Fraud alerting method and device based on called communication

Abstract

The application embodiment provides a fraud early warning method and device based on called communication, innovatively constructs a communication data analysis mechanism, extracts number attribution analysis and call behavior characteristics, realizes accurate portrait of reserved numbers, designs a behavior analysis model based on time sequence modeling, combines a bidirectional recurrent neural network and an attention mechanism, establishes an abnormal call mode recognition strategy for intelligent detection, introduces a deep fusion early warning mechanism, realizes accurate division and timely early warning of risk levels through a residual network and a nonlinear mapping. The method effectively solves the deficiencies of traditional technologies in data analysis, behavior recognition and risk early warning, and significantly improves the accuracy and reliability of fraud early warning.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, in particular to a fraud early warning method and device based on called communication. BACKGROUND

[0002] The existing fraud early warning method has obvious deficiencies. The traditional system lacks depth in dialogue analysis, and it is difficult to effectively integrate phonetics, pragmatics and cross-session semantic features, affecting the accuracy of recognition.

[0003] In addition, the existing technology has bottlenecks in model application. Most systems fail to reasonably utilize the advantages of large and small models, lack of hierarchical recognition and sample optimization mechanism, resulting in waste of computing resources and poor effect.

[0004] The existing system has technical shortcomings in the early warning mechanism. Lack of secondary fine recognition ability for low confidence results, difficult to mine potential risks through cross-session analysis, affecting the early warning effect. The solution to these problems is of great significance to improve the level of fraud early warning. SUMMARY

[0005] In view of the problems in the prior art, the present application provides a fraud early warning method and device based on called communication, which can effectively solve the deficiencies of traditional technology in feature analysis, sample processing and propagation link recognition, and significantly improve the intelligent level and prevention and control effect of fraud early warning.

[0006] In order to solve at least one of the above problems, the present application provides the following technical scheme:

[0007] In a first aspect, the present application provides a fraud early warning method based on called communication, comprising:

[0008] Collecting communication data, extracting the reserved mobile phone number from the media diversion information, performing home analysis and number segment analysis on the reserved mobile phone number, constructing a number feature vector, extracting the call behavior data of the reserved mobile phone number from the communication record, calculating the call frequency and duration distribution based on a sliding time window, and splicing the call behavior features and the number feature vector to obtain a comprehensive feature matrix;

[0009] Constructing a behavior analysis model, time series modeling the comprehensive feature matrix, extracting behavior sequence features using a bidirectional recurrent neural network, weighting key behavior segments based on an attention mechanism, and inputting the weighted results into an anomaly detector, the anomaly detector identifying abnormal call patterns through an isolation forest algorithm, and generating an anomaly score vector;

[0010] The abnormal score vector is input into a risk early warning model, the risk early warning model adopts a residual network structure to fuse features, performs nonlinear mapping through a multilayer perceptron, grades the call number based on a preset risk threshold, generates an early warning label, and distributes the early warning label to a user terminal.

[0011] Further, it also includes: accessing the communication data stream from the media diversion platform, extracting the mobile phone number field from the communication data stream using regular expression pattern matching, removing special characters and spaces in the number based on string parsing rules, performing format verification on the cleaned number, marking the number that passes the verification as a reserved mobile phone number, and constructing a number parsing module based on the number segment database to match the reserved mobile phone number with the home location;

[0012] A number feature extraction network is constructed, and the home location information and number segment information of the reserved mobile phone number are input into a feature encoding layer. The feature encoding layer converts category information into numerical features using one-hot encoding. The usage duration and number portability times of the number are calculated based on number activity calculation rules. The numerical features and statistical features are normalized, and the normalized results are concatenated to generate a number feature vector.

[0013] Further, it also includes: constructing a communication data processing module, querying the historical call records of the reserved mobile phone number from the communication record database, sorting the call records by timestamp, segmenting the call records based on a sliding time window, calculating the call frequency and duration statistics in each time window, fitting the call duration distribution curve using a probability density estimation method, extracting the periodic characteristics of the call frequency sequence through Fourier transform, and combining the statistical values and periodic characteristics into call behavior features;

[0014] A feature fusion network is constructed to standardize the call behavior features to eliminate dimension differences. The standardized behavior features and the number feature vector are concatenated in the feature dimension. Principal component analysis is used to reduce the dimension of the concatenated result. The reduced features are reorganized into a time series matrix according to the time window order. The time series matrix is converted into a comprehensive feature matrix.

[0015] Further, it also includes: constructing a time series feature processing module, segmenting the comprehensive feature matrix according to the time window, smoothing the feature sequence using a moving average method, extracting the change trend of the features based on a difference operator, combining the original features and change trend features into an augmented feature sequence, and constructing a sequence encoding network that adds time sequence position information to the feature sequence using a position encoding method.

[0016] A bidirectional recurrent neural network is constructed, which includes two hidden layer states in forward and backward directions, controls information flow through a gating mechanism, performs bidirectional scanning on the augmented feature sequence, captures long-term dependencies in the sequence based on a long short-term memory unit, prevents gradient disappearance using a skip-connection structure, and splices the forward and backward hidden layer states to obtain behavior sequence features.

[0017] Further, a multi-head attention network is constructed to map the behavior sequence features into query vectors, key vectors and value vectors, calculate attention scores through scaled dot product, weight and combine the outputs of different attention heads, determine key behavior segments based on an adaptive threshold selection algorithm, retain original feature information using a residual connection structure, and reorganize the weighted feature sequence into a behavior feature matrix in chronological order.

[0018] An anomaly detector is constructed to input the behavior feature matrix into an isolation forest model, which calculates sample isolation degrees by randomly partitioning the space, calculates anomaly scores based on the distance of samples to decision boundaries, normalizes the anomaly scores, eliminates short-term fluctuations using an exponential smoothing method, and organizes the smoothed anomaly scores into an anomaly score vector.

[0019] Further, a feature preprocessing module is constructed to standardize the anomaly score vector, calculate local statistical features using a sliding window, splice the statistical features with the original scores, perform dimensionality reduction mapping on the spliced results to obtain preprocessed features, input the preprocessed features into a residual network, which retains original feature information through a skip-connection structure, extracts local features based on convolutional layers, and adjusts feature distribution using a batch normalization layer.

[0020] A feature fusion network is constructed, which uses a multi-branch structure to process residual features of different scales in parallel, calculates importance weights of feature channels through a channel attention module, captures spatial dependencies of features based on a spatial attention module, fuses multiple branch features through weighted summation, and obtains a fusion feature vector through nonlinear transformation of the fusion result.

[0021] Further, a risk mapping network is constructed to input the fusion feature vector into a multi-layer perceptron, which transforms features through hidden layer neurons, normalizes intermediate features using a batch normalization layer, introduces nonlinearity based on an activation function, prevents gradient disappearance through a residual connection structure, and maps features to a risk probability space using a sigmoid function on the output of the last layer to generate a risk score result.

[0022] The hierarchical processing module is constructed, the risk score result is compared with a plurality of preset threshold values, a risk level is divided into three levels of high, medium and low based on a threshold segmentation rule, corresponding early warning labels are generated for different risk levels, the early warning labels and risk level information are packaged as early warning messages, and the early warning messages are distributed to user terminal pushing modules in priority order by using a message queue mechanism.

[0023] In a second aspect, the application provides a fraud early warning device based on called communication, comprising:

[0024] A communication data analysis module is configured to collect communication data, extract a reserved mobile phone number from media diversion information, perform home analysis and number segment analysis on the reserved mobile phone number, construct a number feature vector, extract call behavior data of the reserved mobile phone number from communication records, calculate call frequency and duration distribution based on a sliding time window, splice call behavior features and the number feature vector to obtain a comprehensive feature matrix.

[0025] An anomaly detection module is configured to construct a behavior analysis model, perform time series modeling on the comprehensive feature matrix, extract behavior sequence features by using a bidirectional recurrent neural network, weight key behavior segments based on an attention mechanism, input the weighting result into an anomaly detector, and identify an abnormal call mode by using an isolation forest algorithm to generate an anomaly score vector.

[0026] A risk early warning module is configured to input the anomaly score vector into a risk early warning model, fuse features by using a residual network structure, perform nonlinear mapping by using a multilayer perceptron, classify call numbers based on a preset risk threshold, and generate an early warning label and distribute the early warning label to a user terminal.

[0027] In a third aspect, the application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the fraud early warning method based on called communication when executing the program.

[0028] In a fourth aspect, the application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the steps of the fraud early warning method based on called communication.

[0029] In a fifth aspect, the application provides a computer program product comprising a computer program / instruction, wherein the computer program / instruction is executable by a processor to implement the steps of the fraud early warning method based on called communication.

[0030] According to the technical solution, the application provides a fraud early warning method and device based on called communication, innovatively constructs a communication data analysis mechanism, extracts number attribution analysis and call behavior characteristics, and realizes accurate portrait of reserved numbers. A behavior analysis model based on time sequence modeling is designed, a bidirectional recurrent neural network and an attention mechanism are combined, an abnormal call mode recognition strategy is established, and intelligent detection is performed. A deep fusion early warning mechanism is introduced, residual networks and nonlinear mapping are used, accurate division of risk levels and timely early warning are realized. The method effectively solves the deficiencies of traditional technologies in data analysis, behavior recognition and risk early warning, and significantly improves the accuracy and reliability of fraud early warning. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0032] Figure 1 The flowchart of the fraud early warning method based on called communication in the embodiments of the application is shown.

[0033] Figure 2 The structural diagram of the fraud early warning device based on called communication in the embodiments of the application is shown.

[0034] Figure 3 The structural diagram of the electronic device in the embodiments of the application is shown.

[0035] Reference signs:

[0036] Electronic device 9600, central processor 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage part 9142, data storage part 9143, driver program storage part 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the application more clear, the technical solutions in the embodiments of the application will be described clearly and completely in combination with the drawings in the embodiments of the application. Obviously, the described embodiments are some embodiments of the application, not all embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0038] The acquisition, storage, use, processing, etc. of data in the technical solutions of the present application comply with relevant provisions of national laws and regulations.

[0039] In view of the problems in the prior art, the present application provides a fraud early warning method and device based on called communication, which innovatively constructs a communication data analysis mechanism, extracts number ownership analysis and call behavior characteristics, and realizes accurate profiling of reserved numbers. Design a behavior analysis model based on time series modeling, combine bidirectional recurrent neural network and attention mechanism, establish abnormal call mode recognition strategy for intelligent detection. Introduce a deep fusion early warning mechanism, realize accurate division and timely warning of risk level through residual network and nonlinear mapping. This method effectively solves the shortcomings of traditional technology in data analysis, behavior recognition and risk warning, and significantly improves the accuracy and reliability of fraud early warning.

[0040] In order to effectively solve the shortcomings of traditional technology in feature analysis, sample processing and propagation link identification, and significantly improve the intelligent level and prevention and control effect of fraud early warning, the present application provides an embodiment of a fraud early warning method based on called communication, as shown in Figure 1 , the fraud early warning method based on called communication specifically includes the following contents:

[0041] Step S101: Collecting communication data, extracting reserved mobile phone numbers from media diversion information, performing ownership analysis and number segment analysis on the reserved mobile phone numbers, constructing a number feature vector, extracting call behavior data of the reserved mobile phone numbers from the communication records, calculating the call frequency and duration distribution based on a sliding time window, and splicing the call behavior features and the number feature vector to obtain a comprehensive feature matrix;

[0042] Optionally, the present embodiment innovatively designs a set of communication data analysis scheme based on deep learning to solve the problems of incomplete data collection and insufficient feature extraction in fraud number identification. The present embodiment first constructs a data collection framework to comprehensively capture communication features through multi-level feature extraction. The system designs a feature importance evaluation formula:

[0043] Feature_Score=α Number_Weight+β Location_Weight+γ×Behavior_Weight,

[0044] wherein Number_Weight represents the number feature weight, Location_Weight represents the geographic feature weight, Behavior_Weight represents the behavior feature weight, and a, β, γ are dynamic adjustment coefficients. In the fraud early warning scenario, this multi-dimensional feature evaluation method can effectively identify suspicious numbers.

[0045] This embodiment deeply optimizes the number extraction strategy. For the diversity of number forms in the media diversion platform, a number extraction mechanism based on regular expressions is designed. Through pattern matching and format checking, accurate identification of reserved mobile phone numbers is achieved. Special attention is paid to the validity verification of the number. When abnormal formats are detected, the system will start multiple verification mechanisms. For example, when dealing with numbers containing special characters or spaces, the standard format of the mobile phone number can be accurately extracted through string parsing rules, which is crucial for subsequent feature analysis.

[0046] This embodiment innovatively realizes the home location analysis mechanism. For the dynamic change characteristics of the number home location, the system constructs an analysis framework based on the number segment database. Through real-time updating of number segment information, accurate positioning of the number home location is achieved. Special attention is paid to the case of number transfer, and through the design of dynamic updating strategy, the timeliness of the home location information is ensured. This real-time data-based analysis method can effectively track the geographical distribution characteristics of the number.

[0047] This embodiment deeply optimizes the behavior data analysis strategy. The system constructs a behavior feature extraction framework based on a sliding time window, and captures the timing characteristics of the call behavior through a dynamic window mechanism. Special attention is paid to the continuity of the behavior pattern, and through the design of adaptive window size, the real-time and stability of the features are balanced. This complete behavior analysis method provides reliable behavior features for risk early warning.

[0048] This embodiment realizes the accurate modeling of comprehensive features through feature fusion. The system constructs a fusion framework based on feature splicing, and integrates features through normalization processing. Special attention is paid to the dimensional uniformity of the features, and through the establishment of a standardized processing flow, effective combination of different dimensional features is achieved. This systematic fusion scheme provides comprehensive feature support for subsequent analysis.

[0049] The innovative design of this embodiment not only solves the data processing problem in traditional methods, but also establishes a sustainable optimization feature extraction framework. Through multi-level feature collection and fusion, the system can extract effective risk features from complex call data. This deep learning-based analysis mechanism ensures that the system always maintains effective feature expression ability when facing diversified fraud methods. In fraud early warning, this intelligent feature processing scheme significantly improves the accuracy of early warning.

[0050] The embodiment realizes intelligent analysis upgrading for fraud early warning by establishing a complete data processing link. The system can dynamically adjust the processing strategy based on real-time communication data, avoiding the limitations of traditional fixed feature solutions. Through multi-dimensional feature extraction and fusion, the quality and reliability of feature expression are significantly improved, providing reliable feature support for subsequent risk assessment. This intelligent processing mechanism shows strong adaptability and optimization effect in fraud early warning.

[0051] The embodiment not only improves the accuracy of feature processing, but also establishes a constantly evolving processing system through continuous strategy optimization and effect analysis. This real-time feedback-based optimization mechanism ensures that the system can continuously improve as fraud methods change, providing increasingly accurate feature representations for subsequent analysis. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0052] Step S102: Constructing a behavior analysis model, time-series modeling the comprehensive feature matrix, extracting behavior sequence features using a bidirectional recurrent neural network, weighting key behavior segments based on an attention mechanism, and inputting the weighted results into an anomaly detector. The anomaly detector identifies abnormal call patterns through an isolation forest algorithm and generates an anomaly score vector.

[0053] Optionally, the embodiment innovatively designs a behavior analysis scheme based on deep learning to address issues such as complex behavior patterns and non-obvious abnormal features in fraudulent calls. The embodiment first constructs a time-series analysis framework to achieve accurate modeling of abnormal behavior through multi-level feature extraction. The system designs a behavior anomaly scoring formula:

[0054] Anomaly_Score=α Sequence_Weight+β Attention_Weight+γ×Isolation_Score,

[0055] where Sequence_Weight represents sequence feature weight, Attention_Weight represents attention weight, Isolation_Score represents isolation score, and α, β, γ are dynamic adjustment coefficients. In the fraud call recognition scenario, this multi-dimensional anomaly evaluation method can effectively identify suspicious behavior.

[0056] This embodiment deeply optimizes the timing modeling strategy. According to the timing characteristics of fraudulent behavior, a sequence processing mechanism based on bidirectional recurrent neural network is designed. Through the bidirectional information flow of forward and backward states, complete modeling of behavior sequence is realized. Special attention is paid to long-term dependence, when the behavior pattern changes significantly, the system will keep important information through the gating mechanism. For example, when analyzing the call behavior of fraudulent numbers, through bidirectional modeling, it can accurately capture the typical patterns of short high-frequency calls disappearing, periodic harassment, etc., which is crucial for identifying fraudulent behavior.

[0057] This embodiment innovatively realizes the attention weighting mechanism. According to the importance difference of behavior characteristics, the system constructs a feature processing framework based on multi-head attention. By calculating the attention weight of different time steps, automatic identification of key behavior segments is realized. Special attention is paid to the continuity of behavior, through the design of adaptive weight calculation strategy, to ensure that important behavior patterns are fully focused. This attention-based feature processing method can effectively highlight abnormal behavior characteristics.

[0058] This embodiment deeply optimizes the abnormal detection strategy. The system builds an anomaly identification framework based on the Isolation Forest algorithm, and realizes the rapid positioning of abnormal samples through random feature segmentation. Special attention is paid to the distribution characteristics of samples, through the design of adaptive segmentation strategy, to improve the accuracy of anomaly detection. This complete anomaly detection method provides reliable numerical basis for risk warning.

[0059] This embodiment realizes the quantitative expression of abnormal degree through score generation. The system builds a scoring framework based on multi-dimensional features, and combines different levels of abnormal features for comprehensive evaluation. Special attention is paid to the interpretability of the score, through the establishment of a multi-level scoring system, to realize the clear description of abnormal behavior. This systematic scoring scheme provides reliable feature support for subsequent risk warning.

[0060] The innovative design of this embodiment not only solves the problem of behavior analysis in traditional methods, but also establishes a sustainable optimization of abnormal detection framework. Through multi-level feature extraction and anomaly identification, the system can identify effective risk features from complex behavior sequences. This deep learning-based analysis mechanism ensures that the system always maintains effective recognition ability when facing diversified fraudulent behavior. In the prevention and control of fraudulent calls, this intelligent behavior analysis scheme significantly improves the accuracy of early warning.

[0061] This embodiment realizes the intelligent identification upgrade of fraud phone by establishing a complete behavior analysis link. The system can dynamically adjust the analysis strategy based on real-time behavior characteristics, avoiding the limitations of traditional fixed rule schemes. Through multi-dimensional behavior analysis and anomaly detection, the accuracy and reliability of identification are significantly improved, providing reliable behavior characteristics support for subsequent risk warning. This intelligent analysis mechanism shows strong adaptability and optimization effect in fraud phone identification.

[0062] This embodiment not only improves the accuracy of behavior analysis, but also establishes a constantly evolving detection system through continuous strategy optimization and effect analysis. This optimization mechanism based on real-time feedback ensures that the system can continuously improve as fraud methods change, providing more and more accurate warnings for users. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0063] Step S103: input the anomaly score vector into the risk warning model, the risk warning model adopts a residual network structure to fuse features, performs nonlinear mapping through a multilayer perceptron, classifies the call number based on a preset risk threshold, generates a warning label, and distributes the warning label to a user terminal.

[0064] Optionally, to solve the problems of insufficient feature fusion and inaccurate risk assessment in fraud warning, this embodiment innovatively designs a risk warning scheme based on deep learning. This embodiment first constructs a risk assessment framework to accurately determine the risk level through multi-level feature fusion. The system designs a risk warning score formula:

[0065] Risk_Score=α Anomaly_Weight+β Residual_Weight+γ×Mapping_Score,

[0066] wherein Anomaly_Weight represents the abnormal feature weight, Residual_Weight represents the residual feature weight, Mapping_Score represents the mapping score, and a, β, γ are dynamic weight coefficients. In the fraud phone identification scenario, this multi-dimensional risk assessment method can effectively predict fraud risks.

[0067] The embodiment deeply optimizes the feature fusion strategy. A feature processing mechanism based on residual network is designed for the multi-dimensional characteristics of abnormal scores. Through the jump connection structure, the original feature information is effectively preserved in the deep network. Special attention is paid to the expression ability of the feature. When the feature information is detected to be attenuated, the system will supplement the information through the residual block. For example, when processing the abnormal features in continuous calls, the residual connection can accurately retain the short-term and long-term behavior characteristics, which is crucial for the accuracy of risk assessment.

[0068] The embodiment innovatively realizes the nonlinear mapping mechanism. A mapping framework based on multilayer perceptron is constructed for the complex distribution characteristics of risk features. Through multilayer nonlinear transformation, deep modeling of risk patterns is realized. Special attention is paid to the generalization ability of the mapping, and through the design of hierarchical network structure, it is ensured that the model can adapt to various risk scenarios. This deep learning-based mapping method can effectively capture complex risk patterns.

[0069] The embodiment deeply optimizes the risk grading strategy. The system constructs a dynamic grading framework based on preset thresholds, and balances the coverage range of different risk levels through an adaptive threshold adjustment mechanism. Special attention is paid to the real-time of the grading, and through the design of multi-level cache mechanism, the response speed of the early warning information is improved. This complete grading method provides a reliable basis for the distribution of early warning information.

[0070] The embodiment realizes the accurate push of early warning information through label distribution. The system constructs a distribution framework based on priority, and configures the strategy combined with different scene characteristics. Special attention is paid to the timeliness of the distribution, and through the establishment of message queue mechanism, it is ensured that high-risk early warning can be processed preferentially. This systematic distribution scheme provides timely risk tips for users.

[0071] The innovative design of the embodiment not only solves the problem of risk early warning in traditional methods, but also establishes a sustainable optimization early warning framework. Through multi-level feature fusion and risk grading, the system can generate accurate early warning information from complex features. This deep learning-based early warning mechanism ensures that the system always maintains effective early warning ability when facing diversified fraud methods. In the prevention and control of fraudulent calls, this intelligent early warning scheme significantly improves the pertinence of protection.

[0072] The embodiment realizes the intelligent upgrade of fraud call prevention and control by establishing a complete early warning link. The system can dynamically adjust the early warning strategy based on real-time risk assessment, avoiding the limitations of traditional fixed rule schemes. Through multi-dimensional risk grading and early warning distribution, the accuracy and timeliness of prevention and control are significantly improved, providing more proactive fraud protection support for users. This intelligent early warning mechanism shows strong adaptability and optimization effect in fraud call protection.

[0073] The embodiment not only improves the accuracy of early warning, but also establishes an evolving early warning system through continuous strategy optimization and effect analysis. This optimization mechanism based on real-time feedback ensures that the system can continuously improve as fraud methods change, providing increasingly accurate protection for users. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0074] From the above description, the fraud early warning method based on called communication provided by the embodiments of the application can innovatively construct a communication data analysis mechanism, extract number ownership analysis and call behavior characteristics, and realize accurate profiling of reserved numbers. A behavior analysis model based on time series modeling is designed, combined with a bidirectional recurrent neural network and an attention mechanism, to establish an abnormal call pattern recognition strategy for intelligent detection. A deep fusion early warning mechanism is introduced, which realizes accurate division of risk levels and timely early warning through residual networks and nonlinear mapping. This method effectively solves the shortcomings of traditional technologies in data analysis, behavior recognition, and risk early warning, significantly improving the accuracy and reliability of fraud early warning.

[0075] In an embodiment of the fraud early warning method based on called communication of the application, the following content can be specifically included:

[0076] Step S201: Access the communication data stream from the media diversion platform, extract the mobile phone number field from the communication data stream using regular expression pattern matching, remove special characters and spaces in the number based on string parsing rules, perform format verification on the cleaned number, mark the number that passes the verification as a reserved mobile phone number, and construct a number analysis module based on the number segment database to match the reserved mobile phone number with the number segment information.

[0077] Step S202: Construct a number feature extraction network, input the number's home information and number segment information into the feature encoding layer, the feature encoding layer converts the category information into numerical features using one-hot encoding, calculates the number's usage duration and number portability times based on the number activity calculation rule, normalizes the numerical features and statistical features, and concatenates the normalized results to generate a number feature vector.

[0078] Optionally, the embodiment innovatively designs a number feature extraction scheme based on deep learning to address issues such as imperfect data preprocessing and insufficient feature expression in fraud number identification. The embodiment first constructs a data processing framework to comprehensively capture number features through multi-level feature analysis. The system designs a number feature evaluation formula:

[0079] Number_Score = α Location_Weight+βSegment_Weight+γ Activity_Weight+δ Transfer_Weight,

[0080] where Location_Weight represents the location weight, Segment_Weight represents the segment weight, Activity_Weight represents the activity weight, Transfer_Weight represents the transfer weight, and a, b, g, d are dynamic adjustment coefficients. In the fraud number identification scenario, this multi-dimensional feature evaluation method can effectively identify suspicious numbers.

[0081] This embodiment deeply optimizes the data access strategy. For the diversity of data formats in the media diversion platform, a data access mechanism based on streaming processing is designed. Through real-time data stream processing, continuous collection of communication data is realized. Special attention is paid to the integrity of data, and when data flow interruption or abnormality is detected, the system will start the data compensation mechanism. For example, when processing high-concurrency communication data, streaming processing can ensure the real-time and integrity of data, which is crucial for subsequent feature extraction.

[0082] This embodiment innovatively realizes the number extraction mechanism. For the diversity of number formats, the system constructs a pattern matching framework based on regular expressions. Through the design of flexible matching rules, accurate identification of numbers of different formats is realized. Special attention is paid to the quality of data cleaning, and through the establishment of multi-level filtering rules, the standardization of extraction results is ensured. This rule-based extraction method can effectively handle complex number forms.

[0083] This embodiment deeply optimizes the location matching strategy. The system constructs a location analysis framework based on the number segment database, and realizes accurate positioning of the number location through real-time updated number segment information. Special attention is paid to the timeliness of data, and through the design of incremental update mechanism, it is ensured that the number segment information always maintains the latest state. This complete matching method provides reliable geographical information support for number features.

[0084] This embodiment realizes the numerical expression of category information through feature coding. The system constructs a feature conversion framework based on one-hot coding, and combines multi-dimensional statistical features for comprehensive modeling. Special attention is paid to the standardization of features, and through the establishment of a unified normalization process, effective integration of different dimensional features is realized. This systematic coding scheme provides a standardized feature representation for subsequent analysis.

[0085] The innovative design of the embodiment not only solves the data processing problem in the traditional method, but also establishes a sustainable optimization feature extraction framework. Through multi-level data cleaning and feature encoding, the system can extract effective number features from complex communication data. This deep learning-based analysis mechanism ensures that the system always maintains effective feature expression capability when facing diversified fraudulent numbers. In fraud warning, this intelligent feature processing scheme significantly improves the accuracy of identification.

[0086] The embodiment realizes intelligent analysis upgrade for fraudulent numbers by establishing a complete feature processing link. The system can dynamically adjust the processing strategy based on real-time communication data, avoiding the limitations of traditional fixed feature schemes. Through multi-dimensional feature extraction and encoding, the quality and reliability of feature expression are significantly improved, providing reliable feature support for subsequent risk assessment. This intelligent processing mechanism shows strong adaptability and optimization effect in fraudulent number identification.

[0087] The embodiment not only improves the accuracy of feature processing, but also establishes a continuously evolving processing system through continuous strategy optimization and effect analysis. This real-time feedback-based optimization mechanism ensures that the system can continuously improve as fraudulent methods change, providing increasingly accurate feature representation for subsequent analysis. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0088] In an embodiment of the fraud warning method based on called communication of the present application, the following contents can be specifically included:

[0089] Step S301: Construct a communication data processing module, query the historical call records of the reserved mobile phone number from the communication record database, sort the call records according to the timestamp, segment the call records based on the sliding time window, calculate the call frequency and duration statistics in each time window, use the probability density estimation method to fit the call duration distribution curve, perform Fourier transform on the call frequency sequence to extract periodic features, and combine the statistics and periodic features into call behavior features;

[0090] Step S302: Construct a feature fusion network, standardize the call behavior features to eliminate dimensional differences, concatenate the standardized behavior features and the number feature vector in the feature dimension, use principal component analysis method to reduce the dimension of the concatenation result, and reorganize the reduced features into a time series matrix according to the time window order. Convert the time series matrix into a comprehensive feature matrix.

[0091] Optionally, the embodiment is directed to the problem of incomplete behavior feature extraction and insufficient feature fusion in fraudulent phone calls, and innovatively designs a set of deep learning-based communication data analysis scheme. The embodiment first constructs a data processing framework, and realizes accurate modeling of call behavior through multi-level feature extraction. The system designs a behavior feature evaluation formula:

[0092] Behavior_Score = a Call_Density+β Duration_Pattern + b x Period_Feature,

[0093] where Call_Density represents call density, Duration_Pattern represents duration pattern, Period_Feature represents period feature, and a, b, and g are dynamic weight coefficients. In the fraudulent call recognition scenario, this multi-dimensional behavior evaluation method can effectively capture suspicious call patterns.

[0094] The embodiment deeply optimizes the call record processing strategy. Based on the time sequence characteristics of historical call data, a segmented processing mechanism based on sliding time window is designed. Through dynamic window division, continuous observation of call behavior is realized. Special attention is paid to the selection of time granularity. When a significant change in behavior pattern is detected, the system will optimize the observation period through an adaptive window adjustment mechanism. For example, when analyzing the call rules of fraudulent numbers, a reasonable time window division can accurately capture typical patterns such as short-term high-frequency calls and periodic harassment, which is crucial for identifying fraudulent behavior.

[0095] The embodiment innovatively realizes a duration distribution analysis mechanism. Based on the statistical characteristics of call duration, the system constructs a distribution fitting framework based on probability density estimation. Through kernel density estimation method, accurate modeling of duration distribution is realized. Special attention is paid to the multi-peak characteristics of the distribution, and through the design of adaptive bandwidth selection strategy, it is ensured that the fitting result can accurately reflect the aggregation characteristics of the duration. This probability-based analysis method can effectively identify abnormal call duration patterns.

[0096] The embodiment deeply optimizes the period feature extraction strategy. The system constructs a period analysis framework based on Fourier transform, and captures the periodic characteristics of call behavior through frequency domain conversion. Special attention is paid to the significance of the frequency spectrum, and through the design of frequency selection mechanism, the most representative period pattern is extracted. This complete period analysis method provides reliable time sequence support for behavior features.

[0097] The embodiment realizes the effective integration of multi-dimensional features through feature fusion. The system constructs a feature processing framework based on standardization, and optimizes the dimensionality reduction combined with principal component analysis. Special attention is paid to the importance of feature preservation, and a feature reconstruction mechanism is established to ensure that key information is preserved during dimensionality reduction. This systematic fusion scheme provides high-quality feature support for subsequent analysis.

[0098] The innovative design of the embodiment not only solves the feature processing problem in traditional methods, but also establishes a sustainable optimization feature learning framework. Through multi-level feature extraction and fusion, the system can identify effective behavior features from complex communication data. This deep learning-based analysis mechanism ensures that the system always maintains effective feature expression capability when facing diverse fraud behaviors. In fraud call identification, this intelligent feature processing scheme significantly improves the accuracy of identification.

[0099] The embodiment realizes the intelligent analysis upgrade for fraud calls by establishing a complete feature processing link. The system can dynamically adjust the processing strategy based on real-time communication data, avoiding the limitations of traditional fixed feature schemes. Through multi-dimensional feature extraction and fusion, the quality and reliability of feature expression are significantly improved, providing reliable feature support for subsequent behavior analysis. This intelligent processing mechanism shows strong adaptability and optimization effect in fraud call identification.

[0100] The embodiment not only improves the accuracy of feature processing, but also establishes a continuously evolving processing system through continuous strategy optimization and effect analysis. This real-time feedback-based optimization mechanism ensures that the system can continuously improve as fraud methods change, providing increasingly accurate feature representation for subsequent analysis. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0101] In an embodiment of the fraud warning method based on called communication of the present application, the following contents can be specifically included:

[0102] Step S401: Construct a time series feature processing module, segment the comprehensive feature matrix according to a time window, smooth the feature sequence using a moving average method, extract the trend of the feature based on a difference operator, combine the original feature and the trend feature into an augmented feature sequence, construct a sequence encoding network, and the sequence encoding network adds time sequence position information to the feature sequence using a position encoding method;

[0103] Step S402: a bidirectional recurrent neural network is constructed, the bidirectional recurrent neural network comprises two hidden layer states in forward and backward directions, information flow is controlled through a gating mechanism, the augmented feature sequence is scanned bidirectionally, long-term dependencies in the sequence are captured based on a long short-term memory unit, gradient vanishing is prevented by using a skip connection structure, and the forward and backward hidden layer states are spliced to obtain behavior sequence features.

[0104] Optionally, the embodiment innovatively designs a time sequence feature processing scheme based on deep learning to solve the problems of insufficient time sequence feature extraction and inaccurate long-term dependency modeling in fraud behavior analysis. The embodiment first constructs a time sequence analysis framework to comprehensively model the behavior sequence through multi-level feature extraction. The system designs a sequence feature evaluation formula:

[0105] Sequence_Score=α Smooth_Weight+β Trend_Weight+γ×(Forward_State+Backward_State),

[0106] wherein Smooth_Weight represents a smoothing feature weight, Trend_Weight represents a trend feature weight, Forward_State and Backward_State represent forward and backward state weights respectively, and α, β, γ are dynamic adjustment coefficients. In the fraud behavior recognition scenario, this multi-dimensional sequence evaluation method can effectively capture behavior patterns.

[0107] The embodiment deeply optimizes the time window processing strategy. A segmentation mechanism based on a sliding window is designed according to the time sequence characteristics of fraud behavior. By dynamically adjusting the window size, accurate capture of different scale behavior patterns is achieved. Special attention is paid to the overlap of the window. When a rapid change in the behavior pattern is detected, the system will increase the window overlap to improve the sampling density. For example, when analyzing high-frequency call behavior, dense window sampling can accurately capture the bursty call pattern, which is crucial for identifying typical fraud behavior.

[0108] The embodiment innovatively realizes a feature smoothing mechanism. In view of the noise interference of behavior features, the system constructs a smoothing processing framework based on a sliding average. Through an adaptive smoothing window, effective suppression of short-term fluctuations is achieved. Special attention is paid to the maintenance of trends. By designing a weight decay strategy, it is ensured that important behavior features will not be excessively smoothed. This smoothing-based preprocessing method can effectively improve the stability of the features.

[0109] The embodiment deeply optimizes the trend extraction strategy. The system constructs a trend analysis framework based on difference operators, and captures the change pattern of behavior characteristics through multi-order difference operation. Special attention is paid to the multi-scale characteristics of the trend, and through the design of multi-level difference structure, the accurate extraction of trends of different time scales is realized. This complete trend analysis method provides dynamic feature support for behavior modeling.

[0110] The embodiment realizes the explicit expression of the time sequence position through sequence coding. The system constructs a feature enhancement framework based on position coding, and combines the original features and position information for comprehensive modeling. Special attention is paid to the expression ability of the position information, and through the establishment of a multi-dimensional coding mechanism, the accurate description of the sequence position is realized. This systematic coding scheme provides complete sequence representation for subsequent bidirectional modeling.

[0111] The innovative design of the embodiment not only solves the time sequence modeling problem in the traditional method, but also establishes a sustainable optimization sequence learning framework. Through multi-level feature processing and bidirectional modeling, the system can extract effective time sequence features from complex behavior sequences. This deep learning-based analysis mechanism ensures that the system always maintains effective modeling capability when facing diversified fraud behaviors. In fraud behavior identification, this intelligent sequence processing scheme significantly improves the accuracy of analysis.

[0112] The embodiment realizes the intelligent analysis upgrade for fraud behavior through the establishment of a complete sequence processing link. The system can dynamically adjust the processing strategy based on real-time behavior characteristics, avoiding the limitations of traditional fixed mode schemes. Through multi-dimensional feature extraction and sequence modeling, the quality and reliability of behavior expression are significantly improved, providing reliable time sequence feature support for subsequent risk assessment. This intelligent processing mechanism shows strong adaptability and optimization effect in fraud behavior analysis.

[0113] The embodiment not only improves the accuracy of sequence processing, but also establishes a continuously evolving modeling system through continuous strategy optimization and effect analysis. This real-time feedback-based optimization mechanism ensures that the system can continuously improve as fraud methods change, providing more and more accurate behavior representation for subsequent analysis. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0114] In an embodiment of the fraud warning method based on the called communication connection of the present application, the following contents can be specifically included:

[0115] Step S501: A multi-head attention network is constructed to map the behavior sequence features into query vectors, key vectors and value vectors, calculate attention scores through scaled dot-product, combine the outputs of different attention heads, determine key behavior segments based on an adaptive threshold selection algorithm, retain original feature information using a residual connection structure, and reorganize the weighted feature sequence into a behavior feature matrix in chronological order;

[0116] Step S502: An anomaly detector is constructed to input the behavior feature matrix into an isolation forest model, calculate sample isolation degrees by randomly partitioning the space, calculate anomaly scores based on the distance of samples to decision boundaries, normalize the anomaly scores, eliminate short-term fluctuations using an exponential smoothing method, and organize the smoothed anomaly scores into an anomaly score vector.

[0117] Optionally, the embodiment innovatively designs an anomaly detection scheme based on deep learning to address the problems of insufficient behavior feature analysis and low accuracy of anomaly detection in fraudulent phone calls. The embodiment first constructs a feature analysis framework to accurately model the behavior sequence through a multi-level attention mechanism. The system designs an anomaly score formula:

[0118] Anomaly_Score=α Attention_Weight+β Isolation_Score+γ×Smooth_Factor,

[0119] where Attention_Weight represents the attention weight, Isolation_Score represents the isolation score, Smooth_Factor represents the smoothing factor, and α, β, γ are dynamic weight coefficients. In the fraudulent phone call recognition scenario, this multi-dimensional anomaly evaluation method can effectively identify suspicious behavior.

[0120] The embodiment deeply optimizes the attention calculation strategy. For key feature extraction of the behavior sequence, a feature processing mechanism based on multi-head attention is designed. Through parallel attention heads, different aspects of the behavior sequence are focused on. The importance of features is particularly distinguished, and when a significant change in behavior patterns is detected, the system will automatically adjust the focus through the attention mechanism. For example, when analyzing the call behavior of fraudulent numbers, multi-head attention can simultaneously focus on multiple dimensions of features such as call frequency anomalies and duration anomalies, which is crucial for identifying complex fraud patterns.

[0121] The embodiment innovatively realizes the key behavior recognition mechanism. For the important fragments of the behavior sequence, the system constructs a selection framework based on adaptive threshold. Through dynamic threshold adjustment, accurate positioning of key behaviors is realized. Special attention is paid to the continuity of the fragments, and through the design of the timing constraint strategy, the rationality of the selection result is ensured. This threshold-based selection method can effectively extract abnormal behavior fragments.

[0122] The embodiment deeply optimizes the feature preservation strategy. The system constructs a feature transmission framework based on residual connection, and preserves the original feature information through the jump connection mechanism. Special attention is paid to the integrity of the information, and through the design of the multi-layer residual structure, it is ensured that important features are preserved in the deep network. This complete feature preservation method provides a reliable feature basis for anomaly detection.

[0123] The embodiment realizes the quantitative evaluation of behavior anomalies through anomaly detection. The system constructs an isolation forest-based detection framework, combining spatial segmentation and distance calculation for anomaly identification. Special attention is paid to the stability of the anomaly, and through the establishment of the exponential smoothing mechanism, the interference of short-term fluctuations is eliminated. This systematic detection scheme provides a reliable numerical basis for risk warning.

[0124] The innovative design of the embodiment not only solves the problem of anomaly detection in traditional methods, but also establishes a sustainable optimization detection framework. Through multi-level feature analysis and anomaly evaluation, the system can identify effective abnormal features from complex behavior sequences. This deep learning-based detection mechanism ensures that the system always maintains effective recognition ability when facing diversified fraud behaviors. In the prevention and control of fraudulent phone calls, this intelligent detection scheme significantly improves the accuracy of early warning.

[0125] The embodiment realizes the intelligent recognition upgrade for fraudulent phone calls by establishing a complete anomaly detection link. The system can dynamically adjust the detection strategy based on real-time behavior characteristics, avoiding the limitations of traditional fixed rule schemes. Through multi-dimensional feature analysis and anomaly evaluation, the accuracy and reliability of detection are significantly improved, providing reliable abnormal feature support for subsequent risk warning. This intelligent detection mechanism shows strong adaptability and optimization effect in fraudulent phone call recognition.

[0126] The embodiment not only improves the accuracy of anomaly detection, but also establishes a continuously evolving detection system through continuous strategy optimization and effect analysis. This real-time feedback-based optimization mechanism ensures that the system can continuously improve as fraud methods change, providing more and more accurate early warnings for users. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0127] In an embodiment of the fraud early warning method based on a called connection in the present application, the following content can also be specifically included:

[0128] Step S601: A feature preprocessing module is constructed to perform standardization processing on the abnormal score vector, calculate local statistical features using a sliding window, splice the statistical features and the original scores, perform dimension reduction mapping on the spliced results to obtain preprocessed features, input the preprocessed features into a residual network, the residual network retains original feature information through a skip connection structure, performs local feature extraction on the features based on a convolutional layer, and adjusts feature distribution using a batch normalization layer;

[0129] Step S602: A feature fusion network is constructed, the feature fusion network adopts a multi-branch structure to perform parallel processing on residual features of different scales, calculates importance weights of feature channels through a channel attention module, captures spatial dependency relationships of the features based on a spatial attention module, fuses the multi-branch features through weighted summation, and performs nonlinear transformation on the fusion results to obtain a fusion feature vector.

[0130] Optionally, the embodiment innovatively designs a feature fusion scheme based on deep learning to solve problems such as serious information loss and insufficient feature expression in fraud feature fusion. The embodiment first constructs a feature processing framework to comprehensively retain abnormal features through multi-level feature extraction. The system designs a feature fusion evaluation formula:

[0131] Fusion_Score = α Local_Stats+β Residual_Feature + γ × (Channel_Attention + Spatial_Attention),

[0132] wherein Local_Stats represents local statistical features, Residual_Feature represents residual features, Channel_Attention and Spatial_Attention respectively represent channel and spatial attention features, and α, β, and γ are dynamic adjustment coefficients. In the fraud early warning scenario, this multi-dimensional feature fusion method can effectively retain key information.

[0133] The embodiment deeply optimizes the preprocessing strategy. A feature processing mechanism based on standardization is designed according to the distribution characteristics of abnormal scores. Through an adaptive normalization method, effective calibration of abnormal scores is achieved. Special attention is paid to local statistical characteristics. When a significant change in feature distribution is detected, the system will optimize the statistical range through a dynamic window adjustment mechanism. For example, in processing of sudden abnormal scores, local statistical features can accurately capture short-term abnormal patterns, which is crucial for identifying new fraud behaviors.

[0134] The embodiment innovatively realizes the residual feature extraction mechanism. In view of the information attenuation problem in the deep network, the system constructs a residual learning framework based on jump connection. By establishing a multi-level residual block, the effective preservation of the original feature information is realized. Special attention is paid to the expression ability of the feature, and by designing a multi-scale convolution structure, it is ensured that the local feature is fully extracted. This residual-based feature learning method can effectively prevent information loss.

[0135] The embodiment deeply optimizes the feature distribution adjustment strategy. The system constructs a feature standardization framework based on batch normalization, and realizes real-time adjustment of the feature distribution through dynamic mean and variance calculation. Special attention is paid to the stability of the distribution, and by designing a sliding statistical mechanism, the standardization effect and learning efficiency of the feature are balanced. This complete standardization method provides a stable numerical basis for feature fusion.

[0136] The embodiment realizes the parallel processing of multi-scale features through a multi-branch structure. The system constructs a feature enhancement framework based on attention mechanism, and combines channel and spatial dimensions for comprehensive modeling. Special attention is paid to the importance distinction of the feature, and by establishing a dual attention mechanism, automatic focusing on key features is realized. This systematic feature fusion scheme provides high-quality feature representation for subsequent analysis.

[0137] The innovative design of the embodiment not only solves the feature fusion problem in traditional methods, but also establishes a sustainable optimization feature learning framework. Through multi-level feature processing and fusion, the system can extract effective risk representation from complex abnormal features. This deep learning-based analysis mechanism ensures that the system always maintains effective feature expression ability when facing diversified fraud methods. In fraud warning, this intelligent feature processing scheme significantly improves the accuracy of the warning.

[0138] The embodiment realizes the intelligent analysis upgrade for fraud warning by establishing a complete feature processing link. The system can dynamically adjust the processing strategy based on real-time features, avoiding the limitations of traditional fixed feature schemes. Through multi-dimensional feature extraction and fusion, the quality and reliability of feature expression are significantly improved, providing reliable feature support for subsequent risk assessment. This intelligent processing mechanism shows strong adaptability and optimization effect in fraud warning.

[0139] The embodiment not only improves the accuracy of feature processing, but also establishes a continuously evolving processing system through continuous strategy optimization and effect analysis. This real-time feedback-based optimization mechanism ensures that the system can continuously improve as fraud methods change, providing more and more accurate feature representation for subsequent analysis. In practical applications, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0140] In an embodiment of the fraud early warning method based on the called connection of the present application, the following content can also be specifically included:

[0141] Step S701: constructing a risk mapping network, inputting the fusion feature vector into a multi-layer perception machine, the multi-layer perception machine transforming features through hidden layer neurons, using a batch normalization layer to standardize intermediate features, introducing non-linear characteristics based on an activation function, preventing gradient disappearance through a residual connection structure, using a sigmoid function for the last layer output to map features to a risk probability space, and generating a risk score result;

[0142] Step S702: constructing a hierarchical processing module, comparing the risk score result with a multi-level preset threshold, dividing the risk level into three levels of high, medium and low based on a threshold segmentation rule, generating a corresponding early warning label for different risk levels, packaging the early warning label and risk level information into an early warning message, and using a message queue mechanism to distribute the early warning message to a user terminal push module in order of priority.

[0143] Optionally, the present embodiment innovatively designs a risk mapping and hierarchical processing scheme based on deep learning to solve the problems of inaccurate risk assessment and untimely early warning distribution in fraud calls. The present embodiment first constructs a risk assessment framework to accurately determine the risk level through multi-level feature mapping. The system designs a risk assessment formula:

[0144] Risk_Score=α Feature_Map+β Residual_Weight+γ×Priority_Level,

[0145] where Feature_Map represents the feature mapping value, Residual_Weight represents the residual weight, Priority_Level represents the priority coefficient, and α, β, γ are dynamic adjustment coefficients. In the fraud call recognition scenario, this multi-dimensional risk assessment method can effectively predict fraud risks.

[0146] The present embodiment deeply optimizes the feature mapping strategy. A mapping mechanism based on a multi-layer perception machine is designed for the complex distribution characteristics of the fusion features. Through multi-layer nonlinear transformation, deep modeling of risk features is achieved. Special attention is paid to the expression ability of the features. When the feature distribution changes are detected, the system will adaptively adjust through the batch normalization layer. For example, when processing different types of fraud features, multi-layer mapping can accurately capture the complex correlations between features, which is crucial for the accuracy of risk assessment.

[0147] The embodiment innovatively realizes the gradient optimization mechanism. For the training problem of deep network, the system constructs an optimization framework based on residual connection. Through the jump connection structure, the effective transmission of gradient information is realized. Special attention is paid to the convergence of the network, and through the design of multi-layer residual structure, it is ensured that the model can stably learn complex risk patterns. This residual-based optimization method can effectively improve the expression ability of the model.

[0148] The embodiment deeply optimizes the risk grading strategy. The system constructs a dynamic grading framework based on multiple thresholds, and realizes the accurate division of risk levels through an adaptive threshold adjustment mechanism. Special attention is paid to the rationality of grading, and through the design of grading rules, the clear distinction between different risk levels is ensured. This complete grading method provides reliable decision basis for early warning distribution.

[0149] The embodiment realizes the accurate push of early warning information through message distribution. The system constructs a distribution framework based on priority, and configures strategies combined with different scene characteristics. Special attention is paid to the timeliness of distribution, and through the establishment of message queue mechanism, it is ensured that high-risk early warning can be processed preferentially. This systematic distribution scheme provides timely risk tips for users.

[0150] The innovative design of the embodiment not only solves the risk assessment problem in the traditional method, but also establishes a sustainable optimization early warning framework. Through multi-level risk mapping and grading processing, the system can generate accurate early warning information from complex features. This deep learning-based early warning mechanism ensures that the system always maintains effective early warning capability when facing diversified fraud methods. In the fraud phone prevention and control, this intelligent early warning scheme significantly improves the pertinence of protection.

[0151] The embodiment realizes the intelligent prevention and control upgrade for fraud phone through establishing a complete early warning link. The system can dynamically adjust the early warning strategy based on real-time risk assessment, avoiding the limitations of traditional fixed rule scheme. Through multi-dimensional risk grading and early warning distribution, the accuracy and timeliness of prevention and control are significantly improved, providing more proactive fraud protection support for users. This intelligent early warning mechanism shows strong adaptability and optimization effect in fraud phone protection.

[0152] The embodiment not only improves the accuracy of early warning, but also establishes an evolving early warning system through continuous strategy optimization and effect analysis. This real-time feedback-based optimization mechanism ensures that the system can continuously improve as fraud methods change, providing more and more accurate protection for users. In practical application, this self-optimization mechanism significantly improves the long-term service quality and protection effect of the system, providing reliable technical support for anti-fraud work.

[0153] In order to effectively solve the deficiencies of traditional technologies in feature analysis, sample processing and propagation link identification, and significantly improve the intelligent level and prevention and control effect of fraud warning, the present application provides an embodiment of a fraud warning device based on called communication for implementing all or part of the contents of the fraud warning method based on called communication, see Figure 2 The fraud warning device based on called communication specifically includes the following contents:

[0154] The communication data analysis module 10 is used for collecting communication data, extracting the reserved mobile phone number from the media flow information, performing home analysis and number segment analysis on the reserved mobile phone number, constructing a number feature vector, extracting the call behavior data of the reserved mobile phone number from the communication record, calculating the call frequency and duration distribution based on a sliding time window, splicing the call behavior features and the number feature vector to obtain a comprehensive feature matrix;

[0155] The anomaly detection module 20 is used for constructing a behavior analysis model, performing time series modeling on the comprehensive feature matrix, extracting behavior sequence features by using a bidirectional recurrent neural network, weighting the key behavior segments based on an attention mechanism, inputting the weighting result into an anomaly detector, and identifying an abnormal call mode by the anomaly detector through an isolation forest algorithm to generate an anomaly score vector;

[0156] The risk warning module 30 is used for inputting the anomaly score vector into a risk warning model, fusing features by the risk warning model using a residual network structure, performing nonlinear mapping by a multilayer perceptron, classifying the call number based on a preset risk threshold, and generating a warning label and distributing the warning label to a user terminal.

[0157] From the above description, it can be known that the fraud warning device based on called communication provided by the embodiments of the present application can accurately portrait the reserved number by innovatively constructing a communication data analysis mechanism, through number home analysis and call behavior feature extraction. A behavior analysis model based on time series modeling is designed, combined with a bidirectional recurrent neural network and an attention mechanism, to establish an abnormal call mode identification strategy for intelligent detection. A deep fusion warning mechanism is introduced, through a residual network and nonlinear mapping, to realize accurate division of risk levels and timely warning. This method effectively solves the deficiencies of traditional technologies in data analysis, behavior identification and risk warning, and significantly improves the accuracy and reliability of fraud warning.

[0158] From the hardware level, in order to effectively solve the deficiencies of traditional technologies in feature analysis, sample processing and propagation link identification, and significantly improve the intelligent level and prevention and control effect of fraud warning, the present application provides an embodiment of an electronic device for implementing all or part of the contents of the fraud warning method based on called communication, which specifically includes the following contents:

[0159] A processor, a memory, a communications interface, and a bus; wherein the processor, the memory, the communications interface complete the communication with each other through the bus; the communications interface is used for realizing the information transmission between the fraud early warning device based on the called connection, the core service system, the user terminal, and the related database and other related devices; the logic controller can be a desktop computer, a tablet computer, a mobile terminal, and the like, and the embodiment is not limited thereto. In the embodiment, the logic controller can be implemented with reference to the embodiment of the fraud early warning method based on the called connection and the embodiment of the fraud early warning device based on the called connection, the contents of which are incorporated herein, and the repeated parts are not described herein.

[0160] It can be understood that the user terminal can include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, and the like. The smart wearable device can include smart glasses, a smart watch, a smart bracelet, and the like.

[0161] In actual application, part of the fraud early warning method based on the called connection can be executed on the electronic device as described above, or all operations can be completed in the client device. Specifically, the selection can be made according to the processing capacity of the client device and the limitation of the user use scenario, and the like. The present application is not limited thereto. If all operations are completed in the client device, the client device can further include a processor.

[0162] The client device described above can have a communications module (i.e., a communications unit) and can be communicatively connected with a remote server to realize the data transmission with the server. The server can include a server of the task scheduling center side, and the server of the intermediate platform can also be included in other implementation scenarios, such as the server of the third-party server platform communicatively connected with the server of the task scheduling center. The server can include a single computer device, a server cluster composed of multiple servers, or a server structure of a distributed device.

[0163] Figure 3 A schematic block diagram of a system configuration of the electronic device 9600 of the embodiment of the present application is shown in FIG. 9. As shown in FIG. 9, the electronic device 9600 can include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that the structure shown in FIG. 9 is exemplary; other types of structures can also be used to supplement or replace the structure to realize the telecommunication function or other functions. Figure 3 Figure 3 The structure shown in FIG. 9 is exemplary; other types of structures can also be used to supplement or replace the structure to realize the telecommunication function or other functions. ​

[0164] In an embodiment, the fraud warning method based on the called communication connection can be integrated into the central processor 9100. The central processor 9100 can be configured to control as follows:

[0165] Step S101: Collecting communication connection data, extracting a reserved mobile phone number from media diversion information, performing home analysis and number segment analysis on the reserved mobile phone number, constructing a number feature vector, extracting call behavior data of the reserved mobile phone number from the communication connection record, calculating call frequency and duration distribution based on a sliding time window, splicing call behavior features and the number feature vector to obtain a comprehensive feature matrix;

[0166] Step S102: Building a behavior analysis model, performing time series modeling on the comprehensive feature matrix, extracting behavior sequence features using a bidirectional recurrent neural network, weighting key behavior segments based on an attention mechanism, inputting the weighting result into an anomaly detector, and the anomaly detector identifying an abnormal call mode through an isolation forest algorithm to generate an abnormal score vector;

[0167] Step S103: Inputting the abnormal score vector into a risk warning model, the risk warning model fusing features using a residual network structure, performing nonlinear mapping through a multilayer perceptron, classifying call numbers based on a preset risk threshold, and generating a warning label, and distributing the warning label to a user terminal.

[0168] As can be seen from the above description, the electronic device provided by the embodiments of the present application innovatively constructs a communication connection data analysis mechanism, extracts number home analysis and call behavior features, and realizes accurate profiling of reserved numbers. A behavior analysis model based on time series modeling is designed, combined with a bidirectional recurrent neural network and an attention mechanism, to establish an abnormal call mode identification strategy for intelligent detection. A deep fusion warning mechanism is introduced, nonlinear mapping is performed through a residual network, accurate classification of risk levels and timely warning are realized. This method effectively solves the deficiencies of traditional technologies in data analysis, behavior recognition, and risk warning, and significantly improves the accuracy and reliability of fraud warning.

[0169] In another embodiment, the fraud warning device based on the called communication connection can be configured separately from the central processor 9100, for example, the fraud warning device based on the called communication connection can be configured as a chip connected with the central processor 9100, and the fraud warning method function based on the called communication connection is realized through the control of the central processor.

[0170] As Figure 3As shown, the electronic device 9600 can also include a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, a power supply 9170. Notably, the electronic device 9600 need not necessarily include all of the components shown in FIG. 9B; further, the electronic device 9600 can include components not shown in FIG. 9B, as will be appreciated by those skilled in the art. Figure 3 As shown, the electronic device 9600 can also include a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, a power supply 9170. Notably, the electronic device 9600 need not necessarily include all of the components shown in FIG. 9B; further, the electronic device 9600 can include components not shown in FIG. 9B, as will be appreciated by those skilled in the art. Figure 3 As shown, the electronic device 9600 can also include a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, a power supply 9170. Notably, the electronic device 9600 need not necessarily include all of the components shown in FIG. 9B; further, the electronic device 9600 can include components not shown in FIG. 9B, as will be appreciated by those skilled in the art.

[0171] As shown, the central processing unit 9100, which is sometimes referred to as a controller or operating control, can include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of the various components of the electronic device 9600. Figure 3

[0172] The memory 9140, for example, can be one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. Information relating to failures can be stored, in addition to programs for executing the information. The central processing unit 9100 can execute the programs stored in the memory 9140 to achieve information storage or processing, and the like.

[0173] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 is, for example, a key or touch input device. The power supply 9170 is used to supply power to the electronic device 9600. The display 9160 is used to display display objects such as images and text. The display can be, for example, an LCD display, but is not limited thereto.

[0174] The memory 9140 can be a solid state memory, such as a read only memory (ROM), a random access memory (RAM), a SIM card, and the like. It can also be a memory that retains information even when power is off, can be selectively erased, and is provided with more data, an example of which is sometimes referred to as an EPROM, and the like. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 can include an application / function storage section 9142 for storing application programs and function programs or for executing the flow of operations of the electronic device 9600 by the central processing unit 9100.

[0175] ​The memory 9140 can further include a data storage 9143 for storing data such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. A driver storage 9144 of the memory 9140 can include various drivers of the electronic device for communication functions and / or for performing other functions of the electronic device (e.g., a messaging application, a phonebook application, etc.).

[0176] The communication module 9110 is a transmitter / receiver that transmits and receives signals via the antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processor 9100 to provide input signals and receive output signals, as in the case of a conventional mobile communication terminal.

[0177] Based on different communication technologies, a plurality of communication modules 9110 can be provided in the same electronic device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module, etc. The communication module 9110 (transmitter / receiver) is further coupled to the speaker 9131 and the microphone 9132 via the audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing a conventional telecommunication function. The audio processor 9130 can include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is further coupled to the central processor 9100, thereby enabling recording on the local device via the microphone 9132 and playing stored sound on the local device via the speaker 9131.

[0178] The embodiment of the present application also provides a computer readable storage medium capable of implementing all steps of the fraud warning method based on called communication connection in which the execution subject in the above-mentioned embodiment is a server or a client, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement all steps of the fraud warning method based on called communication connection in which the execution subject in the above-mentioned embodiment is a server or a client, for example, the processor implements the following steps when executing the computer program:

[0179] Step S101: collecting communication connection data, extracting a reserved mobile phone number from media diversion information, performing home analysis and number segment analysis on the reserved mobile phone number, constructing a number feature vector, extracting call behavior data of the reserved mobile phone number from communication connection records, calculating call frequency and duration distribution based on a sliding time window, splicing call behavior features and the number feature vector to obtain a comprehensive feature matrix;

[0180] Step S102: constructing a behavior analysis model, performing time series modeling on the comprehensive feature matrix, extracting behavior sequence features by using a bidirectional recurrent neural network, weighting key behavior segments based on an attention mechanism, inputting the weighting result into an anomaly detector, and identifying an abnormal call mode by the anomaly detector through an isolation forest algorithm to generate an abnormal score vector;

[0181] Step S103: inputting the abnormal score vector into a risk early warning model, fusing features by using a residual network structure, performing nonlinear mapping by using a multilayer perceptron, classifying call numbers based on a preset risk threshold, and generating an early warning label to distribute the early warning label to a user terminal.

[0182] As can be known from the above description, the computer readable storage medium provided by the embodiments of the present application innovatively constructs a call data analysis mechanism, realizes accurate profiling of reserved numbers through number attribution analysis and call behavior feature extraction, designs a behavior analysis model based on time series modeling, establishes an abnormal call mode identification strategy for intelligent detection in combination with a bidirectional recurrent neural network and an attention mechanism, introduces a deep fusion early warning mechanism, realizes accurate division of risk levels and timely early warning through a residual network and nonlinear mapping, and effectively solves the deficiencies of traditional technologies in data analysis, behavior identification, and risk early warning, and significantly improves the accuracy and reliability of fraud early warning.

[0183] Embodiments of the present application also provide a computer program product capable of realizing all steps of the called call-based fraud early warning method in which the execution subject in the above embodiments is a server or a client. The computer program / instruction is executed by a processor to realize the steps of the called call-based fraud early warning method, for example, the computer program / instruction realizes the following steps:

[0184] Step S101: collecting call data, extracting a reserved mobile phone number from media diversion information, performing attribution analysis and number segment analysis on the reserved mobile phone number, constructing a number feature vector, extracting call behavior data of the reserved mobile phone number from call records, calculating call frequency and duration distribution based on a sliding time window, and splicing call behavior features and the number feature vector to obtain a comprehensive feature matrix;

[0185] Step S102: constructing a behavior analysis model, performing time series modeling on the comprehensive feature matrix, extracting behavior sequence features by using a bidirectional recurrent neural network, weighting key behavior segments based on an attention mechanism, inputting the weighting result into an anomaly detector, and identifying an abnormal call mode by the anomaly detector through an isolation forest algorithm to generate an abnormal score vector;

[0186] Step S103: input the abnormal score vector into a risk early warning model, the risk early warning model adopts a residual network structure to fuse features, performs nonlinear mapping through a multilayer perceptron, grades the call number based on a preset risk threshold, generates an early warning label, and distributes the early warning label to a user terminal.

[0187] From the above description, the computer program product provided by the embodiment of the application innovatively constructs a communication data analysis mechanism, realizes accurate profiling of reserved numbers through number attribution analysis and call behavior feature extraction, designs a behavior analysis model based on time series modeling, combines a bidirectional recurrent neural network and an attention mechanism, establishes an abnormal call mode recognition strategy for intelligent detection, and introduces a deep fusion early warning mechanism to realize accurate division of risk levels and timely early warning through a residual network and nonlinear mapping. The method effectively solves the deficiencies of traditional technologies in data analysis, behavior recognition, and risk early warning, and significantly improves the accuracy and reliability of fraud early warning.

[0188] Those skilled in the art will understand that the embodiments of the application can be provided as a method, device, or computer program product. Therefore, the application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0189] The application is described with reference to flowcharts and / or block diagrams of methods, devices (apparatuses), and computer program products according to embodiments of the application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure One The functions specified in one or more flows and / or blocks Figure One The device that implements the functions specified in one or more blocks or flows.

[0190] These computer program instructions can also be stored in a computer readable storage medium that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable storage medium produce a product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure One The functions specified in one or more flows and / or blocks Figure One The device that implements the functions specified in one or more blocks or flows.

[0191] These computer program instructions can also be loaded into a computer or other programmable data processing devices, so that a series of operational steps are performed on the computer or other programmable data processing devices to generate a computer implemented process, so that the instructions executed on the computer or other programmable data processing devices provide a process for implementing the flowchart Figure One The flowchart or the flowcharts and / or the block Figure One The steps of the function specified in one or more flowcharts or one or more blocks.

[0192] The principles and implementation manners of the present application are described in the specific embodiments. The above embodiment description is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed, and the above description should not be understood as a limitation on the present application.

Claims

1. A fraud alerting method based on a called communication, characterized in that, The method comprises: Collecting communication data, extracting reserved mobile phone numbers from media flow information, performing home analysis and number segment analysis on the reserved mobile phone numbers, constructing a number feature vector, extracting call behavior data of the reserved mobile phone numbers from communication records, calculating call frequency and duration distribution based on a sliding time window, splicing call behavior features and the number feature vector to obtain a comprehensive feature matrix, comprising: Constructing a communication data processing module, querying historical call records of the reserved mobile phone numbers from a communication record database, sorting the call records according to timestamps, segmenting the call records based on a sliding time window, calculating call frequency and duration statistics in each time window, fitting a call duration distribution curve using a probability density estimation method, extracting periodic features by performing Fourier transform on the call frequency sequence, and combining the statistics and the periodic features into call behavior features; constructing a feature fusion network, standardizing the call behavior features to eliminate dimensional differences, splicing the standardized behavior features and the number feature vector in the feature dimension, performing dimension reduction on the splicing result using a principal component analysis method, and reorganizing the reduced features into a time series matrix in the order of time windows, and converting the time series matrix into a comprehensive feature matrix; Constructing a behavior analysis model, performing time series modeling on the comprehensive feature matrix, extracting behavior sequence features using a bidirectional recurrent neural network, comprising: Constructing a time series feature processing module, segmenting the comprehensive feature matrix according to time windows, smoothing the feature sequence using a moving average method, extracting the trend of the features based on a difference operator, combining the original features and the trend features into an augmented feature sequence, constructing a sequence encoding network, the sequence encoding network adding time sequence position information to the feature sequence using a position encoding method; constructing a bidirectional recurrent neural network, the bidirectional recurrent neural network including forward and backward hidden layer states, controlling information flow through a gating mechanism, bidirectionally scanning the augmented feature sequence, capturing long-term dependencies in the sequence based on a long short-term memory unit, preventing gradient disappearance using a skip connection structure, and splicing the forward and backward hidden layer states to obtain behavior sequence features; Weighting key behavior segments based on an attention mechanism, inputting the weighting result into an anomaly detector, the anomaly detector identifying abnormal call patterns through an isolation forest algorithm, and generating an anomaly score vector; Inputting the anomaly score vector into a risk warning model, the risk warning model using a residual network structure to fuse features, performing nonlinear mapping through a multilayer perceptron, classifying call numbers based on a preset risk threshold, generating a warning label, and distributing the warning label to a user terminal.

2. The alerting method of fraud based on the call connection of the called number according to claim 1, characterized in that, The collecting communication data, extracting reserved mobile phone numbers from media flow information, performing home analysis and number segment analysis on the reserved mobile phone numbers, and constructing a number feature vector, comprising: Access the communication data stream from the media diversion platform, use regular expression pattern matching to extract the mobile phone number field from the communication data stream, remove special characters and spaces in the number based on string parsing rules, perform format verification on the cleaned number, mark the number that passes the verification as a reserved mobile phone number, and build a number parsing module, which matches the reserved mobile phone number based on the number segment database. Build a number feature extraction network, input the home information and number segment information of the reserved mobile phone number into the feature encoding layer, the feature encoding layer uses one-hot encoding to convert category information into numerical features, calculates the usage time and number portability times of the number based on the number activity calculation rule, normalizes the numerical features and statistical features, and concatenates the normalized results to generate a number feature vector.

3. The alerting method of fraud based on the calling connection of the called number according to claim 1, characterized in that, The weighted result is input into the anomaly detector, which identifies abnormal call patterns through the Isolation Forest algorithm and generates an anomaly score vector, including: Build a multi-head attention network, map the behavior sequence features to query vectors, key vectors and value vectors, calculate attention scores through scaled dot product, weight and combine the outputs of different attention heads, determine key behavior segments based on an adaptive threshold selection algorithm, use a residual connection structure to retain original feature information, and reorganize the weighted feature sequence into a behavior feature matrix in chronological order; Build an anomaly detector, input the behavior feature matrix into the Isolation Forest model, which calculates sample isolation by randomly dividing the space, calculates anomaly scores based on the distance from the sample to the decision boundary, normalizes the anomaly scores, uses exponential smoothing to eliminate short-term fluctuations, and organizes the smoothed anomaly scores into an anomaly score vector.

4. The alerting method of fraud based on the calling connection of the called number according to claim 1, characterized in that, The anomaly score vector is input into the risk warning model, which uses a residual network structure to fuse features, including: Build a feature preprocessing module, standardize the anomaly score vector, calculate local statistical features using a sliding window, concatenate the statistical features and original scores, and map the concatenated results to a preprocessed feature through dimensionality reduction. Build a feature fusion network, which uses a multi-branch structure to process different scales of residual features in parallel, calculates the importance weight of feature channels through a channel attention module, captures the spatial dependency of features based on a spatial attention module, and fuses multiple branch features through weighted summation to obtain a fusion feature vector.

5. The alerting method of fraud based on the call connection of the called number according to claim 4, characterized in that, The nonlinear mapping is performed through a multilayer perceptron, the call number is classified based on a preset risk threshold, and a warning label is generated, which is distributed to the user terminal, including: A risk mapping network is constructed, the fusion feature vector is input into a multilayer perceptron, the multilayer perceptron transforms features through hidden layer neurons, adopts a batch normalization layer to standardize intermediate features, introduces a nonlinear property based on an activation function, prevents gradient disappearance through a residual connection structure, uses a sigmoid function for the last layer output to map features to a risk probability space, and generates a risk score result; A hierarchical processing module is constructed, the risk score result is compared with a plurality of preset threshold values, a threshold segmentation rule is used to divide risk levels into three levels of high, medium and low, corresponding early warning labels are generated for different risk levels, the early warning labels and risk level information are packaged into early warning messages, and a message queue mechanism is used to distribute the early warning messages to user terminal push modules in order of priority.

6. A fraud alerting device based on a called connection, characterized by The device comprises: The data analysis module is configured to collect communication data, extract a reserved mobile phone number from media diversion information, perform home location analysis and number segment analysis on the reserved mobile phone number, construct a number feature vector, extract call behavior data of the reserved mobile phone number from communication records, calculate call frequency and duration distribution based on a sliding time window, and splice call behavior features and the number feature vector to obtain a comprehensive feature matrix. The data analysis module comprises: a communication data processing module configured to query historical call records of the reserved mobile phone number from a communication record database, sort the call records according to timestamps, segment the call records based on a sliding time window, calculate call frequency and duration statistics in each time window, fit a call duration distribution curve by using a probability density estimation method, extract periodic features of a call frequency sequence by Fourier transform, and combine the statistics and the periodic features into call behavior features; and a feature fusion network configured to standardize the call behavior features to eliminate dimensional differences, splice the standardized behavior features and the number feature vector in the feature dimension, reduce dimensions of the spliced result by using a principal component analysis method, reorganize the reduced features into a time series matrix in order of time windows, and convert the time series matrix into a comprehensive feature matrix. An anomaly detection module is configured to construct a behavior analysis model, perform time series modeling on the comprehensive feature matrix, and extract behavior sequence features by using a bidirectional recurrent neural network, including: constructing a time series feature processing module, segmenting the comprehensive feature matrix according to a time window, performing smoothing processing on the feature sequence by using a moving average method, extracting a change trend of the features based on a difference operator, combining the original features and the change trend features into an augmented feature sequence, and constructing a sequence encoding network that adds time sequence position information to the feature sequence by using a position encoding method; constructing a bidirectional recurrent neural network that contains two hidden layer states in the forward and backward directions, controls information flow by using a gating mechanism, performs bidirectional scanning on the augmented feature sequence, captures long-term dependencies in the sequence based on a long short-term memory unit, prevents gradient disappearance by using a skip connection structure, splices the forward and backward hidden layer states to obtain behavior sequence features, weights key behavior segments based on an attention mechanism, and inputs the weighted results into an anomaly detector that identifies abnormal call patterns by using an isolation forest algorithm and generates an anomaly score vector; A risk early warning module is configured to input the anomaly score vector into a risk early warning model that fuses features by using a residual network structure, performs nonlinear mapping by using a multilayer perceptron, classifies call numbers based on a preset risk threshold, and generates an early warning label that is distributed to a user terminal.

7. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the steps of the fraud early warning method based on a called call connection according to any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the fraud early warning method based on a called call connection according to any one of claims 1 to 5.

Images