Intelligent management system for remote communication security virtual number of mobile communication equipment

Abstract

The invention relates to the technical field of mobile communication virtual number safety management, in particular to an intelligent management system for a remote communication safety virtual number of mobile communication equipment. The system comprises a data acquisition module used for acquiring communication data; the communication security analysis module is used for determining the abnormal degree based on the difference between each piece of data in various communication data and the clustering center of the abnormal cluster and the difference between all elements in the abnormal cluster and the clustering center; based on the difference between the path depth and the maximum depth of each data in the various communication data in the decision tree and in combination with the anomaly probability and the anomaly degree of each data, determining the communication anomaly degree; and the communication analysis module is used for intercepting the communication request of the merchant based on the communication abnormality. The invention aims to improve the reliability and security of communication between the merchant and the user.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile communication virtual number security management, and in particular to an intelligent management system for remote communication security virtual numbers of mobile communication equipment. Background Art

[0002] During the communication process between merchants and customers, virtual numbers can protect user privacy, hide real numbers through virtual numbers, prevent personal information from being leaked during communication, and reduce the risk of harassing calls and fraud. Blockchain-based virtual number management can enhance communication security, ensure that call and text message content is difficult to be stolen or tampered with, improve resource utilization, reduce communication costs, and achieve efficient communication resource management.

[0003] Traditional virtual number systems have many security risks due to their reliance on static binding rules. Their security mechanisms are relatively fragile and can be easily reverse-engineered by attackers, thereby obtaining the real information of the user behind the virtual number and leaking user privacy. In addition, traditional virtual number systems lack intelligent differentiation capabilities and cannot effectively distinguish between normal business fluctuations and malicious behavior. This will not only cause false interceptions and affect normal communications, but also reduce the security and reliability of communications between merchants and users. Summary of the Invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide an intelligent management system for remote communication security virtual numbers of mobile communication devices. The technical solutions adopted are as follows:

[0005] The present invention proposes an intelligent management system for remote communication security virtual numbers of mobile communication devices, the system comprising:

[0006] The data collection module is used to obtain all types of communication data when each merchant uses its current virtual number to communicate at each collection moment within a preset time period before the current moment;

[0007] The communication security analysis module is used to cluster all data based on the anomaly scores of all data in each merchant's various communication data to obtain abnormal clusters and normal clusters of various communication data. Based on the difference between the mean of each data in the abnormal cluster and the mean of all data in the normal cluster, as well as the anomaly score of each data, the module determines the anomaly index of each data in the abnormal cluster of various communication data. In combination with the discrete degree of the corresponding collection time of all data in the abnormal cluster, the module determines the time series anomaly degree of each merchant.

[0008] Label each data point in each merchant's communication data, train a decision tree based on the label and anomaly score of each data point, and the merchant's time series anomaly degree, and obtain the anomaly probability of each data point, the path depth of each data point in the decision tree, and the maximum depth of the decision tree;

[0009] Determine the degree of abnormality of each data item in the various communication data items based on the difference between each data item in the various communication data items and the cluster center of the abnormal cluster, as well as the difference between all elements in the abnormal cluster and the cluster center; determine the abnormality confidence of each data item in the various communication data items based on the difference between the path depth and the maximum depth of each data item in the decision tree; and determine the communication abnormality degree of each merchant based on the abnormal probability of each data item and the abnormality degree;

[0010] The communication analysis module is used to intercept the merchant's communication request based on the communication abnormality.

[0011] Preferably, the method for obtaining abnormal clusters and normal clusters of the various communication data is:

[0012] Cluster all data in various communication data of each merchant, calculate the average anomaly score of all data in each cluster, and take the cluster with the largest average anomaly score as the abnormal cluster, and the cluster with the smallest average anomaly score as the normal cluster.

[0013] Preferably, the method for determining the abnormal index of each data in the abnormal cluster of the various communication data is:

[0014] Calculate the difference between each data in the abnormal cluster of various communication data and the mean of all data in the normal cluster, and record it as the abnormal difference of each data;

[0015] The product of the abnormal difference of each data in the abnormal cluster and its abnormal score is used as the abnormal index of each data in the abnormal cluster.

[0016] Preferably, the method for determining the time series abnormality of each merchant is:

[0017] Calculate the cumulative sum of the anomaly indexes of all data in the anomaly cluster of various communication data;

[0018] Calculate the standard deviation of all data in the abnormal cluster of various communication data at the corresponding collection time;

[0019] Calculating an exponential function value with a natural constant as a base and the standard deviation of various communication data as an independent variable, and calculating a ratio of the cumulative sum of the various communication data to the exponential function value, recording the ratio as an abnormal ratio of the various communication data;

[0020] The average of the abnormal ratios of all types of communication data of each merchant is taken as the time series abnormality of each merchant.

[0021] Preferably, the step of setting a label for each data in the various communication data of each merchant includes:

[0022] The labels of all data in the abnormal cluster of each merchant's communication data are set to 1, and the labels of all data in the normal cluster are set to 0.

[0023] Preferably, the process of obtaining the abnormal probability of each data, the path depth of each data in the decision tree, and the maximum depth of the decision tree is:

[0024] All data in each merchant's various communication data are used as the input of the decision tree, wherein the label of each data in each merchant's various communication data, the anomaly score and the merchant's time series anomaly degree are used as the weight vector of the decision tree, and the output is set as the label of the normal communication class and the label of the abnormal communication class, the probability of each data in the various communication data belonging to the abnormal communication class, the path depth of each data in the decision tree and the maximum depth of the decision tree, wherein the probability of each data belonging to the abnormal communication class label is used as the abnormal probability of each data.

[0025] Preferably, the expression for the abnormality degree of each data in the various communication data is: Where U i,j Indicates the abnormality degree of data j in the i-th communication data; g i,j G represents the difference between the cluster center of data j and the corresponding abnormal cluster in the i-th communication data; i It represents the maximum value of the difference between all data in the abnormal cluster of the i-th communication data and the cluster center; exp() represents an exponential function with a natural constant as the base.

[0026] Preferably, the expression for the abnormal confidence level of each data in the various communication data is: Where K i,j represents the abnormal confidence of data j in the i-th communication data; L i,j F represents the path depth of data j in the decision tree within the i-th communication data; i,j Indicates the maximum depth of the decision tree where data j is located in the i-th communication data.

[0027] Preferably, the method for determining the communication abnormality degree of each merchant is:

[0028] For each merchant, the product of the abnormality degree, abnormal confidence and abnormal probability of each data in various communication data is calculated, and the average value of the multiplication results of all data in various communication data is calculated. The average value of all types of communication data for each merchant is taken as the communication abnormality degree of each merchant.

[0029] Preferably, the intercepting of the merchant's communication request includes: if the normalized value of the current merchant's communication anomaly degree is greater than the anomaly threshold, intercepting the new communication request when the current merchant uses its current virtual number to communicate; otherwise, allowing the current merchant to communicate with the user through its current virtual number.

[0030] The present invention has the following beneficial effects:

[0031] This application implements a "capping" mechanism for virtual numbers, which greatly improves the reuse efficiency and system scalability of communication resources. While retaining the basic intermediate number communication function, it realizes the logical expansion of virtual numbers through unlimited combinations of prefix codes; through the linkage between blockchain transaction relationship verification and dynamic allocation of virtual numbers, it effectively avoids the resource redundancy caused by the traditional single number use; further, by comprehensively considering the abnormal degree of communication data and the temporal distribution of abnormal behavior, a temporal anomaly degree is constructed, which can more accurately evaluate whether the merchant's communication behavior has malicious attacks; further, by constructing a decision tree for communication data, abnormal data is identified, thereby constructing an abnormal Constant confidence can more accurately assess the possibility of data anomalies, thereby identifying and intercepting abnormal communications, effectively preventing malicious attacks and harassment, and improving the security of user communications; further, by comprehensively analyzing the abnormal probability and degree of communication data, and combining the abnormal confidence, a communication anomaly degree is constructed, and combined with the preset threshold, multi-level judgment is made on the communication data to distinguish between occasional fluctuations and malicious attacks, reducing the false alarm rate, and combining the blockchain authority management and intermediate number mechanism to achieve real-time and adaptable attack response, and then process the merchant's communication request, improving the reliability and security of communication between merchants and users. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 A block diagram of an intelligent management system for remote communication security virtual numbers of mobile communication devices provided by one embodiment of the present application;

[0034] Figure 2 A schematic diagram of a timing anomaly degree acquisition process provided in one embodiment of the present application. DETAILED DESCRIPTION

[0035] To further illustrate the technical means and effectiveness of the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation, structure, features, and effectiveness of an intelligent management system for remote communication security virtual numbers for mobile communication devices proposed in accordance with the present invention. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0036] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0037] The following describes in detail a specific solution of an intelligent management system for remote communication security virtual numbers of mobile communication devices provided by the present invention in conjunction with the accompanying drawings.

[0038] See also Figure 1 , which shows a block diagram of a mobile communication device remote communication security virtual number intelligent management system provided by an embodiment of the present invention. The system includes: a data acquisition module 101, a communication security analysis module 102, and a communication analysis module 03.

[0039] The data collection module 101 is used to obtain all types of communication data of each merchant at each collection time within a preset time period before the current time.

[0040] Blockchain permission management can ensure the authenticity of transaction relationships and the dynamic nature of permission management through the blockchain's immutability and the automation of smart contracts. Specifically, the implementation of blockchain includes the following three steps:

[0041] Block allocation: In the blockchain implementation, each merchant is assigned a specific block. A mapping is maintained in the smart contract, where the key is the MerchantID and the value is the block number of the merchant's transaction record. Whenever a new transaction occurs, the smart contract finds the corresponding block based on the MerchantID and writes the transaction into the block.

[0042] Transaction relationships are put on the chain: each merchant and user is assigned a unique MerchantID and UserID. When each transaction is completed, key transaction information such as MerchantID, UserID product and timestamp are written into the corresponding block of the merchant in the blockchain through smart contracts, thereby ensuring the immutability and transparency of the transaction relationship. The distributed ledger feature of the blockchain enables transaction data to be stored synchronously on multiple nodes. Any attempt to tamper with the data will be quickly detected, thus ensuring the authenticity and integrity of the transaction data.

[0043] Dynamic permission verification: In communication requests, the blockchain is queried in real time to verify whether there are valid transaction records. The dynamic permission verification mechanism ensures that only authorized communications can be carried out. If the user actively withdraws the authorization, the on-chain status will be updated synchronously, triggering the unbinding of the intermediate number, thereby ensuring the dynamic and flexible permission management.

[0044] For each virtual intermediate number, the intermediate number is "capped" through the merchant code and user code to achieve the establishment of a permanent intermediate number. Specifically, an 11-digit number pool containing a large number of intermediate numbers is maintained. Each intermediate number, such as 10000000000, is used as a basic communication carrier to generate a unique virtual number by adding dynamic coding. The coding rule adopts a hierarchical structure, combining the merchant code and the user code as a prefix. For example, the merchant code is M_001 and the user code is U_123, then the generated virtual number is M_001-U_123-10000000000 to achieve "capping". The "capping" mechanism enables a single intermediate number to serve multiple pairs of merchant-user relationships, significantly improving resource utilization. For example, if the number pool contains 100 million intermediate numbers, the 10-digit dynamic coding theory can support 10 18 This is a virtual relationship, and the actual convergence ratio can be dynamically adjusted according to business needs.

[0045] Code generation and mapping are managed through a distributed database, ensuring fast response in high-concurrency scenarios. A consistent hashing algorithm maps the pool of intermediate numbers to a virtual ring, with each intermediate number acting as a node on the ring. Merchant-user code requests are mapped to a point on the ring using a hash function. The nearest node is searched clockwise to assign the corresponding intermediate number, avoiding hash conflicts caused by data growth. When a code conflict is detected, an alternate code is automatically assigned and the mapping is updated to ensure accurate one-to-one communication.

[0046] For the block corresponding to each merchant, when the user establishes communication with the merchant, the ELKStack logging system is used to obtain the call frequency and average call duration of each merchant when communicating using the virtual number in the current communication process; then the Kafka real-time stream processing platform is used to collect the user complaint frequency and communication failure frequency, wherein the data collection interval is set to t, and the data collection duration is the preset duration. In this embodiment, the values ​​of the data collection interval t and the preset duration are both manually set. In this embodiment, the value of the collection interval t is 1h, and the value of the preset duration is one month. In actual application, the implementer can also set it by himself according to the specific situation. This embodiment does not impose any special restrictions.

[0047] At this point, all types of communication data of each merchant when using its current virtual number to communicate at each collection moment within the preset time period before the current moment, that is, all types of communication data of each merchant include: call frequency, average call duration, user complaint frequency and communication failure frequency.

[0048] In order to eliminate the impact of dimensions between data, all types of communication data collected are normalized separately.

[0049] It should be noted that there are many commonly used normalization methods. In this embodiment, the z-score normalization method is used to normalize various communication data. In actual application, as other implementation methods, the implementer may also adopt other methods such as the maximum and minimum value normalization method. Regarding the selection of the normalization method, this embodiment does not impose any special restrictions.

[0050] Among them, the z-score normalization method is a well-known technology, and its specific principle will not be described in detail.

[0051] It should be noted that the following analysis content is based on all types of communication data of each user when communicating using his / her current virtual number. In the following content, it is simply expressed as all types of communication data of each user.

[0052] The communication security analysis module 102 is used to analyze the data obtained by the data collection module to determine the communication anomaly degree of each merchant.

[0053] S1: Cluster all data in various communication data of each merchant to obtain abnormal clusters and regular clusters of various communication data. Based on the difference in the mean of all data in the abnormal clusters compared with all data in the regular clusters, as well as the abnormal score of each data, determine the abnormal index of each data in the abnormal clusters of various communication data. Combined with the discrete degree of the corresponding collection time of all data in the abnormal clusters, determine the time series abnormality of each merchant.

[0054] In the intelligent management system for remote communication security virtual numbers of mobile communication devices, attackers can forge transaction data, reverse crack the coding rules, or exploit system vulnerabilities to initiate high-frequency harassment calls, malicious marketing, or unauthorized communications, leading to user privacy leakage or resource abuse; in addition, normal communication behavior may also be caused by business fluctuations, such as: traffic surges during promotions, or coding allocation conflicts, which may trigger abnormal patterns. If not identified and handled in a timely manner, it may cause system performance degradation or mistakenly intercept legitimate communications.

[0055] Therefore, based on the above analysis, in order to effectively monitor and evaluate the communication data status of each merchant and promptly discover potential abnormal behaviors, all data in each merchant's various communication data are clustered to obtain abnormal clusters and regular clusters of various communication data. Based on the difference between the mean of all data in the abnormal cluster and the mean of all data in the regular cluster, as well as the abnormal score of each data, the abnormal index of each data in the abnormal cluster of various communication data is determined. Combined with the discrete degree of the corresponding collection time of all data in the abnormal cluster, the time series anomaly degree of each merchant is determined to improve the stability and security of the communication network. The specific process of time series anomaly degree is as follows:

[0056] S101: Cluster all data in each merchant's various communication data to obtain abnormal clusters and normal clusters of various communication data, specifically:

[0057] First, all the data in each merchant's various communication data are used as the input of the anomaly detection algorithm, and the anomaly scores of all the data in various communication data are output to judge the anomaly of the communication data, thereby reflecting whether there is any abnormal behavior in the merchant's communication.

[0058] It should be understood that there are many commonly used anomaly detection algorithms. In this embodiment, the isolation forest algorithm is used to obtain the anomaly scores of all data in various concentric lock protective gear. In actual application, as other implementation methods, implementers may also use other methods such as the LOF anomaly detection algorithm. Regarding the selection of anomaly detection algorithm, this embodiment does not impose any special restrictions.

[0059] Among them, the isolation forest algorithm is a well-known technology, and its specific principle is not repeated here.

[0060] Furthermore, in this embodiment, in order to accurately distinguish normal clusters from potential abnormal clusters in various communication data, all data in various communication data are classified. Specifically, all data in various communication data of each merchant is used as input to the clustering algorithm, wherein the number of clusters is set to 2, the metric distance is the absolute value of the difference between the abnormality scores of the data, and two clusters are output;

[0061] Calculate the mean anomaly score of all data in each cluster of various communication data, and take the cluster with the largest mean anomaly score as the abnormal cluster, and the cluster with the smallest mean anomaly score as the normal cluster.

[0062] In this embodiment, the k-means clustering algorithm is used to cluster all data in various communication data. In actual application, as other implementation methods, the implementer may also adopt other clustering methods such as the density peak clustering algorithm (DPC) and the DBSCAN density clustering algorithm. Regarding the selection of clustering methods, this embodiment does not impose any special restrictions.

[0063] Among them, k-means is a well-known technology, and its specific clustering principle and process are not described in detail.

[0064] At this point, all data in various communication data are preliminarily divided into two categories: abnormal and normal.

[0065] S102: Based on the difference between the mean of all data in the abnormal cluster and the mean of all data in the normal cluster, and the abnormal score of each data, determine the abnormal index of each data in the abnormal cluster of various communication data, specifically:

[0066] In this embodiment, the difference between each data in the abnormal cluster of various communication data and the mean of all data in the normal cluster is calculated and recorded as the abnormal difference of each data;

[0067] The product of the abnormal difference of each data in the abnormal cluster and its abnormal score is used as the abnormal index of each data in the abnormal cluster.

[0068] According to the anomaly index, it can be understood that if the anomaly difference value of the data in all types of communication data of the current merchant is larger, it means that the deviation of all data in the anomaly cluster from the normal level is larger, which means that the communication behavior corresponding to the data in the anomaly cluster is more abnormal, and the larger the anomaly score, the greater the degree of abnormality of the communication behavior corresponding to the data point. Therefore, the larger the anomaly index, the more abnormal the communication behavior of the current merchant; conversely, if the anomaly difference value of the data in all types of communication data of the current merchant is smaller, it means that the deviation of all data in the anomaly cluster from the normal level is smaller, which means that the possibility of the communication behavior corresponding to the data in the anomaly cluster being abnormal is smaller, and the smaller the anomaly score, the smaller the degree of abnormality of the communication behavior corresponding to the data point. Therefore, the smaller the anomaly index, the smaller the possibility of abnormality in the communication behavior of the current merchant.

[0069] At this point, by analyzing the degree of abnormality in the communication data, we have obtained the abnormality index to determine whether the merchant's communication behavior is abnormal.

[0070] S103: Based on the anomaly index of each data in the anomaly cluster of various communication data and the discrete degree of the corresponding collection time of all data in the anomaly cluster, the time series anomaly degree of each merchant is determined, specifically:

[0071] (1) Calculate the cumulative sum of the anomaly indexes of all data in the anomaly cluster of various communication data;

[0072] (2) Furthermore, the standard deviation of all data in the abnormal clusters of various communication data corresponding to the collection time is calculated to measure the dispersion of the time when the merchant's abnormal behavior occurs. The larger the standard deviation, the more dispersed the abnormal behavior in the merchant's communication is in time, and the more likely it is that it is an occasional fluctuation caused by reasons such as a surge in traffic during a promotion, and the less likely there is a malicious attack in the communication process.

[0073] (3) calculating an exponential function value with a natural constant as a base and the standard deviation of various communication data as an independent variable, and calculating a ratio of the cumulative sum of various communication data to the exponential function value, which is recorded as an abnormal ratio of various communication data;

[0074] According to the anomaly ratio, it can be understood that if the anomaly index of all data is larger, the current merchant's communication behavior is more abnormal, and the standard deviation of all data in the anomaly cluster corresponding to the collection time is smaller, the merchant's abnormal communication behavior occurs more concentrated at a certain time, and the possibility of malicious attacks in the communication process is greater. Therefore, the larger the anomaly ratio, the more abnormal the current merchant's communication behavior is. On the contrary, if the anomaly index of all data is smaller, the possibility of abnormal communication behavior of the current merchant is smaller, and the standard deviation of all data in the anomaly cluster corresponding to the collection time is larger, the merchant's abnormal communication behavior occurs more dispersed at a certain time, and the possibility of occasional fluctuations caused by reasons such as a surge in traffic during the promotion period is greater. The possibility of malicious attacks in the communication process is smaller. Therefore, the smaller the anomaly ratio, the less likely the current merchant's communication behavior is to be abnormal.

[0075] (4) Furthermore, the average of the abnormal ratios of all types of communication data of each merchant is taken as the temporal anomaly degree of each merchant. The larger the temporal anomaly degree, the more likely the merchant's communication behavior is to have abnormal cluster behavior.

[0076] At this point, by analyzing the abnormal concentration of communication data, the merchant's time series abnormality degree is obtained.

[0077] Preferably, the schematic diagram of the timing anomaly degree acquisition process provided in this embodiment is as follows: Figure 2 shown.

[0078] S2: Label each data in each merchant's various communication data, and based on the label and anomaly score of each data, as well as the merchant's time series anomaly, obtain the anomaly probability of each data, the path depth of each data in the decision tree, and the maximum depth of the decision tree; determine the degree of anomaly of each data in the various communication data based on the difference between each data in the various communication data and the cluster center of the anomaly cluster, and the difference between all elements in the anomaly cluster and the cluster center; determine the anomaly confidence of each data in the various communication data based on the difference between the path depth and the maximum depth of each data in the decision tree, and determine the communication anomaly degree of each merchant in combination with the anomaly probability of each data and the anomaly degree.

[0079] S201: Label each data item in each merchant's communication data. Based on the label and anomaly score of each data item, as well as the merchant's time series anomaly degree, obtain the anomaly probability of each data item, the path depth of each data item in the decision tree, and the maximum depth of the decision tree. Specifically,

[0080] In the remote communication scenario of mobile communication devices, traditional security mechanisms rely on static rules, such as blacklist interception or fixed threshold alarms, which are difficult to cope with dynamically changing attack methods, such as new harassment techniques and hidden code reverse cracking. They are also unable to distinguish the specific types of abnormal behavior, which can easily lead to false interception or missed detection. However, through real-time classification and dynamic analysis of communication behavior characteristics, abnormal patterns are refined into specific categories, which enables the system to implement precise handling for different risk levels and attack intentions. Therefore, labels are set for each data in the various communication data of each merchant. Based on the labels and anomaly scores of each data, as well as the merchant's time series anomaly, the anomaly probability of each data, the path depth of each data in the decision tree, and the maximum depth of the decision tree are obtained. The specific process is as follows:

[0081] The labels of all data in the abnormal cluster of each merchant's communication data are set to 1, and the labels of all data in the normal cluster are set to 0.

[0082] All data in each merchant's various communication data are used as the input of the decision tree, wherein the label of each data in each merchant's various communication data, the anomaly score and the merchant's time series anomaly degree are used as the weight vector of the decision tree, and the output is set as the label of the normal communication class and the label of the abnormal communication class, the probability of each data in the various communication data belonging to the abnormal communication class, the path depth of each data in the decision tree and the maximum depth of the decision tree, wherein the probability of each data belonging to the abnormal communication class label is used as the abnormal probability of each data.

[0083] The specific process of obtaining the decision tree is a well-known technology, and its specific principles will not be described in detail.

[0084] S202: Determine the abnormality degree of each data in the various communication data based on the difference between each data in the various communication data and the cluster center of the abnormal cluster, as well as the difference between all elements in the abnormal cluster and the cluster center; determine the abnormality confidence of each data in the various communication data based on the difference between the path depth and the maximum depth of each data in the decision tree, and determine the communication abnormality degree of each merchant in combination with the abnormal probability of each data and the abnormality degree, specifically:

[0085] (1) First, based on the differences between each data in the various communication data and the cluster center of the abnormal cluster, as well as the differences between all elements in the abnormal cluster and the cluster center, the abnormality degree of each data in the various communication data is determined. Specifically:

[0086] As an implementation manner, in this embodiment, the expression for the abnormality degree of each data in various communication data is:

[0087] The abnormality degree U of data j in the i-th communication data i,j The expression is: Where g i,j G represents the difference between the cluster center of data j and the corresponding abnormal cluster in the i-th communication data; i It represents the maximum value of the difference between all data in the abnormal cluster of the i-th communication data and the cluster center; exp() represents an exponential function with a natural constant as the base.

[0088] It should be noted that there are many methods for measuring the differences between data. In this embodiment, the absolute value of the difference between the data j in the i-th communication data and the cluster center of the corresponding abnormal cluster is used as the difference between the data j in the i-th communication data and the cluster center of the corresponding abnormal cluster, and the absolute value of the difference between all data in the abnormal cluster of the i-th communication data and the cluster center is used as the difference between all data in the abnormal cluster of the i-th communication data and the cluster center. In actual application, as other implementation methods, the implementer may also adopt other methods for measuring the differences between data, such as the square or ratio of the difference, based on the specific circumstances. This embodiment does not impose any special restrictions on the selection of methods for measuring the differences between data.

[0089] Furthermore, it can be understood from the abnormality of each data in various communication data that when G i ≥g i,j When g i,j -G i The smaller the value, the smaller the difference between data j and the cluster center of the abnormal cluster. The more likely the abnormality of data j is caused by the abnormal communication behavior of the merchant, and the greater the degree of abnormality. i <g i,j When , data j does not belong to the abnormal cluster. At this time, data j is a normal data point, and the smaller the abnormal confidence of the abnormal data caused by the abnormal behavior of the merchant is, the smaller the abnormal confidence.

[0090] (3) Further, based on the difference between the path depth and the maximum depth of each data in the decision tree of each communication data, the abnormal confidence of each data in the various communication data is determined, specifically:

[0091] As an implementation method, in this embodiment, the abnormal confidence level K of data j in the i-th communication data is i,j The expression is: Where, L i,j F represents the path depth of data j in the decision tree within the i-th communication data; i,jIndicates the maximum depth of the decision tree where data j is located in the i-th communication data.

[0092] Among them, if the ratio of the path depth of data j to the maximum depth is smaller, it means that the data j is easier to be classified, that is, the difference between data j and other data is obvious, the possibility of being abnormal data is greater, and its abnormal confidence is greater, which means that the data is more likely to be caused by abnormal communication behavior of the merchant; conversely, if the ratio of the path depth of data j to the maximum depth is smaller, it means that the data j is less likely to be classified, that is, the similarity between data j and other data is greater, the possibility of being abnormal data is smaller, and its abnormal confidence is smaller.

[0093] (4) Furthermore, the abnormal confidence of each data in the various communication data is combined with the abnormal probability of each data and the abnormal degree to determine the communication abnormality degree of each merchant, specifically:

[0094] For each merchant, the product of the abnormality degree, abnormal confidence and abnormal probability of each data in various communication data is calculated, and the average value of the multiplication results of all data in various communication data is calculated. The average value of all types of communication data for each merchant is taken as the communication abnormality degree of each merchant.

[0095] According to the communication anomaly degree of each merchant, it can be understood that the greater the abnormality of the current data, the greater the possibility that the data anomaly is caused by abnormal merchant communication behavior, and the greater the abnormality confidence, the greater the possibility that the current data is abnormal data, indicating that the merchant communication behavior is more likely to be abnormal. At the same time, the greater the abnormal probability of the current data, the greater the possibility that the current data anomaly is caused by abnormal merchant communication behavior. Therefore, the greater the obtained communication anomaly degree, the greater the possibility that the current merchant's communication behavior has a malicious attack;

[0096] On the contrary, if the abnormality degree of the current data is smaller, it means that the possibility that the abnormality of the data is caused by the abnormal communication behavior of the merchant is smaller, and the smaller the abnormality confidence, the smaller the possibility that the current data is abnormal data, and the smaller the possibility that the merchant's communication behavior is abnormal. At the same time, if the abnormal probability of the current data is smaller, it means that the possibility that the current data is abnormal data is smaller. Therefore, the smaller the obtained communication abnormality degree, the smaller the possibility that the current merchant's communication behavior is a malicious attack.

[0097] At this point, by classifying the data and judging the degree of abnormality of the data, the merchant's communication abnormality is obtained, thereby identifying whether the merchant's communication contains malicious attacks.

[0098] The communication analysis module 103 is configured to intercept the merchant's communication request based on the communication abnormality degree.

[0099] Based on the above calculations, it can be seen that when the degree of communication anomaly is greater, the merchant's communication behavior is more likely to be abnormal. Therefore, a preset threshold T is set, and the value range of T is 0.7 to 0.9 to balance the risks between security issues and excessive interception. In this embodiment, the value of the preset threshold T is 0.8, which can tolerate a certain degree of business fluctuations while remaining sensitive to high-risk anomalies.

[0100] Therefore, based on the communication anomaly degree and the preset threshold, the merchant's communication request is intercepted, specifically:

[0101] (1) When the normalized value of the communication anomaly is greater than the preset threshold T, the new communication request when the current merchant uses its current virtual number to communicate is intercepted to prevent the spread of harassment or attack, and the abnormal data points and related block information are pushed to the security audit platform to trigger the manual review process, and an alarm notification is sent to the administrator at the same time.

[0102] (2) When the normalized value of the communication anomaly is less than or equal to the preset threshold value T, and the normalized value of the communication anomaly is near the preset threshold value, that is, around 0.7 to 0.8, the merchant is allowed to communicate with the user through the current virtual number without triggering any interception or flow limiting measures, but the monitoring frequency of the merchant block is automatically increased. Specifically, the communication data of the merchant is adjusted from being collected every hour to being collected every 10 minutes, thereby enhancing the risk prediction capability.

[0103] (3) When the normalized value of the communication anomaly degree is less than the preset threshold T, and the communication anomaly degree is not near the anomaly threshold of 0.7 to 0.8, the merchant is allowed to communicate with the user through the current virtual number without triggering any interception or flow limiting measures.

[0104] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An intelligent management system for remote communication security virtual numbers of mobile communication devices, characterized in that: The system comprises: The data collection module is used to obtain all types of communication data when each merchant uses its current virtual number to communicate at each collection moment within a preset time period before the current moment; The communication security analysis module is used to cluster all data based on the anomaly scores of all data in each merchant's various communication data to obtain abnormal clusters and normal clusters of various communication data. Based on the difference between the mean of each data in the abnormal cluster and the mean of all data in the normal cluster, as well as the anomaly score of each data, the module determines the anomaly index of each data in the abnormal cluster of various communication data. In combination with the discrete degree of the corresponding collection time of all data in the abnormal cluster, the module determines the time series anomaly degree of each merchant. Label each data point in each merchant's communication data, train a decision tree based on the label and anomaly score of each data point, and the merchant's time series anomaly degree, and obtain the anomaly probability of each data point, the path depth of each data point in the decision tree, and the maximum depth of the decision tree; Determine the degree of abnormality of each data item in the various communication data items based on the difference between each data item in the various communication data items and the cluster center of the abnormal cluster, as well as the difference between all elements in the abnormal cluster and the cluster center; determine the abnormality confidence of each data item in the various communication data items based on the difference between the path depth and the maximum depth of each data item in the decision tree; and determine the communication abnormality degree of each merchant based on the abnormal probability of each data item and the abnormality degree; The communication analysis module is used to intercept the merchant's communication request based on the communication abnormality.

2. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The method for obtaining abnormal clusters and normal clusters of various communication data is as follows: Cluster all data in various communication data of each merchant, calculate the average anomaly score of all data in each cluster, and take the cluster with the largest average anomaly score as the abnormal cluster, and the cluster with the smallest average anomaly score as the normal cluster.

3. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The method for determining the abnormal index of each data in the abnormal cluster of various communication data is as follows: Calculate the difference between each data in the abnormal cluster of various communication data and the mean of all data in the normal cluster, and record it as the abnormal difference of each data; The product of the abnormal difference of each data in the abnormal cluster and its abnormal score is used as the abnormal index of each data in the abnormal cluster.

4. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The method for determining the time series abnormality of each merchant is as follows: Calculate the cumulative sum of the anomaly indexes of all data in the anomaly cluster of various communication data; Calculate the standard deviation of all data in the abnormal cluster of various communication data at the corresponding collection time; Calculating an exponential function value with a natural constant as a base and the standard deviation of various communication data as an independent variable, and calculating a ratio of the cumulative sum of the various communication data to the exponential function value, recording the ratio as an abnormal ratio of the various communication data; The average of the abnormal ratios of all types of communication data of each merchant is taken as the time series abnormality of each merchant.

5. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The step of setting a label for each data in each merchant's communication data includes: The labels of all data in the abnormal cluster of each merchant's communication data are set to 1, and the labels of all data in the normal cluster are set to 0.

6. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The process of obtaining the abnormal probability of each data, the path depth of each data in the decision tree, and the maximum depth of the decision tree is as follows: All data in each merchant's various communication data are used as the input of the decision tree, wherein the label of each data in each merchant's various communication data, the anomaly score and the merchant's time series anomaly degree are used as the weight vector of the decision tree, and the output is set as the label of the normal communication class and the label of the abnormal communication class, the probability of each data in the various communication data belonging to the abnormal communication class, the path depth of each data in the decision tree and the maximum depth of the decision tree, wherein the probability of each data belonging to the abnormal communication class label is used as the abnormal probability of each data.

7. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The expression for the abnormality degree of each data in the various communication data is: Where U i,j Indicates the abnormality degree of data j in the i-th communication data; g i,j G represents the difference between the cluster center of data j and the corresponding abnormal cluster in the i-th communication data; i It represents the maximum value of the difference between all data in the abnormal cluster of the i-th communication data and the cluster center; exp() represents an exponential function with a natural constant as the base.

8. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The expression of the abnormal confidence of each data in the various communication data is: Where K i,j represents the abnormal confidence of data j in the i-th communication data; L i,j F represents the path depth of data j in the decision tree within the i-th communication data; i,j Indicates the maximum depth of the decision tree where data j is located in the i-th communication data.

9. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The method for determining the communication abnormality degree of each merchant is as follows: For each merchant, the product of the abnormality degree, abnormal confidence and abnormal probability of each data in various communication data is calculated, and the average value of the multiplication results of all data in various communication data is calculated. The average value of all types of communication data for each merchant is taken as the communication abnormality degree of each merchant.

10. The intelligent management system for remote communication security virtual numbers of mobile communication devices according to claim 1, characterized in that: The interception of the merchant's communication request includes: if the normalized value of the current merchant's communication anomaly degree is greater than the anomaly threshold, intercepting the new communication request when the current merchant uses its current virtual number to communicate; otherwise, allowing the current merchant to communicate with the user through its current virtual number.

Images