High-risk call identification method and device, computer device and storage medium

Abstract

The application discloses a high-risk call identification method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining a to-be-matched call text, preprocessing the to-be-matched call text, eliminating called information and retaining calling information; constructing an event evolution chain extraction prompt word based on the calling information, calling a large language model to generate a to-be-matched event evolution chain; converting the to-be-matched event evolution chain into a to-be-matched event evolution graph; performing multi-stage graph analysis processing on the to-be-matched event evolution graph based on a preset event evolution graph atlas, obtaining a key node number, a key node matching rate and key node connectivity; and determining whether the to-be-matched call text is a high-risk call based on the key node number, the key node matching rate and the key node connectivity. The application does not require a large number of positive and negative labeled samples, reduces the cost of manual labeling, accurately captures the timing logic of fraud tactics, overcomes the limitations of static atlas, and improves the accuracy and practicality of high-risk call identification.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer device and storage medium for identifying high-risk calls. Background Technology

[0002] In the field of telecommunications fraud risk identification and prevention, with the rapid iteration of fraud methods, related technical solutions continue to face multiple challenges in terms of accurate identification, cost control, and dynamic adaptation. Existing technologies still have significant limitations in model training paradigms, graph construction methods, and knowledge representation capabilities, as detailed below:

[0003] Current telecom fraud identification solutions generally adopt supervised learning paradigms. From traditional machine learning models (such as random forest, LightGBM, XGBoost), basic deep learning models (such as multilayer perceptron MLP), to LoRA fine-tuning solutions based on hundreds of billions of large models, all take "a large number of positive and negative labeled samples driving the loss function to decrease" as the core logic. It is necessary to construct a training dataset containing fraudulent calls (black samples) and normal calls (white samples) through manual labeling.

[0004] However, due to the rapid evolution of telecom fraud scenarios and the constant emergence of new scripts, old labels quickly become ineffective. Simultaneously, black samples are scarce, white samples are noisy, and the model is prone to overfitting or bias towards the majority class, making it difficult to balance recall and false positives. In terms of knowledge graph extraction, traditional methods are either limited by the structured information ceiling of constructing triples from static fields in call detail records, or face high domain annotation costs due to the need to extract entity relationships from large labeled corpora using BERT / SBERT. Existing static knowledge graphs, centered on "entity-relationship-entity," have nodes that are mostly objective objects, and edges that only express static associations. They cannot present the causal sequence of fraud scripts and are further fragmented by variations in the same fraud chain, leading to graph expansion and decreased generalization ability. Summary of the Invention

[0005] Therefore, it is necessary to provide a high-risk call identification method, device, computer equipment, and storage medium to address the above-mentioned technical problems and solve at least one of the problems existing in the prior art.

[0006] Firstly, a method for identifying high-risk calls is provided, including:

[0007] Obtain the call text to be matched, preprocess the call text to be matched, remove the called party information and retain the caller information;

[0008] Based on the caller information, an event evolution chain is constructed to extract prompt words, and a large language model is called to generate the event evolution chain to be matched.

[0009] convert the to-be-matched event evolution chain into a to-be-matched event evolution graph;

[0010] perform multi-stage graph analysis processing on the to-be-matched event evolution graph based on the preset event evolution graph to obtain a number of key nodes, a key node matching rate, and key node connectivity;

[0011] determine whether the to-be-matched call text is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity.

[0012] In a possible implementation, the multi-stage graph analysis processing on the to-be-matched event evolution graph based on the preset event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity includes:

[0013] perform node matching on the to-be-matched event evolution graph and the preset event evolution graph to obtain a matching node set;

[0014] perform key node identification on the matching node set to obtain a key node list, the key node list including the number of key nodes;

[0015] determine the key node matching rate based on the number of key nodes and a number of to-be-matched nodes;

[0016] perform node connectivity determination on each key node in the key node list to obtain the key node connectivity.

[0017] In a possible implementation, the node matching on the to-be-matched event evolution graph and the preset event evolution graph to obtain the matching node set includes:

[0018] obtain a to-be-matched node set corresponding to the to-be-matched event evolution graph and a preset node set corresponding to the preset event evolution graph;

[0019] perform similarity calculation on each to-be-matched node in the to-be-matched node set and each preset node in the preset node set;

[0020] based on the similarity calculation result, select a preset number of to-be-matched nodes with the highest similarity from the to-be-matched node set and add the to-be-matched nodes to an initial matching node set;

[0021] from the initial matching node set, filter out to-be-matched nodes with a similarity greater than a preset similarity threshold to form a final matching node set.

[0022] In a possible implementation, the key node identification on the matching node set includes:

[0023] determine out-degree and in-degree of each matching node in the matching node set;

[0024] calculate total degree corresponding to each matching node based on the out-degree and the in-degree;

[0025] select a matching node with total degree greater than a preset threshold as the key node.

[0026] In a possible implementation, the node connectivity determination on each key node in the key node list to obtain the key node connectivity comprises:

[0027] determine an upper limit of edge number of a path between a pair of adjacent nodes in a key node sequence;

[0028] determine an edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence based on the upper limit of edge number;

[0029] aggregate all edge path existence indexes to obtain an overall connectivity result;

[0030] obtain the key node connectivity based on the overall connectivity result.

[0031] In a possible implementation, before the multi-stage graph analysis processing on the to-be-matched event evolution graph based on the preset event evolution graph, the method further comprises:

[0032] construct a training data set, the training data set comprising a plurality of training call samples;

[0033] preprocess each training call sample to eliminate called information and retain calling information;

[0034] construct an event evolution chain extraction prompt word based on the calling information, and call a large language model to generate a training event evolution chain;

[0035] convert the training event evolution chain into a training event evolution graph;

[0036] merge the training event evolution graphs one by one based on a graph merging algorithm to obtain the preset event evolution graph.

[0037] In a possible implementation, each event in the to-be-matched event evolution chain is a verb-object structure phrase, and the conversion of the to-be-matched event evolution chain into a to-be-matched event evolution graph comprises:

[0038] construct a directed graph object as a basic carrier of the to-be-matched event evolution graph based on a preset graph operation tool;

[0039] Traverse the to-be-matched event evolution chain after the conversion of the to-be-matched event evolution chain into a verb-object structure phrase, and directly take each verb-object structure phrase as a node ID in the basic carrier;

[0040] Adopt a preset text vector generation tool to perform vector conversion on each verb-object structure phrase as a node ID, to obtain a vector representation corresponding to the verb-object structure phrase as a node attribute;

[0041] According to the time sequence of the events in the to-be-matched event evolution chain, the nodes corresponding to adjacent events are associated, and unidirectional edges are added between adjacent nodes to form directed edges reflecting the event evolution logic.

[0042] In a second aspect, a high-risk call identification device is provided, comprising:

[0043] A to-be-matched call text preprocessing unit is configured to obtain to-be-matched call text, preprocess the to-be-matched call text, and eliminate called information while retaining calling information.

[0044] An event evolution chain generation unit is configured to construct event evolution chain extraction prompt words based on the calling information, and call a large language model to generate a to-be-matched event evolution chain.

[0045] An event evolution graph generation unit is configured to convert the to-be-matched event evolution chain into a to-be-matched event evolution graph.

[0046] A graph analysis processing unit is configured to perform multi-stage graph analysis processing on the to-be-matched event evolution graph based on a preset event evolution graph, to obtain a number of key nodes, a key node matching rate, and key node connectivity.

[0047] A high-risk call determination unit is configured to determine whether the to-be-matched call text is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity.

[0048] In a third aspect, a computer device is provided, comprising a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, wherein the processor executes the computer readable instructions to implement the steps of the high-risk call identification method described above.

[0049] In a fourth aspect, a readable storage medium is provided, which stores computer readable instructions, wherein the computer readable instructions are executed by a processor to implement the steps of the high-risk call identification method described above.

[0050] The high-risk call identification method, device, computer device, and storage medium, the method of which comprises: obtaining a to-be-matched call text, preprocessing the to-be-matched call text, eliminating called information and retaining calling information; constructing an event evolution chain extraction prompt word based on the calling information, calling a large language model to generate a to-be-matched event evolution chain; converting the to-be-matched event evolution chain into a to-be-matched event evolution graph; performing multi-stage graph analysis processing on the to-be-matched event evolution graph based on a preset event evolution graph, to obtain a key node number, a key node matching rate, and key node connectivity; and determining whether the to-be-matched call text is a high-risk call based on the key node number, the key node matching rate, and the key node connectivity. In the embodiment of the present application, the event evolution chain is generated with the calling information as the core and the event evolution graph is constructed, multi-stage graph analysis processing is carried out in combination with the preset event evolution graph, which not only gets rid of the dependence of supervised learning on a large number of positive and negative labeled samples, but also realizes identification only through event distribution extracted from historical fraud calls, without the need to deal with the problems of black sample scarcity, large white sample noise, and rapid label invalidation, and still maintains robustness in the scene of rapid evolution of fraud scripts; and the traditional graph construction is limited by the defects of structured information or high labeling cost, and the event chain with a subject-object structure is generated by means of a large language model without the need for manual labeling, which can be reused across scenes, greatly reducing the human input while accurately capturing the delicate timing evolution logic of fraud tactics; and through the dynamic graph structure of "event-evolution-event", each fraud call is abstracted into an event evolution chain by means of a large language model, and similar nodes are fused through semantic similarity, to form a highly compressed and incrementally expandable fraud event evolution graph, which overcomes the shortcomings of static knowledge graphs, such as inability to present fraud causal timing and weak generalization ability, and retains the timing causality of "identity impersonation-threat intimidation-inducing transfer", and can detect key node connectivity to complete risk determination in seconds, finally achieving a balance between recall rate and false positive rate in the scene of telecom fraud prevention with few samples, cold start, and continuous drift, and significantly improving the accuracy and practicality of high-risk call identification and the precision and generalization ability of the fraud call identification model. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the description of the embodiments of the present application will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0052] Figure 1 It is an application environment schematic diagram of the high-risk call identification method in an embodiment of the present application.

[0053] Figure 2is a flowchart of a high-risk call identification method in an embodiment of the present application;

[0054] Figure 3 is a structural diagram of an event evolution chain in an embodiment of the present application;

[0055] Figure 4 is a partial structural diagram of an event evolution graph in an embodiment of the present application;

[0056] Figure 5 is a structural diagram of a high-risk call identification device in an embodiment of the present application;

[0057] Figure 6 is a schematic diagram of a computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0059] The high-risk call identification method provided in the embodiments can be applied in an application environment such as Figure 1 , which can include a data preprocessing stage, an event evolution chain extraction stage, a preset event graph (such as a fraud event graph) construction stage, and a high-risk (such as fraud) telephone identification stage. In the data processing stage, a large language model (such as DeepSeek-V3.1-Chat) can be used to filter and process the original call content to filter out fraud and non-fraud call content. In the event evolution chain extraction stage, a large language model (such as DeepSeek-V3.1-Chat) is also called to generate an event evolution chain with a verb-object structure from the calling call. In the event evolution graph construction stage, based on the generated event evolution chain, a preset graph operation tool (such as NetworkX) is used to construct a graph structure, and a tool such as All-MiniLM-L6-v2 is used to obtain node vector representation (as a node attribute to provide features for subsequent matching). In the high-risk telephone identification stage, a tool such as Nearest2 is used for node similarity matching, and the node centrality and path matching functions of Neo4j are used to identify key nodes and determine connectivity, finally outputting the fraud telephone identification result, realizing the efficient automation and intelligence of the whole process from call content to risk determination.

[0060] In an embodiment, as shown in Figure 2 , a high-risk call identification method is provided, including the following steps:

[0061] In step S110, the call text to be matched is obtained, and the call text to be matched is preprocessed to eliminate the called information and retain the caller information.

[0062] Optionally, first, the complete call record text to be matched (including the complete voice transcription content of the caller and the called party) is obtained; then, filtering is performed through a rule engine or a heuristic regular matching method: all information related to the called party (including the called number, the response speech of the called party, the background sound on the called side, etc.) is eliminated; at the same time, all the expression contents on the caller side are retained, specifically including the caller number, the identity claim (such as “I am the express delivery customer service”), the core speech (such as “Your lost package can be compensated”), the operation instruction (such as “click the link to fill in the information”), etc.; finally, the retained caller information is format cleaned (redundant adverbs are removed, and transcription errors are corrected), and finally, the structured caller speech text is formed, providing high-quality input for subsequent event evolution chain extraction.

[0063] In step S120, an event evolution chain extraction prompt word is constructed based on the caller information, and a large language model is called to generate the event evolution chain to be matched.

[0064] Optionally, for the preprocessed caller information, a zero-shot method can be used to construct a special prompt template based on task requirements, and the task is to identify the core speech from the caller's speech, abstract it into an event with a verb-object phrase structure, and concatenate it into an event evolution chain with no more than 10 steps in chronological order. For example: [“claims to be an e-commerce customer service”, “informs about single return commission”, “asks to download an APP”, “explains the rules of advance payment”, “guides high-commission orders”, “asks for tax”, “explains the necessity”, “urges to pay the margin”, “promises to return the money”, “urges to clear the balance”].

[0065] This zero-shot event evolution chain extraction method can effectively map the caller's intention and speech content into a series of event nodes with a verb-object structure, forming an abstract, highly generalized, and time-sequenced evolution process. Compared with the direct text-based analysis method, EEC not only more intuitively reflects the stage-by-stage advancement characteristics of the fraud speech, but also provides standardized input for subsequent event evolution graph construction. The prompt template specifies the task target, output requirements (including event type examples: identity declaration, cause explanation, etc.), and strict list format specifications. After calling a large language model (such as DeepSeek-V3.1-Chat) and inputting the structured prompt filled with caller information, the model will automatically extract key events in chronological order. This zero-shot event evolution chain extraction method can well extract the caller's intention and speech in the form of a verb-object phrase, forming an abstract, generalized, and event development order evolution process, which can be reused across scenes without manual annotation.

[0066] Exemplarily, the prompt template can be as follows:

[0067]

Task

[0068] 1. Identify and extract the core rhetoric that reflects the caller's intention from the content of the call.

[0069] 2. Abstract and generalize these rhetoric into semantic complete verb-object phrase structures (events).

[0070] 3. According to the time sequence of the call, concatenate the events into an event evolution list to depict the development process of the caller's intention.

[0071]

Requirements

[0072] 1. Output events in the order of call time to form an event evolution chain.

[0073] 2. Each chain should not exceed 10 events, and key turning points should be preserved.

[0074] 3. Common event types include:

[0075] * Identity declaration (self-identity)

[0076] * Cause explanation (informing the problem / reason)

[0077] * Request for presentation (requesting a certain behavior)

[0078] * Motivation explanation (explaining reasons / emphasizing necessity)

[0079] * Result commitment (commitment to solve problems / bring benefits)

[0080] * Action guidance (pointing to the next step)

[0081] 4. Strictly follow the output format and do not include irrelevant content.

[0082]

Output Format

[0083] ["Event 1 (verb-object phrase)", "Event 2 (verb-object phrase)", "Event 3 (verb-object phrase)"]

[0084]

Call Caller Information

[0085] {{content}}

[0086] Note that a large language model (LLM) is a Transformer-based language model with hundreds of millions to tens of billions of parameters, which is unsupervised learned on massive texts through autoregressive or autoencoding objectives, and has zero-shot / few-shot understanding and generation capabilities. After fine-tuning, RLHF alignment, and tool invocation expansion, it can complete tasks such as question answering, summarization, reasoning, and code generation, and support efficient reasoning (quantization, pruning). In fraud detection, LLM has been used for text vectorization, zero-shot classification, dialogue summarization, and script extraction, and its models can include GPT-4, Llama-2, DeepSeek-V3.1-Chat, DeepSeek-Coder, etc.

[0087] In step S130, the to-be-matched event evolution chain is converted into a to-be-matched event evolution graph;

[0088] Optionally, based on a preset graph tool (such as NetworkX, Neo4j, etc.) as a framework for graph operations, the to-be-matched event evolution chain is converted into a graph structure: an empty directed graph object is initialized, each verb-object structure phrase in the to-be-matched event evolution chain is added to the graph as a node ID, and a preset text vector generation tool (such as Sentence-BERT) is used to convert each verb-object structure phrase into a vector and store it as a node attribute. Then, in the time order of the event evolution chain, unidirectional edges between nodes corresponding to adjacent events are established in sequence to build a set of directed edges reflecting the temporal evolution relationship of events. After all nodes and edges are added, a to-be-matched event evolution graph is obtained, which is carried by a directed graph.

[0089] For example, if the to-be-matched event evolution chain is ["claims to be an e-commerce customer service", "informs of abnormal single brushing and commission", "asks to download the APP", "explains the rule of advance payment", "guides high-commission single", "asks for tax", "explains the necessity"], the converted to-be-matched event evolution graph is as shown in Figure 3 The "claims to be an e-commerce customer service" node points to the "informs of abnormal single brushing and commission" node through a unidirectional edge, the "informs of abnormal single brushing and commission" node points to the "asks to download the APP" node through a unidirectional edge, the "asks to download the APP" node points to the "explains the rule of advance payment" node through a unidirectional edge, the "explains the rule of advance payment" node points to the "guides high-commission single" node through a unidirectional edge, the "guides high-commission single" node points to the "asks for tax" node through a unidirectional edge, and the "asks for tax" node points to the "explains the necessity" node through a unidirectional edge. Each node has a corresponding verb-object structure phrase vector as an attribute.

[0090] In step S140, based on a preset event evolution graph, the to-be-matched event evolution graph is subjected to multi-stage graph analysis processing to obtain the number of key nodes, the matching rate of key nodes, and the connectivity of key nodes.

[0091] Optionally, with the preset event evolution graph as a reference benchmark, the constructed to-be-matched event evolution graph is analyzed and processed in multiple stages. First, specific operations such as node matching are performed, and nodes matched with the preset graph are screened out, and then key nodes are identified and the number is counted. Next, combined with the total number of nodes of the to-be-matched event evolution graph, the key node matching rate is calculated. At the same time, the overall connection between the key nodes is analyzed to determine whether they are connected according to the reasonable time sequence logic, and finally the key node number, key node matching rate and key node connectivity are obtained. These key indicators provide a basis for subsequent determination of whether the to-be-matched call is a high-risk call.

[0092] It should be noted that the preset event (fraud) evolution graph (Fraud Event Evolution Graph, FEEG) can be regarded as a compression and fusion result of a group of fraud event evolution chains, and is a unified modeling of multiple fraud script evolution paths. Compared with a single event evolution chain, the graph not only has a high compression representation capability, but also supports continuous updating with new samples, thereby having good scalability and dynamic evolution characteristics. It can solidify the reference framework of the typical evolution logic of events in the form of a graph structure. Its nodes correspond to key units in event evolution (mostly active object structure phrases, containing ID, vector and other attributes), and edges embody the time sequence, causality and other evolution relationships between events. The graph also carries global configurations such as key node definition and connectivity requirements; four core links, namely business target definition, typical event chain analysis, technical modeling and dynamic iteration optimization, are required during construction, and subsequent reference can be made to the to-be-matched event evolution graph to perform node matching, key indicator calculation and other operations, thereby providing a unified benchmark for risk determination (such as high-risk call identification) and solving the problem of judgment deviation caused by the lack of standards during analysis.

[0093] In step S150, based on the key node number, key node matching rate and key node connectivity, it is determined whether the to-be-matched call text is a high-risk call.

[0094] Optionally, the three core indicators of the number of key nodes, the key node matching rate, and the key node connectivity are combined to form a judgment logic: if the number of key nodes matched in the to-be-matched event evolution graph does not reach a preset minimum value (for example, does not meet "at least contains 2 high-risk core nodes"), the high-risk possibility can be preliminarily excluded; the key node matching rate (the ratio of the number of key nodes to the total number of to-be-matched nodes) is used to judge the matching coverage, and if the matching rate is lower than a preset threshold (for example, lower than 60%), it indicates that the to-be-matched call does not have enough degree of fit with the preset fraud evolution logic; if the key nodes do not form effective connectivity according to the time sequence of "identity impersonation -> inducing operation -> demanding property" in the preset graph (for example, the missing "inducing operation" node leads to link breakage), it is determined as a non-typical risk link. Only when the three indicators meet the preset qualified standard at the same time (for example, the number of key nodes is greater than or equal to 3, the matching rate is greater than or equal to 25%, and the connectivity meets the standard), it can be finally determined that the to-be-matched call text is a high-risk call, avoiding false positives or false negatives caused by single indicator judgment. In the case of not relying on negative samples at all, through event evolution chain extraction, key node degree threshold filtering, matching rate calculation, and connectivity detection, a second-level high-risk call judgment is finally realized.

[0095] Among them, the high-risk call refers to the type of call in which the calling side transmits false information through specific speech to make the called party have a false cognition and take actions such as property disposal (such as transfer, recharge), privacy disclosure, and other behaviors that harm their own rights and interests.

[0096] In the embodiments of the present application, by generating an event evolution chain with the calling information as the core and constructing an event evolution graph, and combining the preset event evolution graph to carry out multi-stage graph analysis processing, the dependence on a large number of positive and negative labeled samples in supervised learning is avoided, and only the event distribution extracted from historical fraud calls can be used to realize recognition, without the need to deal with the problems of black sample scarcity, large white sample noise, and rapid label invalidation, and the robustness can still be maintained in the scene of rapid evolution of fraud scripts; the defects of traditional graph construction limited by structured information or high labeling cost are avoided, and the event chain of the subject-object structure is generated with the help of the large language model, which can be reused across scenes without manual labeling, greatly reducing the human input, while accurately capturing the subtle time evolution logic of the fraud speech; and through the dynamic graph structure of "event-evolution-event", the deficiencies of the static knowledge graph that cannot present the fraud causal time sequence and have weak generalization ability are overcome, which can not only accurately restore the complete fraud link, but also realize efficient risk judgment through key node analysis, and finally balance the recall rate and the false positive rate in the telecom fraud prevention scene of few samples, cold start, and continuous drift, significantly improving the accuracy and practicality of high-risk call recognition.

[0097] In an embodiment of the present application, based on the preset event evolution graph, the multi-stage graph analysis processing is performed on the to-be-matched event evolution graph to obtain the number of key nodes, the key node matching rate, and the key node connectivity, which includes:

[0098] matching the nodes of the to-be-matched event evolution graph with the preset event evolution graph to obtain a matching node set;

[0099] identifying key nodes from the matching node set to obtain a key node list, the key node list including the number of key nodes;

[0100] determining a key node matching rate based on the number of key nodes and the number of to-be-matched nodes;

[0101] determining the key node connectivity by judging the connectivity of each key node in the key node list.

[0102] Optionally, first, the to-be-matched event evolution graph and the preset event evolution graph are matched at the node level based on node vector similarity, and nodes with similar semantics are screened out to form a matching node set; then, key nodes that meet a preset standard (such as a total degree exceeding a threshold) are identified from the set based on the node centrality rule in graph theory to form a key node list including the number of key nodes; then, the key node matching rate is calculated by the ratio of the number of key nodes to the total number of nodes in the to-be-matched event evolution graph; finally, connectivity detection is performed on adjacent node pairs in the key node list arranged in chronological order to determine whether they have an effective path that meets the upper limit of the number of edges and the timing logic in the preset graph, and the overall connectivity result is aggregated as the key node connectivity. Through the above operations, the system can quantify the degree of fit between the to-be-matched event and the preset risk evolution pattern from three dimensions of matching degree, number of key nodes, and logical coherence.

[0103] Exemplarily, the number of key nodes is represented as:

[0104] The key node matching rate is represented as:

[0105] ;

[0106] The key node connectivity is represented as:

[0107] The three indicators are finally comprehensively evaluated:

[0108]

[0109] wherein m can be 3 and r can be 0.275. That is, when the key nodes are all connected, the key node number must be greater than or equal to 3 and the key node matching rate must be greater than 0.275 to be identified as a high-risk phone.

[0110] It should be noted that the method is verified based on 3715 evaluation samples, of which 1890 are positive samples and 1825 are negative samples. Under the conditions that the minimum matching number satisfies m≥3 and the matching rate is higher than the threshold value r>0.25, the final experimental results are: the precision is 93.48%, the recall rate is 89.52%, and the F1 value is 91.46%.

[0111] In an embodiment of the present application, the node matching of the to-be-matched event evolution graph and the preset event evolution graph is performed to obtain a matching node set, which includes:

[0112] Obtaining a to-be-matched node set corresponding to the to-be-matched event evolution graph and a preset node set corresponding to the preset event evolution graph;

[0113] Calculating the similarity between each to-be-matched node in the to-be-matched node set and each preset node in the preset node set;

[0114] Based on the similarity calculation result, selecting a preset number of to-be-matched nodes with the highest similarity from the to-be-matched node set and adding them to the initial matching node set;

[0115] From the initial matching node set, filtering out to-be-matched nodes with a similarity greater than a preset similarity threshold to form a final matching node set.

[0116] Optionally, first, extract all nodes of the to-be-matched event evolution graph as the to-be-matched node set, and extract all nodes of the preset event evolution graph as the preset node set; then, based on the node vector, calculate the semantic similarity between each to-be-matched node and each preset node; then, according to the similarity result, select a preset number (such as 3) of preset nodes with the highest similarity for each to-be-matched node from the to-be-matched nodes and include them in the initial matching node set; finally, filter out to-be-matched nodes with a similarity to the corresponding preset node exceeding a preset threshold (such as 0.7) from the initial set to form a final matching node set, thereby ensuring that the matching result contains the most relevant nodes and that the matching quality is guaranteed by the threshold control.

[0117] Exemplarily, suppose the nodes of the to-be-matched graph g are , the node vector set is , the node set in the vector index of the preset event evolution graph G is , the similarity function is (for example, cosine similarity), and the similarity threshold is τ.

[0118] Then the matching node set is as follows:

[0119] ;

[0120] Find Top-K (suggested as 1) most similar nodes in the index for each query vector;

[0121] Threshold screening:

[0122]

[0123] Filter nodes according to threshold τ, only keep nodes with similarity higher than threshold;

[0124] The final output is That is, the node set that meets the conditions.

[0125] In an embodiment of the present application, the key node identification of the matched node set comprises:

[0126] Determine the out-degree and in-degree of each matched node in the matched node set;

[0127] Based on the out-degree and in-degree, calculate the total degree corresponding to each matched node;

[0128] Select the matched node with total degree greater than the preset threshold as the key node.

[0129] Optionally, for the matched nodes, the nodes with higher importance need to be retained through key node filtering, and the unimportant nodes are removed. First, the out-degree (the number of edges from the node to other nodes) and the in-degree (the number of edges from other nodes to the node) of each node in the matched node set are counted; then through the calculation method of "total degree = out-degree + in-degree", the total connection number of each matched node is determined, and the higher the total degree, the stronger the correlation of the node in the event evolution link; finally, a preset threshold of total degree (such as threshold set to 5, i.e. total connection number needs to exceed 5) is set to filter out the matched nodes with total degree greater than the threshold, and the matched nodes are determined as key nodes, so as to accurately locate the nodes that play a core role in the event evolution. Only by filtering through the node degree threshold, the core script nodes such as "request verification code" and "induce download APP" can be automatically screened, and the explanation and robustness are simultaneously improved without additional models.

[0130] Specifically, the key node identification method of Degree Centrality can be used for key node identification, which is specifically as follows:

[0131]

[0132] Wherein, is the in-degree of node v, is the out-degree of node v, and the total degree is ​​In-degree + Out-degree. This method is generally used to measure the "connection degree" of a node in the network, and is often used to find high-connection nodes (such as high-risk accounts, popular commodities, key intermediary nodes, etc.).

[0133] Traverse each node in the sequence, respectively calculate the sum of in-degree and out-degree as the degree of the node, and sequentially add the degree list, and finally return the degree result of the entire sequence. For the total degree greater than d, the final key node output KeyNodes is as follows:

[0134]

[0135] In an embodiment of the present application, the node connectivity of each key node in the key node list is determined to obtain the key node connectivity, which comprises:

[0136] Determine the upper limit of the number of edges between adjacent node pairs in the key node sequence;

[0137] Based on the upper limit of the number of edges, determine the edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence;

[0138] Aggregate all edge path existence indexes to obtain the overall connectivity result;

[0139] Based on the overall connectivity result, the key node connectivity is obtained.

[0140] Optionally, the core of the key node connectivity determination process is to verify the validity of the time sequence association between nodes step by step in logic: first, determine the upper limit of the number of edges between adjacent node pairs in the key node sequence (i.e. the maximum number of hops (jump times) allowed between adjacent key nodes) according to the rules of the preset event evolution graph; Then, according to the upper limit of the number of edges, check whether there is an actual effective path that meets the edge number limit between each pair of adjacent key nodes in the event evolution graph to be matched, and generate an edge path existence index indicating "there is an effective path (e.g. 1)" or "there is no effective path (e.g. 0)"; Then aggregate all existence indexes of adjacent node pairs (e.g. use the "full satisfaction" rule: only when all indexes are 1, it is determined that the overall connectivity is connected, or use the "majority satisfaction" rule: more than 50% of the indexes are 1, it is determined that the overall connectivity is partially connected), to obtain the overall connectivity result; Finally, according to the overall connectivity result, determine the final key node connectivity (e.g. if the overall connectivity is connected, it is determined that the connectivity meets the standard, and if the overall connectivity is not connected, it is determined that the connectivity does not meet the standard), to verify whether the key nodes form a complete evolution link according to the reasonable time sequence logic.

[0141] For example, for a key node sequence ​, the maximum hop number h (e.g. 4);

[0142] Edge path existence: for each pair of adjacent nodes in the sequence , a Boolean variable can be defined as:

[0143] ;

[0144] By performing a logical AND operation on the connectivity of all adjacent node pairs, the overall result is obtained:

[0145] ;

[0146] where ∧ denotes a logical AND.

[0147] The final output is:

[0148] .

[0149] If , it is considered that the key node sequence is connected in the graph; otherwise, it is determined to be disconnected, which can effectively evaluate the time sequence reachability of the key node in the fraud event evolution graph, and provide a structured basis for subsequent high-risk phone discrimination.

[0150] In an embodiment of the present application, before the multi-stage graph analysis processing of the to-be-matched event evolution graph based on the preset event evolution graph, the method further comprises:

[0151] constructing a training data set, the training data set comprising a plurality of training call samples;

[0152] preprocessing each of the training call samples, eliminating the called information and retaining the calling information;

[0153] constructing an event evolution chain extraction prompt word based on the calling information, calling a large language model to generate a training event evolution chain;

[0154] converting the training event evolution chain into a training event evolution graph;

[0155] based on a graph merging algorithm, merging the training event evolution graphs one by one to obtain the preset event evolution graph.

[0156] Optionally, high-risk call data can be collected, such as the summary report from CCL23-Eval Task 6, which can include 102762 pieces of information on telecom fraud cases from the Anti-Fraud Big Data Platform, providing basic samples for subsequent model construction. In addition, multiple (such as 200) desensitized normal call information is obtained from the operator, which is used for subsequent evaluation of the identification model (as "negative samples", compared with "positive samples" of fraud calls, to verify the model's distinguishing ability). Taking fraud calls as an example, since the task focuses on "fraud call identification", the relevant report information of telephone fraud needs to be accurately selected from the original CCL23-Eval case data. The method of "heuristic regular expression filtering" is adopted, which is divided into the following two steps of operation:

[0157] Eliminate irrelevant information: delete information containing the word "telephone" but unrelated to telephone fraud, such as "telephone alarm" (the core is "alarm" behavior, not the fraud telephone itself), "contact telephone" (only as a contact method, without fraud attribute), "the telephone received by the alarm person" (describes the behavior of receiving a telephone, without reflecting fraud), "telephone number" (only the number, without fraud intention), etc.

[0158] Preserve target information: "Preserve report information that matches the regular expression '(.?) received (?:.?) telephone'" (i.e. content describing "receiving a certain type of telephone", which is more consistent with the "fraud telephone call scenario").

[0159] After the final screening, multiple, such as 15312 pieces of telephone fraud case information, are obtained, which provide accurate materials for generating fraud call content in the future.

[0160] From the 15312 pieces of telephone fraud cases selected, 4900 records are randomly extracted, and a large language model (DeepSeek - V3.1 - Chat) is used to simulate the content of the first call of the fraudster. By designing a specific prompt, the model generates call text that conforms to the fraud logic based on the "telephone fraud case background", thereby expanding the "fraud call sample library" to solve the problem of scarcity of fraud call data in real scenarios and high labeling cost, and providing sufficient simulation data for the training or testing of the "fraud call identification model" in the future.

[0161] The prompt for converting the specific report information into the first call fraud telephone is as follows:

[0162]

Role

[0163] You are an anti-telephone fraud expert.

[0164]

Task

[0165] According to the provided case information, simulate the content of the first telephone call between the fraudster and the victim, which is used to identify similar fraud calls.

[0166] [Requirements]

[0167] 1. Fraudsters are represented by A, and victims are represented by B.

[0168] 2. If the case information reflects a phone scam, directly return "non-phone scam".

[0169] 3. Restore the true content of the conversation.

[0170] 4. The output content only contains simulated conversations, without any explanation or additional information.

[0171] [Case Information]

[0172] {{content}}

[0173] At the same time, 200 real conversations were also desensitized and rewritten using a large language model (DeepSeek-V3.1-Chat) for subsequent evaluation of negative samples. The specific desensitization and rewriting prompt is as follows:

[0174] [Task]

[0175] Rewrite the given phone call text.

[0176] [Requirements]

[0177] 1. Both parties are uniformly labeled: the caller is A, and the callee is B.

[0178] 2. If there is only caller information, simulate the callee's conversation content.

[0179] 3. Under the premise of ensuring the naturalness and logic of the conversation, try to restore the actual communication content.

[0180] 4. Must desensitize sensitive information (including but not limited to: name, mobile phone number, ID number, address, bank card number, unit name, etc.).

[0181] 5. The output result only contains the rewritten conversation text, and cannot add explanations, summaries or other additional content.

[0182] [Conversation Content]

[0183] {{content}}

[0184] Finally, a training and evaluation corpus is formed. Among them, the training samples are 4684 (including 26 large model judgments as non-scam phone cases), and the evaluation samples are 400 (200 scam phone calls; 200 ordinary phone calls).

[0185] Then, based on the above constructed training and evaluation corpus, the extraction of event evolution chain is carried out, and the event evolution chain is used to abstractly describe an event set of a fraudster's fraud tactics, which is organized into a list in chronological order, The specific construction method is as follows:

[0186] The original call content in the constructed training corpus is screened, and only the information of the caller (fraudster) is retained, and the information of the called party (victim) is eliminated. The purpose of doing this is to focus only on the expressions of the fraudster in the subsequent "fraud tactics extraction", because the core of fraud identification is "how the fraudster guides the victim through the tactics", and the response of the called party is relatively secondary. Retaining the caller information can more accurately capture the intentions and guidance process of the fraudster.

[0187] Based on the "caller call content" obtained after preprocessing, a special prompt (prompt word) is designed, and then a large language model (DeepSeek-V3.1-Chat) is called to generate an event evolution chain of no more than 10 steps. For example: ["claims to be an e-commerce customer service", "informs about single return commission", "asks to download APP", "explains the rules of advance payment", "guides high-commission single", "asks for tax", "explains the necessity", "urges to pay the margin", "promises to return the money", "urges to clear the account"].

[0188] This zero-shot event evolution chain extraction method can well extract the intentions and tactics of the caller in the form of verb-object phrases, forming an abstract, generalized and event development order evolution process. The semantic abstraction paradigm of the verb-object phrase corresponds to the event type enumeration (identity declaration, cause explanation, appeal presentation, motivation explanation, result commitment, action guidance).

[0189] The detailed prompt template extracted is as follows:

[0190]

Task

[0191] 1. For the speech content of the caller, identify and extract the core tactics that can reflect the intentions of the caller.

[0192] 2. Abstract and generalize these tactics into semantic complete verb-object phrase structures (events).

[0193] 3. According to the time sequence of the call, string the events into an event evolution list to depict the development process of the caller's intentions.

[0194]

Requirements

[0195] 1. Output the events in chronological order of the call to form an event evolution chain.

[0196] 2. Each chain has no more than 10 events, and only the key turning points are retained.

[0197] 3. Common event types include:

[0198] * Identity claim (claiming identity)

[0199] * Cause explanation (informing problem / reason)

[0200] * Appeal (requesting certain behavior)

[0201] * Motivation explanation (explaining reason / emphasizing necessity)

[0202] * Result commitment (commitment to solve problems / benefits)

[0203] * Action guidance (pointing to next step operation)

[0204] 4. Output strictly according to the output format, do not include irrelevant content.

[0205] [Output format]

[0206] ["event 1 (dative phrase)", "event 2 (dative phrase)", "event 3 (dative phrase)"]

[0207] [Call caller information]

[0208] {{content}}

[0209] Convert all the above extracted fraud phone event evolution chains into evolution graphs, merge similar event nodes through semantic similarity, form a highly compressed, incrementally expandable dynamic graph, so that the same fraud script of various tactics variants can be normalized to the same main trunk, and realize zero-shot generalization to new variants.

[0210] Then each evolution graph is merged one by one, and then a complete fraud event evolution graph is obtained, that is, as a preset event evolution graph. The fraud event evolution graph is a highly compressed and incrementally expandable collection of fraud event evolution chains. Its nodes are events (events) represented by dative phrases, and edges are the evolution time sequence relationship of events. With "event-evolution-event" as the skeleton, multiple zero-shot extracted event chains are fused by semantic similarity, nodes are merged, and vectors are updated to form an incrementally expandable dynamic graph, solving the problems of traditional KG static, redundancy, and poor generalization.

[0211] Among them, the fraud event evolution graph G can be represented as:

[0212] ;

[0213] , represents the node set

[0214] where (u,v) denotes a directed edge from u to v

[0215] Define attributes for nodes (e.g. event, embedding).

[0216] It is noted that the merging of event evolution graphs is a recursive process, first a first event evolution graph is constructed according to the above method, then for each new graph read, the graph merging algorithm is called to merge it with the merged large graph again according to the similarity threshold, thereby constantly expanding and fusing the existing graph structure, and finally forming a whole graph. The core graph merging algorithm is as follows:

[0217] Input: two graphs , ; similarity threshold τ.

[0218] Specifically, by using a preset graph operation tool, such as the Compose algorithm based on NetworkX , the nodes with the same ID in g1 and g2 are merged into a large graph , where the node .

[0219] For each node of g1 and each node of g2, if , the embedding attribute values of nodes u and v are obtained, and the cosine similarity is calculated:

[0220] ;

[0221] If , the nodes u and v in are merged: . And the embedding vector of the merged node is updated to the average value of the embedding of the two nodes:

[0222] ;

[0223] The merged graph is taken as g1 of the next merging process, and the process is repeated until all graphs are merged into a unified large graph G.

[0224] Finally, the above constructed preset event evolution graph can be stored in the memory, and here the complete graph needs to be written into the Neo4j database for persistence and to provide support for subsequent graph search. First, a vector index (fraud_embedding_idx) is newly created to enable the embedding attribute of the node to have retrieval capability based on cosine similarity; then the transmitted event evolution graph G is traversed, each node is written into Neo4j, and is given a label Fraud and attributes (node ID and corresponding vector embedding); finally, the edges in the graph are traversed to establish a NEXT type directed relationship between the related nodes in Neo4j to represent the time sequence evolution dependence between events, thereby completing the writing and reconstruction of the entire graph structure from NetworkX to Neo4j. The following is an example of a local situation of the graph searched by the Explore tool after writing into Neo4j, as shown in Figure 4

[0225] At this point, the entire fraud event evolution graph construction is completed, and only based on a type of sample of fraud calls, the normal calls can be modeled without normal calls.

[0226] In an embodiment of the present application, each event in the to-be-matched event evolution chain is a verb-object structure phrase, and the converting the to-be-matched event evolution chain into a to-be-matched event evolution graph comprises:

[0227] Based on a preset graph operation tool, a directed graph object is constructed as a basic carrier of the to-be-matched event evolution graph;

[0228] Traversing the to-be-matched event evolution chain converted into a verb-object structure phrase, each verb-object structure phrase is directly taken as a node ID in the basic carrier;

[0229] Using a preset text vector generation tool, each verb-object structure phrase taken as a node ID is vector-converted to obtain a vector representation corresponding to the verb-object structure phrase as a node attribute;

[0230] According to the time sequence of the events in the to-be-matched event evolution chain, the nodes corresponding to adjacent events are associated, and a one-way edge is added between adjacent nodes to form a directed edge reflecting the event evolution logic.

[0231] ​Optionally, based on the graph construction requirement, an empty directed graph object is created as a basic carrier for carrying event relationships by means of a preset graph operation tool (such as NetworkX or Deep Graph Library); then each phrase in the to-be-matched event evolution chain converted into a verb-object structure (such as "self-service") is directly taken as the unique ID of a node in the basic carrier, ensuring that the node and the event are one-to-one corresponding at the semantic level; then the verb-object phrase corresponding to each node ID is converted into a vector representation by means of a preset text vector generation tool (such as Sentence-BERT), and stored in the graph as a node attribute, providing feature support for subsequent node matching; finally, the nodes corresponding to adjacent events in the to-be-matched event evolution chain are associated according to the time sequence of the events, and a one-way edge is added between the front and rear nodes, so as to form a to-be-matched event evolution graph that can intuitively reflect the complete evolution logic of the event from "initial intent" to "final behavior".

[0232] In the embodiments of the present application, by generating an event evolution chain with the caller information as the core and constructing an event evolution graph, and carrying out multi-stage graph analysis processing in combination with a preset event evolution graph, the dependence on a large number of positive and negative labeled samples in supervised learning is avoided, and only the event distribution refined from historical fraud calls can be used for recognition, without the problems of lack of black samples, large noise of white samples, and rapid invalidation of labels, and the robustness can still be maintained in the scene of rapid evolution of fraud scripts; the defects of traditional graph construction limited by structured information or high labeling cost are avoided, and the verb-object structure event chain is generated by means of a large language model without the need for manual labeling, so that the event evolution graph can be reused across scenes, greatly reducing the human input, while accurately capturing the delicate time evolution logic of fraud tactics; and through the dynamic graph structure of "event-evolution-event", each fraud call is abstracted into an event evolution chain by means of a large language model, and then similar nodes are fused by means of semantic similarity, so as to form a highly compressed and incrementally expandable fraud event evolution graph, which overcomes the defects of static knowledge graph that cannot present the fraud causal time sequence and has weak generalization ability, and the graph not only retains the time sequence causality of "identity impersonation-threat intimidation-inducing transfer", but also can detect the key node connectivity to complete the risk determination in seconds, so as to finally balance the recall rate and the false alarm rate in the scene of telecom fraud prevention with few samples, cold start and continuous drift, and significantly improve the accuracy and practicality of high-risk call recognition, and the precision and generalization ability of the fraud call recognition model.

[0233] It should be understood that the size of the serial number of each step in the above embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0234] In an embodiment, a high-risk call identification device is provided, which corresponds to the high-risk call identification method in the above-mentioned embodiments. As shown in FIG. 25, the high-risk call identification device includes a to-be-matched call text preprocessing unit 10, an event evolution chain generation unit 20, an event evolution graph generation unit 30, a graph analysis processing unit 40, and a high-risk call determination unit 50. The functions of each module are described in detail as follows: Figure 5

[0235] The to-be-matched call text preprocessing unit 10 is configured to obtain to-be-matched call text, preprocess the to-be-matched call text, and remove called information and retain calling information.

[0236] The event evolution chain generation unit 20 is configured to construct an event evolution chain extraction prompt word based on the calling information, and call a large language model to generate a to-be-matched event evolution chain.

[0237] The event evolution graph generation unit 30 is configured to convert the to-be-matched event evolution chain into a to-be-matched event evolution graph.

[0238] The graph analysis processing unit 40 is configured to perform multi-stage graph analysis processing on the to-be-matched event evolution graph based on a preset event evolution graph atlas, to obtain a number of key nodes, a key node matching rate, and key node connectivity.

[0239] The high-risk call determination unit 50 is configured to determine whether the to-be-matched call text is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity.

[0240] In an embodiment of the present application, the graph analysis processing unit 40 is further configured to:

[0241] perform node matching on the to-be-matched event evolution graph and the preset event evolution graph atlas to obtain a matched node set;

[0242] perform key node identification on the matched node set to obtain a key node list, the key node list including the number of key nodes;

[0243] determine the key node matching rate based on the number of key nodes and a to-be-matched node number;

[0244] perform node connectivity determination on each key node in the key node list to obtain the key node connectivity.

[0245] In an embodiment of the present application, the graph analysis processing unit 40 is further configured to:

[0246] obtain a to-be-matched node set corresponding to the to-be-matched event evolution graph, and a preset node set corresponding to the preset event evolution graph atlas; ​

[0247] performing similarity calculation on each to-be-matched node in the to-be-matched node set and each preset node in the preset node set;

[0248] based on the similarity calculation result, selecting a preset number of to-be-matched nodes with the highest similarity from the to-be-matched node set, and adding the to-be-matched nodes to the initial matched node set;

[0249] filtering, from the initial matched node set, to-be-matched nodes with a similarity greater than a preset similarity threshold, to form a final matched node set.

[0250] In an embodiment of the present application, the graph analysis processing unit 40 is further configured to:

[0251] determine the out-degree and in-degree of each matched node in the matched node set;

[0252] based on the out-degree and in-degree, calculate the total degree corresponding to each matched node;

[0253] select a matched node with a total degree greater than a preset threshold as the key node.

[0254] In an embodiment of the present application, the graph analysis processing unit 40 is further configured to:

[0255] determine an upper limit of the number of edges of a path between a pair of adjacent nodes in the key node sequence;

[0256] based on the upper limit of the number of edges, determine an edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence;

[0257] aggregate all edge path existence indexes to obtain an overall connectivity result;

[0258] based on the overall connectivity result, obtain the key node connectivity.

[0259] In an embodiment of the present application, the device further comprises a preset event evolution graph construction unit, which is further configured to:

[0260] construct a training data set, the training data set comprising a plurality of training call samples;

[0261] preprocess each training call sample, eliminating called information and retaining calling information;

[0262] based on the calling information, construct an event evolution chain extraction prompt word, and call a large language model to generate a training event evolution chain;

[0263] convert the training event evolution chain into a training event evolution graph;

[0264] Based on a graph merging algorithm, the training event evolution graphs are merged one by one to obtain the preset event evolution graph atlas.

[0265] In an embodiment of the present application, each event in the to-be-matched event evolution chain is a verb-object structure phrase, and the event evolution graph generation unit 30 is further configured to:

[0266] Based on a preset graph operation tool, a directed graph object is constructed as a basic carrier of the to-be-matched event evolution graph;

[0267] The to-be-matched event evolution chain converted into verb-object structure phrases is traversed, and each verb-object structure phrase is directly taken as a node ID in the basic carrier;

[0268] A preset text vector generation tool is used to perform vector conversion on each verb-object structure phrase taken as a node ID to obtain a vector representation corresponding to the verb-object structure phrase as a node attribute;

[0269] According to the time sequence of the events in the to-be-matched event evolution chain, the nodes corresponding to adjacent events are associated, a one-way edge is added between adjacent nodes, and a directed edge reflecting the event evolution logic is formed.

[0270] In an embodiment of the present application, by generating an event evolution chain with the calling information as the core and constructing an event evolution graph, and combining a preset event evolution graph atlas to carry out multi-stage graph analysis processing, the dependence on a large number of positive and negative labeled samples in supervised learning is eliminated, and only the event distribution refined from historical fraud calls can be used for recognition without the need to deal with the problems of black sample scarcity, large white sample noise, and rapid label invalidation, and the robustness can still be maintained in the scene of rapid evolution of fraud scripts; the defects of traditional graph construction limited by structured information or high labeling cost are avoided, and the event chain of the verb-object structure is generated by means of the large language model without the need for manual labeling, which can be reused across scenes, greatly reducing the human input while accurately capturing the delicate time evolution logic of the fraud tactics; and through the dynamic graph structure of “event-evolution-event”, each fraud call is abstracted into an event evolution chain by means of the large language model, and then similar nodes are fused by means of semantic similarity to form a highly compressed and incrementally expandable fraud event evolution graph atlas, which overcomes the shortcomings of static knowledge graphs, such as inability to present the causal time sequence of fraud and weak generalization ability, and the graph atlas not only retains the time sequence and causality of “identity impersonation-threat intimidation-inducing transfer”, but also can detect the connectivity of key nodes to complete risk determination in seconds, finally achieving a balance between recall rate and false positive rate in the scene of telecom fraud prevention with few samples, cold start, and continuous drift, significantly improving the accuracy and practicality of high-risk call recognition and the precision and generalization ability of the fraud call recognition model.

[0271] The specific definition of the high-risk call identification device can refer to the definition of the high-risk call identification method in the foregoing, and will not be repeated here. Each module in the high-risk call identification device described above can be implemented by software, hardware, and a combination thereof, in whole or in part. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to each module.

[0272] In an embodiment, a computer device is provided, which can be a terminal device, and an internal structure diagram of the computer device can be as shown in Figure 6 The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a readable storage medium. The readable storage medium stores computer readable instructions. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer readable instructions are executed by the processor to implement a high-risk call identification method. The readable storage medium provided in the embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0273] In the embodiments of the present application, a computer device is provided, which includes a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, and the processor executes the computer readable instructions to implement the steps of the high-risk call identification method described above.

[0274] In the embodiments of the present application, a readable storage medium is provided, which stores computer readable instructions, and the computer readable instructions are executed by the processor to implement the steps of the high-risk call identification method described above.

[0275] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through computer readable instructions, and the computer readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When the computer readable instructions are executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0276] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of functional units and modules is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above.

[0277] The above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for identifying high-risk calls, characterized in that, The method comprises: acquiring a call text to be matched, preprocessing the call text to be matched, eliminating called information and retaining called information; constructing an event evolution chain extraction prompt word based on the called information, calling a large language model to generate an event evolution chain to be matched; converting the event evolution chain to be matched into an event evolution graph to be matched; based on a preset event evolution graph, performing multi-stage graph analysis processing on the event evolution graph to be matched to obtain a key node number, a key node matching rate, and key node connectivity; based on the key node number, the key node matching rate, and the key node connectivity, determining whether the call text to be matched is a high-risk call.

2. The high risk call identification method of claim 1, wherein, The multi-stage graph analysis processing based on the preset event evolution graph on the event evolution graph to be matched to obtain the key node number, the key node matching rate, and the key node connectivity comprises: performing node matching on the event evolution graph to be matched and the preset event evolution graph to obtain a matching node set; performing key node identification on the matching node set to obtain a key node list, the key node list comprising the key node number; based on the key node number and a to-be-matched node number, determining the key node matching rate; performing node connectivity determination on each key node in the key node list to obtain the key node connectivity.

3. The high risk call identification method of claim 2, wherein, The node matching on the event evolution graph to be matched and the preset event evolution graph to obtain the matching node set comprises: acquiring a to-be-matched node set corresponding to the event evolution graph to be matched and a preset node set corresponding to the preset event evolution graph; performing similarity calculation on each to-be-matched node in the to-be-matched node set and each preset node in the preset node set; based on the similarity calculation result, selecting a preset number of to-be-matched nodes with the highest similarity from the to-be-matched node set and adding them to an initial matching node set; from the initial matching node set, filtering out to-be-matched nodes with a similarity greater than a preset similarity threshold to form a final matching node set.

4. The high risk call identification method of claim 2, wherein, The key node identification on the matching node set comprises: determining the out-degree and in-degree of each matching node in the matching node set; based on the out-degree and in-degree, calculating a total degree corresponding to each matching node; selecting a matching node with a total degree greater than a preset threshold as the key node.

5. The high risk call identification method of claim 2, wherein, The node connectivity determination on each key node in the key node list to obtain the key node connectivity comprises: determining an upper limit of the number of edges of a path between adjacent nodes in a key node sequence; based on the upper limit of the number of edges, determining an edge path existence index corresponding to each pair of adjacent key nodes in the key node sequence; aggregating all edge path existence indexes to obtain an overall connectivity result; based on the overall connectivity result, obtaining the key node connectivity.

6. The high-risk call identification method of any one of claims 1-5, wherein, Before the multi-stage graph analysis processing based on the preset event evolution graph on the event evolution graph to be matched, the method further comprises: building a training data set, the training data set comprising a plurality of training call samples; preprocessing each training call sample to eliminate called information and retain called information; construct an event evolution chain extraction prompt word based on the calling information, call a large language model to generate a training event evolution chain; convert the training event evolution chain into a training event evolution graph; based on a graph merging algorithm, merge the training event evolution graph one by one to obtain the preset event evolution graph.

7. The high risk call identification method of any one of claims 1-5, wherein, Each event in the to-be-matched event evolution chain is a verb-object structure phrase, and converting the to-be-matched event evolution chain into a to-be-matched event evolution graph comprises: based on a preset graph operation tool, construct a directed graph object as a basic carrier of the to-be-matched event evolution graph; traverse the to-be-matched event evolution chain converted into a verb-object structure phrase, and directly take each verb-object structure phrase as a node ID in the basic carrier; using a preset text vector generation tool, perform vector conversion on each verb-object structure phrase as a node ID to obtain a vector representation corresponding to the verb-object structure phrase as a node attribute; according to the time sequence of the events in the to-be-matched event evolution chain, associate the nodes corresponding to adjacent events, add a one-way edge between adjacent nodes, and form a directed edge reflecting the event evolution logic.

8. A high risk call identification apparatus characterized by, The device comprises: a to-be-matched call text preprocessing unit configured to obtain to-be-matched call text, preprocess the to-be-matched call text, and remove called information while retaining calling information; an event evolution chain generation unit configured to construct an event evolution chain extraction prompt word based on the calling information, and call a large language model to generate a to-be-matched event evolution chain; an event evolution graph generation unit configured to convert the to-be-matched event evolution chain into a to-be-matched event evolution graph; a graph analysis processing unit configured to perform multi-stage graph analysis processing on the to-be-matched event evolution graph based on a preset event evolution graph, and obtain a number of key nodes, a key node matching rate, and key node connectivity; a high-risk call determination unit configured to determine whether the to-be-matched call text is a high-risk call based on the number of key nodes, the key node matching rate, and the key node connectivity.

9. A computer device comprising a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, wherein, The processor executes the computer readable instructions to implement the steps of the high-risk call identification method of any one of claims 1-7.

10. A readable storage medium, the readable storage medium storing computer readable instructions, characterized in that, The computer readable instructions are executed by the processor to implement the steps of the high-risk call identification method of any one of claims 1-7.

Images