Card number arbitrage behavior identification method and device, equipment, storage medium and program product

Abstract

The invention discloses a card number arbitrage behavior identification method and device, equipment, a storage medium and a program product. The method comprises the following steps: acquiring communication behavior data of a logout card number in a logout transition period; standardizing the communication behavior data to obtain a standardized data set; aiming at each piece of quantized data in the standardized data set, comparing each piece of quantized data with a preset single-dimensional judgment threshold value, and screening out a candidate card number of any piece of quantized data exceeding the corresponding single-dimensional judgment threshold value; and performing time sequence analysis on the quantitative data of the candidate card numbers, and when a time sequence analysis result of the candidate card numbers meets a preset abnormal fluctuation condition, determining that the candidate card numbers have arbitrage behaviors. According to the embodiment of the invention, a complete identification chain of data acquisition, standardization processing, threshold screening, time sequence analysis and abnormity judgment is constructed by focusing on a scene of high incidence of arbitrage behaviors in a card number cancellation transition period, and the arbitrage behaviors in a card number cancellation stage can be accurately identified.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication, in particular to a card number arbitrage behavior identification method, device, equipment, storage medium and program product. BACKGROUND

[0002] Arbitrage behavior refers to the behavior of social channels (such as offline merchants) or communication users taking advantage of communication service rule loopholes through improper means to obtain the interests of the communication business. In the card number cancellation stage, such arbitrage behavior is particularly prominent. After the user applies for canceling the card number, in the transition period of card number cancellation, due to the fact that the card number still has communication functions, some users will deliberately abnormally increase communication behavior, such as making high-frequency calls, sending a large number of short messages in a short period of time, or consuming all the remaining data flow, so as to use the communication resources provided by the communication business for free or at a low price, thereby realizing arbitrage. At present, the communication business lacks an effective monitoring mechanism for the communication behavior in the transition period of card number cancellation. In the traditional operation mode, the transition period is only regarded as a transition link in the cancellation process, and the communication business has neither formulated restriction measures for the abnormal communication behavior that may occur in this stage nor established corresponding identification rules, resulting in the inability to identify arbitrage behavior in the card number cancellation stage. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a card number arbitrage behavior identification method, device, equipment, storage medium and program product, which can accurately identify arbitrage behavior in the card number cancellation stage.

[0004] To achieve the above-mentioned purpose, the embodiments of the present application provide a card number arbitrage behavior identification method, comprising: obtaining communication behavior data of the canceled card number in the transition period of cancellation; standardizing the communication behavior data to obtain a standardized data set; wherein the standardized data set comprises quantified data of at least one communication behavior; for each quantified data in the standardized data set, respectively comparing with a preset single-dimensional judgment threshold value, and screening out a candidate card number whose any quantified data exceeds the corresponding single-dimensional judgment threshold value; performing time series analysis on the quantified data of the candidate card number; when the time series analysis result of the candidate card number meets a preset abnormal fluctuation condition, determining that the candidate card number has arbitrage behavior.

[0005] As an improvement of the above-mentioned scheme, before the communication behavior data of the canceled card number in the transition period of cancellation is obtained, the method further comprises: obtaining state information of all card numbers in a specified registration area by using a preset traversal algorithm; According to the state information, a card number that has been cancelled is found.

[0006] As an improvement of the above-mentioned scheme, when the preset traversal algorithm is used to obtain the state information of all card numbers in the specified registration area, the method further comprises: Obtain security state evaluation data of the local area network; According to the security state evaluation data, determine the network security evaluation value of the local area network; When the network security evaluation value is greater than a preset network security threshold value, stop obtaining the state information of all card numbers in the specified registration area.

[0007] As an improvement of the above-mentioned scheme, the communication behavior data includes at least one of call records, short message sending records, data usage, and location change information.

[0008] As an improvement of the above-mentioned scheme, after determining that the candidate card number has arbitrage behavior, the method further comprises: The candidate card number with arbitrage behavior is taken as a target card number; Obtain target communication behavior data of all target card numbers in the cancellation transition period, and determine arbitrage associated fees generated by the target communication behavior data based on a preset tariff standard; When any target card number corresponding to a user initiates a new card number registration operation, trigger the settlement process of the arbitrage associated fees.

[0009] As an improvement of the above-mentioned scheme, after determining that the candidate card number has arbitrage behavior, the method further comprises: The candidate card number with arbitrage behavior is taken as a target card number; Obtain abnormal communication behavior data of all target card numbers in the cancellation transition period, and determine arbitrage tendency values of the target card numbers according to the abnormal communication behavior data; Sort all target card numbers according to the arbitrage tendency values.

[0010] As an improvement of the above-mentioned scheme, the abnormal communication behavior data is communication behavior data that exceeds a corresponding single-dimension determination threshold value.

[0011] To achieve the above-mentioned purpose, an embodiment of the present application further provides a card number arbitrage behavior identification device, comprising: A communication behavior data acquisition module is configured to acquire communication behavior data of a cancelled card number in a cancellation transition period; A standardization processing module is configured to perform standardization processing on the communication behavior data to obtain a standardized data set; wherein the standardized data set includes quantified data of at least one communication behavior. The candidate card number screening module is configured to compare each quantified data in the standardized data set with a preset single-dimension judgment threshold, and screen out a candidate card number whose quantified data exceeds the corresponding single-dimension judgment threshold. The time sequence analysis module is configured to perform time sequence analysis on the quantified data of the candidate card number. The arbitrage behavior identification module is configured to determine that the candidate card number has arbitrage behavior when the time sequence analysis result of the candidate card number meets a preset abnormal fluctuation condition.

[0012] To achieve the above object, the embodiments of the present application further provide a card number arbitrage behavior identification device, which comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the card number arbitrage behavior identification method according to any of the above embodiments when executing the computer program.

[0013] To achieve the above object, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, wherein the computer program controls the device where the computer readable storage medium is located to execute the card number arbitrage behavior identification method according to any of the above embodiments when running.

[0014] To achieve the above object, the embodiments of the present application further provide a computer program product, which comprises computer program / instructions, and the computer program / instructions implement the card number arbitrage behavior identification method according to any of the above embodiments when executed by a processor.

[0015] Compared with the prior art, the card number arbitrage behavior identification method, device, equipment, storage medium and program product disclosed by the present application focus on the card number cancellation transition period, a high-arbitrage-scenario, construct a complete identification chain of data acquisition, standardization processing, threshold screening, time sequence analysis and abnormality judgment, and can accurately identify arbitrage behaviors in the card number cancellation stage. In addition, in the arbitrage behavior identification process, the standardization processing of the communication behavior data unifies the quantization dimensions of different types of communication behaviors, lays a foundation for subsequent accurate comparison, and avoids analysis deviation caused by differences in original data formats; the double-layer judgment logic of single-dimension threshold screening and time sequence analysis not only quickly filters normal communication behaviors through the threshold, greatly reduces the suspicious range to improve the identification efficiency, but also captures hidden dynamic abnormal patterns with the help of time sequence analysis, effectively makes up for the limitations of single static threshold judgment, and significantly improves the accuracy of arbitrage behavior identification. The present application aims at accurate monitoring of the specific stage of the cancellation transition period, can timely find and judge arbitrage behaviors of users using rule loopholes, provides strong technical support for communication operators to recover economic losses caused by resource abuse, and helps to regulate the order of the communication service market. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 This is a flowchart for finding a cancelled card number provided in an embodiment of the present invention; Figure 2 This is a flowchart of a network security assessment for a local area network provided in an embodiment of the present invention; Figure 3 This is a flowchart of the card number arbitrage behavior identification method provided in the embodiments of the present invention; Figure 4 This is a flowchart for determining arbitrage-related costs provided in an embodiment of the present invention; Figure 5 This is a trend chart showing the change of arbitrage-related fees generated by the target card number during the cancellation transition period, provided in an embodiment of the present invention. Figure 6 This is a flowchart of sorting target card numbers provided in an embodiment of the present invention; Figure 7 This is a structural block diagram of a card number arbitrage behavior identification device provided in an embodiment of the present invention; Figure 8 This is a structural block diagram of a card number arbitrage behavior identification device provided in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] See Figure 1 , Figure 1 This is a flowchart of the process for finding cancelled card numbers provided in an embodiment of the present invention. Before identifying arbitrage behavior of cancelled card numbers, it is necessary to obtain information about the cancelled card numbers. At this time, the card number arbitrage behavior identification method includes steps S101 to S102.

[0019] S101. Use a preset traversal algorithm to obtain the status information of all card numbers within the specified registration area.

[0020] For example, the traversal algorithm can be one of DFS (Depth-First Search), BFS (Breadth-First Search), Iterative Deepening Search, or Level Order Traversal. The status information includes card registration information, card plan change information, and card cancellation information.

[0021] This invention uses the Depth-First Search (DFS) algorithm as an example. When applying the DFS algorithm, the status information of the SIM card number is obtained based on the location information of the telecommunications carrier. First, a tree-like topology of the telecommunications carrier distribution is constructed. The tree-like topology follows the order of provincial level (designated registration area) → city level → county level → district level. This tree-like topology transforms the geographical scope of the telecommunications carrier into a "tree structure," with the root node being the provincial level, the second-level nodes being the city level, the third-level nodes being the county level, and the leaf nodes being the district level. Each district-level node stores the status information (registration, plan change, cancellation) of all SIM cards in the corresponding region. Then, data traversal is performed based on the telecommunications carrier distribution tree-like topology to obtain the status information of all SIM cards within the province. It should be noted that the designated registration area can also be a city level or county level, or other areas below the provincial level, and the structure of the telecommunications carrier tree-like topology is not fixed. Nodes can be added or deleted, or the node order can be adjusted, all according to the actual situation.

[0022] This invention provides an example of the application process of the DFS algorithm, including the following steps: 1) Create a set to mark whether a node has been visited; that is, create a data list to mark the regions that have been visited, such as marking "City A has been visited" after searching City A. 2) Select the starting node, denoted as s; that is, select the root node of the tree topology (usually the provincial telecommunications provider) as the first node to be traversed; 3) Mark the starting node s as visited and add it to the visited set; if s is a terminal node (such as a district-level unit), read all the card number status information stored in it; if s is a management node (such as a provincial-level unit), only get the list of its subordinate sub-nodes (such as City A, City B), and do not read the card number data. 4) For each unvisited adjacent node of the starting node s, the adjacent node is denoted as v; that is, traverse all child nodes of s and select an unvisited child node as the adjacent node. 5) Push node s onto the stack; the "stack" is a temporary storage tool. After all child nodes of v have been traversed, return to s to continue processing other unvisited child nodes. For example, after traversing city A, return to the provincial unit to process city B. 6) Using the adjacent node v as the new starting point, repeat steps 3) to 4). 7) In a certain recursive level, after all the unvisited adjacent nodes of the current node have been processed, the current node is popped from the stack; that is, after all the subordinate nodes (area a, area b, etc.) of a certain node (such as city A) have been traversed, the node is removed from the stack (popped from city A) and the process returns to its parent node (provincial node). 8) Repeat steps 4) to 6) until the stack is empty, and the operation of traversing the card number status information of the communication backend is over; that is, after returning to the previous level node, continue to process the unvisited adjacent nodes (such as B city, C city, etc. under the provincial node), repeat steps 4) to 6) until all regional nodes have been traversed, there are no nodes in the stack, and the card number status information traversal is over.

[0023] S102. Find the cancelled card number based on the status information.

[0024] For example, by using preset status filtering rules, card numbers that are "cancelled and in transition period" can be extracted from the status information of all card numbers and designated as cancelled card numbers, that is, card numbers that are in the cancellation process and have not yet completed the final number recycling.

[0025] In this embodiment of the invention, a systematic traversal algorithm comprehensively and without omission covers all card numbers within a specified registration area, ensuring that no target card number potentially involved in arbitrage is overlooked, thus avoiding blind spots in arbitrage identification due to incomplete data collection. Furthermore, by accurately filtering cancelled card numbers using status information, the system can specifically target the high-risk group of arbitrage during the cancellation transition period, eliminating interference from irrelevant data such as normally used card numbers and completely cancelled card numbers. This significantly reduces the scope of subsequent communication behavior data analysis and improves the efficiency of the overall identification process. This process provides a precise target object foundation for subsequent arbitrage behavior identification, ensuring that subsequent analysis of communication behavior data revolves only around the truly monitorable cancelled card numbers. This guarantees the targeting and accuracy of the identification method from the source, laying a reliable data foundation for the entire arbitrage behavior identification system.

[0026] Furthermore, during the execution of step S101, in order to improve security when traversing card numbers, a network security assessment of the local area network is required. (See [link to relevant documentation]). Figure 2 , Figure 2 This is a flowchart of a network security assessment of a local area network provided by an embodiment of the present invention. In this case, the card number arbitrage behavior identification method includes steps S103 to S105.

[0027] S103. Obtain security status assessment data for the local area network.

[0028] For example, a local area network (LAN) is an internal network environment that carries out the traversal of card number status information in the communication backend. Security status assessment data includes the number of vulnerabilities in the LAN, the average severity of vulnerabilities, the degree of abnormal traffic fluctuations, the number of abnormal connections, and the authentication success rate during access.

[0029] The vulnerability count refers to the total number of security vulnerabilities existing in various devices (such as servers and switches) and systems within the local area network (LAN). This can be obtained by periodically scanning all targets within the LAN using vulnerability scanning tools (such as Nessus and OpenVAS, professional vulnerability detection software). The average vulnerability severity score represents the average level of vulnerability severity within the LAN. It can be obtained by calculating the arithmetic mean of all vulnerability scores based on the CVSS (Common Vulnerability Scoring System) score returned by the vulnerability scanning tool for each vulnerability. The abnormal traffic fluctuation level represents the degree to which data traffic within the LAN deviates from the normal baseline value. This can be obtained by collecting traffic data per unit time using traffic monitoring devices (such as traffic probes and firewall traffic log modules) and comparing it with the statistical baseline (such as mean and variance) of historical normal traffic data to calculate the deviation (e.g., the ratio of the difference between the current traffic and the normal average to the normal average). The number of abnormal connections represents the total number of network connections within the LAN that do not conform to normal communication rules. This can be obtained through a network intrusion detection system (IDS) or an intrusion prevention system (Intrusion Detection System). Prevention System (IPS) identifies and counts the number of connections that exceed the pre-defined normal connection rules (such as a list of legitimate IP communications and regular port access rules). The access phase authentication success rate is used to characterize the proportion of successful authentications to the total number of authentications during the traversal of card status information in the local area network. It can be obtained by extracting the number of authentication requests and the number of successful authentications from the log records of the communication backend authentication system and calculating the ratio between the two.

[0030] S104. Determine the network security assessment value of the local area network based on the security status assessment data.

[0031] For example, the calculation process for network security assessment values ​​follows the formula: (1); in, This is the network security assessment value for the local area network; This refers to the network security threshold for a local area network (LAN). The number of vulnerabilities in the local area network; This represents the average severity of the vulnerabilities. The degree of abnormal fluctuation in traffic on the local area network; This represents the number of abnormal connections. For the authentication success rate during the local area network access phase; , Here, is the normalization factor; where, This indicates that the local area network (LAN) is secure, and vice versa. S105. When the network security assessment value is greater than the preset network security threshold, stop obtaining the status information of all card numbers in the specified registration area.

[0032] For example, network security thresholds This is a threshold value (e.g., 60 points) set based on historical security event data of the local area network and the security level requirements of communication services. When the calculated network security assessment value exceeds this threshold, it indicates that the current local area network has a high security risk, such as the possibility of malicious intrusion, data transmission leakage, or tampering during the traversal operation. At this time, the security protection mechanism is immediately triggered, stopping the traversal operation of card number status information, generating a security alarm, and notifying the administrator to conduct risk investigation. The traversal process is restarted only after the network security assessment value drops below the threshold and the risk is eliminated. This avoids card number information leakage, tampering, or distortion of traversal results caused by data operations in an insecure network environment, ensuring the underlying data security of the entire arbitrage behavior identification process.

[0033] In this embodiment of the invention, during the process of acquiring the status information of all card numbers within a specified registration area using a preset traversal algorithm, a local area network security assessment mechanism is simultaneously introduced. By acquiring multi-dimensional security assessment data such as the number of vulnerabilities and traffic fluctuations in real time and calculating network security assessment values, the risk level of the data collection environment can be dynamically perceived. When the assessment value exceeds a preset threshold, the acquisition of card number status information is immediately stopped. This can block data interaction in an insecure network environment from the source, effectively preventing card number information from being stolen or tampered with during transmission or reading, or from distorting the traversal results due to network attacks, thus ensuring the integrity and confidentiality of the basic data.

[0034] See Figure 3 , Figure 3 This is a flowchart of a card number arbitrage behavior identification method provided in an embodiment of the present invention, which includes steps S1 to S5.

[0035] S1. Obtain communication behavior data of the cancelled card number during the cancellation transition period.

[0036] For example, the cancellation transition period is a specific time period from when a cardholder submits a cancellation application and it is accepted by the telecommunications operator's system until the number is officially included in the resource pool for recycling and the communication function is completely shut down. The cancellation transition period can be set by the telecommunications operator's system. The communication behavior data can be pre-stored in the cloud. The communication behavior data includes at least one of call records, SMS sending records, data usage, and location change information.

[0037] The call records are the outgoing / receiving records of the card number during the cancellation transition period, including information such as the call recipient's number, call start time, call duration, and call type (e.g., voice call, video call). The SMS sending records are detailed logs of all SMS messages sent by the card number, including data such as the receiving number, sending time, SMS content length, and SMS type (e.g., regular SMS, MMS). The data usage is the total amount of data consumed by the card number through the mobile network during the cancellation transition period and its time-based usage, covering traffic allocation for different application scenarios (e.g., browsing, downloading, streaming media playback). The location change information is the sequence of base station locations accessed by the card number during communication, including the base station identifier, access time, dwell time within the base station's coverage area, and cross-base station handover records. This data can be collaboratively acquired through the communication operator's core network signaling monitoring system, Business Support System (BSS), User Data Record (UDR) system, and base station location log database, ensuring the completeness and real-time nature of data collection and providing comprehensive behavioral characteristic evidence for subsequent arbitrage behavior analysis.

[0038] S2. Standardize the communication behavior data to obtain a standardized data set; wherein the standardized data set includes quantified data of at least one communication behavior.

[0039] For example, the standardization process includes two parts: data cleaning and time-dimensional normalization. First, the raw communication behavior data is cleaned, removing duplicate records, data missing key fields, and obvious outliers. For example, logs of the same call stored multiple times, call records without call duration, and unreasonable records of daily call duration exceeding 24 hours are removed to ensure the accuracy of the data baseline. Then, the cleaned data is uniformly sorted by timestamp to form an ordered dataset with a time granularity of minutes or hours. Based on this, various types of behavioral data are quantified. For example, call records are quantified into total call duration (minutes), number of calls, and average single call duration within a unit of time; SMS sending records are quantified into the number of SMS messages sent within a unit of time and the average number of characters per SMS message; data usage is quantified into data such as data consumption (MB) within a unit of time and the proportion of data usage in different application scenarios; and location change information is quantified into data such as base station handover frequency and number of cross-city / cross-province moves within a unit of time. The resulting standardized dataset, by unifying the time granularity and quantification dimensions, eliminates the format differences between different types of communication behavior data, providing a consistent data foundation for subsequent comparisons with single-dimensional judgment thresholds and time series analysis.

[0040] S3. For each quantized data in the standardized data set, compare it with the preset single-dimensional judgment threshold, and filter out the candidate card number where any quantized data exceeds the corresponding single-dimensional judgment threshold.

[0041] For example, by analyzing the communication behavior of cardholders during the transition period, we can attempt to determine whether there is any arbitrage tendency through the following dimensions: 1) Abnormally increased call frequency: If the number of calls increases significantly during the transition period, especially high-frequency communication with specific areas or numbers, it may indicate that the user is using the remaining call credit of the number for arbitrage. 2) Increased SMS volume: During the transition period, the volume of SMS messages sent increased sharply, especially the large number of SMS messages sent in a short period of time, which may be related to arbitrage behavior, such as using free SMS to send advertisements and promotional information. 3) Abnormal data traffic usage: Data traffic usage during the transition period far exceeds normal values, especially with abnormally high data consumption for several consecutive days, which may indicate that users are trying to use up as much remaining data as possible before canceling the card number, and there is arbitrage behavior involved. 4) Location change analysis: If users frequently change their location information during the transition period, especially if their location information is frequently switched across regions, it may indicate that the user is trying to arbitrage through the differences in communication costs across regions.

[0042] Based on the above scenarios, single-dimensional thresholds can be set to determine whether a card number exhibits arbitrage behavior. For example, for "abnormally increased call frequency," the threshold can be set to ≥20 outgoing calls per hour or ≥120 minutes of total call time per day; for "increased SMS volume," the threshold can be set to ≥50 SMS messages per hour or ≥10,000 SMS characters per day; for "abnormal data usage," the threshold can be set to ≥1GB of data consumption per hour or more than three times the daily average data usage for three consecutive hours; for "abnormal location changes," the threshold can be set to ≥10 base station switching times per hour or ≥5 inter-city moves per day. It should be noted that these thresholds are only examples and can be adjusted as needed in actual applications. When any quantitative data point for a card number exceeds the corresponding dimension's threshold, it is selected as a candidate card number, initially indicating an arbitrage tendency, thus narrowing the scope for subsequent in-depth time series analysis.

[0043] S4. Perform time series analysis on the quantified data of the candidate card numbers.

[0044] For example, time series analysis uses the time granularity (minutes or hours) in the standardized dataset as the horizontal axis and quantitative data of various dimensions (such as call duration, number of SMS messages, data consumption, etc.) as the vertical axis to construct a communication behavior trend curve for candidate SIM cards during the cancellation transition period. The mean and fluctuation amplitude of communication behavior in different time periods are calculated using the sliding window method to capture the dynamic change characteristics of the data. The captured dynamic change characteristics include at least one of the following: 1) Analyze the growth / decline trend of quantitative data over time, such as whether it suddenly enters a surge phase from a stable state; 2) Fluctuation frequency, such as whether it exhibits short-cycle high-frequency oscillations; 3) Cross-dimensional correlation, such as whether the surge in traffic consumption is synchronized with the increase in base station handover frequency; 4) Behavioral mutations at key time points, such as whether the behavioral patterns in the last 24 hours of the cancellation transition period are significantly different from those in the previous period.

[0045] For example, by comparing this dynamic change characteristic with the historical time series data of the card number during the normal use phase, or with the average time series curve of the card number of the same type of package, abnormal dynamic characteristics that deviate from the normal pattern can be identified, providing a trend basis for subsequent judgment.

[0046] S5. When the time series analysis results of the candidate card number meet the preset abnormal fluctuation conditions, it is determined that the candidate card number has arbitrage behavior.

[0047] For example, abnormal fluctuation conditions are set based on the dynamic change characteristics of time series analysis, including but not limited to the following conditions: 1) Any quantitative data shows a step-like surge during the cancellation transition period; for example, the value of three consecutive time windows increases by more than 50% compared to the previous window, and the peak value exceeds twice the corresponding single-dimensional threshold. 2) Cross-dimensional data exhibits abnormal coordination; for example, the overlap between the time windows of a surge in call duration and an increase in base station handover frequency is ≥80%, and both exceed their respective single-dimensional thresholds. 3) A burst of consumption occurs at the end of the cancellation transition period (such as the last 12 hours); for example, the cumulative value of a certain quantitative data accounts for more than 70% of the total value of the entire transition period, and the average growth rate during this period is more than 10 times that of the previous period. 4) Quantitative data exhibits periodic abnormal fluctuations; for example, there are more than 5 “surge-rebound” cycles within 1 hour, and each surge peak exceeds 3 times the average value of the normal period.

[0048] If the time series analysis results of a candidate card number meet any of the above conditions, it can be determined that the cardholder is engaging in arbitrage by maliciously consuming communication resources during the cancellation transition period. It should be noted that all values ​​in the above four conditions are examples and can be set as needed in actual applications.

[0049] Furthermore, based on the analysis of communication behavior, users' arbitrage behavior can be further divided into different stages: Initial tendency: In the early stages of the transition period, communication activity may increase slightly, but it has not yet reached an abnormal level. Users may simply be using the communication limit from the last time they canceled their accounts. Mid-term trend: Users' communication behavior increases significantly, especially certain types of behavior (such as calls, text messages, data traffic, etc.) which surge in a short period of time, showing a clear arbitrage tendency; Late-stage tendency: As the card cancellation date approaches, the user's communication behavior fluctuates dramatically, and usage reaches its peak, indicating that the user is making the most of the remaining resources. This is usually a stage of obvious arbitrage behavior.

[0050] In this embodiment of the invention, by focusing on the high-incidence scenario of arbitrage during the card cancellation transition period, a complete identification chain is constructed, encompassing data acquisition, standardized processing, threshold filtering, time-series analysis, and anomaly detection. This chain accurately identifies arbitrage behavior during the card cancellation phase. Furthermore, in the arbitrage behavior identification process, standardized processing of communication behavior data unifies the quantitative dimensions of different types of communication behavior, laying the foundation for subsequent accurate comparison and avoiding analytical biases caused by differences in original data formats. A dual-layer judgment logic employing single-dimensional threshold filtering and time-series analysis is used. This not only quickly filters normal communication behavior through thresholds, significantly narrowing the scope of suspicion to improve identification efficiency, but also captures hidden dynamic anomaly patterns through time-series analysis, effectively compensating for the limitations of single static threshold judgment and significantly improving the accuracy of arbitrage behavior identification. This invention's precise monitoring of the specific stage of the cancellation transition period can promptly detect and determine arbitrage behavior by users exploiting rule loopholes, providing strong technical support for telecommunications operators to recover economic losses caused by resource abuse, while also helping to regulate the order of the telecommunications service market.

[0051] Furthermore, after executing step S5, the settlement process for arbitrage-related fees can also be triggered, see [link to relevant documentation]. Figure 4 , Figure 4 This is a flowchart of determining arbitrage-related costs provided in an embodiment of the present invention. In this case, the method further includes steps S61 to S63.

[0052] S61. Target card numbers are candidate card numbers where arbitrage activities are present.

[0053] S62. Obtain target communication behavior data for all target card numbers during the cancellation transition period, and determine the arbitrage associated fees generated by the target communication behavior data based on the preset tariff standards.

[0054] For example, the target communication behavior data refers to the communication behavior data of the target SIM card number that triggers arbitrage judgment during the cancellation transition period. This data needs to be extracted from a standardized dataset and associated with corresponding behavior details (such as call recipients, data consumption periods, SMS sending times, etc.) to ensure that cost measurement is directly linked to arbitrage behavior. The tariff standard is based on the business rules of the telecommunications operator, and the arbitrage-related cost for a single target SIM card number is derived through the calculation logic of "communication behavior data volume × corresponding tariff standard".

[0055] See Figure 5 , Figure 5This invention provides a trend chart of arbitrage-related costs generated during the cancellation transition period for a target card number. This trend chart visually displays to managers the changes in average cost losses incurred when each communication card number is cancelled. The rise and fall of the curves clearly show the development trend of cost losses at different stages, allowing managers to quickly grasp the overall management effectiveness trend and providing data support for subsequent decisions. For example, when a significant increase in cost losses is observed at a certain stage, factors such as management measures and market environment at that stage can be analyzed, and strategies can be adjusted accordingly. If cost losses show a downward trend and remain stable, the effectiveness of the current management method can be verified, providing a reference for decisions such as whether to continue using the method.

[0056] Furthermore, after deriving the arbitrage-related costs, a detailed cost measurement log is generated, recording the data source, calculation basis, and trend chart to ensure the traceability of cost measurement. The arbitrage-related costs are then linked to the target card number, cancellation transition period, and details of abnormal behavior, and synchronously stored in the cloud database to form a complete cost archive.

[0057] S63. When it is detected that a user corresponding to any target card number initiates a new card number registration operation, the settlement process of the arbitrage-related fees is triggered.

[0058] For example, by linking the user authentication system of a telecommunications operator with a cloud database, when a user initiates a new card number registration and submits their identity information, the system automatically compares the identity information with the "target card number - user identity" binding relationship in the cloud database. If any outstanding arbitrage-related fees are detected, the settlement process is triggered. For instance, a fee notification window can pop up on the registration interface, displaying the amount, time period, and details of the arbitrage-related fees, thereby ensuring the effective recovery of these fees.

[0059] In this embodiment of the invention, this series of operations forms a complete closed loop from arbitrage behavior identification to fee recovery. By accurately identifying target SIM cards exhibiting arbitrage behavior, and based on their actual communication behavior during the cancellation transition period and preset tariff standards, arbitrage-related fees can be calculated scientifically and reasonably, ensuring the accuracy and relevance of fee measurement and preventing operators from suffering economic losses due to user arbitrage behavior. Furthermore, linking the settlement of arbitrage-related fees to the user's new SIM card registration effectively constrains user behavior, protects the legitimate rights and interests of operators, maintains a fair order in the communication service market, and also improves the communication business management process, enhancing the refinement and intelligence of back-end management.

[0060] Furthermore, after executing step S5, the arbitrage activity levels of the target card numbers can be sorted, allowing back-office staff to focus on high-risk arbitrage activities. See [link / reference]. Figure 6 , Figure 6This is a flowchart of sorting target card numbers provided in an embodiment of the present invention. The method further includes steps S71 to S73.

[0061] S71. Target card numbers are candidate card numbers where arbitrage activities are present.

[0062] S72. Obtain abnormal communication behavior data of all target card numbers during the cancellation transition period, and determine the arbitrage tendency value of the target card number based on the abnormal communication behavior data.

[0063] For example, the abnormal communication behavior data refers to communication behavior data that exceeds the corresponding single-dimensional judgment threshold, such as call records with more than 20 outgoing calls per hour, or data usage records with more than 1GB of data consumption. The calculation process of the arbitrage tendency value satisfies the following formula: (2); in, The arbitrage tendency value corresponding to the target card number; A collection of abnormal communication behavior data of the target card number during the transition period; For the first The number of times each type of abnormal communication behavior data occurs; The duration of the transition period; For the first The data for each type of abnormal communication behavior corresponds to a weight, and all The sum of is 1; where, Table Find the mean.

[0064] S73. Sort all target card numbers according to the arbitrage tendency value.

[0065] For example, using a descending sorting rule, all target card numbers are sorted from highest to lowest based on their arbitrage tendency value. A unique numerical identifier is added to each sorted card number; for example, the card with the highest tendency value is marked as 1, the next highest as 2, and so on. Simultaneously, a sorted list containing card number, arbitrage tendency value, cancellation transition period duration, and details of abnormal communication behavior is generated and stored in the cloud database. The cloud database discards card number data without numerical identifiers (i.e., non-target card number data not included in this sorting, or redundant data that has been processed and no longer needs to be retained) in real time, retaining only the target card number associated with the sorting number. This reduces database storage pressure and allows back-end personnel to quickly locate high-priority processing objects. Back-end personnel can prioritize focusing on card numbers with higher serial numbers (higher arbitrage tendency values), such as prioritizing the verification of arbitrage behavior details for target cards 1-10 and prioritizing the settlement of fees for high-tendency cards. This avoids low work efficiency due to a lack of priority differentiation and improves the targeting and timeliness of arbitrage behavior handling. In this embodiment of the invention, the arbitrage tendency assessment and sorting operation based on target SIM card numbers establishes a highly efficient management mechanism for the handling of arbitrage behavior in the back-end of telecommunications operators, enabling precise positioning and tiered processing. By focusing on abnormal communication behavior data during the cancellation transition period of target SIM card numbers and converting it into quantified arbitrage tendency values, the severity of arbitrage for each target SIM card number is precisely quantified. This allows back-end personnel to clearly understand the differences in arbitrage behavior among different SIM card numbers, avoiding a one-size-fits-all approach to management. Furthermore, the descending sorting based on arbitrage tendency values ​​directly assigns processing priorities to back-end personnel. SIM card numbers with higher tendency values ​​indicate more severe arbitrage behavior and greater potential losses to the operator, and can be prioritized for investigation and cost recovery processes. SIM card numbers with lower tendency values ​​can be processed sequentially, effectively preventing back-end personnel from randomly filtering through a massive number of target SIM card numbers, significantly reducing ineffective workload, and improving the response speed and resource utilization of arbitrage handling.

[0066] See Figure 7 , Figure 7 This is a structural block diagram of a card number arbitrage behavior identification device 100 provided in an embodiment of the present invention. The card number arbitrage behavior identification device 100 includes: The communication behavior data acquisition module 11 is used to acquire the communication behavior data of the cancelled card number during the cancellation transition period; The standardization processing module 12 is used to standardize the communication behavior data to obtain a standardized data set; wherein the standardized data set includes at least one quantified data of communication behavior. The candidate card number filtering module 13 is used to compare each quantized data in the standardized data set with a preset single-dimensional judgment threshold, and filter out candidate card numbers whose quantized data exceeds the corresponding single-dimensional judgment threshold. The time series analysis module 14 is used to perform time series analysis on the quantified data of the candidate card numbers; Arbitrage behavior identification module 15 is used to determine that the candidate card number has arbitrage behavior when the time series analysis result of the candidate card number meets the preset abnormal fluctuation conditions.

[0067] Specifically, the card number arbitrage behavior identification device 100 further includes: The status information acquisition module is used to obtain the status information of all card numbers within a specified registration area using a preset traversal algorithm; The cancelled card number lookup module is used to find cancelled card numbers based on the status information. The security status assessment data acquisition module is used to acquire security status assessment data of the local area network. The network security assessment value determination module determines the network security assessment value of the local area network based on the security status assessment data. The status information acquisition module is further configured to: stop acquiring the status information of all card numbers within the specified registration area when the network security assessment value is greater than the preset network security threshold.

[0068] Specifically, the card number arbitrage behavior identification device 100 further includes: The target card number acquisition module is used to select candidate card numbers that are subject to arbitrage as target card numbers; The arbitrage-related fee calculation module is used to obtain the target communication behavior data of all target card numbers during the cancellation transition period, and determine the arbitrage-related fees generated by the target communication behavior data based on the preset tariff standard. The arbitrage-related fee settlement module is used to trigger the settlement process of the arbitrage-related fees when it detects that a user corresponding to any target card number initiates a new card number registration operation. The arbitrage tendency determination module is used to acquire abnormal communication behavior data of all target card numbers during the cancellation transition period, and determine the arbitrage tendency value of the target card number based on the abnormal communication behavior data. The target card number sorting module is used to sort all target card numbers according to the arbitrage tendency value.

[0069] It is worth noting that the working process of each module in the card number arbitrage behavior identification device 100 described in the embodiments of the present invention can refer to the working process of the card number arbitrage behavior identification method described in the above embodiments, and will not be repeated here.

[0070] See Figure 8 , Figure 8 This is a structural block diagram of a card number arbitrage behavior identification device 200 provided in an embodiment of the present invention. The card number arbitrage behavior identification device 200 includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the above-described embodiments of the card number arbitrage behavior identification methods.

[0071] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the card arbitrage behavior identification device 200.

[0072] The card number arbitrage behavior identification device 200 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the card number arbitrage behavior identification device 200 and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the card number arbitrage behavior identification device 200 may also include input / output devices, network access devices, buses, etc.

[0073] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the card number arbitrage behavior identification device 200, connecting all parts of the device via various interfaces and lines.

[0074] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the card number arbitrage behavior identification device 200 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0075] The modules / units integrated into the card number arbitrage behavior identification device 200, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0076] Furthermore, the present invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the card number arbitrage behavior identification method as described in any of the above embodiments.

[0077] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying card number arbitrage behavior, characterized in that, include: Obtain communication behavior data of cancelled card numbers during the cancellation transition period; The communication behavior data is standardized to obtain a standardized data set; wherein the standardized data set includes quantified data of at least one communication behavior. For each quantified data in the standardized data set, it is compared with a preset single-dimensional judgment threshold to filter out candidate card numbers where any quantified data exceeds the corresponding single-dimensional judgment threshold. Time series analysis was performed on the quantified data of the candidate card numbers; When the time series analysis results of the candidate card number meet the preset abnormal fluctuation conditions, it is determined that the candidate card number involves arbitrage.

2. The card number arbitrage behavior identification method as described in claim 1, characterized in that, Before obtaining the communication behavior data of the cancelled card number during the cancellation transition period, the method further includes: The status information of all card numbers within the specified registration area is obtained using a preset traversal algorithm; Find the cancelled card number based on the status information.

3. The card number arbitrage behavior identification method as described in claim 2, characterized in that, When using a preset traversal algorithm to obtain the status information of all card numbers within a specified registration area, the method further includes: Obtain security status assessment data for the local area network; The network security assessment value of the local area network is determined based on the security status assessment data; When the network security assessment value is greater than the preset network security threshold, the acquisition of status information of all card numbers within the specified registration area is stopped.

4. The method for identifying card number arbitrage behavior as described in claim 1, characterized in that, The communication behavior data includes at least one of the following: call records, SMS sending records, data usage, and location change information.

5. The method for identifying card number arbitrage behavior as described in claim 1, characterized in that, After determining that the candidate card number involves arbitrage, the method further includes: The target card number is the candidate card number where arbitrage activities are suspected. Acquire target communication behavior data for all target card numbers during the cancellation transition period, and determine the arbitrage associated costs generated by the target communication behavior data based on a preset tariff standard; When a user corresponding to any target card number initiates a new card number registration operation, the settlement process for the arbitrage-related fees is triggered.

6. The method for identifying card number arbitrage behavior as described in claim 1, characterized in that, After determining that the candidate card number involves arbitrage, the method further includes: The target card number is the candidate card number where arbitrage activities are suspected. Obtain abnormal communication behavior data for all target card numbers during the cancellation transition period, and determine the arbitrage tendency value of the target card number based on the abnormal communication behavior data; Sort all target card numbers according to the arbitrage propensity value.

7. The method for identifying card number arbitrage behavior as described in claim 6, characterized in that, The abnormal communication behavior data refers to communication behavior data that exceeds the corresponding single-dimensional judgment threshold.

8. A device for identifying card number arbitrage behavior, characterized in that, include: The communication behavior data acquisition module is used to acquire communication behavior data of cancelled card numbers during the cancellation transition period; A standardization processing module is used to standardize the communication behavior data to obtain a standardized data set; wherein the standardized data set includes quantified data of at least one communication behavior; The candidate card number filtering module is used to compare each quantified data in the standardized data set with a preset single-dimensional judgment threshold, and filter out candidate card numbers whose quantified data exceeds the corresponding single-dimensional judgment threshold. The time series analysis module is used to perform time series analysis on the quantified data of the candidate card numbers; The arbitrage behavior identification module is used to determine that the candidate card number has arbitrage behavior when the time series analysis results of the candidate card number meet the preset abnormal fluctuation conditions.

9. A device for identifying card number arbitrage behavior, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the card number arbitrage behavior identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the card number arbitrage behavior identification method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes a computer program / instruction that, when executed by a processor, implements the card number arbitrage behavior identification method as described in any one of claims 1 to 7.

Images