system and method for investigating telecommunications network fraud cases. Background Technology

[0002] Chinese patent application number CN2023110560013 discloses a method, apparatus, device, and storage medium for training a telecommunications anti-fraud model. The method includes: reading real user data from the local edge telecommunications node; generating synthetic data based on the real user data, wherein the synthetic data is similar to the real user data but does not contain the real user data; and sending the synthetic data to a joint training node for training a first anti-fraud model.

[0003] With the development of computer technology, virtual reality training systems are being used more and more widely. However, existing training systems for investigating telecommunications network fraud cases have problems such as limited scenario cases and incomplete processes, which cannot meet actual training needs. Summary of the Invention

[0004] To address the problems of limited scenario examples and incomplete processes in existing technologies, this invention proposes a virtual reality-based training system and method for investigating telecommunications network fraud cases, enriching the scenarios and processes for training in the investigation of telecommunications network fraud cases.

[0005] The first technical solution of the present invention: a training system for investigating telecommunications network fraud cases based on virtual reality, comprising, The server and database module are used to build the server architecture and store and manage system operation data. The teacher-side module includes, A scene editing unit is used to construct virtual scenes; The case editing unit is used to edit case information, the identity, appearance, and behavioral characteristics of the character model, as well as communication information, transfer information, and evidence information. It also predicts the development direction of the case information, generates a case development event tree, constructs a virtual case, and sets the investigation standards and procedures in the virtual case. A data management and publishing unit is used to organize and classify virtual scenes and virtual cases, and store them in the server and database module; The student-side module includes, The case receiving and display unit is used to receive virtual scenes and virtual case details from the server and database module, load the virtual scenes in the virtual reality environment, and generate an operation interface. A scene exploration unit, which is used to interact with the virtual scene. A dialogue simulation unit, wherein the dialogue simulation unit is used to simulate scene dialogue; A virtual platform unit, which constructs a virtual network platform based on virtual case details to generate virtual social information and transfer records; A simulation process unit, which generates evidence options based on a virtual case, compares the evidence options with evidence information, and determines and generates case progress data; An event progress unit generates virtual arrest scenarios and virtual interrogation scenarios based on case progress data; The training data recording unit is used to record operation data, score the operation data, and generate a score report.

[0006] Preferably, the scene editing unit is used to generate a graphical editing interface, import scene models, evidence models, character models, and prop models, construct a virtual scene, and design the layout of the virtual scene, setting the position, angle, and size parameters of the models in the scene.

[0007] Preferably, the scene exploration unit generates scene exploration options based on a virtual scene and binds them to an action interaction script. According to the scene exploration options, it interacts with the scene model in the virtual scene and provides feedback on the attribute information of the evidence model.

[0008] Preferably, the dialogue simulation unit is based on a virtual case, configured with a language processing model, generates a text input box, understands the text content in the text input box, and generates a response text.

[0009] This invention is developed based on the Unity development engine. It uses a server architecture and a database management system to store and manage various types of data generated during system operation, including virtual scene data, case information, student operation data, etc.

[0010] Using graphical editing technology, models of scenes, evidence, characters, props, etc. are imported through 3D modeling software interfaces. The layout of the virtual scene is designed using graphical interface tools, and the position, angle, and size parameters of the models are set.

[0011] The case information was edited using a text editing tool, and the identity, appearance, and behavioral characteristics of the character model were defined using a character attribute setting tool. Information such as communication, transfers, and evidence was integrated, and an event tree generation algorithm was used to predict the development direction of the case and construct an event tree for the case development.

[0012] The virtual scene and virtual case data are organized and classified according to the set classification rules, and the data is stored in the server and database module using database operation commands.

[0013] Virtual scene and virtual case data are obtained from the server and database module through network communication technology, the virtual scene is loaded using a virtual reality engine, and an operation interface is generated based on graphical user interface technology.

[0014] Based on virtual reality interaction technology, interactive exploration options are generated in a virtual scene, action interaction scripts are written to realize interaction with the scene model, and the attribute information of the evidence model is fed back through the model data interface.

[0015] Configure a natural language processing language model, use a text input box to obtain the text input by the student, perform semantic analysis and understanding of the text through the model, and generate a response text.

[0016] A virtual online platform is built based on the fictional case, and data generation algorithms are used to generate virtual social information and transfer records.

[0017] Evidence options are generated based on the virtual case scenario. The evidence options are compared with the evidence information stored in the database using a data comparison algorithm to determine and generate case progress data.

[0018] Based on the case progress data, virtual arrest and interrogation scenarios were generated using animation generation technology.

[0019] The system uses log recording technology to record students' operational data during the training process, and uses data analysis algorithms to score the operational data and generate a score report.

[0020] Preferably, the teacher-side module includes a case template unit, which creates case templates and builds a case template library; the case templates include scene settings, character relationships, case clues, and evidence distribution.

[0021] This invention provides editing tools such as a graphical interface and a text editing box, allowing teachers to independently design elements such as scene settings, character relationships, case clues, and evidence distribution.

[0022] Preferably, the student-side module includes an auxiliary prompting unit, which generates a prompting interface based on investigation standards and procedures and at preset time intervals.

[0023] This invention pre-organizes and stores the investigation standards and procedures for telecommunications network fraud cases. During student training, it monitors students' operations in real time and utilizes timer technology, setting an adjustable time interval parameter in the student's software. When a student begins training, the timer starts, sending check commands to the system at preset time intervals to determine if the conditions for generating a prompt are met. If met, it invokes interface generation technology to create and display the prompt interface.

[0024] Preferably, the student-side module includes a virtual prop unit, which generates a virtual user interface for the props based on a prop model. The prop model includes network monitoring equipment, data analysis equipment, and evidence collection tools, and provides feedback on the operation results based on the operation information of the virtual user interface.

[0025] This invention utilizes 3D modeling technology to construct models of props such as network monitoring equipment, data analysis equipment, and evidence collection tools, and imports these models into a virtual reality development environment. Through graphical user interface (GUI) development technology, corresponding virtual user interfaces are designed and generated based on the functions and usage logic of the props. For example, for network monitoring equipment, an interface including a signal strength display area and a monitoring range setting area is designed; for data analysis equipment, functional areas such as data import, analysis method selection, and result display are constructed.

[0026] This invention sets up interactive event listeners on the virtual user interface. When students perform operations such as clicking or swiping, the system captures the operation information, generates corresponding operation results, and provides feedback to the student through the virtual reality interface. For example, when a student adjusts the monitoring range on the virtual user interface of a network monitoring device, the system calculates the new monitoring range based on the adjustment parameters and updates the area displaying signal strength on the interface, showing the signal situation within the new range.

[0027] Preferably, the investigation training system includes a case library module, which is used to establish a case library of telecommunications network fraud cases, set common decision points in telecommunications network fraud cases, and establish a decision tree.

[0028] This invention collects various cases of telecommunications and online fraud, organizes and classifies them, and stores the structured data in a database to form a case library. It analyzes the characteristics and investigation processes of different types of telecommunications and online fraud cases, identifying common decision points, such as judging the reliability of fraud clues and choosing appropriate investigative directions. Using a decision tree algorithm, with decision points as nodes, it constructs a decision tree model based on different decision outcome branches to assist in investigation training and case analysis.

[0029] Preferably, the common decision points in telecommunications network fraud cases are established by extracting decision point information from a case database. This decision point information includes suspicious phone calls, suspicious links, and suspicious information. A decision point information dataset is created, and binary variables are used to encode the category features in the dataset. The numerical features of each category are then obtained, and the mean of these numerical features is calculated using the following formula.

[0030]

[0031] In the formula, This represents the i-th numerical feature of the k-th sample under category j; The mean of a numerical characteristic; Centralized data representing numerical characteristics; This represents the number of samples in category j, where a sample refers to decision point information. The centralized data is substituted into the decision point information dataset for centralization, resulting in a centralized dataset. The covariance between the numerical features is then calculated using the following formula.

[0032] In the formula, This represents the centered numerical feature of the m-th value under category i. Let m represent the mean of the m-th numerical feature under category i. This represents the number of samples in category i; This represents the numerical feature centered on the nth value under category i. Let represent the mean of the nth numerical feature under category i. Let represent the covariance between the m-th numerical feature in category i and the n-th numerical feature in category i; The Pearson correlation coefficient is calculated using the following formula:

[0033] In the formula, This represents the Pearson correlation coefficient; The standard deviation of the m-th numerical feature under category i is denoted as . This represents the standard deviation of the m-th numerical feature under category i; The Pearson correlation coefficient matrix is ​​created as follows.

[0034] In this matrix, each element represents the Pearson correlation coefficient between a pair of features, and the value of each element is in the range of -1 to +1; and the absolute value of the element with a value of 0.7 in the Pearson correlation coefficient matrix is ​​selected as the common decision point.

[0035] This invention extracts decision point information related to suspicious phone calls, suspicious links, and suspicious information from a case database and organizes it into a structured decision point information dataset. This dataset contains various feature data related to telecommunications network fraud. Binary variables are used to encode the categorical features in the decision point information dataset, converting non-numerical categorical data into a numerical form easily processed by computers. The data is preprocessed through operations such as calculating the mean and centering the data to prepare for further analysis of the relationships between the data.

[0036] Preferably, the formula for calculating the standard deviation is as follows:

[0037]

[0038] In the formula, The standard deviation of the m-th numerical feature under category i is denoted as . It represents the standard deviation of the nth numerical feature under category i.

[0039] In this invention, standard deviation is used to measure the fluctuation of numerical features of each category in the decision point information dataset. When calculating the Pearson correlation coefficient, standard deviation is used to standardize the covariance, making the correlations between different features comparable. By calculating the standard deviation of each category of numerical features, it participates in the construction of the Pearson correlation coefficient matrix, thereby assisting in the determination of common decision points.

[0040] Preferably, the Pearson correlation coefficient matrix is ​​a symmetric matrix, represented as follows: The elements on the main diagonal of the symmetric matrix are 1.

[0041] This invention allows us to observe the correlation from the perspective of any two numerical features, without needing to distinguish the order of their occurrence.

[0042] Preferably, the prediction of the development direction of case information is based on the following formula to analyze the probability of the event occurring.

[0043] In the formula, x represents the input vector, including call records and transaction records; w represents the weight vector, which represents the importance of call records and transaction records; b represents the bias term; and p(y=1|x) represents the probability prediction of the positive class.

[0044] This invention uses a linear combination approach to analyze the influence of numerical features on the probability of event occurrence.

[0045] Preferably, the training data recording unit scores the operational data in the following way. Establish an evaluation matrix , is represented as ,

[0046] in, This represents the raw score of the m-th user on the k-th metric; Evaluation matrix The original scores of users are subjected to an exponential transformation to obtain the transformed evaluation matrix. , is represented as ,

[0047] in, This represents the exponentially transformed value of the original score of the m-th user on the k-th metric; Based on the normalization formula, the transformed evaluation matrix After normalization, the evaluation matrix is ​​obtained. The normalized score of the user is expressed by the normalization formula as follows:

[0048] in, This represents the normalized score of the m-th user on the k-th metric. Establish a normalized evaluation matrix R, denoted as follows:

[0049] Establish the weight matrix W, denoted as

[0050]

[0051] in, This represents the preset weight value for the k-th indicator; based on the normalized evaluation matrix R and the weight matrix W, the user's weighted comprehensive score is calculated using the following formula.

[0052] Among them, S m It is the weighted composite score of the m-th user, which serves as the user's performance score.

[0053] In this invention, exponential transformation effectively amplifies the differences between original scores, making the scores of users with similar performance on certain indicators more distinct after transformation. For example, on the action accuracy indicator, two users may have original scores of 80 and 85 respectively, with no significant difference. However, after exponential transformation, the score gap may be widened, more accurately reflecting their actual performance differences on this indicator, thus more precisely reflecting the differences in user skill levels in the final score. Normalization makes the scores of different indicators comparable. During training, indicators such as action completion time and dialogue rationality have different dimensions. Directly calculating scores would lead to unreasonable results. By normalizing, the scores of all indicators are unified within the range of [0,1], eliminating the influence of dimensions and ensuring that each indicator plays a fair role in the scoring, thus improving the scientific nature of the scoring. The weight matrix setting can highlight the importance of indicators according to the training focus. Based on this scoring rule, it is possible to further analyze the correlation between different indicators and the performance differences of users in different scenarios based on a large amount of user scoring data. For example, if data analysis reveals that users generally score low on a certain metric in a particular scenario, the training content can be optimized or the scoring rules adjusted accordingly, thereby continuously improving the quality and effectiveness of the training system and better meeting training needs.

[0054] The second technical solution of the present invention: a training method for investigating telecommunications network fraud cases based on virtual reality, comprising the following steps, (S01) Teachers use the teacher-side module to import and create model data, arrange scenes, evidence and characters, set character information, communication information and transfer information, construct virtual scenes and virtual cases, save the virtual scenes and virtual cases after editing, and publish them to the student-side module. (S02) Students receive virtual scenes and virtual case details on the student terminal, wear hardware devices, and enter the virtual scene; (S03) Students explore the virtual scene, including opening doors, searching rooms, and inspecting items; (S04) Students observe, measure, and test the evidence models in the virtual scene to obtain the attribute information of the evidence models; (S05) Students engage in simulated dialogue with character models in a virtual scene, inputting the dialogue text into a text input box to obtain the response text; (S06) Students log in to the virtual network platform to search for virtual social information and transaction records; (S07) Based on the information collected, students hold a case analysis meeting to discuss, select evidence options, and obtain case progress data; (S08) Students enter the virtual arrest scenario, watch the virtual arrest scenario and the virtual interrogation scenario, and end the training; (S09) Score students’ operation data and generate a score report.

[0055] The present invention has the following beneficial effects: (1) Through the teacher-side module, teachers can independently edit the scenarios and cases. The editing method is simple and efficient, and multiple cases for training can be created quickly, and the overall training process can be improved. This solves the problems of single scenario cases and incomplete process in the existing technology, and meets the actual training needs.

[0056] (2) Through the student terminal module, students can interact with the virtual scene in a variety of ways, such as scene investigation, evidence detection, character dialogue, virtual platform operation, etc., to obtain rich information and promote the progress of the case, which enhances the interactivity and pertinence of the training and improves the learning effect.

[0057] (3) Through the enrichment and optimization of the case library, a large number of up-to-date cases are provided for investigation training. At the same time, the decision tree model is used to assist in the analysis, which helps students better understand and master the investigation ideas and methods. Attached Figure Description

[0058] Figure 1 This is a schematic diagram of the overall structure of the present invention. Detailed Implementation

[0059] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this should not be construed as limiting the present invention.

[0060] A training system for investigating telecommunications network fraud cases based on virtual reality, such as Figure 1 As shown, including, The server and database module is used to build server architecture and store and manage system running data. The teacher-side module includes: The scene editing unit is used to build virtual scenes; The case editing unit is used to edit case information, the identity, appearance, and behavioral characteristics of the character model, as well as communication information, transfer information, and evidence information. It also predicts the development direction of the case information, generates a case development event tree, constructs a virtual case, and sets the investigation standards and procedures in the virtual case. The data management and publishing unit is used to organize and classify virtual scenarios and virtual cases, and store them in the server and database module; The student-side module includes: The case receiving and display unit is used to receive virtual scenes and virtual case details from the server and database module, load the virtual scenes in the virtual reality environment, and generate an operation interface. Scene exploration unit, used to interact with the virtual scene; Dialogue simulation unit, used to simulate scene dialogue; The virtual platform unit is based on virtual case details, constructs a virtual network platform, and generates virtual social information and transfer records; The simulation process unit generates evidence options based on a virtual case scenario, compares the evidence options with the evidence information, and determines and generates case progress data. The event progress unit generates virtual arrest and virtual interrogation scenarios based on case progress data. The training data recording unit is used to record operational data, score the operational data, and generate a score report.

[0061] The scene editing unit is used to generate a graphical editing interface, import scene models, evidence models, character models, and prop models, construct virtual scenes, design the layout of virtual scenes, and set the position, angle, and size parameters of the models in the scene.

[0062] The scene exploration unit generates scene exploration options based on the virtual scene and binds them to action interaction scripts. According to the scene exploration options, it interacts with the scene model in the virtual scene and provides feedback on the attribute information of the evidence model.

[0063] The dialogue simulation unit is based on a virtual case, configures a language processing model, generates a text input box, understands the text content in the text input box, and generates a response text.

[0064] The teacher-side module includes a case template unit, which creates case templates and builds a case template library. Case templates include scene settings, character relationships, case clues, and evidence distribution.

[0065] The student-side module includes an auxiliary prompt unit, which generates a prompt interface based on investigation standards and procedures and preset time intervals.

[0066] The student-side module includes a virtual prop unit. Based on the prop model, the virtual prop unit generates a virtual user interface for the prop. The prop model includes network monitoring equipment, data analysis equipment, and evidence collection tools. Based on the operation information of the virtual user interface, the module provides feedback on the operation results.

[0067] The investigation training system includes a case library module, which is used to build a case library of telecommunications network fraud cases, set common decision points in telecommunications network fraud cases, and build a decision tree.

[0068] Setting common decision points in telecommunications fraud cases involves extracting decision point information from a case database. This information includes suspicious phone calls, suspicious links, and suspicious messages. A decision point information dataset is created, and binary variables are used to encode the categorical features in this dataset. The numerical features of each category are then obtained, and the mean of these numerical features is calculated using the following formula.

[0069]

[0070] In the formula, This represents the i-th numerical feature of the k-th sample under category j; The mean of a numerical characteristic; Centralized data representing numerical characteristics; This represents the number of samples in category j, where a sample refers to decision point information. The centralized data is substituted into the decision point information dataset for centralization, resulting in a centralized dataset. The covariance between the numerical features is then calculated using the following formula.

[0071] In the formula, This represents the centered numerical feature of the m-th value under category i. Let m represent the mean of the m-th numerical feature under category i. This represents the number of samples in category i; This represents the numerical feature centered on the nth value under category i. Let represent the mean of the nth numerical feature under category i. Let represent the covariance between the m-th numerical feature in category i and the n-th numerical feature in category i; The Pearson correlation coefficient is calculated using the following formula:

[0072] In the formula, This represents the Pearson correlation coefficient; This represents the standard deviation of the m-th numerical feature under category i. This represents the standard deviation of the m-th numerical feature under category i; The Pearson correlation coefficient matrix is ​​created as follows.

[0073] In this matrix, each element represents the Pearson correlation coefficient between a pair of features, and the value of each element is in the range of -1 to +1; and the absolute value of the element with a value of 0.7 in the Pearson correlation coefficient matrix is ​​selected as the common decision point.

[0074] The formula for calculating standard deviation is as follows:

[0075]

[0076] In the formula, This represents the standard deviation of the m-th numerical feature under category i. It represents the standard deviation of the nth numerical feature under category i.

[0077] The Pearson correlation coefficient matrix is ​​a symmetric matrix, represented as follows: The elements on the main diagonal of a symmetric matrix are all 1.

[0078] To predict the development of case information, the probability of events occurring is analyzed based on the following formula.

[0079] In the formula, x represents the input vector, including call records and transaction records; w represents the weight vector, which represents the importance of call records and transaction records; b represents the bias term; and p(y=1|x) represents the probability prediction of the positive class.

[0080] The training data recording unit scores the operational data in the following way. Establish an evaluation matrix , is represented as ,

[0081] in, This represents the raw score of the m-th user on the k-th metric; Perform an exponential transformation on the original user scores in the evaluation matrix X to obtain the transformed evaluation matrix. , is represented as ,

[0082] in, This represents the exponentially transformed value of the original score of the m-th user on the k-th metric; Based on the normalization formula, the transformed evaluation matrix After normalization, the evaluation matrix is ​​obtained. The normalized score of the user is expressed by the normalization formula as follows:

[0083] in, This represents the normalized score of the m-th user on the k-th metric. Establish a normalized evaluation matrix R, denoted as follows:

[0084] Establish the weight matrix W, denoted as

[0085]

[0086] in, This represents the preset weight value for the k-th indicator; based on the normalized evaluation matrix R and the weight matrix W, the user's weighted comprehensive score is calculated using the following formula.

[0087] Among them, S m It is the weighted composite score of the m-th user, which serves as the user's performance score.

[0088] A training method for investigating telecommunications fraud cases based on virtual reality includes the following steps: (S01) Teachers use the teacher-side module to import and create model data, arrange scenes, evidence and characters, set character information, communication information and transfer information, construct virtual scenes and virtual cases, save the virtual scenes and virtual cases after editing, and publish them to the student-side module. (S02) Students receive virtual scenes and virtual case details on the student terminal, wear hardware devices, and enter the virtual scene; (S03) Students explore the virtual scene, including opening doors, searching rooms, and inspecting items; (S04) Students observe, measure, and test the evidence models in the virtual scene to obtain the attribute information of the evidence models; (S05) Students engage in simulated dialogue with character models in a virtual scene, inputting the dialogue text into a text input box to obtain the response text; (S06) Students log in to the virtual network platform to search for virtual social information and transaction records; (S07) Based on the information collected, students hold a case analysis meeting to discuss, select evidence options, and obtain case progress data; (S08) Students enter the virtual arrest scenario, watch the virtual arrest scenario and the virtual interrogation scenario, and end the training; (S09) Score students’ operation data and generate a score report.

[0089] Example 1: A training system for investigating telecommunications network fraud cases based on virtual reality, such as... Figure 1 As shown, including, The server and database module is used to build server architecture and store and manage system running data. The teacher-side module includes: The scene editing unit is used to build virtual scenes; The case editing unit is used to edit case information, the identity, appearance, and behavioral characteristics of the character model, as well as communication information, transfer information, and evidence information. It also predicts the development direction of the case information, generates a case development event tree, constructs a virtual case, and sets the investigation standards and procedures in the virtual case. The data management and publishing unit is used to organize and classify virtual scenarios and virtual cases, and store them in the server and database module; The student-side module includes: The case receiving and display unit is used to receive virtual scenes and virtual case details from the server and database module, load the virtual scenes in the virtual reality environment, and generate an operation interface. Scene exploration unit, used to interact with the virtual scene; Dialogue simulation unit, used to simulate scene dialogue; The virtual platform unit is based on virtual case details, constructs a virtual network platform, and generates virtual social information and transfer records; The simulation process unit generates evidence options based on a virtual case scenario, compares the evidence options with the evidence information, and determines and generates case progress data. The event progress unit generates virtual arrest and virtual interrogation scenarios based on case progress data. The training data recording unit is used to record operational data, score the operational data, and generate a score report.

[0090] The scene editing unit is used to generate a graphical editing interface, import scene models, evidence models, character models, and prop models, construct virtual scenes, design the layout of virtual scenes, and set the position, angle, and size parameters of the models in the scene.

[0091] The scene exploration unit generates scene exploration options based on the virtual scene and binds them to action interaction scripts. According to the scene exploration options, it interacts with the scene model in the virtual scene and provides feedback on the attribute information of the evidence model.

[0092] The dialogue simulation unit is based on a virtual case, configures a language processing model, generates a text input box, understands the text content in the text input box, and generates a response text.

[0093] The teacher-side module includes a case template unit, which creates case templates and builds a case template library. Case templates include scene settings, character relationships, case clues, and evidence distribution.

[0094] The student-side module includes an auxiliary prompt unit, which generates a prompt interface based on investigation standards and procedures and preset time intervals.

[0095] The student-side module includes a virtual prop unit. Based on the prop model, the virtual prop unit generates a virtual user interface for the prop. The prop model includes network monitoring equipment, data analysis equipment, and evidence collection tools. Based on the operation information of the virtual user interface, the module provides feedback on the operation results.

[0096] This example uses a simulated case receiving scenario and dialogue options as an example.

[0097] In this embodiment, the teacher first utilizes the scene editing unit of the teacher-side module to present a graphical editing interface. This interface features a navigation bar and operation buttons for easy operation. Teachers can use the resource search window to filter and import various models related to telecommunications network fraud cases from local resource libraries and online material platforms, or create their own models. For example, a model of a police reception room includes multiple police reception desks with computers, telephones, documents, and other office equipment on them, which can be obtained by downloading existing model resources from the internet.

[0098] Using the case editing unit, teachers can edit case information. First, the complainant is set up as a white-collar worker, characterized by wearing a business suit and exhibiting anxious eyes. When editing the communication information, the complainant receives a call from an unknown number overseas. The caller claims to be customer service from a large financial institution, citing abnormal transaction risks in the account, and attempts to induce the complainant to transfer money in an attempt to defraud them.

[0099] The teachers further manipulated the transfer information, with the complainant transferring 80,000 yuan under the pretense of verifying fund security, and limiting the transfer time to one hour to increase the sense of urgency. Simultaneously, they edited evidence information, including screenshots of call records on the complainant's phone showing the caller ID and call duration; and screenshots of fraudulent text messages containing suggestive language and information about the transfer account.

[0100] Furthermore, teachers, drawing on their experience and knowledge, predict the development of case information and construct a case development event tree. For example, if a student (playing the role of a police officer) asks the complainant whether they clicked on a link in a fraudulent text message, two main scenarios may occur: First, the complainant clicked the link, and their phone was subsequently infected with malware, leading to the leakage of information such as contacts and payment passwords. Subsequent investigations will focus on tracing the source of the malware, defining the scope of the information leakage, and tracking the flow of funds. Second, the complainant did not click the link, and the investigation will focus on tracing the fraudsters' phone contact information, using data from telecommunications operators to find information such as the location of the phone number and associated numbers.

[0101] Teachers also need to set up investigation standards and procedures in the virtual case scenarios, clearly stipulating that students should first calm the complainant's emotions, then ask the complainant for information such as their personal identity, the time and place of the fraud, then check the evidence such as call records and text messages provided by the complainant, then analyze the fraud methods, and set prompts and operating procedures for each step.

[0102] Teachers can also search the case template library by entering keywords such as "case reporting" to filter similar case templates and then use them for editing. Teachers can also create their own templates and store them in the case template library according to case type, difficulty level, and other dimensions for easy retrieval and reuse later.

[0103] After editing, teachers can use the data transmission interface to store the data to the server and database module, waiting for the student-side module to call it.

[0104] In this embodiment, students establish a network connection with the server and database module through the student-side module to receive virtual scenarios and virtual case data published by the teacher. Students can wear hardware devices such as HTC Vive and use the Unity VR engine to load the virtual scenario. After loading, students enter the virtual police station reception room scenario and are shown an operation interface with floating function buttons, such as dialogue input boxes, scene investigation tools, and evidence viewing options, for convenient student operation.

[0105] Students can then begin a simulated dialogue with the complainant model. This dialogue simulation unit is based on a virtual case and uses a language processing model, such as GPT-Neo, to generate a freely input text box. Students enter dialogue content into the box, such as, "Hello, please don't worry, please explain the details of the matter in detail." The language processing model performs semantic analysis and understanding of the input text, generating a logically sound response. The complainant model then displays the response to the student: "I received a phone call while I was at work today. The caller said my account was suspicious and demanded that I immediately transfer 80,000 yuan to their designated account for verification, otherwise my account would be frozen!" This embodiment provides students with multiple pre-set dialogue options based on a simulated case, tailored to actual investigative needs. Examples include: "Did you transfer the money as requested?", "What is the other party's phone number? Do you remember it?", "Did the other party mention any specific account irregularities on the phone?", and "Did you disclose any other personal information to the other party, such as your ID number or verification code?". After a student selects a different dialogue option, the complainant model generates a corresponding response text based on the simulated case and the analysis results of the language processing model. For example, if a student selects "Did you transfer the money as requested?", the complainant model replies: "I almost transferred it; I had already opened the transfer interface, but I suddenly remembered that my company had previously organized anti-fraud training, so I hesitated and didn't dare to transfer it," allowing the student to further understand the case.

[0106] Through the above embodiments, the scenario of receiving a police report and the dialogue options can be successfully simulated in the virtual reality-based training system for investigating telecommunications network fraud cases, providing students with an interactive experience and improving the practicality and effectiveness of the training system.

[0107] Example 2: This example is basically the same as Example 1, except that this example uses a simulated physical evidence analysis interface as an example.

[0108] In this embodiment, teachers can edit laboratory scene models for evidence analysis through the teacher-side module, and at the same time, edit evidence models related to telecommunications network fraud cases, such as mobile phones involved in the case, storage devices containing fraudulent information, and communication tools suspected of being used for fraud.

[0109] Furthermore, teachers can edit case information based on the evidence. For the mobile phones involved in the case, they can assign the identity of the suspect or victim to them. For example, if a mobile phone is suspected, its communication records may contain call content with multiple victims and contact information with gang members. Then, when editing the case information, the teacher can assign the identity of the suspect to the mobile phone, specifying that it contains evidence such as fraud script templates, transfer record documents, and victim information forms.

[0110] Teachers can set relevant analytical points and expected results for each piece of evidence, thereby constructing a logical connection between the development of the case and the analysis of physical evidence. For example, if students search and analyze the call records of a mobile phone, they may discover the call time between the suspect and the victim, and thus infer the time of the fraud; searching and analyzing the mobile phone's transfer records can trace the flow of funds and determine the receiving account and the path of fund transfer in the fraud.

[0111] In this embodiment, students can use the student-side module to select edited evidence, such as the mobile phone involved in the case. Upon selection, an evidence analysis interface pops up. The left side of the interface displays a 3D model of the phone, which can be rotated, zoomed in, and zoomed out to allow students to easily view the phone's details. The right side is divided into several functional sections, such as a basic information bar displaying the phone's brand and model; call logs, which students can click to access the call log viewing interface, presenting call time, call duration, and other information in a list format; and a file directory, where students can open folders layer by layer to view files, while also viewing file attributes such as creation time, modification time, and file size.

[0112] Through the above embodiments, the physical evidence analysis interface can be successfully simulated in the virtual reality-based training system for investigating telecommunications network fraud cases, providing students with an interactive experience and improving the practicality and effectiveness of the training system.

[0113] Example 3: This example is basically the same as Example 1, except that this example uses a simulated case analysis meeting scenario as an example.

[0114] In this embodiment, the teacher uses the teacher-side module to edit a meeting room scene model for case analysis, including a long conference table, chairs, a projector, and an electronic whiteboard. Then, based on the case information, the teacher edits the background of the case analysis meeting, including the timeline of the case, the main figures involved, the methods of fraud, and the direction of discussion, constructing a logical framework for the case analysis. For example, the teacher can pose questions to guide students' thinking: "Can we analyze the flow of funds of the fraud gang from these transfer records?" "Based on the suspicious person's call recordings, determine their possible crime location and the number of accomplices." Simultaneously, reference answers are provided for each question for students' reference.

[0115] In this embodiment, students enter the meeting room scenario through the student-side module. After the meeting begins, students introduce the case background and clues to each other via voice, explaining their understanding and analytical approach to the case. For example, student A says, "I checked these transfer records and found that the funds were dispersed and transferred to multiple different accounts in a short period of time. This may mean that the fraud gang used a method of dispersing funds to evade investigation." Other students can respond and discuss via voice, offering different viewpoints or supplementary evidence.

[0116] Through the above embodiments, a case analysis meeting scenario can be successfully simulated in the virtual reality-based training system for investigating telecommunications network fraud cases, providing students with an interactive experience and improving the practicality and effectiveness of the training system.

[0117] Example 4: This example is basically the same as Example 1, except that this example uses a simulated scenario of apprehending a suspect.

[0118] In this embodiment, teachers can edit virtual arrest scenarios, such as the room where the suspect is hiding, through the teacher-side module. Furthermore, teachers can edit the suspect's appearance and clothing, quickly generate simple suspect models using model resources downloaded from the internet, or create their own models. A text display interface is also provided to explain the arrest time, location, and suspect in text, facilitating student understanding.

[0119] In this embodiment, students watch a virtual capture scene through the student terminal module, and a pop-up prompt box lists the evidence that the student has successfully found, enhancing the students' immersion.

[0120] Through the above embodiments, the virtual reality-based training system for investigating telecommunications network fraud cases can successfully simulate the arrest of suspects, providing students with an interactive experience and improving the practicality and effectiveness of the training system.

[0121] Example 5: This example is basically the same as Example 1, except that this example uses a simulated interrogation of a suspect as an example.

[0122] In this embodiment, teachers can edit virtual interrogation scenarios, such as interrogation rooms, through the teacher-side module. Furthermore, teachers can edit the appearance and clothing of suspects in custody, quickly generate simple suspect models using model resources downloaded from the internet, or create their own models. A text display interface is also provided to explain the interrogation process and results in text, facilitating student understanding.

[0123] In this embodiment, students watch a virtual interrogation scene through the student terminal module, and a pop-up prompt box ends the training session, allowing for a summary of the students' scores.

[0124] Through the above embodiments, the interrogation of suspects can be successfully simulated in the virtual reality-based training system for investigating telecommunications network fraud cases, providing students with an interactive experience and improving the practicality and effectiveness of the training system.

[0125] Example 6: This example supplements Example 1 with the following technical solution: The training data recording unit scores the operational data in the following way: Establish an evaluation matrix X, denoted as follows:

[0126] in, This represents the raw score of the m-th user on the k-th metric; Perform an exponential transformation on the original user scores in the evaluation matrix X to obtain the transformed evaluation matrix. , is represented as ,

[0127] in, This represents the exponentially transformed value of the original score of the m-th user on the k-th metric; Based on the normalization formula, the transformed evaluation matrix After normalization, the evaluation matrix is ​​obtained. The normalized score of users is expressed by the normalization formula as follows:

[0128] in, This represents the normalized score of the m-th user on the k-th metric. Establish a normalized evaluation matrix R, denoted as follows:

[0129] Establish the weight matrix W, denoted as

[0130]

[0131] in, This represents the preset weight value for the k-th indicator; based on the normalized evaluation matrix R and the weight matrix W, the user's weighted comprehensive score is calculated using the following formula.

[0132] Among them, S m It is the weighted composite score of the m-th user, which serves as the user's rating.

[0133] In this embodiment, police officers A, B, and C are used as examples to evaluate the scores based on three indicators: action indicator X1, dialogue indicator X2, and time indicator X3.

[0134] A 85 70 90 B 75 80 85 C 90 65 75 Substituting the data into the table, we obtain the evaluation matrix:

[0135] Using the natural exponential function Perform an exponential transformation on the data in the evaluation matrix X above, resulting in the following evaluation matrix:

[0136] The transformed score is compressed to the range [0,1] using the min-max normalization method:

[0137] in, ; The normalized matrix is:

[0138] Furthermore, the weight of each indicator is manually set. Then the weight matrix: ; Then, the weighted composite score for each officer was calculated: ; Simplified version: ; Furthermore, the weighted composite score above can be simplified as follows: ; Insert specific values ​​to perform exponential calculations:

[0139] Then, substitute the above calculation results into the weighted composite score to calculate an approximate value:

[0140] Normalized value:

[0141] Final weighted composite score:

[0142] Based on the weighted composite score, the rankings of Officer A, Officer B, and Officer C are as follows: 1. Officer C (score 0.413), 2. Officer A (score 0.294), 3. Officer B (score 0.174).

[0143] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can apply the technical solution and inventive structure of the present invention within the scope of the technology disclosed in the present invention.

Claims

1. A training system for investigating telecommunications network fraud cases based on virtual reality, characterized by: include, The server and database module are used to build the server architecture and store and manage system operation data. The teacher-side module includes, A scene editing unit is used to construct virtual scenes; The case editing unit is used to edit case information, the identity, appearance, and behavioral characteristics of the character model, as well as communication information, transfer information, and evidence information. It also predicts the development direction of the case information, generates a case development event tree, constructs a virtual case, and sets the investigation standards and procedures in the virtual case. A data management and publishing unit is used to organize and classify virtual scenes and virtual cases, and store them in the server and database module; The student-side module includes, The case receiving and display unit is used to receive virtual scenes and virtual case details from the server and database module, load the virtual scenes in the virtual reality environment, and generate an operation interface. A scene exploration unit, which is used to interact with the virtual scene. A dialogue simulation unit, wherein the dialogue simulation unit is used to simulate scene dialogue; A virtual platform unit, which constructs a virtual network platform based on virtual case details to generate virtual social information and transfer records; A simulation process unit, which generates evidence options based on a virtual case, compares the evidence options with evidence information, and determines and generates case progress data; An event progress unit generates virtual arrest scenarios and virtual interrogation scenarios based on case progress data; A training data recording unit is used to record operational data, score the operational data, and generate a scoring report. The dialogue simulation unit is based on a virtual case, configured with a language processing model, generates a text input box, understands the text content in the text input box, and generates a response text; The student-side module includes an auxiliary prompting unit, which generates a prompting interface based on investigation standards and procedures and a preset time interval. The student-side module includes a virtual prop unit, which generates a virtual user interface for the props based on a prop model. The prop model includes network monitoring equipment, data analysis equipment, and evidence collection tools, and provides feedback on the operation results based on the operation information of the virtual user interface. The investigation training system includes a case library module, which is used to establish a case library of telecommunications network fraud cases, set common decision points in telecommunications network fraud cases, and establish a decision tree; The common decision points in the telecommunications network fraud cases are set by extracting decision point information from the case database. The decision point information includes suspicious phone calls, suspicious links, and suspicious information. A decision point information dataset is established, and binary variables are used to encode the category features in the decision point information dataset to obtain the numerical features of the categories.

2. The training system for investigating telecommunications network fraud cases based on virtual reality according to claim 1, characterized in that: The scene editing unit is used to generate a graphical editing interface, import scene models, evidence models, character models, and prop models, construct a virtual scene, design the layout of the virtual scene, and set the position, angle, and size parameters of the models in the scene.

3. The training system for investigating telecommunications network fraud cases based on virtual reality according to claim 1, characterized in that: The scene exploration unit generates scene exploration options based on a virtual scene and binds them to action interaction scripts. According to the scene exploration options, it interacts with the scene model in the virtual scene and provides feedback on the attribute information of the evidence model.

4. The training system for investigating telecommunications network fraud cases based on virtual reality according to claim 1, characterized in that: The teacher-side module includes a case template unit, which creates case templates and builds a case template library; the case templates include scene settings, character relationships, case clues, and evidence distribution.

5. A training method for a virtual reality-based training system for investigating telecommunications network fraud cases based on any one of claims 1-4, characterized in that, Includes the following steps: (S01) Teachers use the teacher-side module to import and create model data, arrange scenes, evidence and characters, set character information, communication information and transfer information, construct virtual scenes and virtual cases, save the virtual scenes and virtual cases after editing, and publish them to the student-side module. (S02) Students receive virtual scenes and virtual case details on the student terminal, wear hardware devices, and enter the virtual scene; (S03) Students explore the virtual scene, including opening doors, searching rooms, and inspecting items; (S04) Students observe, measure, and test the evidence models in the virtual scene to obtain the attribute information of the evidence models; (S05) Students engage in simulated dialogue with character models in a virtual scene, inputting the dialogue text into a text input box to obtain the response text; (S06) Students log in to the virtual network platform to search for virtual social information and transaction records; (S07) Based on the information collected, students hold a case analysis meeting to discuss, select evidence options, and obtain case progress data; (S08) Students enter the virtual arrest scenario, watch the virtual arrest scenario and the virtual interrogation scenario, and end the training; (S09) Score students’ operation data and generate a score report.

Images