Fraud identification method, system and equipment based on integrated learning and medium
By using ensemble learning methods, multiple base models are created and feature weights are adjusted and models are fused, which solves the problems of sample imbalance and data drift in telecommunications fraud identification, improves identification accuracy and model robustness, and provides more secure communication services.
Patent Information
- Application Number
- CN202511172451.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-21
- Publication Date
- 2025-11-21
AI Technical Summary
Existing technologies face problems of sample imbalance and data drift when identifying telecom fraud, making it difficult for models to identify new fraud methods and affecting prediction quality.
An ensemble learning-based approach is adopted, which involves creating multiple base models, setting feature weights, using feature combination and derived feature generation, optimizing model parameters using the Adam algorithm, filtering inefficient models using the F1 score, and finally fusing high-performance sub-models to form an ensemble model for fraud detection.
It significantly improves the model's generalization ability and recognition accuracy, alleviates the problems of sample imbalance and data drift, and provides more secure and reliable communication services.
Smart Images
Figure CN120996929A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence technology, and specifically to a fraud identification method, system, device, and medium based on ensemble learning. Background Technology
[0002] In recent years, the number of telecommunications fraud cases in my country has continued to rise, with increasingly sophisticated methods and a wide range of applications, posing a serious threat to public property safety and social stability. Consumers expect operators to provide safer and more reliable communication services to effectively prevent fraud. While the development of technologies such as big data and artificial intelligence has provided strong technical support for operators to accurately identify fraudulent activities, fraudsters represent a small percentage of users compared to the general public. This can lead to sample imbalance when building anti-fraud models. Sample imbalance refers to a significant difference between the number of positive and negative samples; positive samples represent users involved in fraud, while negative samples represent those not involved. Furthermore, the ever-evolving nature of fraud methods often makes it difficult for existing anti-fraud models to identify new ones, leading to data drift. Over time, changes in data distribution can affect the predictive quality of the model. Summary of the Invention
[0003] This invention addresses the shortcomings of existing technologies by providing a fraud identification method, system, device, and medium based on ensemble learning, effectively alleviating the problem of imbalanced positive and negative samples in anti-fraud model training and the problem of data drift over time.
[0004] To achieve the above objectives, the present invention adopts the following technical solution:
[0005] A fraud detection method based on ensemble learning includes the following steps:
[0006] S1. Preprocess the full training data;
[0007] S2. Create n basic models;
[0008] S3, Initial k = 1;
[0009] S4. Extract positive and negative samples from the preprocessed full training data to obtain a training subset;
[0010] S5. Set the weight type of the features of the k-th base model;
[0011] S6. Train the k-th base model using the training subset dataset;
[0012] S7. Is k equal to n? If yes, proceed to S8; otherwise, return to S4.
[0013] S8. Filter the basic models and merge the remaining basic models to obtain the integrated model;
[0014] S9. Calculate the score using the integrated model, and determine the fraud risk level based on the score.
[0015] To optimize the above technical solution, the specific measures also include:
[0016] Furthermore, the full training data is user call detail record (CDR) data, and the preprocessing of the full training data specifically involves: converting the user CDR data into numerical data, calculating the mean and variance of each feature of all user CDR data, and standardizing each feature of the user CDR data using the mean and variance to obtain a standardized feature vector F. sta .
[0017] Furthermore, the step of extracting positive and negative samples from the preprocessed full training data specifically involves: extracting positive samples from the preprocessed full training data, and randomly extracting an equal number of negative samples from the negative samples without replacement, based on the number of positive samples.
[0018] Furthermore, the specific weight type for the features of the k-th base model is as follows:
[0019] The basic scoring model categorizes features into four classes: positive feature weights; negative feature weights; no restrictions on feature weights; and zero feature weights. Let W... pos The weights are the positive feature weights, and the dimension is D. pos W neg The negative weights are the feature weights, and the dimension is D. neg W nolimit These are unrestricted feature weights, with dimension D. nolimit W zero The weights are those where the feature weight is 0, and the dimension is D. zero The initial value of each feature weight is 1.
[0020] Furthermore, the specific steps of training the k-th base model using the training subset dataset are as follows:
[0021] For the standardized feature vector F in the training subset sta By using feature combination methods, some derived features and standardized feature vectors F are generated. sta Concatenate to form the original derived feature vector F ori Original derived feature vector F ori Dimension D feat =D pos +D neg +W nolimit +D zero Update the weights of the four types of features using the following formula:
[0022] W pos←W pos 2 W neg ←-W neg 2 W nolimit ←W nolimit W zero ←0
[0023] In the formula, the symbol ← indicates assignment;
[0024] By concatenating the updated four feature weights, we obtain the updated feature weight vector W. new ←[W pos W neg W nolimit W zero ];
[0025] Based on the original derived feature vector F ori Adjust and update the feature weight vector W new The feature weights are ordered to generate the original feature weight vector W. ori ;
[0026] Using the original derived feature vector F ori and the original feature weight vector W ori Calculate the score S of the basic model. base The calculation method is as follows:
[0027]
[0028] Where · represents the vector dot product, and Sigmoid(·) represents the Sigmoid activation function;
[0029] Update the base model's score S base The minimum and maximum values are used for truncation, and the update method is as follows:
[0030] S base ←max(S base ,val min )
[0031] S base ←min(S base ,val max )
[0032] The formula indicates that S should be selected first. base and val min Assign the largest value in S base Then select S base and val max Assign the smallest value in S base In the formula, val min and valmax These are the preset minimum and maximum values, respectively;
[0033] The Adam algorithm is used to optimize the base model, specifically as follows:
[0034] The loss function is as follows:
[0035]
[0036] Where loss represents the loss value, and y is the training subset Dataset. train The labels of the samples, where γ is the regularization coefficient;
[0037] Calculate the gradient of the total loss with respect to the parameters θ of the base model:
[0038]
[0039] Update the parameters of the base model:
[0040]
[0041] Where η is the learning rate.
[0042] Furthermore, the filtering base model, when fused with the remaining base models to obtain the integrated model, is specifically as follows:
[0043] Filter out base models with F1 scores below a threshold on the validation set, and retain P. k The basic model of ≥T, where P k This represents the F1 score of the k-th basic model, where T is a set threshold, and there are M remaining basic models.
[0044] The ensemble model is obtained by fusing m basic models, and the parameters W of the ensemble model are... fuse The calculation method is as follows:
[0045]
[0046] Among them, W m,ori C represents the feature weights of the remaining m-th basic model. m The confidence score of the m-th base model is calculated as follows:
[0047]
[0048] Among them, P m This represents the F1 score of the m-th basic model.
[0049] Furthermore, the calculation of the score using the ensemble model specifically involves:
[0050] S fuse =sigmoid(Wfuse ·F ori ))
[0051] In the formula, S fuse W represents the score of the ensemble model. fuse F represents the parameters of the ensemble model. ori For the original derived feature vector, sigmoid(·) represents the sigmoid activation function.
[0052] This invention also proposes a fraud detection system based on ensemble learning, comprising:
[0053] The dataset processing module is used to preprocess the entire training data.
[0054] The basic model training module is used to create n basic models; extract positive and negative samples from the preprocessed full training data to obtain training subsets; and train the basic models using the training subsets.
[0055] The fusion module is used to filter the base models and fuse the remaining base models to obtain the integrated model;
[0056] The risk level assessment module is used to calculate a score using an integrated model, and then determine the level of fraud risk based on the score.
[0057] The present invention also proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the fraud identification method based on ensemble learning as described above.
[0058] The present invention also proposes a computer-readable storage medium storing a computer program that causes a computer to execute the fraud detection method based on ensemble learning as described above.
[0059] The beneficial effects of this invention are:
[0060] This invention avoids overfitting a single model to a specific data distribution, significantly improving the model's generalization ability to unknown fraud patterns. The sample equalization strategy effectively alleviates the model bias problem caused by the scarcity of negative samples (fraud samples) in fraud scenarios, enhancing the model's robustness in imbalanced data scenarios.
[0061] This invention enhances the interpretability of the model through a feature classification weighting mechanism, ensuring that the influence of high-risk features aligns with business logic. The non-linear update of weights amplifies the effect of strongly correlated features, automatically selecting key features and reducing the complexity of manual feature engineering.
[0062] Inefficient models are filtered out by F1 score, eliminating the negative impact of redundant base models; F1 score is used as the confidence weight for fusion, making the ensemble model more focused on high-performance sub-models, significantly improving the overall recognition accuracy and recall.
[0063] This invention can effectively alleviate the problem of imbalance between positive and negative samples in the training of anti-fraud models and the problem of data drift over time, and can accurately identify fraudulent behavior, providing the public with safer and more reliable communication services. Attached Figure Description
[0064] Figure 1 This is an overall flowchart of the fraud identification method based on ensemble learning proposed in this invention. Detailed Implementation
[0065] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0066] Example 1
[0067] This invention proposes a fraud detection method based on ensemble learning. The overall process of this method is as follows: Figure 1 As shown, it includes the following steps:
[0068] S1. Preprocessing the full training data; the full training data consists of user call detail records (CDRs). Preprocessing the full training data specifically involves converting the CDRs into numerical data, calculating the mean and variance of each feature of all CDRs, and standardizing each feature using the mean and variance to obtain the standardized feature vector F. sta .
[0069] S2. Create n basic models;
[0070] S3, Initial k = 1;
[0071] S4. Extract positive and negative samples from the preprocessed full training data to obtain a training subset. Specifically, extract positive and negative samples from the preprocessed full training data: extract positive samples from the preprocessed full training data, and randomly extract an equal number of negative samples from the negative samples without replacement based on the number of positive samples. The positive and negative samples together form the training subset.
[0072] S5. Set the weight type of the features of the k-th base model; specifically:
[0073] The basic scoring model categorizes features into four classes: positive feature weights; negative feature weights; no restrictions on feature weights; and zero feature weights. Let W... pos The weights are the positive feature weights, and the dimension is D. pos W neg The negative weights are the feature weights, and the dimension is D. neg W nolimit These are unrestricted feature weights, with dimension D. nolimit W zero The weights are those where the feature weight is 0, and the dimension is D. zero The initial value of each feature weight is 1.
[0074] S6. Train the k-th base model using the training subset dataset; specifically:
[0075] For the standardized feature vector F in the training subset sta By using feature combination methods, some derived features and standardized feature vectors F are generated. sta Concatenate to form the original derived feature vector F ori Original derived feature vector F ori Dimension D feat =D pos +D neg +W nolimit +D zero Update the weights of the four types of features using the following formula:
[0076] W pos ←W pos 2 W neg ←-W neg 2 W nolimit ←W nolimit W zero ←0
[0077] In the formula, the symbol ← indicates assignment;
[0078] By concatenating the updated four feature weights, we obtain the updated feature weight vector W. new ←[W pos W neg W nolimit W zero ];
[0079] Based on the original derived feature vector F ori Adjust and update the feature weight vector W new The feature weights are ordered to generate the original feature weight vector W. ori ;
[0080] Using the original derived feature vector Fori and the original feature weight vector W ori Calculate the score S of the basic model. base The calculation method is as follows:
[0081]
[0082] Where · represents the vector dot product, and sigmoid(·) represents the sigmoid activation function;
[0083] Update the base model's score S base The minimum and maximum values are used for truncation, and the update method is as follows:
[0084] S base ←max(S base ,val min )
[0085] S base ←min(S base ,val max )
[0086] The formula indicates that S should be selected first. base and val mun Assign the largest value in S base Then select S base and val max Assign the smallest value in S base In the formula, val min and val max These are the preset minimum and maximum values, respectively;
[0087] The Adam algorithm is used to optimize the base model, specifically as follows:
[0088] The loss function is as follows:
[0089]
[0090] Where loss represents the loss value, and y is the training subset Dataset. train The labels of the samples, where γ is the regularization coefficient;
[0091] Calculate the gradient of the total loss with respect to the parameters θ of the base model:
[0092]
[0093] Update the parameters of the base model:
[0094]
[0095] Where η is the learning rate.
[0096] S7. Is k equal to n? If yes, proceed to S8; otherwise, return to S4.
[0097] S8. Filter the base models and merge the remaining base models to obtain the integrated model; specifically:
[0098] Filter out base models with F1 scores below a threshold on the validation set, and retain P. k The basic model of ≥T, where P k This represents the F1 score of the k-th basic model, where T is a set threshold, and there are M remaining basic models.
[0099] The ensemble model is obtained by fusing m basic models, and the parameters W of the ensemble model are... fuse The calculation method is as follows:
[0100]
[0101] Among them, W m,ori C represents the feature weights of the remaining m-th basic model. m The confidence score of the m-th base model is calculated as follows:
[0102]
[0103] Among them, P m This represents the F1 score of the m-th basic model.
[0104] S9. Calculate the score using the ensemble model:
[0105] S fuse =sigmoid(W fuse ·F ori ))
[0106] In the formula, S fuse W represents the score of the ensemble model. fuse F represents the parameters of the ensemble model. ori The original derived feature vector is represented by sigmoid(·), which denotes the sigmoid activation function. The fraud risk level is determined based on the score.
[0107] Example 2
[0108] This invention proposes a fraud detection system based on ensemble learning, corresponding to the method in Embodiment 1, comprising:
[0109] The dataset processing module is used to preprocess the entire training data.
[0110] The basic model training module is used to create n basic models; extract positive and negative samples from the preprocessed full training data to obtain training subsets; and train the basic models using the training subsets.
[0111] The fusion module is used to filter the base models and fuse the remaining base models to obtain the integrated model;
[0112] The risk level assessment module is used to calculate a score using an integrated model, and then determine the level of fraud risk based on the score.
[0113] The implementation methods of each module and its function in the system are completely consistent with the steps of the method in Implementation Example 1, so they will not be repeated here.
[0114] Example 3
[0115] This invention proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the fraud identification method based on ensemble learning as described in Embodiment 1.
[0116] Example 4
[0117] This invention proposes a computer-readable storage medium storing a computer program that causes a computer to execute the fraud detection method based on ensemble learning as described in Embodiment 1.
[0118] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0119] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0120] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.
Claims
1. A fraud detection method based on ensemble learning, characterized in that, Includes the following steps: S1. Preprocess the full training data; S2. Create n basic models; S3, Initial k = 1; S4. Extract positive and negative samples from the preprocessed full training data to obtain a training subset; S5. Set the weight type of the features of the k-th base model; S6. Train the k-th base model using the training subset dataset; S7. Is k equal to n? If yes, proceed to S8; otherwise, return to S4. S8. Filter the basic models and merge the remaining basic models to obtain the integrated model; S9. Calculate the score using the integrated model, and determine the fraud risk level based on the score.
2. The fraud detection method based on ensemble learning as described in claim 1, characterized in that, The full training data is user call detail records (CDRs). The preprocessing of the full training data specifically involves: converting the user CDRs into numerical data; calculating the mean and variance of each feature of all user CDRs; and standardizing each feature of the user CDRs using the mean and variance to obtain a standardized feature vector F. sta .
3. The fraud detection method based on ensemble learning as described in claim 1, characterized in that, The step of extracting positive and negative samples from the preprocessed full training data specifically involves: extracting positive samples from the preprocessed full training data, and randomly extracting an equal number of negative samples from the negative samples without replacement, based on the number of positive samples.
4. The fraud detection method based on ensemble learning as described in claim 1, characterized in that, The specific weight type for setting the features of the k-th base model is as follows: The basic scoring model categorizes features into four classes: positive feature weights; negative feature weights; no restrictions on feature weights; and zero feature weights. Let W... pos The weights are the positive feature weights, and the dimension is D. pos W neg The negative weights are the feature weights, and the dimension is D. neg W nolimit These are unrestricted feature weights, with dimension D. nolimit W zero The weights are those where the feature weight is 0, and the dimension is D. zero The initial value of each feature weight is 1.
5. The fraud detection method based on ensemble learning as described in claim 4, characterized in that, The specific steps for training the k-th base model using the training subset dataset are as follows: For the standardized feature vector F in the training subset sta By using feature combination methods, some derived features and standardized feature vectors F are generated. sta Concatenate to form the original derived feature vector F ori Original derived feature vector F ori Dimension D feat =D pos +D neg +W nolimit +D zero Update the weights of the four types of features using the following formula: IN pos ←In pos 2 ,IN neg ←-W neg 2 ,IN nolimit ←In nolimit ,IN zero ←0 In the formula, the symbol ← indicates assignment; By concatenating the updated four feature weights, we obtain the updated feature weight vector W. new ←[W pos W neg W nolimit W zero ]; Based on the original derived feature vector F ori Adjust and update the feature weight vector W new The feature weights are ordered to generate the original feature weight vector W. ori ; Using the original derived feature vector F ori and the original feature weight vector W ori Calculate the score S of the basic model. base The calculation method is as follows: Where · represents the vector dot product, and sigmoid(·) represents the sigmoid activation function; Update the base model's score S base The minimum and maximum values are used for truncation, and the update method is as follows: S base ←max(S base ,val min ) S base ←min(S base ,val max ) The formula indicates that S should be selected first. base and val min Assign the largest value in S base Then select S base and val max Assign the smallest value in S base In the formula, val min and val max These are the preset minimum and maximum values, respectively; The Adam algorithm is used to optimize the base model, specifically as follows: The loss function is as follows: Where loss represents the loss value, and y is the training subset Dataset. train The labels of the samples, where γ is the regularization coefficient; Calculate the gradient of the total loss with respect to the parameters θ of the base model: Update the parameters of the base model: Where η is the learning rate.
6. The fraud detection method based on ensemble learning as described in claim 1, characterized in that, The filtering base model, fused with the remaining base models, yields the integrated model as follows: Filter out base models with F1 scores below a threshold on the validation set, and retain P. k The basic model of ≥T, where P k This represents the F1 score of the k-th basic model, where T is a set threshold, and there are M remaining basic models. The ensemble model is obtained by fusing m basic models, and the parameters W of the ensemble model are... fuse The calculation method is as follows: Among them, W m,ori C represents the feature weights of the remaining m-th basic model. m The confidence score of the m-th base model is calculated as follows: Among them, P m This represents the F1 score of the m-th basic model.
7. The fraud identification method based on ensemble learning as described in claim 1, characterized in that, The specific steps for calculating the score using the ensemble model are as follows: S fuse =sigmoid(W fuse ·F ori )) In the formula, S fuse W represents the score of the ensemble model. fuse F represents the parameters of the ensemble model. ori For the original derived feature vector, sigmoid(·) represents the sigmoid activation function.
8. A fraud detection system based on ensemble learning, characterized in that, include: The dataset processing module is used to preprocess the entire training data. The basic model training module is used to create n basic models; Positive and negative samples are extracted from the preprocessed full training data to obtain a training subset; Train the base model using a training subset dataset; The fusion module is used to filter the base models and fuse the remaining base models to obtain the integrated model; The risk level assessment module is used to calculate a score using an integrated model, and then determine the level of fraud risk based on the score.
9. An electronic device, characterized in that, include: The memory, the processor, and the computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the fraud identification method based on ensemble learning as described in any one of claims 1-7.
10. A computer-readable storage medium storing a computer program, characterized in that, The computer program causes the computer to execute the fraud identification method based on ensemble learning as described in any one of claims 1-7.