Abnormal communication identification method and device

Abstract

The invention provides an abnormal communication identification method and device, and relates to the technical field of computers, and the method comprises the steps: building a heterogeneous network diagram based on the attribute information of each communication entity in a telecommunication service scene and the interaction relation between the communication entities; wherein the telecommunication service scene comprises multiple types of communication entities, nodes in the heterogeneous network diagram represent different types of communication entities, each node has different attribute information, and edges between the nodes are marked with interaction types between the communication entities; and inputting the heterogeneous network diagram into a pre-trained abnormal communication identification model to obtain abnormal attribute information corresponding to each communication entity, thereby effectively overcoming the limitations that the traditional method depends on manual rule update lagging and a statistical threshold is difficult to set, adaptively capturing complex and changeable fraud mode and weak signal association characteristics, and improving the identification accuracy. The identification accuracy and generalization ability are significantly improved, and a more reliable and efficient technical guarantee is provided for telecommunication service security.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an abnormal communication identification method and apparatus. Background Technology

[0002] The rapid development of modern communication technologies has propelled telecommunications services into all sectors of the social economy, leading to a continuous expansion of the user base. However, this rapid growth has also brought with it a high incidence and variability in telecommunications fraud. Fraudsters exploit system vulnerabilities and management weaknesses, employing various methods such as fake text messages, malicious calls, and identity impersonation to severely infringe upon users' rights and privacy, posing a significant threat to the reputation of telecommunications operators and the security of the network environment. Faced with the increasingly patterned and industrialized trends of fraud, traditional protection methods are no longer effective. Developing efficient and accurate fraud detection technologies is of urgent and crucial practical significance for protecting user interests, ensuring communication order, and safeguarding public safety.

[0003] Currently, the technical methods for identifying telecommunications fraud can be mainly divided into two categories: one is the matching method based on expert rules, which relies on domain knowledge to set static or dynamic rule thresholds. Its logic is clear and easy to deploy, and it has a certain preventive effect on early fixed-pattern fraud; the other is the analysis method based on mathematical statistics, which identifies abnormal objects that deviate from normal behavior patterns by statistically analyzing the probability distribution and dispersion of user behavior data. It is suitable for mining explicit anomalies from large-scale data.

[0004] However, rule-based methods heavily rely on human experience, suffer from lagging rule updates, struggle to adapt to the rapid evolution of fraud tactics, and have weak generalization capabilities for unknown attack patterns. Statistical methods are mostly limited to shallow anomaly detection, failing to capture complex fraud patterns composed of multiple weak signal combinations. Furthermore, their detection effectiveness is highly dependent on the setting of statistical thresholds; thresholds that are too strict or too wide can easily lead to increased false positives or false negatives, making it difficult to achieve a balance between detection effectiveness and efficiency in practical applications. Therefore, rule-based methods rely on human intervention and are ill-suited to rapidly changing fraud patterns, while statistical methods have limited ability to identify complex correlation patterns and struggle to balance thresholds, resulting in poor detection performance. Summary of the Invention

[0005] This application provides an abnormal communication identification method and apparatus to overcome the limitations of traditional methods that rely on the lag of manual rule updates and the difficulty in setting statistical thresholds. It can adaptively capture complex and ever-changing fraud patterns and weak signal correlation features, significantly improving the identification accuracy and generalization ability, and providing a more reliable and efficient technical guarantee for telecommunications service security.

[0006] In a first aspect, embodiments of this application provide an abnormal communication identification method, the method comprising:

[0007] A heterogeneous network graph is constructed based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationships between the communication entities. The telecommunications service scenario includes multiple types of communication entities, and the nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction types between the communication entities.

[0008] The heterogeneous network graph is input into a pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity.

[0009] Secondly, embodiments of this application also provide an abnormal communication identification device, the device comprising:

[0010] The heterogeneous network graph construction module is used to construct a heterogeneous network graph based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationship between the communication entities; wherein, the telecommunications service scenario includes multiple types of communication entities, the nodes in the heterogeneous network graph represent different types of communication entities, each node has different attribute information, and the edges between nodes are labeled with the interaction type between the communication entities.

[0011] An abnormal attribute determination module is used to input the heterogeneous network graph into a pre-trained abnormal communication identification model to obtain abnormal attribute information corresponding to each of the communication entities.

[0012] Thirdly, embodiments of this application also provide an electronic device, which includes:

[0013] One or more processors;

[0014] Storage device for storing one or more programs.

[0015] When one or more programs are executed by one or more processors, the one or more processors implement an abnormal communication identification method as described in any of the embodiments of this application.

[0016] Fourthly, embodiments of this application also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform any of the abnormal communication identification methods described in embodiments of this application.

[0017] This application provides an abnormal communication identification method and apparatus. Based on the attribute information of each communication entity in a telecommunications service scenario and the interaction relationships between these entities, a heterogeneous network graph is constructed. The telecommunications service scenario includes multiple types of communication entities, and the nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction types between the communication entities. The heterogeneous network graph is then input into a pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity. The technical solution of this application, by constructing a heterogeneous network graph that integrates multiple types of communication entities and their rich interaction relationships, and utilizing a pre-trained deep anomaly identification model for end-to-end analysis, effectively overcomes the limitations of traditional methods that rely on lag in manual rule updates and the difficulty in setting statistical thresholds. It can adaptively capture complex and ever-changing fraud patterns and weak signal correlation features, significantly improving identification accuracy and generalization ability, and providing a more reliable and efficient technical guarantee for telecommunications service security. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the exemplary embodiments of this application, the accompanying drawings used in describing the embodiments are briefly introduced below. Obviously, the accompanying drawings described are only a portion of the embodiments to be described in this application, and not all of them. For those skilled in the art, other drawings can be obtained from these drawings without any creative effort.

[0019] Figure 1 A flowchart illustrating an abnormal communication identification method provided in an embodiment of this application;

[0020] Figure 2 A flowchart illustrating yet another abnormal communication identification method provided in an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of the process for augmenting heterogeneous network graph samples as described in the embodiments of this application.

[0022] Figure 4 This is a schematic diagram illustrating the training process of the abnormal communication identification model proposed in the embodiments of this application;

[0023] Figure 5 This is a schematic diagram of the overall technical flow of the model training process involved in the embodiments of this application;

[0024] Figure 6 This is a schematic diagram of the structure of an abnormal communication identification device provided in an embodiment of this application;

[0025] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the present application are shown in the drawings, not the entire structure.

[0027] Example 1

[0028] Figure 1 This is a flowchart illustrating an abnormal communication identification method provided in an embodiment of this application. This embodiment is applicable to any situation where abnormal communication is identified by analyzing telecommunications interaction behavior based on heterogeneous networks. The method can be executed by an abnormal communication identification device, which can be implemented in the form of software and / or hardware. The hardware can be an electronic device, such as a mobile terminal, a PC, or a server.

[0029] like Figure 1 As shown, the method includes:

[0030] S110. Construct a heterogeneous network graph based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationship between communication entities.

[0031] In this context, "telecommunications service scenario" refers to a specific technological environment and business logic framework supported by telecommunications network services, comprising various heterogeneous communication entities (such as individuals, enterprises, and facilities) and their complex interactions. This framework defines the types of communication entities, their inherent attribute characteristics, and various specific types of relationships between entities. A telecommunications service scenario includes multiple types of communication entities. A communication entity refers to any independently identifiable logical subject or network element in a telecommunications service scenario that possesses specific attributes and can interact with other such objects. These entities possess heterogeneous attribute characteristics due to their different types and collectively constitute the basic behavioral units in the communication network through their categorized interaction relationships.

[0032] Among them, the attribute information of a communication entity refers to the set of quantitative or qualitative data used to describe and define a series of inherent static characteristics and dynamic state indicators of the communication entity. This information serves as the entity's feature vector, which can characterize its identity, state, behavior patterns and capabilities from different dimensions. It provides key feature basis for subsequent graph analysis models based on heterogeneous networks to distinguish different entities, measure their similarity and detect anomalies.

[0033] In this context, the interaction relationship between communication entities refers to a specific type of connection or association with clear business or technical semantics that occurs between different communication entities in a telecommunications service scenario. This relationship is a structured abstraction that defines the nature, direction, and pattern of interaction behavior between entities. It serves as an edge connecting different nodes (i.e., communication entities) in a heterogeneous network and usually carries metadata describing the specific characteristics of the interaction. It is the key structural information for constructing network topology, analyzing communication behavior patterns, and ultimately identifying anomalies.

[0034] Heterogeneous network graphs are graph data structures used to represent complex networks containing multiple types of nodes and edges. Nodes in a heterogeneous network graph represent different types of communication entities, each with different attribute information, and the edges between nodes are labeled with the interaction type between the communication entities. It can be understood that the nodes in a heterogeneous network graph correspond to different types of communication entities (such as individuals, businesses, and facilities), and each edge represents a specific type of interaction relationship (such as calls, messages, and financial transactions). This graph structure is "heterogeneous" because its nodes and edges are no longer considered homogeneous elements, but rather possess rich type semantics and differentiated attribute information bound to them, thus more fully expressing the multimodal and complex communication scenarios in the real world.

[0035] In this embodiment, within the service environment provided by the telecommunications operator, individual users, enterprise users, and network facilities such as base stations, switches, and optical modems are treated as different types of communication entities. Static attributes (such as user packages, consumption, terminals, and behavioral preferences, and facility coverage areas, capacity, and models) and dynamic interaction records (such as voice calls, SMS messages, data traffic, financial transactions, and device access) are extracted from each entity. Then, these entities are used as nodes, and the various interactions between them are used as edges. The edges are labeled according to the interaction type, and the attribute information is used as node features. Finally, a heterogeneous network graph containing multiple node types and multiple edge types is constructed, which can fully reflect the complex relationships of telecommunications services, for subsequent identification and analysis of abnormal communication behaviors.

[0036] For example, a communication system containing users (attributes such as age and package type), merchants (attributes such as registered capital and industry category), and base stations (attributes such as geographical location and load capacity) can be abstracted into a structured graph model based on information such as call records (interaction relationships), SMS exchanges (interaction relationships), and connection logins (interaction relationships) between them. In this model, users, merchants, and base stations are nodes of different types with their own attributes, while specific interactions such as calls and SMS messages are edges of different types and weights connecting these nodes, ultimately forming a multi-dimensional, labeled, and attributed heterogeneous network graph.

[0037] Optionally, based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationships between communication entities, the specific implementation steps for constructing a heterogeneous network graph may include:

[0038] S1. Obtain raw operational data in telecommunications service scenarios.

[0039] Raw operational data refers to the initial set of data that is naturally generated and collected in telecommunications service scenarios and has not been processed for specific analytical tasks. This data objectively records the static attributes, dynamic behaviors, and various interaction events between communication entities from different dimensions. Raw operational data includes entity attribute tables that record attribute information of various communication entities, voice communication interaction records, message interaction records, transaction records, network facility registry, and communication entity and facility binding logs.

[0040] The entity attribute table is a fundamental data table in the telecommunications business database used to statically describe the inherent characteristics and states of various communication entities. It centrally stores multi-dimensional fields such as identity identifiers, basic information, service activation, function configuration, metering and billing, lifecycle, and management status for objects like individual users, enterprise customers, and network facilities, using a two-dimensional structure of primary key-attribute columns. It is linked to the interaction record table through foreign keys or unified codes, providing a source of node attributes for constructing heterogeneous network graphs and supporting tracking of attribute change history by time slice or version number, ensuring the integrity and traceability of node feature vectors. The voice communication interaction record is structured log data generated in real time by telecommunications operators during voice call setup. It records the identity identifiers, terminal equipment, network location, service attributes, and key spatiotemporal and technical parameters of the call event for both the caller and the recipient in the form of call detail records. The message interaction record is a structured event log generated by telecommunications operators during the processing of short message and multimedia message services. It registers the identity identifiers of the sender and receiver, message type, service code, timestamp, message length, sending status, access base station or gateway identifier, and billing-related fields for each message. Transaction records are real-time or batch-processed accounting logs generated by telecom operators during financial transactions such as phone bill top-ups, package purchases, corporate payments, third-party deductions, points redemption, and e-voucher consumption. Each transaction records the account identifiers of the payer and payee, the transaction type, transaction amount, payment method, channel code, terminal information, order number, account subject, discounts / reductions, timestamp, and transaction status. The network infrastructure registry is a core static data table used by telecom operators to uniformly manage their network infrastructure assets. Using a unique primary key, it records the engineering parameters, coverage attributes, technical specifications, lifecycle, maintenance level, and operational status of various facilities such as base stations, optical distribution boxes, routers, switches, PON ports, and wireless access points. The communication entity and facility binding log is operational log data used by telecom operators to record the dynamic relationships between communication entities (such as individual users, enterprise users, or IoT terminals) and network facilities (such as base stations, PON ports, and access gateways). It records each binding or unbinding event in a time-series format, including the entity identifier, facility code, binding type, access location, timestamp, and reason for status change.

[0041] In this embodiment, obtaining raw operational data in telecommunications service scenarios refers to extracting all initial business flow data and static information related to communication entities from the operator's production systems such as BOSS, billing, signaling, accounting, resource management, and access authentication. This includes entity attribute tables recording basic characteristics of users and facilities, voice communication interaction records registering voice call events, message interaction records registering SMS and multimedia message events, transaction records registering financial events such as recharge, payment, and transfer, network facility registry entries registering network asset information such as base stations and gateways, and communication entity and facility binding logs recording the dynamic binding relationship between users or terminals and network facilities. This data is directly aggregated into the data warehouse without being summarized or transformed, providing raw materials of node attributes, edge relationships, and timestamps for subsequent construction of heterogeneous network graphs.

[0042] In this embodiment, raw operational data that is unprocessed or only preliminarily cleaned and can comprehensively reflect the attributes of communication entities and their interactive behaviors can be collected from the core business system, network management system and supporting database of the telecom operator through compliant data interfaces or extraction, conversion and loading processes.

[0043] S2. Based on the entity attribute table, network facility registry, and communication entity and facility binding log of various communication entity attribute information in the original operation data, determine the node set of different types of communication entities, and generate a corresponding attribute feature vector for each communication entity node.

[0044] In this context, a node set refers to a subset of all communication entity nodes belonging to the same type, formed after partitioning the heterogeneous network graph according to the type of communication entity. Elements within each node set share the same type semantics but possess unique identifiers and attribute feature vectors. An attribute feature vector is a fixed-length numerical array or vector formed by standardizing and quantifying the multi-dimensional attribute information of a communication entity through feature engineering. This vector comprehensively represents the core features of the entity in a machine-readable, dense form.

[0045] In this embodiment, basic static features of individual and enterprise users can be extracted from the entity attribute table, and inherent technical parameters of facilities such as base stations and access points can be extracted from the network facility registry. Then, combined with the dynamic binding relationship in the communication entity and facility binding log, the original fields are normalized, numbered, deduplicated, and concatenated to form a numerical or vectorized representation covering multiple dimensions such as identity, consumption, behavior, location, device, and lifecycle. This abstracts users and facilities in communication services into graph nodes with a unified feature format, providing a standardized set of nodes and their computable attribute inputs for the construction of heterogeneous network graphs.

[0046] Optionally, the entity attribute table includes attribute information for individual-type communication entities and attribute information for enterprise-type communication entities. Individual-type communication entities refer to legal entities that are natural persons who register, sign contracts, and actually use telecommunications network resources with the operator. Enterprise-type communication entities refer to legal entities that are legal persons or non-legal persons who register, sign contracts, and uniformly use telecommunications network resources with the operator. Based on this, and using the attribute information of various communication entities in the original operational data, the network facility registry, and the communication entity and facility binding logs, the specific implementation methods for determining the node sets of different types of communication entities and generating corresponding attribute feature vectors for each communication entity node may include:

[0047] (1) Based on the attribute information of personal type communication entities in the entity attribute table, determine the first node set of personal communication entities, and generate a corresponding personal attribute feature vector for each personal type communication entity node.

[0048] The first node set refers to the set of all personal type communication entity nodes extracted from the entity attribute table. The personal attribute feature vector is a dense or sparse numerical vector formed by numerating, normalizing, discretizing or embedding the original static attribute information of personal type communication entities and organizing it according to a unified dimension.

[0049] Specifically, all communication entity records of all personal types can be filtered from the entity attribute table, and their unique identifiers can be used as node identifiers to construct the first node set of personal communication entities. The original attribute fields in each record are preprocessed by numericalization, normalization, discretization or embedding mapping, and personal attribute feature vectors that can comprehensively characterize the static features of individual users are generated according to a unified dimension. Then, the vectors are attached to the corresponding nodes to provide a computable personal node representation for the heterogeneous network graph.

[0050] (2) Based on the attribute information of enterprise type communication entities in the entity attribute table, determine the second node set of enterprise type communication entities, and generate the corresponding enterprise attribute feature vector for each enterprise type communication entity node.

[0051] The second node set refers to the set of all enterprise-type communication entity nodes extracted from the entity attribute table. The enterprise attribute feature vector is a compact numerical vector formed by digitizing, normalizing, discretizing, or embedding the original static information generated by enterprise-type communication entities in the registration, operation, billing, and contract stages, and then splicing it together according to a unified dimension.

[0052] In this embodiment, records of all enterprise-type communication entities can be filtered from the entity attribute table, and their unique identifiers can be used as node identifiers to construct a second set of enterprise-type communication entities. The original enterprise attribute fields in each record are preprocessed by numericalization, normalization, discretization, or embedding mapping. Enterprise attribute feature vectors that can reflect multi-dimensional characteristics such as enterprise size, industry, tariff, and credit are generated according to a unified dimension. Then, the vectors are attached to the corresponding nodes to provide a computable enterprise node representation for the heterogeneous network graph.

[0053] (3) Based on the network facility registry and the communication entity and facility binding log, determine the third node set of facility type communication entities, and generate a corresponding facility attribute feature vector for each facility type communication entity node.

[0054] Among them, facility-type communication entities refer to non-customer objects existing in the telecommunications service environment as network infrastructure. The third-node set refers to the set of all facility-type communication entity nodes extracted from the network facility registry and the communication entity and facility binding log. The facility attribute feature vector is a compact numerical vector formed by numerating, normalizing, or embedding the static technical attributes and dynamic operational indicators of network infrastructure objects, and then concatenating them along a unified dimension.

[0055] In this embodiment, the unique identifiers of all facility objects can be extracted from the network facility registry as node candidates. Then, the online association relationship between the communication entity and the facility binding log is verified, and the facility objects that can actually be accessed by users are selected to form a third node set of facility type communication entities. Subsequently, the static technical parameters in the registry and the dynamic operation indicators in the binding log are numericalized, normalized or embedded and mapped to generate facility attribute feature vectors that can reflect facility coverage, capacity level, standard type and life cycle status according to a unified dimension, and mounted on the corresponding nodes to provide a computable network side node representation for the heterogeneous network graph.

[0056] S3. Based on voice communication interaction records, message interaction records, and transaction records, generate a set of interaction relationship edges, and label each edge with the interaction type and timestamp.

[0057] The set of interaction relationship edges is a collection of all edges derived from voice communication interaction records, message interaction records, transaction records, and communication entity and facility binding logs, based on the original operational data of telecommunications services. Interaction type is a semantic classification identifier for events occurring between communication entities or between a communication entity and network facilities, used to distinguish different business behaviors such as voice communication, message interaction, financial transactions, and access binding. The timestamp is a precise time identifier carried in the interaction record, used to indicate the absolute time sequence of voice, message, financial, or access events.

[0058] In this embodiment, the set of interaction relationship edges includes: voice communication relationship edges, message interaction relationship edges, financial transaction relationship edges between various communication entities, and access relationship edges between communication entities and network facilities. Voice communication relationship edges are directed or undirected edges in a heterogeneous network graph used to connect two communication entity nodes, and their type attribute is marked as "voice communication". Message interaction relationship edges are edge instances in a heterogeneous network graph connecting two communication entity nodes, and their interaction type attribute is assigned the value "message interaction". Financial transaction relationship edges are edge instances in a heterogeneous network graph connecting two communication entity nodes, and their interaction type attribute is marked as "financial transaction". Access relationship edges between communication entities and network facilities are edge instances in a heterogeneous network graph used to connect user-side nodes and network-side facility nodes, and their interaction type attribute is marked as "access".

[0059] Specifically, voice communication interaction records, message interaction records, and transaction records can be parsed and associated. The communication entity pairs in each record are abstracted into edges between nodes, uniformly assigned predefined interaction type labels, and the precise timestamp of the event is extracted as the edge attribute. This forms a complete set of edges covering the three types of interactions: voice, message, and funds, providing a dynamic and temporal relationship description for heterogeneous network graphs.

[0060] For example, scanning voice communication interaction records reveals that caller number A and called number B had a 180-second conversation at the same time. Immediately, a directed edge from A to B is added to the heterogeneous network graph, the interaction type is labeled "voice communication," and the exact timestamp of the call is recorded in the edge attribute. Next, it checks message interaction records and sees that number C sent two text messages to number D. An undirected edge from C to D is then generated, labeled with the interaction type "message interaction" and the sending time. Subsequently, it reads transaction records and finds that enterprise E successfully transferred a recharge amount to the corporate account of virtual operator F. An edge from E to F is added, labeled with the interaction type "funds transfer," and the transfer time is recorded. Finally, these three types of edges are integrated into the interaction relationship edge set, ensuring that each edge has a clear interaction type and timestamp, thus fully depicting the multi-dimensional connections between communication entities that unfold over time.

[0061] S4. Based on the set of each node and the set of all interaction edges, construct a heterogeneous network graph containing nodes of various types of communication entities and edges of various types of interaction relationships.

[0062] Each communication entity node has its corresponding attribute feature vector attached, and the interaction relationship edges have recorded the interaction type and timestamp.

[0063] In this embodiment, a pre-defined set of nodes (individuals, enterprises, and facilities) can be merged with a set of interactive relationship edges covering four categories: voice, messaging, funds, and access, forming a graph structure. In the graph, each node is instantiated as its unique identifier, and the corresponding attribute feature vector is persistently mounted as node weight data. At the same time, each edge is instantiated as a connection between the two nodes, and the pre-labeled interaction type string and precise timestamp are written into the edge attributes. This completes the construction of a large-scale heterogeneous network graph that simultaneously carries multiple types of nodes, multiple types of relationships, temporal information, and rich features, enabling it to be directly input into a graph neural network for message passing and anomaly detection operations.

[0064] S120. Input the heterogeneous network graph into the pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity.

[0065] Among them, the abnormal communication identification model is a computing framework built on machine learning or deep learning technology, which aims to model and analyze the behavior patterns of communication entities in telecommunications networks in order to automatically detect communication activities with abnormal characteristics.

[0066] Among them, the abnormal attribute information is a set of numerical labels or features output by the abnormal communication identification model for each communication entity node, used to quantify the degree to which its communication behavior deviates from the normal pattern. The abnormal attribute information may include anomaly score, risk level, anomaly type probability, and key anomaly indicators. It is inferred by end-to-end learning of the node's topological position, attribute characteristics, and temporal interactions in the heterogeneous network through a graph neural network, and can be directly used by the operation system for subsequent early warning, auditing, or handling decisions.

[0067] In this embodiment, the constructed heterogeneous network graph can be fed into a fully trained abnormal communication identification model. The model uses a graph neural network mechanism to perform forward propagation and feature aggregation on topology, node attributes, edge types and timestamps, automatically calculates and outputs the abnormal score, risk level and related abnormal features of each communication entity node, thereby completing the quantitative judgment of the abnormal attributes of all individual, enterprise and facility nodes in one go.

[0068] Optionally, the anomaly communication identification model includes a feature encoder and a two-layer multilayer perceptron predictor head. The feature encoder is a graph neural network component in the anomaly communication identification model used to convert the original attribute and temporal information of nodes of different categories and their adjacent edges within a heterogeneous network graph into initial embedding vectors of a unified dimension. The two-layer multilayer perceptron predictor head is a downstream module composed of two fully connected neural networks. It receives the initial node embedding representation output by the feature encoder, first performs high-dimensional mapping through a first-layer weight matrix and a nonlinear activation function, and then uses a second layer to compress the hidden features into a low-dimensional anomaly discrimination space, thereby outputting a node-level anomaly score or risk probability, achieving end-to-end anomaly detection decision.

[0069] Based on this, the specific implementation methods for inputting the heterogeneous network graph into a pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity can include:

[0070] S1. Input the heterogeneous network graph into the feature encoder to obtain the initial embedding representation of each node in the heterogeneous network graph.

[0071] Here, the initial embedding representation is a low-dimensional dense vector output by the feature encoder after performing the first feature transformation on each node in the heterogeneous network graph.

[0072] In this embodiment, a heterogeneous network graph can be fed into a feature encoder. The encoder performs message passing and aggregation according to node type and edge type, respectively, and performs a forward computation in parallel for all nodes in the graph, outputting a set of low-dimensional dense vectors that correspond one-to-one with the nodes. These vectors are the initial embedding representations of each node in the graph structure context, which are used by the subsequent prediction head to further refine abnormal features.

[0073] S2. For each node, perform nonlinear projection on the initial embedding representation of the current node based on the two-layer multilayer perceptron prediction head to determine the feature embedding representation corresponding to the current node.

[0074] The feature embedding representation is a low-dimensional latent vector obtained by performing two nonlinear transformations and dimensionality reductions on the initial embedding representation by the two-layer multilayer perceptron prediction head.

[0075] In this embodiment, the initial embedding vector of each node can be sequentially fed into a two-layer fully connected neural network: first, the first layer weight matrix and activation function complete the high-dimensional mapping, and then the second layer reduces the dimension and introduces nonlinear changes, thereby converting the general topological features output by the encoder into a new vector space that is more focused on anomaly discrimination, and obtaining a feature embedding representation that retains the original structural information and enhances the risk pattern for subsequent anomaly detection decision-making.

[0076] S3. Based on the feature embedding representation corresponding to each node, determine the abnormal attribute information of the corresponding communication entity.

[0077] Specifically, the feature embedding representation obtained by nonlinear projection of the prediction head of a two-layer multilayer perceptron can be used to map the vector into quantitative indicators such as anomaly score, risk level and anomaly type probability through the built-in discriminant function or classification layer. This allows for the generation of anomaly attribute information for each communication entity node that can be directly used for subsequent early warning, auditing or handling decisions.

[0078] This application provides an abnormal communication identification method and apparatus. Based on the attribute information of each communication entity in a telecommunications service scenario and the interaction relationships between these entities, a heterogeneous network graph is constructed. The telecommunications service scenario includes multiple types of communication entities, and the nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction types between the communication entities. The heterogeneous network graph is then input into a pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity. The technical solution of this application, by constructing a heterogeneous network graph that integrates multiple types of communication entities and their rich interaction relationships, and utilizing a pre-trained deep anomaly identification model for end-to-end analysis, effectively overcomes the limitations of traditional methods that rely on lag in manual rule updates and the difficulty in setting statistical thresholds. It can adaptively capture complex and ever-changing fraud patterns and weak signal correlation features, significantly improving identification accuracy and generalization ability, and providing a more reliable and efficient technical guarantee for telecommunications service security.

[0079] Example 2

[0080] Figure 2 This diagram illustrates an abnormal communication identification method provided in this application. Based on the foregoing embodiments, the training process of the abnormal communication identification model is explained in detail. Specific implementation methods can be found in the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here.

[0081] like Figure 2 As shown, the method specifically includes the following steps:

[0082] S210. Obtain historical attribute information of each communication entity in the telecommunications service scenario and historical interaction relationships between communication entities.

[0083] Historical attribute information refers to the set of static and quasi-static characteristics of a communication entity that have been continuously recorded and archived by the operator's system over a specific period of time. This includes user identity, package configuration, terminal model, network access time, consumption level, industry category, facility technical parameters, and their statistical derivative indicators for that period. Historical interaction relationships refer to the set of all communication events that actually occurred through the telecommunications network within a specified period of time and have been continuously recorded and archived by the operator's system. This includes behaviors such as voice calls, SMS / MMS, data traffic, financial transactions, and access binding with network facilities. It includes attributes such as event timestamps, direction, frequency, and duration, used to characterize the temporal characteristics of dynamic relationships between entities and providing traceable behavioral evidence for abnormal communication identification models.

[0084] In this embodiment, static registration data of all individuals, enterprises and facilities communication entities and all communication, transaction and access events that occur during the specified time window can be extracted and associated in batches from the operator's production systems such as billing, accounting, signaling, resource management, payment and access logs, forming a traceable set of entity-level attributes and an interaction sequence between entities. This data is then used to construct heterogeneous network graph samples with a time dimension and to conduct comparative learning training.

[0085] S220. Construct heterogeneous network graph samples based on the historical attribute information and historical interaction relationships of each communication entity.

[0086] Among them, the heterogeneous network graph sample is a single graph instance that abstracts historical attribute information and historical interaction relationships. It contains nodes of various types such as individuals, enterprises, and facilities. Each node carries a uniformly encoded attribute feature vector. The nodes are connected by voice, message, funds or access edges labeled with interaction type and timestamp. It is used to receive random augmentation and generate training signals under the contrastive learning framework, thereby supporting the parameter optimization of the abnormal communication identification model.

[0087] In the heterogeneous network graph sample, the nodes represent different types of communication entities, each node has different historical attribute information, and the edges between nodes represent the historical interaction types between the communication entities.

[0088] In this embodiment, this step refers to abstracting the historical attribute information and historical interaction relationships of all communication entities within a given time period into a unified graph structure: mapping three types of communication entities—individuals, enterprises, and facilities—as different types of nodes, encoding the statistical attributes of the nodes themselves into attribute feature vectors, and then converting four types of interaction events—voice, message, funds, and access—into directed or undirected edges between corresponding nodes according to their timestamps and interaction types. This forms a heterogeneous network graph instance containing multiple types of nodes, multiple types of edges, and with attached attributes and timestamps, serving as a single graph sample for subsequent comparative learning training and anomaly detection. More specifically, the specific implementation method for constructing the heterogeneous network graph sample is consistent with the specific implementation method of the heterogeneous network graph itself. The specific process can be found in the construction process of the heterogeneous network graph in Embodiment 1, and will not be repeated here.

[0089] S230. Based on the distance of each node's attribute information in hyperbolic space, perform two random normalization samplings on the edges of different interaction types in the heterogeneous network graph samples, and generate the first augmented network graph and the second augmented network graph according to the two sampling results.

[0090] Hyperbolic space is a non-Euclidean geometric manifold with constant negative curvature. Its distance metric grows exponentially with position and can be naturally embedded into tree-like or hierarchical structures while maintaining low-dimensional distortion. In the process of heterogeneous network graph augmentation, after the node attribute vectors are mapped to this space, the hyperbolic distance can be calculated using the Lorentz inner product, thereby measuring similarity in a way that conforms to the hierarchical relationship of telecommunications entities, and probabilistically sampling and deleting edges accordingly.

[0091] The first augmented network graph is a variant obtained by performing an initial topological perturbation on the original heterogeneous network graph sample. Its generation process is based on the node attribute distance in hyperbolic space, performing a random normalization sampling on the edges of each interaction type subgraph: retaining edges marked as 1 and deleting edges marked as 0. The remaining subgraphs are then merged again to form a new graph with a structure similar to the original but a reduced connection density, used for constructing positive and negative examples within and across views in the contrastive learning framework. The second augmented network graph is another topological perturbation version obtained by performing random normalization edge selection on the same sample independently of the first sampling. Its retained edge set differs from the first augmented network graph, thus constituting the second view required for contrastive learning, used to train cross-view node embeddings together with the first view. Figure 1 This improves consistency and robustness of the abnormal communication identification model.

[0092] In this embodiment, the attribute information of each node can be mapped to hyperbolic space and the hyperbolic distance between any two nodes can be calculated using the Lorentz inner product. Then, the heterogeneous network graph samples are divided into several subgraphs according to the interaction type. The minimum-maximum normalization is performed on the hyperbolic distance of each edge in the subgraph to obtain the retention probability. Then, two rounds of Bernoulli sampling are performed independently: the first round retains the edges marked as 1 and recombines the subgraphs to obtain the first augmented network graph. The second round repeats the same process to generate a second augmented network graph with different edge sets. Thus, the hyperbolic distance-guided random deletion mechanism provides two topologically related but complementary views for contrastive learning.

[0093] In the data augmentation stage, an adaptive multi-subgraph augmentation strategy for heterogeneous graphs based on hyperbolic space distance is proposed. Specifically, firstly, different subgraphs are divided according to edge type. For each edge within a subgraph, the attribute features of the nodes at both ends are mapped to hyperbolic space, and the corresponding hyperbolic geometric distance is calculated. Subsequently, the distance is normalized to a probability distribution, and Bernoulli sampling is performed accordingly to adaptively determine the retention and deletion of edges in each subgraph, achieving refined and structure-aware intra-subgraph augmentation. Finally, multiple augmented subgraphs are merged again to form an augmented heterogeneous graph view, thereby generating diverse and semantically consistent comparative views of the original heterogeneous graph structure. The beneficial effects of this augmentation method are as follows: by introducing hyperbolic geometric computation, it can more accurately express the inherent hierarchy and scale characteristics in complex heterogeneous graph structures, enabling the augmentation process to not only maintain semantic connections but also highlight potential anomalous patterns; by using normalized distance as the sampling basis, it achieves probabilistic and adaptive control of heterogeneous relation deletion, avoiding semantic distortion that may be caused by random augmentation; the strategy of augmenting multiple subgraphs separately and then merging them effectively maintains the structural integrity of the heterogeneous graph, ensures the diversity of generated views and the effectiveness of contrastive learning, and lays the foundation for subsequent accurate identification of anomalous communication behaviors.

[0094] Optionally, based on the distance of each node's attribute information in hyperbolic space, the edges of different interaction types in the heterogeneous network graph samples are randomly normalized and sampled twice. The specific implementation of generating the first augmented network graph and the second augmented network graph based on the two sampling results can include:

[0095] (1) Divide the heterogeneous network graph into multiple independent adjacency subgraphs according to the interaction type of the connecting edges.

[0096] In this embodiment, all edges in the original heterogeneous network graph can be grouped according to their labeled interaction type, so that each group of edges forms an independent adjacency subgraph containing only that type of connection. This allows for edge sampling and deletion to be performed on different subgraphs during subsequent augmentation, ensuring that the four types of relationships—voice, message, funds, and access—do not affect each other during topology disturbances.

[0097] (2) For each adjacent subgraph, calculate the distance value of the attribute feature vector of the two ends of each edge in hyperbolic space by using the Lorentz inner product operation, and use the distance value as the feature attribute value corresponding to each edge.

[0098] Among them, the feature attribute value is an intermediate quantitative index assigned to each edge when performing edge augmentation on heterogeneous network graph samples.

[0099] In this embodiment, for each adjacent subgraph, the attribute feature vectors of its two endpoints are mapped to hyperbolic space, and the geodesic distance between them is calculated using the Lorentz inner product. The resulting distance value is directly assigned as the feature attribute value of the edge, which is used to quantify the similarity of nodes in the hierarchical structure and provide a probabilistic basis for subsequent normalization and random sampling.

[0100] (3) Perform min-max normalization on each feature attribute value corresponding to the same interaction type, map each feature attribute value to the interval between zero and one, and obtain the normalized distance weight.

[0101] The normalized distance weights are edge feature values ​​calculated in hyperbolic space and linearly scaled to the interval between zero and one.

[0102] Specifically, the hyperbolic distance feature attribute values ​​of all edges can be normalized by min-max within the same interaction type subgraph: first, find the minimum and maximum values ​​of the distance values ​​in the subgraph, then subtract the minimum value from the distance value of each edge and divide by the range, thereby linearly compressing all distances to between 0 and 1, forming normalized distance weights; these weights are then used as the retention probability of the corresponding edges, ensuring that subsequent Bernoulli sampling determines whether edges are retained based on the hierarchical similarity between nodes at a uniform scale.

[0103] (4) Based on the normalized distance weight as the retention probability, perform Bernoulli sampling once for each edge, and recombine the edges marked as retained into the first augmented subgraph set. Merge each first augmented subgraph to obtain the first augmented network graph.

[0104] Bernoulli sampling is a stochastic decision-making process based on a 0-1 distribution: each edge is assigned a retention probability between 0 and 1, then a uniform random number is generated and compared with the probability. If the random number is less than the probability, it is marked as 1 and retained; otherwise, it is marked as 0 and deleted. This allows for rapid graph sparsification perturbation in an independent and identically distributed manner.

[0105] The first augmented subgraph set is a temporary aggregation of all adjacent subgraphs retained according to interaction type after the initial Bernoulli sampling. These subgraphs have undergone independent edge deletion based on normalized distance weights, containing only edges marked as retained during sampling. After merging, they will be reassembled into a complete first augmented network graph for use in subsequent contrastive learning. Figure 1 Embedded computing.

[0106] Specifically, using normalized distance weights as retention probabilities, Bernoulli sampling is performed independently on each edge: if the sampling result is to retain, it is marked as 1, otherwise it is marked as 0; then all edges marked as 1 are reassigned to their respective adjacency subgraphs according to their original interaction types, forming the first augmented subgraph set; finally, these subgraphs are merged to obtain the first augmented network graph with a reduced number of edges but a complete type structure, which is used for subsequent comparative learning views.

[0107] (5) Perform an independent Bernoulli sampling again based on the same normalized distance weight, and recombin the edges marked as retained by the sampling into a second augmented subgraph set. Merge the second augmented subgraphs to obtain the second augmented network graph.

[0108] The second augmented subgraph set is a temporary aggregation of the interaction type subgraphs obtained by re-performing independent Bernoulli sampling using the same set of normalized distance weights after the first round of augmentation. These subgraphs only contain the edges marked as retained in the second sampling, and their edge composition differs from that of the first augmented subgraph set. After merging, they will be pieced together to form the second augmented network graph, which is used to provide another view required for contrastive learning.

[0109] In this embodiment, after the first round of augmentation is completed, the same set of normalized distance weights obtained previously is reused, and Bernoulli sampling is performed independently on each edge again: new random numbers are generated and compared with the retention probability to re-determine whether the edge is retained; all edges marked as retained are assigned to their respective second augmented subgraphs according to their original interaction types to form a set of second augmented subgraphs; then these subgraphs are merged to obtain a second augmented network graph whose edge structure differs from the first augmented network graph, thereby providing another view required for contrastive learning.

[0110] An exemplary flowchart illustrating the augmentation process for heterogeneous network graph samples is shown below. Figure 3 As shown. The specific process of augmenting heterogeneous network graph samples to determine the first and second augmented network graphs can be as follows:

[0111] In heterogeneous graph representations, graph structure can be formally defined as: ,in Let N represent the set of all nodes in the graph, where N is the total number of nodes; E is the set of edges; and Φ is the type mapping function. and Let | represent the set of node types and the set of edge types. When | satisfies In this case, G is called a heterogeneous graph. Taking a telecommunications operator's business scenario as an example, node types can include mobile phone users, fixed-line phone users, and enterprise users, while edge types can include call relationships, SMS relationships, and financial transaction relationships. If If the graph is homogeneous, then 𝐺 is called a homogeneous graph.

[0112] Feature matrix It consists of the initial features of all nodes in the graph, where Let d represent the eigenvectors of node 𝑣𝑖. These features are typically generated using feature engineering methods based on node attributes. The topology of the graph can be represented by the adjacency matrix. This means: If there is an edge between node 𝑖 and node 𝑗, then ,otherwise .

[0113] To transform multi-source heterogeneous user attributes into numerical features that can be processed by the model, this invention designs a complete feature engineering process. First, based on the data type of user attributes in telecommunications services, they are divided into three categories: numerical, categorical, and textual. For numerical attributes (such as call duration and data usage), normalization is used to eliminate dimensional differences. For categorical attributes (such as user level and account status), one-hot encoding is used to convert them into high-dimensional sparse vectors. For textual attributes (such as user profiles, customer service chat logs, or device repair information), a pre-trained BERT model is used to extract semantic features and convert them into dense vector representations. Finally, the various processed feature vectors are concatenated to construct a unified initial feature representation for each user node. The features of all nodes together constitute the initial feature matrix , which serves as the input to the graph neural network model.

[0114] In heterogeneous network graph samples, since there are multiple types of nodes and edges, the adjacency matrix can be divided into multiple sub-matrices according to the edge type, so that the graph can be represented as 𝐺=(𝑋,{𝐴1,⋯ ,𝐴∣Φ(𝐸)∣}), where 𝐴𝑒 represents the adjacency matrix corresponding to edge type Φ(𝑒), and ∣Φ(𝐸)∣ is the total number of edge types. In this method, for each subgraph corresponding to edge type, a deletion augmentation operation is performed on the edges of specific types within it. Specifically, firstly, the distance between the two ends of each edge of type 𝑒 in hyperbolic space is calculated using formula (1), where Represents the Lorentz inner product of the node feature vectors, where 𝑘 is the hyperbolic curvature parameter, the value of which is determined through parameter tuning:

[0115] (1)

[0116] Subsequently, the obtained distances are normalized according to the edge type 𝑒, and the hyperbolic distance of each edge is mapped to the interval [0,1] using formula (2):

[0117] (2)

[0118] Next, for edges of type 𝑒, sampling is performed according to the Bernoulli distribution based on their normalized distance values, as shown in formula (3), where 𝑚𝑒 represents the number of edges of this type:

[0119] (3)

[0120] Subsequently, for each type of subgraph, a deletion operation is performed on the edges corresponding to the positions where the Bernoulli sampling result is 1, resulting in the augmented adjacency matrix. After repeating the above process for all edge types of subgraphs, the subgraphs are merged to complete the multi-subgraph augmentation of the heterogeneous graph, ultimately obtaining the augmented graph.

[0121] S240. Input the first augmented network graph and the second augmented network graph into the abnormal communication recognition model to be trained, respectively, to obtain the embedding representation of each node in the two augmented network graphs.

[0122] Among them, the abnormal communication identification model to be trained refers to the initial graph neural network framework that has not yet completed parameter learning. It consists of a feature encoder with adjustable weights and a two-layer multilayer perceptron prediction head. It can receive heterogeneous network graphs and output node anomaly scores, but it needs to iteratively update the weights of each layer through backpropagation driven by contrast loss in order to gradually converge to the final state that can accurately identify the abnormal attributes of communication entities.

[0123] In this embodiment, the first augmented network graph and the second augmented network graph can be sequentially fed into the feature encoder of the abnormal communication recognition model to be trained. The model performs forward propagation on the two views respectively: firstly, it aggregates neighbor information according to node type and edge type, and then outputs the low-dimensional vector of each node in the current view. These vectors are the embedding representations of the nodes in the corresponding augmented network graphs, which are used to calculate the positive and negative similarity across views and within views and drive the optimization of contrastive loss.

[0124] Optionally, the anomaly communication recognition model to be trained includes a feature encoder to be trained and a two-layer multilayer perceptron prediction head to be trained. Based on this, the specific implementation of inputting the first augmented network graph and the second augmented network graph into the anomaly communication recognition model to be trained, and obtaining the embedding representation of each node in the two augmented network graphs, can include:

[0125] (1) Input the first augmented network graph and the second augmented network graph into the encoder containing the features to be trained, respectively, to obtain the initial embedding representation of each node in the two augmented network graphs.

[0126] In this embodiment, the first augmented network graph and the second augmented network graph are sequentially fed into the feature encoder to be trained. The encoder aggregates the neighbor features according to the node type, edge type and attribute information of each view through a heterogeneous message passing mechanism. After transformation, it outputs the low-dimensional vector of each node in the current view. These vectors constitute the initial embedding representation of the node in the two augmented network graphs, providing a unified and comparable input for the subsequent two-layer multilayer perceptron prediction head to further extract abnormal features.

[0127] (2) For each node, nonlinear projection is performed on the two initial embedding representations of the current node based on the prediction head of the two-layer multilayer perceptron to be trained, to determine the first embedding representation of the current node in the first augmented network graph and the second embedding representation of the current node in the second augmented network graph.

[0128] The first embedding representation is a low-dimensional feature vector obtained by nonlinearly projecting the initial embedding of the first augmented network graph onto the current node using the prediction head of the two-layer multilayer perceptron to be trained. It integrates the node's attributes and topological information in the first view and is used for subsequent cross-view and intra-view positive and negative example matching and contrastive loss calculation. The second embedding representation is a low-dimensional feature vector obtained by nonlinearly projecting the initial embedding of the second augmented network graph onto the current node using the prediction head of the two-layer multilayer perceptron to be trained. It focuses on characterizing the node's attributes and topological features in the second view and is used together with the first embedding representation to complete cross-view positive and negative example matching and contrastive loss calculation.

[0129] In this embodiment, the two initial embedding vectors obtained by the current node in the first augmented view and the second augmented view can be respectively input into the training two-layer multilayer perceptron prediction head with shared weights: first, the high-dimensional mapping is completed by the first layer weight matrix and nonlinear activation, and then the second layer dimensionality reduction and activation function are introduced to output two new low-dimensional feature vectors, namely the first embedding representation and the second embedding representation. This nonlinear projection strengthens the abstract features required for anomaly discrimination, while maintaining cross-view comparability, and provides a unified and more discriminative embedding space for subsequent positive and negative example matching and contrast loss calculation.

[0130] S250. For each node, based on the hyperbolic distance values ​​between nodes in the first augmented network graph and the second augmented network graph, determine the set of positive example nodes and the set of negative example nodes corresponding to the current node.

[0131] Among them, the hyperbolic distance value is a measure of the geodesic length induced by the Lorentz inner product in a hyperbolic manifold with constant negative curvature. It is used to quantify the actual interval between the attribute feature vectors of two nodes in the hierarchical space. Its value increases exponentially with the difference in node hierarchy, maintaining low-distortion embedding of the tree structure and providing a geometric basis for subsequent normalized sampling that reflects the similarity of nodes.

[0132] The positive example node set is a set of nodes that exhibit high similarity to the current node in both topological importance ranking and hyperbolic attribute distance. Its members are of the same type as the current node and are retained after screening. They are used as positive sample pairs in the contrastive learning framework to enhance the model's embedding consistency with normal communication patterns.

[0133] The negative example node set is the set of remaining nodes obtained after removing all positive example members from all other nodes of the same type as the current node after determining the positive example node. It is used as a negative sample pair in the contrastive learning framework to increase the distance between the current node and the positive example node in the embedding space, thereby strengthening the model's ability to distinguish abnormal patterns.

[0134] In this embodiment, the global topology and node attributes of two augmented views are used to measure the hierarchical similarity between the current node and other nodes in hyperbolic space. First, candidate nodes with high topological importance are selected by the graph diffusion matrix. Then, nodes with the same type as the current node and the smallest distance are sorted according to the hyperbolic distance value and retained as a set of positive example nodes. Subsequently, these positive examples are removed from the set of nodes of the same type, and the remaining nodes are classified as a set of negative example nodes. Thus, the automatic division of positive and negative samples within the same type is completed, providing a basis for subsequent comparative loss calculation.

[0135] To facilitate the calculation of the contrastive loss function, this embodiment proposes a positive example expansion strategy that integrates topological structure and attribute feature information to address the construction of positive and negative examples. Specifically, this strategy first utilizes a personalized PageRank algorithm to mine nodes closely related to the target node at the graph structure level. Then, it combines feature distance metrics in hyperbolic space to filter semantically similar nodes at the attribute level. Finally, these two types of nodes, along with the target node's representation in another view, form the expanded positive example set, thus achieving multi-information fusion in positive example construction. The beneficial effects of this positive and negative example construction method are: by comprehensively considering the network's topological relationships and node attribute features, it overcomes the problems of single positive examples and lack of semantic association in traditional contrastive learning; the introduction of personalized PageRank and hyperbolic distance metrics enables more accurate identification of highly relevant positive samples in complex heterogeneous graphs, enhancing the model's ability to discriminate abnormal patterns; and the effective expansion of positive examples improves sample utilization efficiency and the stability of contrastive learning, helping the model learn more generalizable node representations, thereby significantly improving the accuracy and robustness of abnormal communication identification.

[0136] Optionally, the specific implementation steps for determining the set of positive and negative nodes corresponding to each node based on the hyperbolic distance values ​​between nodes in the first and second augmented network graphs may include:

[0137] S1. Based on the global topology of the first augmented network graph and the second augmented network graph, construct a graph diffusion matrix that represents the importance between nodes.

[0138] The graph diffusion matrix is ​​a global association matrix obtained by propagating adjacency relationships multiple times through random walks or power series. Its elements quantify the higher-order reachability and influence strength between any two nodes. In abnormal communication identification, it is used to quickly assess the importance of nodes at the topological level, thereby supporting the automatic screening and comparative learning training of subsequent positive and negative examples.

[0139] In this embodiment, the complete topology of the first augmented network graph and the second augmented network graph can be used to propagate the adjacency matrix multiple times through iterative random walks or polynomial series, thereby calculating a graph diffusion matrix that reflects the high-order reachability probability and mutual influence strength between any two nodes. The larger the element value, the closer the association between the node pairs in the global structure, which is used to quantify the topological importance of each node in the entire view and provide a ranking basis for subsequent screening of candidate strongly related nodes.

[0140] S2. Based on the graph diffusion matrix, determine the importance ranking of each node at the topological level, and select the nodes whose ranking meets the preset conditions as the candidate strongly related node set.

[0141] Among them, the importance ranking at the topology level refers to the quantitative calculation of the importance of each node in the graph relative to a specific node from the global topology connection relationship of the network based on the graph diffusion algorithm, and the ranking of all nodes in descending order according to the score, so as to reflect their close association with the target node and their influence ranking in the network structure.

[0142] The preset condition could be to select a predetermined number of nodes with the highest ranking as the candidate strongly correlated node set. The candidate strongly correlated node set is a subset of nodes that have the highest importance correlation with the current node in the topological structure, calculated based on the graph diffusion matrix. Its members are determined by sorting the global random walk probability and truncating the preceding positions.

[0143] In this embodiment, the global influence values ​​reflected by the elements in each row of the graph diffusion matrix can be used to rank the importance of the node set: by arranging the element values ​​in the row corresponding to the current node in order of size, the nodes ranked in the top 2K positions are selected to form a set of candidate strongly related nodes; this set has the highest correlation strength with the current node at the topological level, providing a concise and high-quality candidate pool for subsequent screening of positive examples using hyperbolic distance, ensuring the reliability and representativeness of positive samples in the contrastive learning stage.

[0144] S3. Based on the hyperbolic distance of the attribute features between each candidate node in the candidate strongly correlated set and the current node, the candidate nodes are filtered to determine multiple positive nodes corresponding to the current node. The nodes corresponding to the current node in the non-attached augmented network graph are also determined as positive nodes, thus obtaining the set of positive nodes.

[0145] Among them, the hyperbolic distance of attribute features is the geodesic length calculated by mapping the attribute feature vector of a node to a hyperbolic manifold with constant negative curvature and then using the Lorentz inner product.

[0146] A non-attached augmented network graph is another augmented view that is compared with the view where the current node is located: if the current node is in the first augmented network graph, then the second augmented network graph is its non-attached augmented network graph, and vice versa; this graph is generated by an independent random sampling process and has an edge structure that is related to the current view but not completely identical in topology. It is used to provide positive examples across views and drive the model to learn consistent and robust node embeddings.

[0147] In this embodiment, within the candidate strongly correlated set, the operation sorts the candidate nodes by hyperbolic distance from the current node in order of proximity, selects several nodes with the smallest distance and consistent type as positive examples in the same view, and forcibly designates the corresponding node of the current node in another augmented view as a positive example across views, and includes it in the set of positive example nodes. This is used to bring the embedding representation closer in subsequent comparative learning, ensuring that the model maintains feature consistency for the same entity and its highly similar neighbors under different perturbations.

[0148] S4. For all nodes, after removing the already determined positive example nodes based on the entire set of nodes, determine all remaining nodes as the set of negative example nodes.

[0149] In this embodiment, after determining the set of positive example nodes, all nodes that have been selected as positive examples are directly removed from the set of all nodes of the same type as the current node, and each remaining node is unconditionally classified into the set of negative example nodes. This process does not require additional distance or similarity calculations and can be completed quickly by set difference alone, ensuring that the scale of negative examples is sufficient and mutually exclusive with positive examples, providing the necessary negative sample signals for the contrast loss.

[0150] For example, the specific implementation process for determining the set of positive and negative nodes corresponding to the current node can be:

[0151] First, a graph diffusion matrix based on personalized PageRank is used. To calculate the importance of nodes at the topological level, a relevant set of nodes is selected. The expression is as shown in formula (4), where To add a self-joined adjacency matrix, adjust the angle matrix. , .

[0152] (4)

[0153] Symmetric matrix It stores the importance of nodes to each other, that is: elements Representative node With nodes The relative importance of each other. Compared to an adjacency matrix, Even non-neighbor nodes in the matrix still possess an importance score, which considers multi-hop neighbor relationships and incorporates higher-order topological information. After calculating this matrix, this invention combines hyperparameters... , for target node Select the elements in the corresponding row that have the highest importance scores. The elements are determined by the corresponding node index function. A preliminary set of strongly correlated groups is determined, a process that can be represented by formula (5):

[0154] (5)

[0155] Subsequently, in order to utilize node attribute features, this invention also uses hyperbolic distance as a similarity metric to further filter and select similar nodes. During the filtering process, this invention only selects nodes that meet the conditions and are of the same type as the target node to obtain the final set of positive examples. This process is shown in formula (6):

[0156] (6)

[0157] In the above formula, the present invention first calculates the hyperbolic distance between the target node and the set of nodes obtained in the previous step, and the feature matrix is ​​used in this process. Then we obtain the one with the smallest distance. A set of nodes, and then through a type mapping function Filter out nodes that match the target node Nodes of the same type yield the final target set of positive examples.

[0158] Accordingly, this invention treats all nodes of the same type outside the set of positive examples as target nodes. The negative example nodes are shown in formula (7):

[0159] (7)

[0160] S260. Based on the embedding representation of each node, determine the matching attributes of the positive and negative example node pairs of the current node across views and within views, so as to determine the contrast loss value of the current node based on the matching attributes of the positive and negative example node pairs.

[0161] In this context, the positive and negative example node pairs across views and within views refer to the positive and negative sample combinations constructed for loss calculation for each target node under the graph contrastive learning framework. The "within-view" positive and negative example node pairs come from the same augmented view (such as the first augmented network graph), selected based on topological or feature similarity, and randomly sampled negative example nodes. The "cross-view" positive and negative example node pairs refer to the positive example nodes (i.e., their own embedding representations in different views) corresponding to the target node in different augmented views (such as the first and second augmented network graphs) and all other mismatched nodes as negative examples. By jointly optimizing these two pairing relationships, the model can learn node representations that are robust to augmentation and highly discriminative.

[0162] Among them, the matching attribute refers to the metric used to quantify the consistency or compatibility between the representation vectors of a pair of nodes (such as a pair of positive or negative nodes) in the embedding space.

[0163] Among them, the contrastive loss value is a loss function calculated based on the contrastive learning paradigm. Its core idea is to measure the consistency between the current node representation and its set of positive and negative nodes by bringing positive sample pairs (semantically or structurally similar nodes) closer in the embedding space, while pushing away the distance between negative sample pairs (dissimilar nodes). This value is used to guide the optimization of model parameters to make the learned node representation more discriminative.

[0164] In this embodiment, during the training of the abnormal communication identification model, the similarity between the embedded representations of nodes in hyperbolic space (such as hyperbolic distance or cosine similarity) is calculated to evaluate the consistency (i.e., matching attribute) between the current node and its set of positive nodes (across views and within views), as well as the difference between the current node and its set of negative nodes. Based on these matching attributes, the contrastive loss function (e.g., loss based on InfoNCE) will encourage the current node to be as close as possible to positive nodes in the embedding space and as far away as possible from negative nodes. This maximizes the similarity of positive pairs and minimizes the similarity of negative pairs to quantify the contrastive loss value of the current node, thereby driving the model to learn more discriminative node representations.

[0165] Optionally, the specific implementation of determining the matching attribute of the positive and negative example node pairs of the current node across and within the view, based on the embedding representation of each node, may include:

[0166] The embedding representation of the current node is paired with the embedding representations of other views and the identified positive node embedding representations in the same view. Cosine similarity is calculated and exponential weighting is accumulated to obtain the positive matching attributes between views and the positive matching attributes within views.

[0167] The inter-view positive example matching attribute refers to the consistency measure between the embedding representation of the current node in one augmented network view and the embedding representation of the corresponding positive example node (usually derived from the same original node) in another different augmented network view. The intra-view positive example matching attribute refers to the consistency measure between the embedding representation of the current node and the embedding representation of other identified positive example nodes (usually semantically similar nodes selected based on graph topology or attribute similarity) within the same augmented network view used for contrastive learning.

[0168] In this embodiment, for the embedding representation of the current node in the first augmented network graph and the second augmented network graph, it is paired with the embedding representation of the identified positive example node in another augmented network graph (i.e., between views) and paired with the embedding representation of the identified positive example node in the same augmented network graph (i.e., within the view). Cosine similarity is calculated for each pair of embedding representations to measure their similarity. Then, these cosine similarity values ​​are exponentially weighted and accumulated. The final results are used as the positive example matching attribute between views and the positive example matching attribute within views, respectively.

[0169] The embedding representation of the current node is paired with the embedding representations of other views and the identified negative example nodes in the same view. Cosine similarity is calculated and exponential weighting is accumulated to obtain the negative example matching attributes between views and the negative example matching attributes within views.

[0170] The inter-view negative example matching attribute refers to pairing the embedding representation of the current node with the embedding representations of identified negative example nodes in another augmented network graph (i.e., across views), calculating a cosine similarity for each pair of embedding representations to measure their similarity, and then performing an exponential weighted operation on these cosine similarity values ​​and summing the results. The intra-view negative example matching attribute refers to pairing the embedding representation of the current node with the embedding representations of identified negative example nodes in the same augmented network graph (i.e., within the view), calculating a cosine similarity for each pair of embedding representations to measure their similarity, and then performing an exponential weighted operation on these cosine similarity values ​​and summing the results.

[0171] In this embodiment, for the embedding representation of the current node in the first augmented network graph and the second augmented network graph, it is paired with the embedding representation of the identified negative example node in another augmented network graph (i.e., between views) and paired with the embedding representation of the identified negative example node in the same augmented network graph (i.e., within views). Cosine similarity is calculated for each pair of embedding representations to measure their similarity. Then, these cosine similarity values ​​are exponentially weighted and accumulated. The final results are used as the negative example matching attribute between views and the negative example matching attribute within views, respectively.

[0172] Furthermore, specific implementations for determining the contrastive loss value of the current node based on the matching attributes of positive and negative example node pairs may include:

[0173] Based on the positive example matching attributes between views, the positive example matching attributes within views, the negative example matching attributes between views, the negative example matching attributes within views, and the preset loss function, determine the contrast loss value of the current node.

[0174] The pre-defined loss function is a mathematical function pre-set before model training to quantify the difference between the predicted result and the expected result of the current node. It calculates the contrastive loss value of the current node by combining inter-view positive example matching attributes, intra-view positive example matching attributes, inter-view negative example matching attributes, and intra-view negative example matching attributes, reflecting the degree of error in the model's prediction and providing a basis for optimizing and adjusting model parameters. Optionally, the pre-defined loss function may include:

[0175]

[0176] In the formula, This represents the contrastive loss value of the i-th node. This indicates a positive match attribute between views. This indicates a positive match attribute within the view. This indicates that the negative instance matching attribute is between views. This indicates that the negative instance matches the attribute within the view.

[0177] Specifically, the obtained positive example matching attributes between views, positive example matching attributes within views, negative example matching attributes between views, and negative example matching attributes within views can be used as inputs and substituted into a pre-defined mathematical function (i.e., a preset loss function) used to quantify the difference between the prediction result and the expected result. Through the calculation of this function, a value that reflects the degree of prediction error of the current node can be obtained. This value is the contrast loss value of the current node.

[0178] Based on the aforementioned positive example augmentation strategy, this embodiment further designs a corresponding negative sample selection mechanism and a multi-component contrastive loss function, specifically introducing an intra-view positive-negative sample pair discrimination loss term. Specifically, outside the positive example set, all other nodes within the batch are considered negative examples by default, and the contrastive losses between the target node and cross-view sample pairs, as well as with intra-view positive-negative sample pairs, are calculated separately, collectively constituting the final optimization objective. The beneficial effects of this loss function calculation mode are: by explicitly introducing an intra-view contrastive loss term, the model's ability to distinguish between positive and negative samples within the same augmented view is enhanced, improving the discriminativeness and consistency of the representation; combined with the expanded positive example set, this loss mode prompts the model not only to learn cross-view invariant features but also to strengthen its perception of local structures within the view, thereby more comprehensively capturing abnormal behavior patterns; multi-component joint optimization effectively improves training stability and representation quality, enabling the model to better adapt to the dual requirements of accuracy and robustness in telecommunications fraud detection.

[0179] S270. Determine the overall target loss based on the comparative loss value of each node, and optimize and adjust the parameters of the abnormal communication identification model to be trained according to the overall target loss to obtain the pre-trained abnormal communication identification model.

[0180] The overall target loss is the comparative loss value calculated based on the nodes corresponding to all communication entities (i.e., each node in the heterogeneous network graph sample) during the training process of the abnormal communication identification model.

[0181] In this embodiment, during the model training phase of the abnormal communication identification method, the contrastive loss value of each node in the heterogeneous network graph sample is first calculated using a preset loss function. Then, the contrastive loss values ​​of all nodes are integrated in a specific way (such as summation or averaging) to form an overall target loss that reflects the overall prediction error or target deviation of the entire model in the current training state. Subsequently, with the core objective of reducing or minimizing this overall target loss, relevant optimization algorithms (such as gradient descent) are used to adjust various parameters within the model (such as weights in the node embedding calculation process and connection parameters between network layers). This allows the model to more accurately learn the characteristics and interaction patterns of communication entities when processing data in subsequent steps, reducing overall prediction deviation and gradually improving the model's ability to identify abnormal communication until the overall target loss of the model is reduced to a level that meets the training requirements. This completes the optimization process of the model parameters, resulting in a trained abnormal communication identification model.

[0182] For example, the schematic diagram of the above abnormal communication identification model training process can be found in [reference needed]. Figure 4 As the core step of this solution, it mainly includes the following three components:

[0183] (1) Data augmentation step: used to transform the original data to generate multiple different views. In order to obtain views that are related to and different from the original graph data (denoted by G), this invention performs augmentation operations on the topological structure of heterogeneous graphs. Specifically, for each subgraph corresponding to different types of edges in the graph, edge deletion processing based on hyperbolic spatial distance is performed. During the edge deletion process, the normalized endpoint hyperbolic distance is used as the sampling basis to adaptively determine the edges to be deleted, thereby achieving adaptive augmentation for multiple subgraphs.

[0184] (2) Encoding and Projection Steps: This step extracts features from the multiple views obtained after augmentation. Each view is encoded by a graph neural network to generate a node embedding representation, which is then connected to a projection head composed of a two-layer MLP to further improve the representation quality and contrastive learning effect.

[0185] (3) Comparative loss calculation step: This step is based on the projection results and optimized using an improved infoNCE loss. Unlike the traditional method that only considers the embeddings of the same node in different views as positive sample pairs, this invention proposes a positive example expansion strategy: by combining a personalized PageRank algorithm with hyperbolic space distance, and comprehensively considering the topology of heterogeneous graphs and node attribute features, multiple classes of highly relevant positive sample nodes are selected for each node. For example... Figure 2 As shown, when calculating the contrastive loss of the target node (marked with a red star), the nodes selected by the above strategy (marked with a green plus sign) are used as positive examples, and the remaining nodes are used as negative examples (marked with a gray minus sign). Furthermore, this invention introduces an in-view loss term, which together constitute the final contrastive loss target to comprehensively optimize the model parameters.

[0186] A schematic diagram of the overall technical process of the above model training can be found in [reference needed]. Figure 5 .like Figure 5 As shown, the main modules include heterogeneous graph construction, initial feature mapping, multi-positive heterogeneous graph comparative learning, and model optimization and updating. The communication anomaly identification problem is modeled as a node classification task on a heterogeneous graph. By designing a specific objective loss function and using the gradient backpropagation algorithm to iteratively optimize the model parameters until convergence, a fully trained classification model is obtained, which can be directly deployed in real-world business scenarios to achieve end-to-end accurate identification of potential abnormal communication entities.

[0187] S280. Based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationship between communication entities, construct a heterogeneous network graph.

[0188] In the telecommunications service scenario, there are multiple types of communication entities. The nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction type between the communication entities.

[0189] S290. Input the heterogeneous network graph into the pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity.

[0190] The technical solution of this application embodiment, when training the abnormal communication identification model, obtains the historical attribute information of each communication entity in the telecommunications service scenario and the historical interaction relationship between communication entities; based on the historical attribute information and historical interaction relationship of each communication entity, a heterogeneous network graph sample is constructed; wherein, the nodes in the heterogeneous network graph sample represent different types of communication entities, each node has different historical attribute information, and the edges between nodes represent the historical interaction type between communication entities; based on the distance of the attribute information of each node in hyperbolic space, the edges of different interaction types in the heterogeneous network graph sample are randomly normalized and sampled twice, and a first augmented network graph and a second augmented network graph are generated according to the two sampling results respectively; the first augmented network graph is then used to generate the second augmented network graph. The network graph and the second augmented network graph are respectively input into the abnormal communication recognition model to be trained to obtain the embedding representation of each node in the two augmented network graphs. For each node, based on the hyperbolic distance value between each node in the first and second augmented network graphs, the set of positive and negative nodes corresponding to the current node are determined. According to the embedding representation of each node, the matching attribute of the positive and negative node pairs of the current node in the cross-view and in-view is determined, and the contrastive loss value of the current node is determined based on the matching attribute of the positive and negative node pairs. The overall target loss is determined based on the contrastive loss value of each node, and the parameters of the abnormal communication recognition model to be trained are optimized and adjusted according to the overall target loss to obtain the trained abnormal communication recognition model. The technical solution of this application effectively reduces the dependence on large-scale labeled data through an unsupervised contrastive learning paradigm. It generates semantically consistent and structurally diverse views by using an adaptive graph augmentation strategy based on hyperbolic distance, which enhances the model's ability to express complex heterogeneous relationships and its robustness. Furthermore, it improves the model's ability to perceive association patterns such as collaborative fraud by using a positive example expansion strategy that integrates topological structure and attribute features. At the same time, it introduces an intra-view contrastive loss term and a multi-level contrast mechanism to enrich the sources of self-supervised signals, significantly improve the discriminativeness and generalization performance of node representations, and thus achieve higher accuracy and stronger adaptability in communication anomaly identification tasks.

[0191] Example 3

[0192] Figure 6 This is a schematic diagram of an abnormal communication identification device provided in an embodiment of this application. The device includes a heterogeneous network graph construction module 310 and an abnormal attribute determination module 320.

[0193] The heterogeneous network graph construction module 310 is used to construct a heterogeneous network graph based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationship between communication entities. The telecommunications service scenario contains multiple types of communication entities, and the nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction type between communication entities.

[0194] The abnormal attribute determination module 320 is used to input the heterogeneous network graph into the pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity.

[0195] This application provides an abnormal communication identification method and apparatus. Based on the attribute information of each communication entity in a telecommunications service scenario and the interaction relationships between these entities, a heterogeneous network graph is constructed. The telecommunications service scenario includes multiple types of communication entities, and the nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction types between the communication entities. The heterogeneous network graph is then input into a pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity. The technical solution of this application, by constructing a heterogeneous network graph that integrates multiple types of communication entities and their rich interaction relationships, and utilizing a pre-trained deep anomaly identification model for end-to-end analysis, effectively overcomes the limitations of traditional methods that rely on lag in manual rule updates and the difficulty in setting statistical thresholds. It can adaptively capture complex and ever-changing fraud patterns and weak signal correlation features, significantly improving identification accuracy and generalization ability, and providing a more reliable and efficient technical guarantee for telecommunications service security.

[0196] Based on the above-mentioned device, optionally, the heterogeneous network graph construction module 310 includes:

[0197] The operation data acquisition unit is used to acquire raw operation data in telecommunications service scenarios. The raw operation data includes entity attribute tables that record the attribute information of various communication entities, voice communication interaction records, message interaction records, transaction records, network facility registry, and communication entity and facility binding logs.

[0198] The node attribute feature determination unit is used to determine the node set of different types of communication entities based on the entity attribute table, network facility registry, and communication entity and facility binding log of various communication entity attribute information in the original operation data, and to generate a corresponding attribute feature vector for each communication entity node.

[0199] The connection edge determination unit is used to generate a set of interaction relationship edges based on voice communication interaction records, message interaction records, and transaction records, and to label each edge with the interaction type and timestamp; wherein, the set of interaction relationship edges includes: voice communication relationship edges, message interaction relationship edges, fund transaction relationship edges between various communication entities, and access relationship edges between communication entities and network facilities;

[0200] The heterogeneous network graph determination unit is used to construct a heterogeneous network graph containing multiple types of communication entity nodes and multiple types of interaction relationship edges based on the set of each node and the set of all interaction relationship edges; wherein, each communication entity node has been attached with the corresponding attribute feature vector, and the interaction relationship edges have recorded the interaction type and timestamp.

[0201] Based on the aforementioned device, optionally, the entity attribute table includes attribute information of personal type communication entities and attribute information of enterprise type communication entities. The node attribute feature determination unit is specifically used to: determine a first set of nodes for personal type communication entities based on the attribute information of personal type communication entities in the entity attribute table, and generate a corresponding personal attribute feature vector for each personal type communication entity node; determine a second set of nodes for enterprise type communication entities based on the attribute information of enterprise type communication entities in the entity attribute table, and generate a corresponding enterprise attribute feature vector for each enterprise type communication entity node; and determine a third set of nodes for facility type communication entities based on the network facility registry and communication entity-facility binding logs, and generate a corresponding facility attribute feature vector for each facility type communication entity node.

[0202] Based on the above-mentioned device, optionally, the abnormal attribute determination module 320 includes:

[0203] The initial embedding determination unit is used to input the heterogeneous network graph into the feature encoder to obtain the initial embedding representation of each node in the heterogeneous network graph;

[0204] The feature embedding determination unit is used to perform nonlinear projection on the initial embedding representation of the current node based on the two-layer multilayer perceptron prediction head for each node, and determine the feature embedding representation corresponding to the current node.

[0205] The abnormal attribute determination unit is used to determine the abnormal attribute information of the corresponding communication entity based on the feature embedding representation of each node.

[0206] Based on the above-mentioned device, optionally, the abnormal communication identification device further includes: a model training unit; the model training unit includes:

[0207] The historical data acquisition unit is used to acquire historical attribute information of each communication entity in the telecommunications service scenario, as well as the historical interaction relationships between communication entities.

[0208] The network graph sample determination unit is used to construct heterogeneous network graph samples based on the historical attribute information and historical interaction relationships of each communication entity. In the heterogeneous network graph sample, the nodes represent different types of communication entities, each node has different historical attribute information, and the edges between nodes represent the historical interaction types between communication entities.

[0209] The network graph augmentation unit is used to perform two random normalized samplings of edges of different interaction types in a heterogeneous network graph sample based on the distance of each node's attribute information in hyperbolic space, and generate a first augmented network graph and a second augmented network graph based on the two sampling results respectively.

[0210] The embedding representation determination unit is used to input the first augmented network graph and the second augmented network graph into the abnormal communication identification model to be trained, respectively, to obtain the embedding representation of each node in the two augmented network graphs;

[0211] The contrast loss value determination unit is used to determine the matching attributes of positive and negative example node pairs of the current node in cross-view and within-view based on the embedding representation of each node, so as to determine the contrast loss value of the current node based on the matching attributes of positive and negative example node pairs.

[0212] The model parameter optimization unit is used to determine the overall target loss based on the comparative loss value of each node, and to optimize and adjust the parameters of the abnormal communication identification model to be trained according to the overall target loss, so as to obtain the pre-trained abnormal communication identification model.

[0213] Based on the above-mentioned device, optionally, a network graph augmentation unit is used to divide a heterogeneous network graph into multiple independent adjacency subgraphs according to the interaction type of the connecting edges; for each adjacency subgraph, the distance value of the attribute feature vectors of the two ends of each edge in hyperbolic space is calculated by the Lorentz inner product operation, and the distance value is used as the feature attribute value corresponding to each edge; for each feature attribute value corresponding to the same interaction type, min-max normalization is performed to map each feature attribute value to the interval between zero and one to obtain normalized distance weights; based on the normalized distance weights as the retention probability, Bernoulli sampling is performed once for each edge, and the edges marked as retained by the sampling are recombined into a first augmented subgraph set, and the first augmented subgraphs are merged to obtain a first augmented network graph; based on the same normalized distance weight, an independent Bernoulli sampling is performed again, and the edges marked as retained by the sampling are recombined into a second augmented subgraph set, and the second augmented subgraphs are merged to obtain a second augmented network graph.

[0214] Based on the above-mentioned device, optionally, the embedding representation determination unit is specifically used to input the first augmented network graph and the second augmented network graph into the feature encoder to be trained, respectively, to obtain the initial embedding representation of each node in the two augmented network graphs; for each node, nonlinear projection is performed on the two initial embedding representations of the current node based on the prediction head of the two-layer multilayer perceptron to be trained, to determine the first embedding representation of the current node in the first augmented network graph and the second embedding representation of the current node in the second augmented network graph.

[0215] Based on the above-mentioned device, the abnormal communication identification device may optionally include: a positive and negative example node determination module;

[0216] The positive and negative example node determination module is used to determine the set of positive example nodes and the set of negative example nodes corresponding to each node based on the hyperbolic distance values ​​between nodes in the first augmented network graph and the second augmented network graph.

[0217] Based on the above-mentioned device, optionally, a positive and negative example node determination module is used to construct a graph diffusion matrix representing the importance between nodes based on the global topology of the first augmented network graph and the second augmented network graph; based on the graph diffusion matrix, determine the importance ranking of each node at the topological level, and select nodes whose ranking meets preset conditions as a set of candidate strongly correlated nodes; based on the hyperbolic distance of the attribute features between each candidate node in the candidate strongly correlated set and the current node, perform screening processing on each candidate node to determine multiple positive example nodes corresponding to the current node, and determine the nodes corresponding to the current node in the augmented network graph that are not to which it belongs as positive example nodes, thus obtaining a set of positive example nodes; for all nodes, after removing the determined positive example nodes based on the entire set of nodes, determine all remaining nodes as a set of negative example nodes.

[0218] Based on the above-mentioned device, optionally, the comparison loss value determination unit includes: a matching attribute determination subunit and a comparison loss value determination subunit;

[0219] The matching attribute determination sub-unit is specifically used to pair the embedding representation of the current node with the embedding representations of other views and the identified positive example nodes in the same view, calculate the cosine similarity and accumulate the exponential weighted operation to obtain the positive example matching attribute between views and the positive example matching attribute within a view; and to pair the embedding representation of the current node with the embedding representations of other views and the identified negative example nodes in the same view, calculate the cosine similarity and accumulate the exponential weighted operation to obtain the negative example matching attribute between views and the negative example matching attribute within a view.

[0220] The comparison loss value determination sub-unit is specifically used to determine the comparison loss value of the current node based on inter-view positive example matching attributes, intra-view positive example matching attributes, inter-view negative example matching attributes, intra-view negative example matching attributes, and a preset loss function; wherein, the preset loss function includes:

[0221]

[0222] In the formula, This represents the contrastive loss value of the i-th node. This indicates a positive match attribute between views. This indicates a positive match attribute within the view. This indicates that the negative instance matching attribute is between views. This indicates that the negative instance matches the attribute within the view.

[0223] The abnormal communication identification device provided in this application embodiment can execute the abnormal communication identification method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of the execution method.

[0224] It is worth noting that the various units and modules included in the above system are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the protection scope of the embodiments of this application.

[0225] Example 4

[0226] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 A block diagram is shown of an exemplary electronic device 40 suitable for implementing embodiments of the present application. Figure 7 The electronic device 40 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0227] like Figure 7 As shown, electronic device 40 is represented in the form of a general-purpose computing device. The components of electronic device 40 may include, but are not limited to: one or more processors or processing units 401, system memory 402, and bus 403 connecting different system components (including system memory 402 and processing unit 401).

[0228] Bus 403 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0229] Electronic device 40 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 40, including volatile and non-volatile media, removable and non-removable media.

[0230] System memory 402 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 404 and / or cache memory 405. Electronic device 40 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 406 may be used to read and write non-removable, non-volatile magnetic media (… Figure 7 Not shown; usually referred to as a "hard drive"). Although Figure 7 As not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 403 via one or more data media interfaces. Memory 402 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this application.

[0231] A program / utility 408 having a set (at least one) of program modules 407 may be stored, for example, in memory 402. Such program modules 407 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 407 typically perform the functions and / or methods described in the embodiments of this application.

[0232] Electronic device 40 can also communicate with one or more external devices 409 (e.g., keyboard, pointing device, display 410, etc.), and with one or more devices that enable a user to interact with electronic device 40, and / or with any device that enables electronic device 40 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 411. Furthermore, electronic device 40 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 412. As shown, network adapter 412 communicates with other modules of electronic device 40 via bus 403. It should be understood that, although... Figure 7 As not shown, other hardware and / or software modules may be used in conjunction with electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0233] The processing unit 401 executes various functional applications and page processing by running programs stored in the system memory 402, such as implementing the abnormal communication identification method provided in the embodiments of this application.

[0234] Example 5

[0235] This application also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform an abnormal communication identification method, the method comprising:

[0236] Based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationship between communication entities, a heterogeneous network graph is constructed. The telecommunications service scenario contains multiple types of communication entities, and the nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction type between communication entities.

[0237] The heterogeneous network graph is input into a pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity.

[0238] The computer storage medium in this application embodiment can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0239] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0240] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0241] Computer program code for performing the operations of the embodiments of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0242] Note that the above description is merely a preferred embodiment and the technical principles employed in this application. Those skilled in the art will understand that this application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments. Many other equivalent embodiments may be included without departing from the concept of this application, and the scope of this application is determined by the scope of the appended claims.

Claims

1. An abnormal communication identification method, characterized in that, The method includes: A heterogeneous network graph is constructed based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationships between the communication entities. The telecommunications service scenario includes multiple types of communication entities, and the nodes in the heterogeneous network graph represent different types of communication entities. Each node has different attribute information, and the edges between nodes are labeled with the interaction types between the communication entities. The heterogeneous network graph is input into a pre-trained abnormal communication identification model to obtain the abnormal attribute information corresponding to each communication entity.

2. The method according to claim 1, characterized in that, The construction of a heterogeneous network graph based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationships between the communication entities includes: Obtain raw operational data in telecommunications service scenarios; wherein, the raw operational data includes entity attribute tables that record attribute information of various communication entities, voice communication interaction records, message interaction records, transaction records, network facility registry, and communication entity and facility binding logs; Based on the entity attribute table of various communication entity attribute information in the original operation data, the network facility registry, and the communication entity and facility binding log, the node set of different types of communication entities is determined, and a corresponding attribute feature vector is generated for each communication entity node. Based on the voice communication interaction records, the message interaction records, and the transaction records, an interaction relationship edge set is generated, and each edge is labeled with the interaction type and timestamp; wherein, the interaction relationship edge set includes: voice communication relationship edges, message interaction relationship edges, fund transaction relationship edges between various communication entities, and access relationship edges between communication entities and network facilities; Based on the set of nodes and the set of all interaction edges, a heterogeneous network graph containing multiple types of communication entity nodes and multiple types of interaction edges is constructed; wherein, each communication entity node has its corresponding attribute feature vector attached, and the interaction edges have recorded the interaction type and timestamp.

3. The method according to claim 2, characterized in that, The entity attribute table includes attribute information for personal communication entities and attribute information for enterprise communication entities. Based on the attribute information of various communication entities in the original operational data, the network facility registry, and the communication entity-facility binding logs, the node sets of different types of communication entities are determined, and a corresponding attribute feature vector is generated for each communication entity node, including: Based on the attribute information of personal type communication entities in the entity attribute table, a first set of nodes for personal communication entities is determined, and a corresponding personal attribute feature vector is generated for each personal type communication entity node. Based on the attribute information of enterprise type communication entities in the entity attribute table, a second set of enterprise type communication entities is determined, and a corresponding enterprise attribute feature vector is generated for each enterprise type communication entity node. Based on the network facility registry and the communication entity and facility binding log, a third node set of facility type communication entities is determined, and a corresponding facility attribute feature vector is generated for each facility type communication entity node.

4. The method according to claim 1, characterized in that, The abnormal communication identification model includes a feature encoder and a two-layer multilayer perceptron prediction head. The step of inputting the heterogeneous network graph into the pre-trained abnormal communication identification model to obtain abnormal attribute information corresponding to each communication entity includes: The heterogeneous network graph is input into the feature encoder to obtain the initial embedding representation of each node in the heterogeneous network graph; For each node, a nonlinear projection is performed on the initial embedding representation of the current node based on the two-layer multilayer perceptron prediction head to determine the feature embedding representation corresponding to the current node; Based on the feature embedding representation corresponding to each node, the abnormal attribute information of the corresponding communication entity is determined.

5. The method according to claim 1, characterized in that, The method includes: Obtain historical attribute information of each communication entity in the telecommunications service scenario, as well as the historical interaction relationships between communication entities; Based on the historical attribute information of each communication entity and the historical interaction relationship, a heterogeneous network graph sample is constructed; wherein, the nodes in the heterogeneous network graph sample represent different types of communication entities, each node has different historical attribute information, and the edges between nodes represent the historical interaction types between communication entities. Based on the distance of the attribute information of each node in hyperbolic space, the edges of different interaction types in the heterogeneous network graph sample are randomly normalized and sampled twice, and a first augmented network graph and a second augmented network graph are generated according to the two sampling results respectively. The first augmented network graph and the second augmented network graph are respectively input into the abnormal communication recognition model to be trained to obtain the embedding representation of each node in the two augmented network graphs; Based on the embedding representation of each node, determine the matching attributes of positive and negative example node pairs of the current node across views and within views, so as to determine the contrast loss value of the current node based on the matching attributes of the positive and negative example node pairs. The overall target loss is determined based on the comparative loss value of each node, and the parameters of the abnormal communication identification model to be trained are optimized and adjusted according to the overall target loss to obtain the pre-trained abnormal communication identification model.

6. The method according to claim 5, characterized in that, The method involves performing two random normalized samplings on edges of different interaction types in the heterogeneous network graph sample based on the distances of the attribute information of each node in hyperbolic space, and generating a first augmented network graph and a second augmented network graph based on the two sampling results, respectively, including: The heterogeneous network graph is divided into multiple independent adjacency subgraphs according to the connection edge interaction type; For each of the adjacent subgraphs, the distance between the attribute feature vectors of the two ends of each edge in hyperbolic space is calculated by the Lorentz inner product operation, and the distance value is used as the feature attribute value corresponding to each edge; For each of the feature attribute values ​​corresponding to the same interaction type, perform minimum-maximum normalization to map each of the feature attribute values ​​to the interval between zero and one, and obtain the normalized distance weight; Based on the normalized distance weight as the retention probability, Bernoulli sampling is performed once for each edge, and the edges marked as retained by the sampling are recombined into a first augmented subgraph set. The first augmented subgraphs are merged to obtain the first augmented network graph. Based on the same normalized distance weight, perform an independent Bernoulli sampling again, and recombine the edges marked as retained into a second augmented subgraph set. Merge the second augmented subgraphs to obtain the second augmented network graph.

7. The method according to claim 5, characterized in that, The abnormal communication recognition model to be trained includes a feature encoder to be trained and a two-layer multilayer perceptron prediction head to be trained. The first augmented network graph and the second augmented network graph are respectively input into the abnormal communication recognition model to be trained to obtain the embedding representation of each node in the two augmented network graphs, including: The first augmented network graph and the second augmented network graph are respectively input into the encoder containing the features to be trained to obtain the initial embedding representation of each node in the two augmented network graphs; For each node, a nonlinear projection is performed on the two initial embedding representations of the current node based on the prediction head of the two-layer multilayer perceptron to be trained, to determine the first embedding representation of the current node in the first augmented network graph and the second embedding representation of the current node in the second augmented network graph.

8. The method according to claim 5, characterized in that, The method further includes: For each node, based on the hyperbolic distance values ​​between the nodes in the first augmented network graph and the second augmented network graph, the set of positive example nodes and the set of negative example nodes corresponding to the current node are determined.

9. The method according to claim 8, characterized in that, The step of determining the set of positive and negative nodes corresponding to each node based on the hyperbolic distance values ​​between the nodes in the first and second augmented network graphs includes: Based on the global topology of the first and second augmented network graphs, a graph diffusion matrix representing the importance between nodes is constructed. Based on the graph diffusion matrix, the importance ranking of each node at the topological level is determined, and nodes whose ranking meets the preset conditions are selected as a set of candidate strongly related nodes. Based on the hyperbolic distance of the attribute features between each candidate node in the candidate strongly correlated set and the current node, the candidate nodes are filtered to determine multiple positive example nodes corresponding to the current node. The nodes corresponding to the current node in the non-attached augmented network graph are also determined as positive example nodes, thus obtaining a set of positive example nodes. For all the nodes, after removing the identified positive example nodes based on the entire set of nodes, all the remaining nodes are determined as a set of negative example nodes.

10. The method according to claim 5, characterized in that, The step of determining the matching attributes of positive and negative example node pairs of the current node across and within the view based on the embedding representation of each node includes: Pair the current node's embedding representation with the embedding representations of other views and the identified positive node embedding representations in the same view, calculate the cosine similarity and accumulate the exponential weighted operation to obtain the positive matching attributes between views and the positive matching attributes within views. The embedding representation of the current node is paired with the embedding representations of other views and the identified negative example nodes in the same view. Cosine similarity is calculated and exponential weighting is accumulated to obtain the negative example matching attributes between views and the negative example matching attributes within views.

11. The method according to claim 10, characterized in that, Determining the contrast loss value of the current node based on the matching attributes of the positive and negative example node pairs includes: Based on the inter-view positive example matching attribute, the intra-view positive example matching attribute, the inter-view negative example matching attribute, the intra-view negative example matching attribute, and a preset loss function, the contrast loss value of the current node is determined; wherein, the preset loss function includes: In the formula, This represents the contrastive loss value of the i-th node. This indicates a positive match attribute between views. This indicates a positive match attribute within the view. This indicates that the negative instance matching attribute is between views. This indicates that the negative instance matches the attribute within the view.

12. An abnormal communication identification device, characterized in that, The device includes: The heterogeneous network graph construction module is used to construct a heterogeneous network graph based on the attribute information of each communication entity in the telecommunications service scenario and the interaction relationship between the communication entities; wherein, the telecommunications service scenario includes multiple types of communication entities, the nodes in the heterogeneous network graph represent different types of communication entities, each node has different attribute information, and the edges between nodes are labeled with the interaction type between the communication entities. An abnormal attribute determination module is used to input the heterogeneous network graph into a pre-trained abnormal communication identification model to obtain abnormal attribute information corresponding to each of the communication entities.

Images