Telecommunication network fraud damage mode analysis method

Abstract

The invention discloses a telecommunication network fraud damage mode analysis method, which belongs to the technical field of mode analysis, and comprises the following steps of: through an LERT model, carrying out part-of-speech tagging, named entity recognition and dependency syntax analysis on sentences in a desensitization alarm text to obtain trigger words so as to form embedded vectors; through a MoE model, according to the embedded vector, obtaining weight coefficients corresponding to a plurality of experts, so as to screen the previous expert to execute processing, and combining to obtain a processing result, so as to obtain a candidate argument tag corresponding to each trigger word, and form an output tag sequence corresponding to the sentence; and according to the tag sequence, in combination with the embedded vector, obtaining a classification role tag through a softmax classification layer of the MoE model. Through the design of the multi-task collaborative architecture and the MoE model, the problems of feature expression singleness, behavior association fragmentation, event extraction and mode mining disjunction, insufficient dynamic adaptability and the like are effectively solved.

Description

Technical Field

[0001] This invention belongs to the field of pattern analysis technology, specifically relating to a method for analyzing victim patterns in telecommunications network fraud. Background Technology

[0002] With the rapid development of information technology, telecommunications and online fraud crimes are exhibiting new characteristics of intelligence, cross-platform operation, and organization, seriously threatening citizens' property security and social stability. Traditional anti-fraud technology systems mainly rely on rule engines and shallow machine learning models to identify fraudulent behavior through single-dimensional features (such as call frequency, geographical location, and SMS keywords).

[0003] However, when faced with increasingly sophisticated fraud methods, such methods reveal a dual bottleneck: limited feature representation and fragmented behavioral connections. For example, fraudsters often commit crimes through a multi-stage, cross-platform modus operandi: "short video lead generation → social media inducement → cryptocurrency transfer." Traditional technologies struggle to capture such dynamically evolving behavioral chains, resulting in low identification rates.

[0004] To address these challenges, academia and industry have gradually introduced Natural Language Processing (NLP) and deep learning technologies to drive the evolution of telecom fraud analysis from rule-driven to data-driven approaches. Early research employed a pipeline paradigm, processing heterogeneous data such as text analysis, communication behavior analysis, and financial transaction analysis separately, and building independent models for each. For example, key information was first extracted using Named Entity Recognition (NER), and then a classification model was used to determine the type of fraud. However, this separate processing approach has significant drawbacks, including conflicting task objectives and low data utilization efficiency. Specifically, event detection models pursue global classification accuracy, while argument extraction requires local semantic focus, and sharing parameters can easily lead to performance degradation. Furthermore, false detection results from early modules can continuously pollute subsequent analysis processes, creating an error accumulation effect that severely impacts the accuracy of the final analysis.

[0005] In recent years, some studies have attempted to alleviate the aforementioned problems by employing end-to-end joint extraction models (such as joint annotation frameworks) or multi-task learning. However, these methods remain insufficient when dealing with the highly heterogeneous and dynamically evolving complex scenario of telecommunications fraud. Existing technologies generally suffer from technical problems in addressing telecommunications network fraud, such as shallow multimodal feature fusion, disconnect between event extraction and pattern mining, and a lack of spatiotemporal context support for association rules.

[0006] Therefore, there is an urgent need to provide a method for analyzing victim patterns in telecommunications network fraud that can deeply integrate multi-dimensional semantic features and achieve closed-loop optimization of joint extraction of event elements and pattern mining, so as to effectively identify the dynamic evolution of fraud behavior. Summary of the Invention

[0007] This invention provides a method for analyzing victim patterns in telecommunications network fraud. This method can deeply integrate multi-dimensional semantic features and achieve closed-loop optimization of event element extraction and pattern mining to effectively identify the dynamic evolution of fraudulent behavior.

[0008] The technical solution adopted in this invention is as follows: A method for analyzing victim patterns in telecommunications network fraud includes: Using the LERT model, trigger words are obtained from sentences in de-identified police alert texts through part-of-speech tagging, named entity recognition, and dependency parsing, in order to form embedding vectors; Using the MoE model, weight coefficients are obtained for multiple experts based on the embedding vectors, in order to select the top experts. Each expert performs the processing, and the results are combined to obtain the candidate argument labels corresponding to each trigger word, forming the output label sequence corresponding to the sentence; Based on the label sequence and the embedding vector, the classification role labels are obtained through the softmax classification layer of the MoE model.

[0009] The method for analyzing victim patterns in telecommunications network fraud disclosed in this invention also has the following additional technical features: The loss function for training the LERT model is as follows: , in, , This indicates the loss of the task based on the trigger word prediction. This represents the loss from part-of-speech tagging. This represents the loss of the named entity recognition task. This indicates the loss in dependency parsing tasks. This represents the scaling factor for each task. The training step size is determined by the gradient variables of the predictions from neighboring models. This indicates scaling the learning speed.

[0010] The weighting coefficients for multiple experts are obtained as follows: According to the embedding vector Through the Softmax mechanism, the processing of each expert is obtained. The weight, , in, It is a trainable weight matrix. The feature dimensions of the input token. Number of representative experts.

[0011] Filter the first One expert will perform the processing, specifically: According to the weight Determine the embedding vectors respectively The corresponding K experts perform the processing task and obtain .

[0012] The combined processing results are as follows: According to the weight Regarding the task processing results Execute weighted, , The combined results are used to obtain candidate argument labels through the softmax mechanism.

[0013] Based on the label sequence and the embedding vector, the classification role labels are obtained through the softmax classification layer of the MoE model, specifically as follows: According to the tag sequence Combined with the embedding vector corresponding to sentence X in the text The vector representation sequence of the labels is obtained. and the event category vector corresponding to the label sequence. ; Sequences represented by vectors of labels and event category vectors Obtain the category / role tags.

[0014] Obtain the event category vector corresponding to the label sequence. Specifically: Based on the candidate argument labels in the label sequence Establish a mapping relationship between the candidate argument tags and event categories to obtain an event category vector, wherein the event category includes at least one of traffic generation, inducement, and transfer.

[0015] Sequences represented by vectors of labels and event category vectors The categorized role tags are as follows: Represent the sequence using vectors and event category vectors By using the weight scores of the dot product attention layer, , in, ; According to the weighted score For event category vectors Weighted summaries yield attention scores. , To obtain the final classification and role tags.

[0016] The methods for analyzing victim patterns in telecommunications network fraud also include: Based on the classification role labels, the association rules between the two police incidents are obtained, and the support and confidence levels are determined. , , A set of risk behavior patterns is obtained to optimize the MoE model.

[0017] The present invention further discloses a processing apparatus, comprising: Memory, used to store computer programs; A processor is used to implement the steps of the telecommunications network fraud victim analysis method when executing the computer program.

[0018] Due to the adoption of the above technical solution, the beneficial effects achieved by this invention are as follows: 1. In this invention, the LERT model performs part-of-speech tagging, named entity recognition, and dependency parsing on sentences in de-identified police reports to obtain trigger words and form embedding vectors. Through a multi-task collaborative architecture, the LERT model can more comprehensively capture multi-dimensional semantic features in the text, thereby improving the ability to identify complex fraudulent behaviors.

[0019] Based on the embedding vectors, the MoE model calculates the weight coefficients of multiple experts, selects the top K experts for processing, and combines them to obtain the processing results. This generates candidate argument labels for each trigger word, forming the output label sequence corresponding to the sentence. The MoE model achieves joint extraction of trigger words for different events through a dynamic routing mechanism and a Top-K expert selection strategy. By generating weight coefficients, the Top-K expert network is activated to participate in the calculation. This design allows the model to adaptively select the most suitable expert network based on the characteristics of the input data, improving the recognition accuracy for different event types. The model can dynamically adjust the selection of experts according to specific semantic patterns, enhancing its ability to capture long-tail events.

[0020] By dynamically weighting and fusing the original text features extracted by the LERT model with the event classification label sequence, the model not only enhances its attention to local semantics but also better handles the correlations between different events. The softmax classification layer of the MoE model further enhances its fine-grained classification capability for role labels, ensuring that the model maintains high accuracy and recall when facing new fraud methods.

[0021] In summary, this invention effectively solves problems such as the lack of single feature representation, fragmented behavior association, disconnect between event extraction and pattern mining, and insufficient dynamic adaptability through the design of a multi-task collaborative architecture and the MoE model. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart illustrating the method for analyzing victim patterns in telecommunications network fraud according to one embodiment of the present invention. Figure 2 This is a schematic diagram illustrating the result of obtaining trigger words from sentences in desensitized police alert text according to one embodiment of the present invention; Figure 3 This is a flowchart illustrating the LERT model according to one embodiment of the present invention; Figure 4 This is a flowchart illustrating the MOE model according to one embodiment of the present invention; Figure 5 This is a schematic diagram illustrating the process of obtaining categorized role tags according to one embodiment of the present invention. Detailed Implementation

[0023] To more clearly illustrate the overall concept of the present invention, a detailed description will be provided below with reference to the accompanying drawings and examples.

[0024] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0025] like Figure 1 As shown, a method for analyzing victim patterns in telecommunications network fraud includes: S100: Through the LERT model (e.g.) Figure 3 As shown), for sentences in the de-identified police alert text, trigger words (such as...) are obtained through part-of-speech tagging, named entity recognition, and dependency parsing. Figure 2 As shown, to form an embedding vector.

[0026] The core objective of this step is to accurately extract key trigger words for fraudulent behavior from de-identified police reports using multi-task collaborative processing technology, and generate high-quality embedding vectors to provide structured input for subsequent event extraction and pattern analysis.

[0027] In telecommunications fraud scenarios, textual data often contains complex semantic relationships (such as manipulative dialogue and transfer instructions), requiring Natural Language Processing (NLP) techniques to analyze its underlying structure. Part-of-speech tagging (POS) identifies function words (such as verbs and nouns) in the text, helping to pinpoint the trigger points of fraudulent activities. Named entity recognition (NER) extracts key entities (such as names of people, organizations, and amounts) to clarify the subject and object of the fraudulent activity. Dependency parsing analyzes sentence structure (such as subject-verb and verb-object relationships) to reveal the causal chain of the fraudulent activity. Finally, embedding vectors are generated, transforming the text into a numerical representation that can be processed by machine learning models, providing input for subsequent event extraction.

[0028] The input content is anonymized alert text (e.g., "User A received a text message: 'Click the link to receive a red envelope'"). It should be noted that preprocessing is required, including word segmentation, punctuation removal, and standardization of format (e.g., timestamps are standardized to ISO 8601).

[0029] For the input data, part-of-speech tagging (POS) is performed, using the LERT model to assign part-of-speech tags (such as "click / V" and "link / NN") to each word in the text. By combining a rule engine with a statistical model, the accuracy of identifying special words (such as "inducement" and "transfer") in fraudulent texts is improved.

[0030] In addition, Named Entity Recognition (NER) is performed to identify entities in the text (such as "red envelope / ORG" and "user A / PER"). Deep learning models (such as BERT-CRF) are used, combined with a domain dictionary (such as common fraud terms) to optimize entity boundary detection.

[0031] Furthermore, dependency parsing is performed to resolve the dependencies between sentence components (e.g., "click → link (verb-object)"). Based on the dependency tree structure, the core verbs of fraudulent behavior (e.g., "induce" and "deceive") and their associated objects are extracted.

[0032] Embedding vectors are generated by taking the results of POS, NER, and dependency parsing as input to the LERT model. A Transformer encoder then generates context-aware embedding vectors (768 dimensions). These embedding vectors integrate features from POS, NER, and dependency parsing, more accurately reflecting the context of fraudulent behavior (e.g., the causal chain of "clicking a link → receiving a red envelope"). Structured outputs (e.g., trigger word tag sequences) provide clear input for subsequent event extraction in the MoE model, reducing redundant computation.

[0033] This step achieves efficient parsing of telecom fraud texts through multi-task collaborative processing and a dynamic loss balancing mechanism.

[0034] S200: such as Figure 4 As shown, using the MoE model, weight coefficients corresponding to multiple experts are obtained based on the embedding vector, in order to filter out the top experts. Each expert performs the processing, and the results are combined to obtain candidate argument labels for each trigger word, forming an output label sequence for the sentence.

[0035] The core objective of this step is to accurately identify candidate argument labels corresponding to trigger words in telecom fraud texts through the dynamic routing mechanism of the hybrid expert (MoE) model and the Top-K expert screening strategy, and to generate a structured output label sequence, providing efficient and accurate input for subsequent event extraction.

[0036] In telecom fraud texts, trigger words (such as "inducement" and "transfer") often have complex relationships with multiple candidate arguments (such as "victim" and "fraudster"). Traditional methods process all inputs through a single model, making it difficult to balance accuracy and efficiency.

[0037] Based on the input embedding vector (e.g., 768-dimensional), ensure compatibility with the MoE model. Perform a nonlinear transformation on the embedding vector to generate weight coefficients for each expert. Select the top K experts with the highest weights (e.g., Top-5) and activate their corresponding subnetworks to process the input.

[0038] The outputs of the Top-K experts are weighted and summed to generate the final candidate argument labels. These are then combined to obtain the output label sequence corresponding to the sentence.

[0039] The Top-K expert screening strategy reduces redundant computation, and experimental data shows that it improves processing speed. This step achieves efficient association between trigger words and arguments in telecom fraud texts through dynamic routing, Top-K expert screening, and weighted aggregation.

[0040] S300: such as Figure 5 As shown, based on the label sequence and the embedding vector, the classification role labels are obtained through the softmax classification layer of the MoE model.

[0041] The core objective of this step is to generate classification role labels corresponding to trigger words in telecom fraud texts by combining the softmax classification layer of the MoE model with label sequences and embedding vectors, thereby completing the final structured output of event extraction.

[0042] In telecom fraud scenarios, trigger words (such as "inducement" and "transfer") need to be clearly associated with specific argument roles (such as "victim," "fraudster," and "transfer amount"). Traditional classification methods (such as single-layer Softmax) struggle to handle complex contextual dependencies, while this solution achieves more accurate role labeling through the classification layer of the MoE model.

[0043] To fuse the tag sequence and embedding vector, the tag sequence needs to be encoded beforehand and concatenated with the embedding vector to form a joint input. The Softmax classification layer of the MoE model is used to calculate the probability distribution of the joint input. Based on the Softmax probability distribution, the role tag with the highest confidence (such as "victim" or "transfer target") is selected.

[0044] By fusing embedding vectors and label sequences, the model can accurately identify causal chains in fraud incidents (such as "inducement → transfer" and "victim → account"), enhancing semantic understanding capabilities. This step achieves accurate mapping between trigger words and classification role labels in telecom fraud texts through the Softmax classification layer of the MoE model, combined with label sequences and embedding vectors.

[0045] In a preferred embodiment of the present invention, the loss function for training the LERT model is specifically: , in, , This indicates the loss of the task based on the trigger word prediction. This represents the loss from part-of-speech tagging. This represents the loss of the named entity recognition task. This indicates the loss in dependency parsing tasks. This represents the scaling factor for each task. The training step size is determined by the gradient variables of the predictions from neighboring models. This indicates scaling the learning speed.

[0046] The core objective of this implementation method is to dynamically adjust the contribution of each auxiliary task (part-of-speech tagging, named entity recognition, and dependency parsing) to the total loss in multi-task learning, thereby solving the problem of gradient conflicts caused by inconsistent convergence speeds of tasks in multi-task training. This allows auxiliary tasks to participate in model optimization in an orderly manner while ensuring the performance of the main task (trigger word prediction), thus improving the overall representation capability and final effect of the model.

[0047] The loss function calculation revolves around the sum of the main task loss and the dynamic ratio multiplied by the auxiliary task loss. To calculate the loss of the main task (trigger word prediction), first calculate the loss of the trigger word prediction task. Error feedback, as the core objective of the model, ensures that training is always anchored to the main task.

[0048] Calculate the loss for each auxiliary task, and calculate the part-of-speech tagging loss separately. Named entity recognition loss Dependency parsing loss This quantifies the prediction errors of each auxiliary task, providing a basis for subsequent weighted calculations.

[0049] Dynamically calculate the scaling factor for each task. , scaling factor Where: t is the model training step size, reflecting the training progress: a smaller step size represents the early stage of training, and a larger step size represents the later stage of training). The scaling learning speed for task j controls the growth rate of the scaling factor; different settings can be applied to different tasks. Each is adapted to its own convergence characteristics.

[0050] This implementation achieves dynamic growth of the scaling factor with the training step size by minimizing the ratio of the step size to the scaling variable to 1. In the early stages of training, t is small. Small; t approaches in the later stages of training , Close to 1.

[0051] Combined loss yields total loss Losses from various auxiliary tasks (Multiplied by the corresponding dynamic scaling factor) Sum the results to obtain the total loss. The total loss is used for backpropagation to update the model parameters.

[0052] In this implementation, the auxiliary task has a small loss weight in the early stage of training, and the main task converges first; in the later stage of training, the weight of the auxiliary task increases, and the supervision signal of the auxiliary task is used to improve the richness of the model's semantic representation (such as part-of-speech, entity, and syntactic structure information), which ultimately feeds back into the performance of the main task (trigger word prediction). Different auxiliary tasks through Independent scaling speed control allows for slower weighting of tasks with slow convergence (such as dependency parsing) and faster weighting of tasks with fast convergence (such as part-of-speech tagging), preventing fast tasks from slowing down the overall process or slow tasks from interfering with the main task. The dynamic adjustment strategy makes model training more stable, ultimately achieving better performance on the main task (trigger word prediction). At the same time, the optimization of auxiliary tasks also improves the model's ability to understand text in multiple dimensions, enhancing the model's robustness and effectiveness.

[0053] In a preferred embodiment of the present invention, the weighting coefficients corresponding to multiple experts are obtained as follows: According to the embedding vector Through the Softmax mechanism, the processing of each expert is obtained. The weight, , in, It is a trainable weight matrix. The feature dimensions of the input token. Number of representative experts.

[0054] The core objective of this implementation is to dynamically calculate the weight coefficients for each expert processing the input based on the input's embedding vector. In a hybrid expert (MoE) architecture or dynamic routing mechanism, the weight coefficients are used to quantify the matching degree between the input and the expert, providing a basis for subsequent route allocation decisions.

[0055] The input embedding vector With trainable weight matrix (N is the number of experts) Perform matrix multiplication to obtain the dimension as The expert relevance score vector. The input is measured using the learned weight matrix. Correlation with the characteristics of each expert.

[0056] in, It is a trainable parameter matrix whose values ​​are continuously optimized through backpropagation during model training: if the expert performs well after processing the input (e.g., low loss), the corresponding expert's weight score parameters will be enhanced; otherwise, they will be weakened. This allows the weight allocation strategy to adaptively evolve with the training data, eventually converging to a better input-expert matching scheme, thus improving the overall performance of the model.

[0057] Input the expert relevance score vector into the Softmax function to obtain the weight coefficients of N experts. .

[0058] Weighting coefficients are derived from the input Dynamic computation (rather than fixed allocation) enables the model to intelligently select the most suitable expert based on input features. For example, for inputs in a specific domain (such as medical text), weights will be more inclined to be assigned to medical experts, enabling expert collaboration and improving the model's adaptability to complex tasks.

[0059] The purpose of Softmax is to transform the score into a probability distribution, ensuring that all weight coefficients are non-negative and sum to 1, thus guaranteeing the reasonableness of the weight coefficients. A higher score indicates a more favorable input. The higher the matching degree with the corresponding expert, the more likely the route will be processed by that expert (or assigned a higher weight), making the routing decision clearer, reducing the participation of ineffective experts, and improving computational efficiency.

[0060] As a preferred embodiment of this implementation, the first... One expert will perform the processing, specifically: According to the weight Determine the embedding vectors respectively The corresponding K experts perform the processing task and obtain .

[0061] The core objective of this embodiment is to achieve precise routing and allocation of tasks to experts based on a weighted mechanism, ensuring that each embedding vector... The task is handled collaboratively by the K most suitable experts, thereby maximizing the efficiency and quality of task processing under resource constraints.

[0062] The weights of all experts are ranked, and the top K experts with the highest weights are selected. This strategy replaces single-point decision-making with a set of locally optimal solutions, avoiding overload on a single expert while improving processing robustness through multi-expert collaboration. Weighted routing replaces random assignment, ensuring that tasks are prioritized for the most suitable experts and reducing unnecessary computation. Furthermore, the parallel processing of the K experts significantly improves task throughput, making it suitable for high-concurrency scenarios (such as large-scale data processing systems).

[0063] The task is assigned to K selected experts for parallel processing, and the final output is summarized. Here This can be understood as the j-th expert's input The processing results are optimized. Multi-expert collaboration reduces the risk of single points of failure (e.g., if one expert fails, other experts can still take over), and different experts can focus on different sub-dimensions of the task (e.g., in text processing, different experts handle semantic understanding and sentiment analysis respectively). The final results are further improved in accuracy through fusion strategies (e.g., weighted average, voting).

[0064] Weight The system can be dynamically adjusted (e.g., based on real-time expert load and task priority) to ensure efficient operation even under resource fluctuations, avoiding expert idleness or task backlog. This invention does not impose any limitations on this.

[0065] Specifically, the combined results are as follows: According to the weight Regarding the task processing results Execute weighted, , The combined results are used to obtain candidate argument labels through the softmax mechanism.

[0066] The core objective of this embodiment is to integrate the processing results of the multi-expert model (MoE) and output candidate argument labels through a probabilistic mechanism.

[0067] By router weight Task processing results of each expert model We perform weighted combination to fuse the outputs of multiple models, so as to take advantage of the different processing capabilities of different experts on the task; and use the softmax mechanism to convert the fused results into a probability distribution, thereby determining the most likely label of the candidate argument and completing the mapping from model output to decisionable label.

[0068] Weighted fusion of multi-expert outputs: Iterate through all expert models, and for each expert model j, use its corresponding router weights. The coefficient represents the result of the task processing. Perform weighted summation; sum the weighted results of all experts to obtain the fused output. The contribution of each expert to the final result is adjusted by weighting.

[0069] Softmax probabilistic output, Each dimension (corresponding to the original value of different candidate labels) is converted into a probability value in the interval [0,1], and the sum of all probabilities is 1; the label corresponding to the dimension with the highest probability is used as the final candidate argument label.

[0070] Router weight Dynamically assigning expert weights based on task input features allows more suitable experts to contribute more to the output, avoiding overfitting or undergeneralization by a single model. The probability distribution of the softmax output not only provides the predicted label but also reflects the model's confidence in the prediction (e.g., probability values ​​of 0.95 vs. 0.51), facilitating subsequent system evaluation of the reliability of the results. This approach leverages the advantages of multi-model collaboration while ensuring the output meets the decision-making needs of real-world application scenarios.

[0071] In a preferred embodiment of the present invention, based on the label sequence and the embedding vector, the classification role labels are obtained through the softmax classification layer of the MoE model, specifically as follows: According to the tag sequence Combined with the embedding vector corresponding to sentence X in the text The vector representation sequence of the labels is obtained. and the event category vector corresponding to the label sequence. ; Sequences represented by vectors of labels and event category vectors Obtain the category / role tags.

[0072] The core objective of this implementation is to achieve accurate classification of event role labels based on the combination of label sequences and text embedding vectors, using the softmax classification layer of the MoE model. Specifically, it transforms discrete label sequences and semantic vectors of text into vector representations in continuous space (Q and T), and then outputs the final classified role labels (such as roles like "trigger words," "participants," and "time" in the event) through collaborative computation by expert models.

[0073] Generate a vector representation sequence of labels, based on the label sequence. Embedded vector of text sentence X Each label With the corresponding embedding vector Combine (e.g., concatenation, attention weighting, or linear transformation) to generate vector representations of the labels. Ultimately forming a sequence By fusing information from the label itself with the semantic context of the text, Q simultaneously incorporates the symbolic features of discrete labels and the semantic features of continuous text, providing multi-dimensional input for subsequent classification.

[0074] Specifically, the event category vector corresponding to the label sequence is obtained. Specifically: Based on the candidate argument labels in the label sequence Establish a mapping relationship between the candidate argument tags and event categories to obtain an event category vector, wherein the event category includes at least one of traffic generation, inducement, and transfer.

[0075] This embodiment transforms unstructured / semi-structured tag sequences (such as text annotations and behavior log tags) into structured event category vectors, enabling automated identification and classification of event types, and providing structured data support for subsequent risk interventions (such as anti-fraud and compliance review).

[0076] Based on individual labels in the sequence (e.g., "click link", "enter bank card number", "redirect page"), candidate argument labels are mapped to predefined event categories (containing at least one of "lead generation", "inducement", or "transfer") based on established mapping relationships. For example, if the label "click unknown link" is identified as a candidate argument → it is mapped to the "lead generation" event; if the combination of labels "enter bank password" and "verify identity" appears → it is mapped to the "inducement" event; if the labels "transfer confirmation" and "amount change" appear → it is mapped to the "transfer" event.

[0077] Based on a rule-based mapping table, generate event category vectors. in For event categories (such as =“Traffic generation” =“Inducement”). The vector dimension matches the number of event types, supporting multi-tag events (such as a single event containing both “traffic generation” and “induction”).

[0078] This embodiment breaks down the barriers between data and scenarios by performing a preliminary semantic transformation from "technical tags to business events," providing high-timeliness and high-precision event recognition capabilities for core scenarios (such as anti-fraud).

[0079] Specifically, sequences are represented by vectors of labels. and event category vectors The categorized role tags are as follows: Represent the sequence using vectors and event category vectors By using the weight scores of the dot product attention layer, , in, ; According to the weighted score For event category vectors Weighted summaries yield attention scores. , To obtain the final classification and role tags.

[0080] The core of this embodiment is to weight the event category vector through a dot product attention mechanism, and finally obtain the attention value used to classify role labels.

[0081] Event Category Vector Sequence (Considered as "queries / keys," representing the event category information to be classified) and the vector representation sequence Q of the labels (considered as "values," representing the feature representation of the labels). For each event category vector Through dot product operation Calculate its similarity score with Q. Quantify each event category. The higher the score of the correlation with the label feature Q, the stronger the correlation (e.g., the "time" label pays more attention to time-related words).

[0082] For each score Apply the softmax function to obtain the weights. The numerator is exponentially mapped to the current score (amplifying differences and reinforcing the weight of highly correlated scores); the denominator is summed over the exponential scores of all event categories (normalizing, making all...). The sum is 1). The original scores are converted into probabilistically distributed weights, highlighting highly relevant event categories (such as weights). The larger, the more it represents The greater the impact on the final classification, the better, while suppressing interference from low-relevance events.

[0083] Perform a weighted sum to generate the attention value. Weights event category vector T Weighted summation aggregates the event category information after weight allocation into a fixed-length vector, retaining the part most relevant to the label feature Q, as the final representation of the classification role label.

[0084] Through attention weight The model automatically learns the event category most relevant to label Q (e.g., the "location" label is associated with geographic location words), avoiding irrelevant or noisy information from interfering with the classification results. The weight allocation is based on the current input T and Q, and the focus can be dynamically adjusted in different text / event scenarios (e.g., "time" has a higher weight in news events, and "people" has a higher weight in social events), improving the model's generalization ability.

[0085] This intuitively reflects the contribution of each event category to the classification decision (e.g., =0.5 represents It occupies half of the decision-making weight, which facilitates the analysis of classification logic.

[0086] In summary, by employing dot product scoring, softmax weighting, and weighted aggregation attention processes, intelligent filtering and aggregation of event category information are achieved. The core value lies in improving the accuracy, interpretability, and model adaptability of classification labels.

[0087] As a preferred embodiment of the present invention, the method for analyzing victim patterns in telecommunications network fraud further includes: Based on the classification role labels, the association rules between the two police incidents are obtained, and the support and confidence levels are determined. , , A set of risk behavior patterns is obtained to optimize the MoE model.

[0088] In this implementation, the correlation between two police incidents is identified and quantified, providing a basis for subsequent risk behavior pattern analysis.

[0089] Specifically, based on the obtained classification role labels, data mining algorithms (such as the Apriori algorithm) are used to find frequent itemsets, and then association rules are generated. For example, if multiple police incidents involve "elderly people" as victims and "impersonating public security, procuratorate, and court personnel" as a means of fraud, an association rule can be generated: "elderly people → impersonating public security, procuratorate, and court personnel".

[0090] Calculate support, which measures the prevalence of association rules in the dataset. Support represents the proportion of transactions that contain both X and Y out of the total number of transactions, where... This represents the number of transactions that simultaneously contain both X and Y, where N represents the total number of transactions. In other words, it counts the number of transactions that simultaneously contain both X and Y, and divides that number by the total number of transactions.

[0091] Calculating the confidence score measures the reliability of an association rule; it represents the probability that Y will occur given that X has occurred. The confidence score indicates the probability that Y will also occur given that X has occurred. This represents the number of transactions containing X. Specifically, it counts the number of transactions that contain both X and Y, and divides that number by the total number of transactions containing X.

[0092] Based on the aforementioned association rules and their support and confidence levels, a risk behavior pattern set is constructed for further analysis and prediction of telecommunications network fraud. Association rules meeting the preset support and confidence thresholds are selected to form the risk behavior pattern set. The selected risk behavior patterns are then analyzed in depth to identify common fraud patterns and high-risk factors.

[0093] This study optimizes the MoE model using a risk behavior pattern set to improve its ability to identify and predict telecommunications network fraud. The risk behavior pattern set is used as training data to adjust the parameters and structure of the MoE model, allowing it to better fit actual fraud behavior patterns. The performance of the optimized MoE model is evaluated using methods such as cross-validation to ensure its effectiveness and stability in practical applications.

[0094] By mining association rules and calculating support and confidence scores, we can more comprehensively capture the characteristics and patterns of fraudulent behavior, improving the accuracy and robustness of identification. A risk behavior pattern set based on support and confidence scores can clearly demonstrate the relationships and key features of fraudulent behavior, enhancing the model's interpretability and operability. Regularly updating the risk behavior pattern set and optimizing the MoE model allows us to promptly reflect the latest characteristics of fraudulent behavior, maintaining the model's effectiveness and advancement.

[0095] This implementation method constructs a set of risk behavior patterns through association rule mining and the calculation of support and confidence, and optimizes the MoE model to achieve efficient identification and prediction of telecommunications network fraud. It not only improves the accuracy of identification but also enhances the interpretability and operability of the model, supporting dynamic updates and continuous optimization.

[0096] The present invention further provides a processing apparatus, comprising: Memory, used to store computer programs; A processor is used to implement the steps of the telecommunications network fraud victim analysis method when executing the computer program.

[0097] Therefore, it can achieve any effect in the analysis method of victim patterns in telecommunications network fraud, which will not be elaborated here.

[0098] For any parts not mentioned in this invention, existing technologies can be used or referenced.

[0099] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0100] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A method for analyzing victim patterns in telecommunications network fraud, characterized in that, include: Using the LERT model, trigger words are obtained from sentences in de-identified police alert texts through part-of-speech tagging, named entity recognition, and dependency parsing, in order to form embedding vectors; Using the MoE model, weight coefficients are obtained for multiple experts based on the embedding vectors, in order to select the top experts. Each expert performs the processing, and the results are combined to obtain the candidate argument labels corresponding to each trigger word, forming the output label sequence corresponding to the sentence; Based on the label sequence and the embedding vector, the classification role labels are obtained through the softmax classification layer of the MoE model.

2. The method for analyzing victim patterns in telecommunications network fraud according to claim 1, characterized in that, The loss function for training the LERT model is as follows: ， in, , This indicates the loss of the task based on the trigger word prediction. This represents the loss from part-of-speech tagging. This represents the loss of the named entity recognition task. This indicates the loss in dependency parsing tasks. This represents the scaling factor for each task. The training step size is determined by the gradient variables of the predictions from neighboring models. This indicates scaling the learning speed.

3. The method for analyzing victim patterns in telecommunications network fraud according to claim 1, characterized in that, The weighting coefficients for multiple experts are obtained as follows: According to the embedding vector Through the Softmax mechanism, the processing of each expert is obtained. The weight, ， in, It is a trainable weight matrix. The feature dimensions of the input token. Number of representative experts.

4. The method for analyzing victim patterns in telecommunications network fraud according to claim 3, characterized in that, Filter the first One expert will perform the processing, specifically: According to the weight Determine the embedding vectors respectively The corresponding K experts perform the processing task and obtain .

5. The method for analyzing victim patterns in telecommunications network fraud according to claim 4, characterized in that, The combined processing results are as follows: According to the weight Regarding the task processing results Execute weighted, ， The combined results are used to obtain candidate argument labels through the softmax mechanism.

6. The method for analyzing victim patterns in telecommunications network fraud according to claim 1, characterized in that, Based on the label sequence and the embedding vector, the classification role labels are obtained through the softmax classification layer of the MoE model, specifically as follows: According to the tag sequence Combined with the embedding vector corresponding to sentence X in the text The vector representation sequence of the labels is obtained. and the event category vector corresponding to the label sequence. ; Sequences represented by vectors of labels and event category vectors Obtain the category / role tags.

7. The method for analyzing victim patterns in telecommunications network fraud according to claim 6, characterized in that, Obtain the event category vector corresponding to the label sequence. Specifically: Based on the candidate argument labels in the label sequence Establish a mapping relationship between the candidate argument tags and event categories to obtain an event category vector, wherein the event category includes at least one of traffic generation, inducement, and transfer.

8. The method for analyzing victim patterns in telecommunications network fraud according to claim 6, characterized in that, Sequences represented by vectors of labels and event category vectors The categorized role tags are as follows: Represent the sequence using vectors and event category vectors By using the weight scores of the dot product attention layer, ， in, ; According to the weighted score For event category vectors Weighted summaries yield attention scores. ， To obtain the final classification and role tags.

9. The method for analyzing victim patterns in telecommunications network fraud according to claim 1, characterized in that, Also includes: Based on the classification role labels, the association rules between the two police incidents are obtained, and the support and confidence levels are determined. ， ， A set of risk behavior patterns is obtained to optimize the MoE model.

10. A processing apparatus, characterized in that, include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the telecommunications network fraud victim pattern analysis method as described in any one of claims 1 to 9.

Images