Abnormal user identification method and device, electronic equipment, storage medium and computer product

Abstract

The invention relates to the technical field of computers, and provides an abnormal user identification method and device, electronic equipment, a storage medium and a computer product, and the method comprises the steps: constructing a feature matrix containing call information according to call ticket data of a to-be-identified user; respectively constructing a first neighborhood graph and a second neighborhood graph according to the call ticket data; wherein the first neighborhood graph comprises a neighborhood representing a communication relationship between call user nodes; the second neighborhood graph comprises a neighborhood representing a chain node relation related to the abnormal behavior; inputting the feature matrix, the first neighborhood graph and the second neighborhood graph into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by performing model training based on a sample feature matrix of a sample user, a first sample neighborhood graph and a second sample neighborhood graph in combination with a classification label of the sample user. According to the invention, the accuracy of abnormal user identification can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device, storage medium, and computer product for identifying abnormal users. Background Art

[0002] Strengthened national efforts to combat telecom fraud have curbed traditional telecom fraud to a certain extent, but the emergence of new, sophisticated gang-based scams presents new challenges. Traditional telecom fraud involves fraudsters calling multiple victims, a "one-to-many" approach. Newer scams often operate in a coordinated fashion, with two types of fraudsters working together: junior and advanced. Junior fraudsters' job is to make continuous outbound calls to reach as many victims as possible, and their calling patterns differ significantly from those of ordinary users. Advanced fraudsters, on the other hand, further entice those vulnerable individuals identified by junior fraudsters. Their tactics are more sophisticated, allowing them to better understand their victims' psychology and successfully execute their scams. Advanced fraudsters avoid frequent calls, focusing solely on pre-screened victims. Consequently, their characteristics resemble those of ordinary users, making them difficult to identify using data-based features such as call frequency. Faced with this type of "multi-point to single-point" gang fraud, traditional analysis based on call signaling records has had little effect. Technical personnel have begun to try to use topology maps based on communication relationships to achieve a comprehensive crackdown on fraudulent numbers.

[0003] However, currently, the graph is constructed only based on the call relationship between the caller and the callee or the same callee relationship between users, resulting in insufficient generalization learning of node features. Specifically, in the current method, only the existence of calls or the same callee is used as the basis for constructing the edges in the topology graph. This approach will lead to incomplete consideration of the problem. First, constructing a graph based solely on calls cannot effectively construct a "multi-point to single-point" gang fraud behavior pattern, and thus the nodes cannot directly learn this behavior feature; second, when constructing a graph based solely on the same callee relationship, the nodes fail to fully learn the communication features from the nodes with call relationships. Therefore, the existing graph structure with a single node neighborhood is difficult to fully reflect and characterize the current complex fraud characteristics, and thus cannot more comprehensively identify fraudsters with complex and changeable fraud behaviors. As a result, the current accuracy in identifying abnormal users is insufficient. Summary of the Invention

[0004] This application aims to solve at least one of the technical problems existing in the related art. To this end, this application proposes a method, device, electronic device, storage medium, and computer product for identifying abnormal users, which are used to solve the current problem of being unable to comprehensively identify fraudsters whose fraudulent behavior is complex and changeable, and to improve the accuracy of abnormal user identification.

[0005] According to the first embodiment of the present application, the abnormal user identification method includes: Construct a feature matrix containing call information based on the call record data of the user to be identified; Based on the call record data, a first neighborhood graph and a second neighborhood graph are constructed respectively; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; The feature matrix, the first neighborhood graph, and the second neighborhood graph are input into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

[0006] According to one embodiment of the present application, the abnormal user identification model is specifically used to: Performing feature extraction based on the feature matrix, the first neighborhood graph, and the second neighborhood graph to obtain a feature tensor; Extracting features of the continuous time series behavior based on the feature tensor to obtain a first feature; Performing random discrete abnormal feature extraction based on the feature tensor to obtain a second feature; Performing feature fusion on the first feature and the second feature to obtain a feature to be classified; Abnormal user identification is performed based on the features to be classified to obtain an abnormal user identification result.

[0007] According to one embodiment of the present application, extracting features based on the feature matrix, the first neighborhood graph, and the second neighborhood graph to obtain a feature tensor includes: Determining a first regularized Laplacian matrix of the first neighborhood graph and a second regularized Laplacian matrix of the second neighborhood graph; Performing feature extraction based on the first regularized Laplace matrix and the feature matrix to obtain a first feature tensor; Performing feature extraction based on the second regularized Laplace matrix and the feature matrix to obtain a second feature tensor; The first feature tensor and the second feature tensor are fused to obtain a feature tensor.

[0008] According to one embodiment of the present application, extracting features of the continuous time series behavior based on the feature tensor to obtain the first feature includes: Flattening the feature tensor to obtain flattened features; Extracting continuous temporal behavior features based on the flattened features to obtain first extracted features; The first extracted features are post-processed to obtain first features.

[0009] According to one embodiment of the present application, the step of performing random discrete abnormal feature extraction based on the feature tensor to obtain the second feature includes: Performing a multi-layer convolution operation based on the feature tensor to obtain a second extracted feature; wherein each layer uses multiple convolution kernels to extract features of different dimensions, and a maximum pooling operation is performed after each layer of convolution operation; Perform feature transformation on the second extracted feature to obtain a second feature.

[0010] According to one embodiment of the present application, the step of fusing the first feature and the second feature to obtain a feature to be classified includes: Performing feature activation based on the first feature to obtain a first activated feature; Performing feature activation based on the second feature to obtain a second activated feature; determining a weight factor based on the first activation feature and the second activation feature; Based on the weight factor, feature fusion is performed on the first activation feature and the second activation feature to obtain a feature to be classified.

[0011] According to the second embodiment of the present application, the abnormal user identification device includes: The first construction module is used to construct a feature matrix containing call information based on the call record data of the user to be identified; A second construction module is configured to construct a first neighborhood graph and a second neighborhood graph based on the call record data; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; An identification module is used to input the feature matrix, the first neighborhood graph, and the second neighborhood graph into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

[0012] According to an electronic device of an embodiment of the third aspect of the present application, the electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the abnormal user identification method described above is implemented.

[0013] According to the storage medium of the fourth aspect embodiment of the present application, the storage medium is a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements any of the above-mentioned abnormal user identification methods.

[0014] According to the computer program product of the fifth embodiment of the present application, the computer program includes a computer program, which, when executed by a processor, implements any of the above-mentioned abnormal user identification methods.

[0015] The above one or more technical solutions in the embodiments of the present application have at least the following technical effects: In addition to constructing a feature matrix containing call information based on the call log data of the user to be identified, a first neighborhood graph containing the communication relationships between calling user nodes and a second neighborhood graph containing chain node relationships related to abnormal behavior are also constructed based on the call log data. The feature matrix, first neighborhood graph, and second neighborhood graph are then input into a pre-trained abnormal user identification model to obtain abnormal user identification results output by the abnormal user identification model. Because communication neighborhoods and chain neighborhoods related to suspected abnormal behavior are designed for "single-point to multi-point" and "multi-point to single-point" abnormal behavior patterns, respectively, the abnormal user identification model can perform comprehensive user topology feature extraction based on the feature matrix, first neighborhood graph, and second neighborhood graph, which helps improve the accuracy of the model's predictions and, therefore, the accuracy of abnormal user identification.

[0016] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 This is one of the flow charts of the abnormal user identification method provided in the embodiment of the present application.

[0019] Figure 2 This is a schematic diagram of the scenario framework provided in an embodiment of the present application.

[0020] Figure 3 This is the second flow chart of the abnormal user identification method provided in the embodiment of the present application.

[0021] Figure 4 It is a structural diagram of the electronic device provided in this application. DETAILED DESCRIPTION

[0022] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0023] In the description of the embodiments of the present application, it should be noted that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as limiting the embodiments of the present application. In addition, the terms "first", "second", and "third" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

[0024] In the description of the embodiments of this application, it should be noted that, unless otherwise specified or limited, the terms "connected" and "connection" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium. Those skilled in the art will understand the specific meanings of the above terms in the embodiments of this application based on the specific circumstances.

[0025] In the embodiments of the present application, unless otherwise expressly specified or limited, a first feature being "above" or "below" a second feature may mean that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediate medium. Furthermore, a first feature being "above," "above," and "above" a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below," "below," and "below" a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0026] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0027] The present application proposes a method, device, electronic device, storage medium and computer product for identifying abnormal users.

[0028] Figure 1 This is one of the flow charts of the abnormal user identification method provided in the embodiment of the present application, such as Figure 1 As shown, the abnormal user identification method includes: Step 110: construct a feature matrix containing call information based on the call record data of the user to be identified.

[0029] Step 120: construct a first neighborhood graph and a second neighborhood graph based on the call record data; wherein the first neighborhood graph includes neighborhoods representing the communication relationship between the call user nodes; and the second neighborhood graph includes neighborhoods representing the chain node relationship related to abnormal behavior.

[0030] Step 130: Input the feature matrix, the first neighborhood graph, and the second neighborhood graph into the abnormal user identification model to obtain the abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

[0031] It should be noted that the abnormal user identification method provided in the embodiment of the present application can be specifically applied to the scenario of telecommunications fraud identification. Therefore, the abnormal user identification in the present application can specifically be telecommunications fraud user identification.

[0032] The execution subject of the abnormal user identification method provided in the embodiments of this application may be a computer device, such as a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA). It should be noted that the data required for this application is obtained through formal channels with the authorization of the relevant users.

[0033] An abnormal user identification device may be provided in or connected to the computer device of the present application, thereby controlling the abnormal user identification device to execute the abnormal user identification method of the present application.

[0034] It should be noted that, in this application, for each user, the user's call information can be obtained from the user's call bill data as its feature.

[0035] Specifically, the present application can divide the call record data of user calls into several specified time slices according to a specific time interval, and perform data aggregation analysis on the call record data within each time slice, extract the characteristic statistical values of each call information in the call record data, which may include but not be limited to call frequency, called frequency, dispersion, average call interval duration, average call duration, connection rate, average off-hook ringing duration, called release rate, etc., and finally obtain the characteristics of all nodes (nodes are users with whom the association is determined through call record data) in the time slice. The characteristic matrix when ,in, , Indicates the number of nodes, represents the feature dimension, Indicates the Nodes in time slice The eigenvector of .

[0036] It's important to note that, in addition to the traditional "single-point to multi-point" fraud model, a "multi-point to single-point" group fraud model has also emerged. Traditional technical solutions establish connections between nodes based solely on the caller-caller relationship or the presence of the same callee. However, this solution only models one aspect, making it difficult to fully identify all types of fraudsters.

[0037] Based on this, this application can also set up a spatiotemporal dual-neighborhood graph construction module.

[0038] Figure 2 This is a schematic diagram of the scene framework provided by the embodiment of the present application, such as Figure 2As shown, the present application can construct a first neighborhood graph containing a neighborhood representing the communication relationship between call user nodes based on the communication relationship between users according to call bill data (the first neighborhood graph can be referred to as the communication neighborhood graph in the present application), and construct a second neighborhood graph containing a neighborhood representing the chain node relationship related to abnormal behavior based on the suspected fraud link (the second neighborhood graph can be referred to as the suspected fraud chain neighborhood graph in the present application), thereby forming a spatiotemporal dual neighborhood graph.

[0039] Specifically, considering the existing traditional "single point to multi-point" abnormal behavior pattern (the abnormal behavior in this application can be fraudulent behavior, so the abnormal behavior pattern can be a fraud pattern), this application According to the communication relationship between users, the communication neighborhood of the node is constructed to obtain the communication neighborhood graph ,in, , , Represents a user With users Is there a call between nodes? With node Is there an edge between them?

[0040] At the same time, in view of the current "multi-point to single-point" fraud model, the suspected fraud chain neighborhood of the node is constructed based on the call list data and the suspected fraud link, and the suspected fraud chain neighborhood graph is obtained. ,in, , , Represents a user With users Whether to give at least The same users all passed the call.

[0041] Combining the two neighborhood graphs, we get a spatiotemporal dual neighborhood graph based on the communication neighborhood graph and the suspected fraud chain neighborhood graph. .

[0042] It should be noted that the present application can use a certain number of users as sample users, and obtain the feature matrix of the sample users as the sample feature matrix in the above manner, obtain the first neighborhood graph of the sample users as the first sample neighborhood graph, obtain the second neighborhood graph of the sample users as the second sample neighborhood graph, and can also obtain the classification label set for the user sample to determine whether the sample user is an abnormal user (for example, whether it is a fraudulent user).

[0043] Based on this, the sample feature matrix of the sample data, the first sample neighborhood graph, the second sample neighborhood graph and the classification labels thereof can be used as training data to train the pre-built model. After the training is completed, an abnormal user identification model is obtained that can make predictions based on the input feature matrix, the first neighborhood graph and the second neighborhood graph, and output the abnormal user identification result of whether the user is involved in fraud.

[0044] Therefore, after obtaining the feature matrix, the first neighborhood graph and the second neighborhood graph of the user to be identified, the feature matrix, the first neighborhood graph and the second neighborhood graph of the user to be identified can be input into the abnormal user identification model, and the abnormal user identification model is used to make predictions to obtain the abnormal user identification result of whether the user is involved in fraud output by the abnormal user identification model.

[0045] According to the abnormal user identification method of the embodiment of the present application, in addition to constructing a feature matrix containing call information based on the call data of the user to be identified, a first neighborhood graph containing the communication relationship between the call user nodes and a second neighborhood graph containing the chain node relationship related to abnormal behavior are respectively constructed based on the call data; and then the feature matrix, the first neighborhood graph and the second neighborhood graph are input into the pre-trained abnormal user identification model to obtain the abnormal user identification result output by the abnormal user identification model. Since the communication neighborhood and the chain neighborhood related to the suspected abnormal behavior are designed for the abnormal behavior patterns of "single point to multipoint" and "multipoint to single point", the abnormal user identification model can perform comprehensive user topology feature extraction based on the feature matrix, the first neighborhood graph and the second neighborhood graph, which helps to improve the accuracy of the model prediction, and thus can improve the accuracy of abnormal user identification.

[0046] Based on the above embodiment, the abnormal user identification model is specifically used for: Perform feature extraction based on the feature matrix, the first neighborhood graph, and the second neighborhood graph to obtain a feature tensor; Extract features of continuous temporal behavior based on the feature tensor to obtain the first feature; Perform random discrete abnormal feature extraction based on the feature tensor to obtain the second feature; Perform feature fusion on the first feature and the second feature to obtain the feature to be classified; Abnormal users are identified based on the features to be classified to obtain abnormal user identification results.

[0047] It's important to note that traditional technical solutions often use recurrent neural networks to extract continuous time-series behavior patterns. However, due to the rapid evolution of current fraud methods, some fraudsters have begun using random short-term call times to commit fraud. This relatively discrete and random time-series behavior is easily lost in the vast amount of time-series data, making it difficult for recurrent neural networks to extract and, consequently, identify the fraudster.

[0048] Based on this, Figure 2 As shown, the pre-built model in this application includes a graph convolution module using multi-frequency Beta wavelets to learn the characteristics of nodes in the graph topology structure in the spatiotemporal dual-neighborhood graph. Multi-frequency Beta wavelets are an extension of Beta wavelets, primarily used for signal processing and analysis. Beta wavelets are constructed using the probability density function of the Beta distribution. The Beta distribution is a probability distribution defined on the interval [0, 1].

[0049] Specifically, the spatiotemporal dual-neighborhood graph obtained by the above process of this application is It is obtained through artificial construction rules, which inevitably may connect nodes belonging to different categories or with dissimilar features. However, the Graph Convolutional Neural Network (GCN), which is commonly used to extract features from graph-structured data, uses a low-pass filter to extract features based on the assumption that the features of connected nodes are similar. This makes GCN unusable in spatiotemporal dual-neighborhood graphs. Therefore, this application introduces a multi-frequency Beta wavelet filter, using low-frequency filters and high-frequency filters to respectively extract similar features and differentiated features from aggregated adjacent nodes, and designs a graph convolution module based on this.

[0050] Furthermore, the graph convolution module can be used to perform feature extraction based on the feature matrix, the first neighborhood graph, and the second neighborhood graph, thereby obtaining a feature tensor.

[0051] It should be noted that if Figure 2 As shown, the above-mentioned pre-built model of the present application also constructs an adaptive time series feature extraction module, which is used to mine the user's continuous time series behavior patterns and the fraud behavior features that are important at certain moments, and to perform feature aggregation by weighing the importance of both for identifying fraudsters.

[0052] Specifically, the adaptive temporal feature extraction module includes an abnormal continuous temporal behavior extraction sub-module and a random discrete abnormal feature extraction sub-module, which are used to extract features from continuous temporal behavior and abnormal moment behavior, respectively; it also includes a fusion feature sub-module, which uses the self-attention mechanism to dynamically adjust the importance of the two types of features for identifying fraudulent behavior through the fusion feature sub-module, and fully aggregate and learn the two types of feature information.

[0053] Thus, the abnormal continuous temporal behavior extraction submodule can be used to extract features of continuous temporal behavior based on the feature tensor to obtain the first feature. Also, the random discrete abnormal feature extraction submodule can be used to extract random discrete abnormal features based on the feature tensor to obtain the second feature.

[0054] Furthermore, the first feature and the second feature can be fused through a fusion feature submodule to obtain a feature to be classified.

[0055] It should be noted that if Figure 2 As shown, the above-mentioned pre-built model of the present application also has a classification module, which may include a multi-layer perceptron and a softmax function.

[0056] Therefore, the classification module can be used to further extract features and transform the dimensions of the classification features through a multi-layer perceptron, and then the softmax function is used to calculate the probability of each node being involved in fraud or not. If the probability of being involved in fraud is greater than the probability of not being involved in fraud, the user corresponding to the node is output as being involved in fraud, otherwise the user corresponding to the node is output as not being involved in fraud. Therefore, the abnormal user identification result can be obtained. Among them, the softmax function is an activation function commonly used in machine learning and deep learning. The calculation formula of the softmax function in this application is as follows: ; in, Indicates the probability of fraud, 、 are the parameters of the multilayer perceptron in the output layer, Represents the features to be classified.

[0057] This application fuses the user's continuous temporal behavior and random discrete behavior features when extracting user temporal features to expand the feature extraction space. It specifically designs an abnormal continuous temporal behavior extraction submodule and a random discrete abnormal feature extraction submodule to respectively extract the user's two abnormal behavior patterns. The self-attention mechanism is used to implement a model that can dynamically fuse features according to the importance of the two types of features, ultimately improving the model's recognition capabilities and solving the problem of incomplete extraction of user temporal features. Currently, more cunning fraudsters often use counter-detection fraud methods to commit fraud, which reduces the effectiveness of traditional models based on user continuous temporal behavior. Therefore, by supplementing the extraction of user random discrete abnormal behavior features to improve the model's recognition coverage, it helps to improve the accuracy of model predictions, thereby improving the accuracy of abnormal user identification.

[0058] Based on the above embodiment, feature extraction is performed based on the feature matrix, the first neighborhood graph, and the second neighborhood graph to obtain a feature tensor, including: determining a first regularized Laplacian matrix of the first neighborhood graph and a second regularized Laplacian matrix of the second neighborhood graph; Perform feature extraction based on the first regularized Laplace matrix and the feature matrix to obtain a first feature tensor; Perform feature extraction based on the second regularized Laplace matrix and the feature matrix to obtain a second feature tensor; The first feature tensor is fused with the second feature tensor to obtain a feature tensor.

[0059] Specifically, the present application can determine the first regularized Laplacian matrix of the first neighborhood graph and the second regularized Laplacian matrix of the second neighborhood graph through a graph convolution module.

[0060] More specifically, the time slice can be determined The regularized Laplace moment of the first neighborhood graph is used as the first regularized Laplace matrix, and the time slice is determined The regularized Laplace moment of the lower second neighborhood graph is used as the second regularized Laplace matrix.

[0061] Furthermore, the first regularized Laplace matrix and the characteristic matrix can be input into the multi-frequency Beta wavelet filter Perform feature extraction and aggregation, and input the second regularized Laplace matrix and feature matrix into the multi-frequency Beta wavelet filter Perform feature extraction and aggregation. The specific calculation method is shown in the following formula: ; in, Indicates time slice The regularized Laplacian matrix of the first or second neighborhood graph, express The matrix composed of the orthogonal basis after decomposition, Indicated by A diagonal matrix composed of the eigenvalues of ; , is a hyperparameter used to control the receptive field of the filter.

[0062] Furthermore, the extracted features are input into the multi-layer perceptron for feature transformation, and the outputs of various filters are spliced and output to obtain the first feature tensor and the second feature tensor. The specific calculation method is as follows: ; ; in, 、 are the parameters of the multilayer perceptron in the output layer.

[0063] Specifically, due to the different modeling angles of the two types of neighborhood graphs, different convolution kernels are constructed for feature extraction, namely, node features In the communication neighborhood graph The corresponding filter The first eigentensor is obtained under the action of , and in the suspected fraud chain neighborhood graph The corresponding filter The second eigentensor is obtained under the action of .

[0064] Furthermore, the first feature tensor and the second feature tensor can be fused and outputted by concatenation and multi-layer perceptron feature transformation, as shown below: ; in, 、 are the parameters of the multilayer perceptron in the output layer.

[0065] Thus, the feature tensor can be obtained .

[0066] This application introduces a multi-frequency Beta wavelet filter, uses low-frequency filters and high-frequency filters to respectively extract similar features and differentiated features from adjacent nodes, and designs a graph convolution module based on this. Through neighborhood feature fusion, it realizes comprehensive and in-depth extraction of user topological features, which helps to improve the accuracy of model prediction and thus improves the accuracy of abnormal user identification.

[0067] Based on the above embodiment, feature extraction of continuous time series behavior is performed based on the feature tensor to obtain a first feature, including: Flatten the feature tensor to obtain flattened features; Extract continuous temporal behavior features based on the flattened features to obtain the first extracted features; The first extracted feature is post-processed to obtain a first feature.

[0068] Specifically, the abnormal continuous temporal behavior extraction submodule uses the Long Short-Term Memory (LSTM) model to extract user continuous temporal behavior patterns.

[0069] Assume that the time series input to this submodule, i.e. the above-mentioned feature tensor, is: , in, Indicates the length of the input time series.

[0070] First, the submodule will Each feature tensor in is flattened and then input into The continuous temporal behavior feature extraction is performed in the LSTM model of the layer. ( ) layer is calculated as follows: ; ; ; ; ; ; in, represents the Hadamard product, 、 、 、 、 、 、 、 For the The calculation parameters of the layer, ;when for hour, is 0; 、 Represents different activation functions.

[0071] Thus, the first extracted feature is obtained.

[0072] Furthermore, after performing feature transformation and size adjustment on the first extracted feature output by the LSTM model, the output of the abnormal continuous temporal behavior extraction submodule is obtained and used as the first feature : ; in, 、 Reshape() is used to change the shape of an array, tensor, or data structure while keeping its data elements unchanged.

[0073] Furthermore, random discrete abnormal feature extraction is performed based on the feature tensor to obtain the second feature, including: Perform multi-layer convolution operations based on the feature tensor to obtain the second extracted features. Each layer uses multiple convolution kernels to extract features of different dimensions, and a maximum pooling operation is performed after each convolution operation. Perform feature transformation on the second extracted feature to obtain a second feature.

[0074] Specifically, the random discrete abnormal feature extraction submodule uses convolution and maximum pooling operations to extract the fraud features that appear randomly and discretely in the time series. The input of this submodule is the same as that of the abnormal continuous time series behavior extraction submodule, both of which are . It will first The sequences are stacked to obtain the time series feature tensor : , Further multi-layer convolution operations are performed, in which each layer uses multiple convolution kernels to extract features of different dimensions of time series data. At the same time, after each layer of convolution operation, a maximum pooling operation is performed to select local features with high significance and highlight them. This enables this sub-module to have the ability to identify occasional abnormal behaviors hidden in the daily behavior of cunning fraudsters.

[0075] Assume that the submodule is The convolution and maximum pooling operations of the layer are realized, then the ( ) layer is calculated as follows: ; ; in, express Tier convolution kernels, A tensor representing the output of the convolution operation, .

[0076] Thus, the second extracted feature can be obtained.

[0077] Finally, after the feature transformation of the output second extracted feature, the output of the random discrete anomaly feature extraction submodule is obtained and used as the second feature : ; in, 、 is the feature transformation parameter.

[0078] Furthermore, the first feature and the second feature are fused to obtain features to be classified, including: Perform feature activation based on the first feature to obtain a first activated feature; Perform feature activation based on the second feature to obtain a second activated feature; determining a weight factor based on the first activation feature and the second activation feature; Based on the weight factor, the first activation feature and the second activation feature are fused to obtain the feature to be classified.

[0079] Specifically, the feature fusion submodule adaptively fuses the outputs of the abnormal continuous temporal behavior extraction submodule and the random discrete abnormal feature extraction submodule through the self-attention mechanism to obtain the resulting feature matrix that fully extracts the spatiotemporal features of the nodes.

[0080] Specifically, the process of fusing the first feature and the second feature can be achieved by the following calculation method: ; ; ; ; ; in, is a shared attention matrix, 、 Parameters of this submodule.

[0081] When extracting user temporal features, this application integrates user continuous temporal behavior and random discrete behavior features to expand the feature extraction space. Specifically, an abnormal continuous temporal behavior extraction submodule and a random discrete abnormal feature extraction submodule are designed to respectively extract the user's two abnormal behavior patterns, and through the self-attention mechanism, the model can dynamically fuse features according to the importance of the two types of features, ultimately achieving an improvement in model recognition capabilities, which helps to improve the accuracy of abnormal user identification.

[0082] Figure 3 This is the second flow chart of the abnormal user identification method provided in the embodiment of the present application. Figure 3 As shown, the abnormal user identification method of the present application may include the following S1-S4.

[0083] Specifically, there are: S1: Calculate the characteristics of each user (such as call frequency) from user call record data, and build a communication neighborhood and a suspected fraud chain neighborhood based on the communication relationships between users and suspected fraud links, forming a spatiotemporal dual neighborhood graph; S2: Construct a graph convolution module based on multi-frequency Beta wavelet to learn the characteristics of nodes in the graph topology structure in the spatiotemporal dual-neighborhood graph; S3: Build an adaptive time series feature extraction module to mine users' continuous time series behavior patterns and important fraud behavior features at certain moments, and aggregate features by weighing their importance in identifying fraudsters. S4: The learned spatiotemporal features of the nodes are generalized through a multi-layer perceptron and processed with a softmax function to obtain a classification result on whether the user is involved in fraud.

[0084] Based on the above examples, this application optimizes the method for extracting user spatiotemporal features in telecommunications fraud models to better identify the two current mainstream fraud patterns and the unpredictable temporal behavior characteristics of fraudsters, thereby extracting deeper features. This application can also be used in scenarios such as banks where multiple relationships between users or complex and changing temporal behaviors need to be modeled.

[0085] Through reasonable user spatiotemporal feature extraction methods, the prediction accuracy of the model can be effectively improved, the number of numbers involved in the case can be reduced, and it is conducive to the efficient and accurate crackdown on the telecommunications fraud industry.

[0086] For operators, deploying multiple SIM cards can help them rapidly expand their business, but this carries the risk that these cards could be used for telecom fraud. By designing a highly accurate and comprehensive model, we can ensure quality during rapid business expansion and avoid user complaints caused by accidental shutdowns.

[0087] The abnormal user identification device provided in the present application is described below. The abnormal user identification device described below and the abnormal user identification method described above can be referenced to each other.

[0088] Furthermore, the present application also provides an abnormal user identification device.

[0089] The abnormal user identification device includes: The first construction module is used to construct a feature matrix containing call information based on the call record data of the user to be identified; A second construction module is configured to construct a first neighborhood graph and a second neighborhood graph based on the call record data; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; An identification module is used to input the feature matrix, the first neighborhood graph, and the second neighborhood graph into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

[0090] The abnormal user identification device of the present application, in addition to constructing a feature matrix containing call information based on the call data of the user to be identified, also constructs a first neighborhood graph containing the communication relationship between the call user nodes and a second neighborhood graph containing the chain node relationship related to abnormal behavior based on the call data; then, the feature matrix, the first neighborhood graph, and the second neighborhood graph are input into the pre-trained abnormal user identification model to obtain the abnormal user identification result output by the abnormal user identification model. Since the communication neighborhood and the chain neighborhood related to suspected abnormal behavior are designed for the abnormal behavior patterns of "single point to multipoint" and "multipoint to single point", the abnormal user identification model can perform comprehensive user topology feature extraction based on the feature matrix, the first neighborhood graph, and the second neighborhood graph, which helps to improve the accuracy of model prediction and thus improve the accuracy of abnormal user identification.

[0091] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the following method: constructing a feature matrix containing call information based on the call record data of the user to be identified; Based on the call record data, a first neighborhood graph and a second neighborhood graph are constructed respectively; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; The feature matrix, the first neighborhood graph, and the second neighborhood graph are input into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

[0092] In addition, the logical instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program code.

[0093] In another aspect, an embodiment of the present application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods provided in the above embodiments, for example, including: constructing a feature matrix containing call information based on call record data of a user to be identified; Based on the call record data, a first neighborhood graph and a second neighborhood graph are constructed respectively; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; The feature matrix, the first neighborhood graph, and the second neighborhood graph are input into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

[0094] In another aspect, an embodiment of the present application further provides a computer program product having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods provided in the above embodiments, for example, including: constructing a feature matrix containing call information based on call record data of a user to be identified; Based on the call record data, a first neighborhood graph and a second neighborhood graph are constructed respectively; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; The feature matrix, the first neighborhood graph, and the second neighborhood graph are input into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

[0095] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0096] Through the description of the above embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the relevant technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0097] Finally, it should be noted that the above embodiments are intended only to illustrate the present application and are not intended to limit the present application. Although the present application has been described in detail with reference to the embodiments, it should be understood by those skilled in the art that various combinations, modifications, or equivalent substitutions of the technical solutions of the present application do not depart from the spirit and scope of the technical solutions of the present application.

Claims

1. A method for identifying abnormal users, characterized in that: include: Construct a feature matrix containing call information based on the call record data of the user to be identified; Based on the call record data, a first neighborhood graph and a second neighborhood graph are constructed respectively; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; The feature matrix, the first neighborhood graph, and the second neighborhood graph are input into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

2. The abnormal user identification method according to claim 1, characterized in that: The abnormal user identification model is specifically used for: Performing feature extraction based on the feature matrix, the first neighborhood graph, and the second neighborhood graph to obtain a feature tensor; Extracting features of the continuous time series behavior based on the feature tensor to obtain a first feature; Performing random discrete abnormal feature extraction based on the feature tensor to obtain a second feature; Performing feature fusion on the first feature and the second feature to obtain a feature to be classified; Abnormal user identification is performed based on the features to be classified to obtain an abnormal user identification result.

3. The abnormal user identification method according to claim 2, characterized in that: The extracting features based on the feature matrix, the first neighborhood graph, and the second neighborhood graph to obtain a feature tensor includes: Determining a first regularized Laplacian matrix of the first neighborhood graph and a second regularized Laplacian matrix of the second neighborhood graph; Performing feature extraction based on the first regularized Laplace matrix and the feature matrix to obtain a first feature tensor; Performing feature extraction based on the second regularized Laplace matrix and the feature matrix to obtain a second feature tensor; The first feature tensor and the second feature tensor are fused to obtain a feature tensor.

4. The abnormal user identification method according to claim 2, characterized in that: The extracting features of the continuous time series behavior based on the feature tensor to obtain the first feature includes: Flattening the feature tensor to obtain flattened features; Extracting continuous temporal behavior features based on the flattened features to obtain first extracted features; The first extracted features are post-processed to obtain first features.

5. The abnormal user identification method according to claim 2, characterized in that: The extracting of a random discrete abnormal feature based on the feature tensor to obtain a second feature includes: Performing a multi-layer convolution operation based on the feature tensor to obtain a second extracted feature; wherein each layer uses multiple convolution kernels to extract features of different dimensions, and a maximum pooling operation is performed after each layer of convolution operation; Perform feature transformation on the second extracted feature to obtain a second feature.

6. The abnormal user identification method according to claim 2, characterized in that: The fusing the first feature and the second feature to obtain a feature to be classified includes: Performing feature activation based on the first feature to obtain a first activated feature; Performing feature activation based on the second feature to obtain a second activated feature; determining a weight factor based on the first activation feature and the second activation feature; Based on the weight factor, feature fusion is performed on the first activation feature and the second activation feature to obtain a feature to be classified.

7. An abnormal user identification device, characterized in that: include: The first construction module is used to construct a feature matrix containing call information based on the call record data of the user to be identified; A second construction module is configured to construct a first neighborhood graph and a second neighborhood graph based on the call record data; wherein the first neighborhood graph includes neighborhoods representing communication relationships between call user nodes; and the second neighborhood graph includes neighborhoods representing chain node relationships related to abnormal behavior; An identification module is used to input the feature matrix, the first neighborhood graph, and the second neighborhood graph into an abnormal user identification model to obtain an abnormal user identification result output by the abnormal user identification model; the abnormal user identification model is obtained by model training based on the sample feature matrix, the first sample neighborhood graph, and the second sample neighborhood graph of the sample user, combined with the classification label of the sample user.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the abnormal user identification method according to any one of claims 1 to 6 is implemented.

9. A storage medium, wherein the storage medium is a non-transitory computer-readable storage medium and stores a computer program, wherein: When the computer program is executed by a processor, the abnormal user identification method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormal user identification method according to any one of claims 1 to 6 is implemented.

Images