Short message fraud early warning method and system based on abnormal behavior detection

Abstract

The invention discloses a short message fraud early warning method and system based on abnormal behavior detection, and relates to the field of short message fraud early warning, and the method comprises the steps: obtaining user terminal equipment behavior data and financial transaction request behavior data, and constructing a continuous behavior sequence after a user short message is received; constructing a dynamic baseline based on user historical behavior data, calculating a deviation degree between single behavior data and the dynamic baseline, and generating a suspicious behavior set; performing cross-platform behavior tracking to obtain cross-platform behavior data; inputting the deviation degree corresponding to the suspicious behavior, the sequence context information of the occurrence time point of the suspicious behavior and the cross-platform behavior data into an AI fusion analysis model, outputting a fraud risk confidence coefficient, and calculating a fluctuation ratio; and performing fraud behavior identification based on the fraud risk confidence and the fluctuation ratio, and triggering real-time early warning when fraud is confirmed. According to the invention, high-precision and self-adaptive real-time detection and early warning of short message fraud behaviors are realized.

Description

Technical Field

[0001] This invention relates to the field of SMS fraud early warning technology, and in particular to an SMS fraud early warning method and system based on abnormal behavior detection. Background Technology

[0002] Existing fraud detection technologies typically focus on single-point or single-dimensional analysis. Some systems only monitor abnormal transaction requests within financial applications, while others may only focus on keywords in the SMS content itself or matching blacklisted sender codes. These methods often lack a holistic perspective on the series of coherent, cross-application behaviors triggered by a user receiving a fraudulent SMS. Since fraud-driven behavior chains usually involve multiple stages, this isolated risk assessment approach is highly susceptible to missed detections and cannot effectively identify carefully designed, dispersed fraud processes.

[0003] Furthermore, many existing solutions rely on static, uniform threshold rules when determining whether behavior is abnormal. These rules are difficult to adapt to the unique behavioral habits of different users, potentially leading to two extremes: for active users, they can easily generate a large number of false alarms, interfering with the normal experience; for cautious users, they may fail to sensitively detect subtle abnormal changes. The lack of dynamic baseline modeling capabilities based on individual user historical behavior is a key reason for insufficient detection accuracy and high false alarm rates.

[0004] Furthermore, sophisticated scams often exhibit cross-platform and cross-device characteristics, and the data silo effect of a single application or platform limits the scope of defense systems. For example, a device fingerprint or network IP used to commit fraud may have been tagged on other platforms, but this intelligence cannot be shared and utilized in real time. At the same time, traditional models often simply superimpose different risk signals, making it difficult to make highly confident and accurate judgments about fraud risk. Summary of the Invention

[0005] The purpose of this invention is to provide a method for early warning of SMS fraud based on abnormal behavior detection, solving the problem of accurate, real-time and adaptive early warning of SMS fraud. To solve the above technical problems, this invention provides the following technical solution:

[0006] In a first aspect, the present invention provides a method for early warning of SMS fraud based on abnormal behavior detection, which includes acquiring user terminal device behavior data and financial transaction request behavior data, and integrating them according to time series to construct a continuous behavior sequence after the user receives SMS messages.

[0007] A dynamic baseline is constructed based on the user's historical behavior data. The deviation of individual behavior data in the continuous behavior sequence from the dynamic baseline is calculated to generate a set of suspicious behaviors.

[0008] Cross-platform behavior tracking is performed on the behaviors in the suspicious behavior set to obtain cross-platform behavior data;

[0009] The deviation corresponding to the suspicious behavior and the sequence context information of the time point when the suspicious behavior occurred are input into the AI ​​fusion analysis model along with cross-platform behavioral data to output the fraud risk confidence level and calculate the volatility ratio.

[0010] Fraudulent behavior is identified based on the aforementioned fraud risk confidence level and volatility ratio, and a real-time alert is triggered when fraud is confirmed.

[0011] As a preferred embodiment of the SMS fraud early warning method based on abnormal behavior detection described in this invention, the terminal device behavior data includes APP activation and foreground switching behavior, sensitive permission call behavior, and network connection behavior; the financial transaction request behavior data includes: transfer requests, payment activation requests, and password change requests.

[0012] As a preferred embodiment of the SMS fraud early warning method based on abnormal behavior detection described in this invention, the generation of the suspicious behavior set includes:

[0013] Extract the user's historical behavior data within the first preset time period, and calculate the average and standard deviation of individual behavior data of the same type at the same time each day;

[0014] The deviation of a single action data point from the dynamic baseline in a continuous action sequence is calculated using a Z-Score-based normalization algorithm, and is expressed as:

[0015] ;

[0016] Where Z represents the degree of deviation of the current single behavioral data point from the historical normal fluctuation range; X represents a single behavioral data point in a continuous behavioral sequence; μ represents the average value calculated at the same time each day; and σ represents the standard deviation calculated at the same time each day.

[0017] A dynamic threshold is set for the Z-Score value of each type of behavior; if the absolute value of the Z-Score value of any single behavior is greater than the corresponding dynamic threshold, the behavior and the time point of occurrence are marked as suspicious behavior and included in the suspicious behavior set.

[0018] As a preferred embodiment of the SMS fraud early warning method based on abnormal behavior detection described in this invention, the dynamic threshold includes: setting a dynamic threshold based on the distribution of Z-Score values ​​for each type of behavior in the user's historical behavior data according to percentiles.

[0019] For high-frequency behavior types, the 95th percentile is used as the dynamic threshold; for low-frequency behavior types, the 99th percentile is used as the dynamic threshold.

[0020] The criteria for classifying high-frequency and low-frequency behavior types are based on the frequency of occurrence of each type of behavior in the user's historical behavior data.

[0021] As a preferred embodiment of the SMS fraud early warning method based on abnormal behavior detection described in this invention, the cross-platform behavior tracking includes:

[0022] Extract the device fingerprint and network environment information at the time of the suspicious behavior. The device fingerprint includes the device ID, browser fingerprint, and mobile phone number. The network environment information includes the IP address.

[0023] In third-party threat intelligence databases and partner platform data, query the device fingerprint and network environment information to see if there are any recorded fraudulent activities or abnormal activity records.

[0024] As a preferred embodiment of the SMS fraud early warning method based on abnormal behavior detection described in this invention, the sequence context information includes: the type, occurrence time, and order of all other behaviors in the continuous behavior sequence within a second preset time period before the occurrence of the suspicious behavior and a third preset time period after the occurrence of the suspicious behavior.

[0025] As a preferred embodiment of the SMS fraud early warning method based on abnormal behavior detection described in this invention, the output fraud risk confidence level includes:

[0026] The confidence level of fraud risk is calculated using an AI fusion analysis model and expressed as follows:

[0027] ;

[0028] in, This represents the confidence level of fraud risk for the i-th suspicious behavior; This represents the total number of categories of cross-platform behavioral data; This indicates the total number of cross-platform actions; This represents the weight coefficient for the x-th cross-platform action; This represents the amount of data of type u in the x-th cross-platform action; express The average amount of cross-platform behavioral data; This represents the deviation of the i-th suspicious behavior; This represents the mean of the deviations from all suspicious behaviors.

[0029] The weighting coefficients are calculated based on the principle of temporal proximity and are expressed as follows:

[0030] ;

[0031] in, Indicates the time when the i-th suspicious behavior occurred; Indicates the time when the x-th cross-platform action occurred; This represents the time decay factor.

[0032] As a preferred embodiment of the SMS fraud early warning method based on abnormal behavior detection described in this invention, the step of identifying fraudulent behavior includes:

[0033] For the fraud risk confidence sequence corresponding to all suspicious user behaviors, the ratio of the standard deviation to the mean is calculated as the volatility ratio.

[0034] If the confidence level of fraud risk is greater than the preset first confidence level threshold, it is directly judged as fraudulent behavior; if the confidence level of fraud risk is greater than the preset second confidence level threshold and the volatility ratio is greater than the preset volatility threshold, it is also judged as fraudulent behavior.

[0035] Secondly, the present invention provides a text message fraud early warning system based on abnormal behavior detection, comprising:

[0036] Data acquisition module: used to acquire user terminal device behavior data and financial transaction request behavior data, and integrate them according to time series to construct a continuous behavior sequence after the user receives SMS messages;

[0037] Suspicious Behavior Generation Module: Used to build a dynamic baseline based on users' historical behavior data, calculate the deviation of individual behavior data in a continuous behavior sequence from the dynamic baseline, and generate a set of suspicious behaviors;

[0038] Cross-platform behavior tracking module: used to track behaviors in a suspicious behavior set across platforms and obtain cross-platform behavior data;

[0039] Fusion Analysis Module: This module is used to input the deviation degree corresponding to suspicious behavior and the sequence context information of the time point when the suspicious behavior occurs, along with cross-platform behavioral data, into the AI ​​fusion analysis model, output the fraud risk confidence level, and calculate the volatility ratio.

[0040] Fraud Behavior Detection Module: Used to identify fraud behavior based on fraud risk confidence level and volatility ratio, and trigger real-time alerts when fraud is confirmed.

[0041] The beneficial effects of this invention are: (1) By integrating user terminal device behavior data and financial transaction request data, it can accurately capture a series of consecutive actions of the user after receiving the SMS, improve the contextual relevance of the behavior data and the coverage of anomaly detection, so that potential fraud clues can be identified in the early stage, and enhance the timeliness and accuracy of the warning.

[0042] (2) By introducing a dynamic baseline deviation calculation mechanism based on Z-Score and combining it with a cross-platform behavior tracking strategy, fine-grained assessment of abnormal behavior and fusion of multi-source information were achieved. Furthermore, by leveraging AI models to comprehensively analyze behavior deviation, temporal context, and cross-platform data, the fraud risk confidence score was output. This mechanism enhanced the ability to identify fraud patterns that are highly concealed and involve cross-platform crimes, and also effectively reduced the risk of misjudgment caused by the limitations of single-platform data.

[0043] (3) By adopting a dual judgment strategy based on the confidence level of fraud risk and its fluctuation ratio, it can flexibly trigger early warning when the confidence level is abnormal or the confidence level fluctuates significantly. This not only ensures a rapid response to clear fraudulent behavior, but also identifies risk behaviors that show abnormal fluctuation patterns even if the confidence level is not extremely high. This reduces false alarms while effectively controlling the false alarm rate, achieving efficient and intelligent real-time anti-fraud protection. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart of a method for early warning of SMS fraud based on abnormal behavior detection; Figure 2 This is a schematic diagram illustrating the SMS fraud early warning process in a specific application scenario. Figure 3 This is a framework diagram of a text message fraud early warning system based on abnormal behavior detection. Detailed Implementation

[0046] To make the above-mentioned objects, features, and advantages of the present invention more readily understood, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0047] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0048] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0049] Example 1

[0050] Reference Figure 1 and Figure 2 This is the first embodiment of the present invention, which provides a method for early warning of SMS fraud based on abnormal behavior detection, including:

[0051] S1. Obtain user terminal device behavior data and financial transaction request behavior data, and integrate them according to time series to construct a continuous behavior sequence after the user receives SMS messages;

[0052] S2. Construct a dynamic baseline based on user historical behavior data, calculate the deviation of individual behavior data in the continuous behavior sequence from the dynamic baseline, and generate a set of suspicious behaviors;

[0053] S3. Perform cross-platform behavior tracking on the behaviors in the suspicious behavior set to obtain cross-platform behavior data;

[0054] S4. Input the deviation degree corresponding to the suspicious behavior and the sequence context information of the time point of the suspicious behavior with the cross-platform behavior data into the AI ​​fusion analysis model, output the fraud risk confidence degree, and calculate the volatility ratio;

[0055] S5. Based on the fraud risk confidence level and volatility ratio, identify fraudulent behavior and trigger a real-time warning when fraud is confirmed.

[0056] This method constructs a continuous behavioral sequence by integrating user terminal behavior and financial transaction data, and accurately calculates behavioral deviation based on a dynamic baseline to identify suspicious activities. It then combines cross-platform behavior tracking to obtain a wider range of intelligence data, and uses an AI fusion analysis model to deeply correlate and weight these multi-source information to ultimately output fraud risk confidence. Its dual judgment mechanism based on confidence level and its volatility ratio can adaptively trigger high-precision, low-false-alarm real-time warnings, thereby significantly improving the overall ability to identify and defend against complex and covert SMS fraud.

[0057] Specifically, user terminal device behavior data and financial transaction request behavior data are acquired and integrated according to time series to construct a continuous behavior sequence after the user receives SMS messages;

[0058] Among them, terminal device behavior data includes APP activation and foreground switching behavior, sensitive permission call behavior, and network connection behavior; financial transaction request behavior data includes: transfer requests, payment activation requests, and password change requests.

[0059] Specifically, app activation and foreground switching behaviors can reflect the shift in user focus; sensitive permission calls are directly related to the risk of information theft; network connection behaviors can indicate background communication; and financial transaction requests are directly related to fund security, covering the three most frequently exploited key operations in fraud: transfers, payment activation, and password changes. Together, they form the foundation for full-chain behavior monitoring from inducing clicks to ultimately carrying out fraud.

[0060] A dynamic baseline is constructed based on users' historical behavior data. The deviation of individual behavior data in a continuous behavior sequence from the dynamic baseline is calculated to generate a set of suspicious behaviors. Specifically, this includes:

[0061] Extract the user's historical behavior data within the first preset time period, and calculate the average and standard deviation of individual behavior data of the same type at the same time each day;

[0062] The deviation of individual action data points from the dynamic baseline in a continuous action sequence is calculated using a Z-Score-based normalization algorithm. The specific formula for the Z-Score normalization algorithm is as follows:

[0063] ;

[0064] Where Z represents the degree of deviation of the current single behavioral data point from its historical normal fluctuation range. The larger the absolute value of Z, the more abnormal the behavior is; X represents a single behavioral data in a continuous behavioral sequence; μ represents the average value calculated at the same time each day; and σ represents the standard deviation calculated at the same time each day.

[0065] A dynamic threshold is set for the Z-Score value of each type of behavior; if the absolute value of the Z-Score of any single behavior is greater than its corresponding dynamic threshold, the behavior and the time point of occurrence are marked as suspicious behavior and included in the suspicious behavior set.

[0066] In this step, the value range of the first preset time period is 30-90 days, and the update cycle of the dynamic threshold is consistent with the first preset time period. When calculating the average value and standard deviation of single behavioral data of the same type at the same time every day, invalid data that has been marked as abnormal and confirmed by manual review in the historical behavioral data needs to be removed. Invalid data includes abnormal behavioral data caused by user terminal device failure and non-real behavioral data generated by user misoperation.

[0067] Furthermore, the dynamic threshold setting method includes: setting the dynamic threshold according to the percentile based on the distribution of Z-Score values ​​for each type of behavior in the user's historical behavior data; for high-frequency behavior types, the 95th percentile is used as the dynamic threshold; for low-frequency behavior types, the 99th percentile is used as the dynamic threshold.

[0068] Thresholds are set based on percentiles according to the distribution of historical Z-Score values, allowing the thresholds to adaptively match the fluctuation range of users' actual behavior. A more lenient 95th percentile threshold is used for high-frequency behaviors to avoid excessive interference from frequent normal operations; a stricter 99th percentile threshold is used for low-frequency but high-risk behaviors to ensure that any anomalies can be effectively captured.

[0069] The criteria for classifying low-frequency and high-frequency behavior types are based on the frequency of occurrence of each type of behavior in the user's historical behavior data: high-frequency behavior types refer to routine operations that occur more than 5 times per day on average during the historical observation period, such as daily app activation or network connection; low-frequency behavior types refer to risk-sensitive operations that occur no more than 2 times per day on average, such as sensitive permission calls or large transfer requests; this classification is determined by statistical behavior frequency distribution to ensure that the threshold setting is both adaptable to normal fluctuations and can effectively capture rare high-risk events.

[0070] Cross-platform behavior tracking is performed on behaviors within the suspicious behavior set to obtain cross-platform behavior data; cross-platform behavior tracking includes:

[0071] Extract device fingerprints and network environment information at the time of suspicious behavior. Device fingerprints include device ID, browser fingerprint, and mobile phone number. Network environment information includes IP address.

[0072] In third-party threat intelligence databases and partner platform data, check device fingerprints and network environment information for any recorded fraudulent activities or abnormal events.

[0073] Specifically, by extracting device fingerprints and network environment information, it can uniquely identify the perpetrator and associate them with a broader threat context; querying third-party threat intelligence databases and data from partner platforms aims to discover whether the device or IP has a known history of fraud, whether it belongs to a virtual operator number segment, or whether it has made abnormal attempts on multiple platforms in a short period of time; it evaluates single-point anomalies within a global perspective, improving the ability to identify professional criminal activities.

[0074] The deviation degree corresponding to the suspicious behavior and the sequential context information of the time point of occurrence are input into the AI ​​fusion analysis model along with cross-platform behavioral data to output the fraud risk confidence level.

[0075] The sequence context information includes: the type, occurrence time, and order of all other behaviors in the continuous behavior sequence within the second preset time period before the occurrence of the suspicious behavior and the third preset time period after the occurrence of the suspicious behavior;

[0076] The second preset time period ranges from 1 to 5 minutes, and the third preset time period ranges from 1 to 3 minutes. When extracting sequence context information, it is necessary to deduplicate the same type of behavior that occurs repeatedly in the continuous behavior sequence, and only retain the first occurrence time and the last occurrence time. The criteria for determining the same type of behavior are: the APP name is the same in the APP activation and foreground switching behaviors, the permission type is the same in the sensitive permission call behaviors, the network protocol and target address are the same in the network connection behaviors, and the business type requested is the same in the financial transaction request behaviors.

[0077] It can reveal whether suspicious behavior is an isolated incident or part of a coherent attack process, such as whether the sequence is receiving a text message, enabling an unknown app, requesting camera permissions, or initiating a money transfer; this kind of contextual information helps to distinguish between malicious operations and accidental user errors.

[0078] Furthermore, the AI ​​fusion analysis model calculates the fraud risk confidence level using the following formula:

[0079] ;

[0080] in, This represents the confidence level of fraud risk for the i-th suspicious behavior; This represents the total number of categories of cross-platform behavioral data; This indicates the total number of cross-platform actions; This represents the weight coefficient for the x-th cross-platform action; This represents the amount of data of type u in the x-th cross-platform action; express The average amount of cross-platform behavioral data; This represents the deviation of the i-th suspicious behavior; This represents the mean of the deviations from all suspicious behaviors.

[0081] Furthermore, weighting coefficients Calculated based on the principle of temporal proximity:

[0082] ;

[0083] in, Indicates the time when the i-th suspicious behavior occurred; Indicates the time when the x-th cross-platform action occurred; This represents the time decay factor; it uses an exponential decay function, which makes the cross-platform behavior that is closer to the current suspicious behavior at a given time point have a greater weight and contribute more to the confidence calculation.

[0084] By calculating the deviation of current suspicious behavior and the weighted correlation coefficient between various cross-platform behavioral data, and by calculating the correlation across multiple data categories and taking the average, the model comprehensively evaluates the correlation strength between internal behavioral anomalies and external threat intelligence. The stronger the correlation, the higher the confidence level of the output fraud risk, thereby achieving deep fusion and quantitative evaluation of multi-source heterogeneous information.

[0085] Fraudulent behavior is identified based on the confidence level and volatility ratio of fraud risk, and a real-time alert is triggered upon confirmation of fraud. The identification of fraudulent behavior based on the confidence level and volatility ratio of fraud risk includes:

[0086] For the fraud risk confidence sequence corresponding to all suspicious user behaviors, calculate the ratio of its standard deviation to the mean, as the volatility ratio V; if the fraud risk confidence... If the confidence level exceeds the preset first confidence threshold Z1, it is directly judged as fraudulent behavior; if the fraud risk confidence level is higher... If the value exceeds the preset confidence level second threshold Z2 and the fluctuation ratio V exceeds the preset fluctuation threshold V1, it is also judged as fraudulent behavior.

[0087] In this step, a single high-confidence event can be directly identified as fraud; while for cases with moderate confidence but significant fluctuations in the overall risk of user behavior, it is also identified as fraud. This effectively captures potential victims with unstable behavioral patterns and elusive risks, thereby reducing false alarms while reducing underreporting.

[0088] Furthermore, the specific actions that trigger real-time alerts include: sending a forced pop-up warning to the user's terminal and calling the system interface to attempt to automatically stop the ongoing transfer or payment operation; sending a risk warning message containing the risk type, time of occurrence, and suggested actions to the user's preset emergency contacts; and sending a standardized high-risk alert work order to the local anti-fraud center system, the work order content of which includes at least the user's anonymization identifier, risk confidence level, type of suspicious behavior, and time of occurrence.

[0089] In specific application scenarios, this early warning method, through deep integration of user internal and external behavioral data and real-time threat intelligence, can track and analyze the user's entire subsequent behavioral chain in real time, starting from a suspicious text message, thereby accurately intercepting the fraud before it is completed; for example... Figure 2 As shown, its implementation process includes:

[0090] 1) Collection and integration of abnormal behavior sequences;

[0091] When a user clicks on a fraudulent SMS link disguised as a bank's "points redemption," full-dimensional behavioral monitoring is immediately activated to capture the user's continuous actions in real time. This includes recording, in chronological order by timestamp, a series of cross-application operations such as "downloading and activating the fake bank app and switching it to the foreground," "the fake app requesting to read SMS verification codes and modifying system settings permissions," "the device connecting to an unknown overseas IP address in the background," and "initiating a large transfer to an unknown account through a legitimate payment app." This device behavior data is then integrated with financial transaction request data to form a continuous sequence of behaviors with strict temporal logic, fully reconstructing the user's operational trajectory after receiving the fraudulent SMS.

[0092] 2) Suspicious behavior flagging based on dynamic baselines;

[0093] By accessing the user's historical behavioral data from the past few months, a personalized dynamic baseline was constructed for each type of behavior, such as "APP download and activation," "sensitive permission requests," and "transfer operations," using the Z-Score algorithm. At the same time, the average and standard deviation of the same type of behavior at the same time each day were calculated. By comparing the deviation of key operations in the current behavior sequence from the dynamic baseline, it was found that the Z-Score values ​​of "downloading and activating unknown APPs," "requesting SMS read permissions," and "transferring large sums of money to unknown accounts" all far exceeded their respective set dynamic thresholds. These behaviors and their corresponding times were then marked as highly suspicious and included in the suspicious behavior set.

[0094] 3) Cross-platform threat intelligence correlation query;

[0095] For flagged suspicious behavior, the system extracts the device fingerprint and network environment information at the time of the operation and synchronizes this identification information to a third-party threat intelligence database and cooperative security platforms for retrieval. The query results show that the device ID has attempted to register on multiple financial platforms in the past hour, and its IP address has been recorded as a known source of fraudulent activity. External threat intelligence verifies that this operation has cross-platform association risks, providing a global perspective for subsequent risk assessment.

[0096] 4) AI-powered fusion analysis and real-time early warning triggering;

[0097] The AI ​​fusion analysis model receives three types of core data: high deviation of suspicious behavior, tight malicious behavior sequence context, and cross-platform threat intelligence. It performs weighted calculations according to a preset formula and finally outputs a fraud risk confidence level of 0.98 for this event. Since this confidence level far exceeds the preset extremely high risk threshold Z1, the system does not need to wait for volatility ratio analysis and directly determines it as a confirmed fraud, immediately triggering the highest level of warning: a mandatory warning pop-up appears when the user is about to enter the payment password, and the system interface is called to automatically stop the transfer transaction, successfully intercepting the fraudulent operation.

[0098] In summary, this method, by constructing multi-dimensional behavioral sequences, establishing personalized dynamic baselines, integrating cross-platform threat intelligence, and relying on intelligent algorithms for multi-level risk assessment, has demonstrated high sensitivity and strong adaptability to new and complex SMS fraud methods in practice. It has achieved effective early warning and proactive intervention before users suffer financial losses, thus improving the accuracy and real-time nature of anti-fraud protection.

[0099] Example 2

[0100] Reference Figure 3 This embodiment provides a text message fraud early warning system based on abnormal behavior detection, including:

[0101] Data acquisition module: used to acquire user terminal device behavior data and financial transaction request behavior data, and integrate them according to time series to construct a continuous behavior sequence after the user receives SMS messages;

[0102] Suspicious Behavior Generation Module: Used to build a dynamic baseline based on users' historical behavior data, calculate the deviation of individual behavior data in a continuous behavior sequence from the dynamic baseline, and generate a set of suspicious behaviors;

[0103] Cross-platform behavior tracking module: used to track behaviors in a suspicious behavior set across platforms and obtain cross-platform behavior data;

[0104] Fusion Analysis Module: This module is used to input the deviation degree corresponding to suspicious behavior and the sequence context information of the time point when the suspicious behavior occurs, along with cross-platform behavioral data, into the AI ​​fusion analysis model, output the fraud risk confidence level, and calculate the volatility ratio.

[0105] Fraud Behavior Detection Module: Used to identify fraud behavior based on fraud risk confidence level and volatility ratio, and trigger real-time alerts when fraud is confirmed.

[0106] In summary, this system achieves full-process tracking and accurate identification of SMS fraud chains through multi-dimensional behavioral sequence analysis, personalized dynamic baseline comparison, cross-platform threat intelligence fusion, and intelligent risk assessment, thereby improving the real-time performance, accuracy, and adaptability of fraud detection.

[0107] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for early warning of SMS fraud based on abnormal behavior detection, characterized in that: include, Acquire user terminal device behavior data and financial transaction request behavior data, and integrate them according to time series to construct a continuous behavior sequence after the user receives SMS messages; A dynamic baseline is constructed based on the user's historical behavior data. The deviation of individual behavior data in the continuous behavior sequence from the dynamic baseline is calculated to generate a set of suspicious behaviors. Cross-platform behavior tracking is performed on the behaviors in the suspicious behavior set to obtain cross-platform behavior data; The deviation corresponding to the suspicious behavior and the sequence context information of the time point when the suspicious behavior occurred are input into the AI ​​fusion analysis model along with cross-platform behavioral data to output the fraud risk confidence level and calculate the volatility ratio; Fraudulent behavior is identified based on the aforementioned fraud risk confidence level and volatility ratio, and a real-time alert is triggered when fraud is confirmed.

2. The SMS fraud early warning method based on abnormal behavior detection as described in claim 1, characterized in that: The terminal device behavior data includes APP activation and foreground switching behavior, sensitive permission call behavior, and network connection behavior. Financial transaction request behavior data includes: transfer requests, payment activation requests, and password change requests.

3. The SMS fraud early warning method based on abnormal behavior detection as described in claim 1, characterized in that: The generated set of suspicious behaviors includes: Extract the user's historical behavior data within the first preset time period, and calculate the average and standard deviation of individual behavior data of the same type at the same time each day; The deviation of a single action data point from the dynamic baseline in a continuous action sequence is calculated using a Z-Score-based normalization algorithm, and is expressed as: ； Where Z represents the degree of deviation of the current single behavioral data point from the historical normal fluctuation range; X represents a single behavioral data point in a continuous behavioral sequence; μ represents the average value calculated at the same time each day; and σ represents the standard deviation calculated at the same time each day. A dynamic threshold is set for the Z-Score value of each type of behavior; if the absolute value of the Z-Score value of any single behavior is greater than the corresponding dynamic threshold, the behavior and the time point of occurrence are marked as suspicious behavior and included in the suspicious behavior set.

4. The SMS fraud early warning method based on abnormal behavior detection as described in claim 3, characterized in that: The dynamic threshold includes: setting a dynamic threshold based on the distribution of Z-Score values ​​for each type of behavior in the user's historical behavior data, according to percentiles. For high-frequency behavior types, the 95th percentile is used as the dynamic threshold; for low-frequency behavior types, the 99th percentile is used as the dynamic threshold. The criteria for classifying high-frequency and low-frequency behavior types are based on the frequency of occurrence of each type of behavior in the user's historical behavior data.

5. The SMS fraud early warning method based on abnormal behavior detection as described in claim 1, characterized in that: The cross-platform behavior tracking includes: Extract the device fingerprint and network environment information at the time of the suspicious behavior. The device fingerprint includes the device ID, browser fingerprint, and mobile phone number. The network environment information includes the IP address. In third-party threat intelligence databases and partner platform data, query the device fingerprint and network environment information to see if there are any recorded fraudulent behaviors or abnormal activities.

6. The SMS fraud early warning method based on abnormal behavior detection as described in claim 1, characterized in that: The sequence context information includes: the type, occurrence time, and order of all other behaviors in the continuous behavior sequence within the second preset time period before the occurrence of the suspicious behavior and the third preset time period after the occurrence time.

7. The SMS fraud early warning method based on abnormal behavior detection as described in claim 1, characterized in that: The output fraud risk confidence level includes: The confidence level of fraud risk is calculated using an AI fusion analysis model and expressed as follows: ； in, This represents the confidence level of fraud risk for the i-th suspicious behavior; This represents the total number of categories of cross-platform behavioral data; This indicates the total number of cross-platform actions; This represents the weight coefficient for the x-th cross-platform action; This represents the amount of data of type u in the x-th cross-platform action; express The average amount of cross-platform behavioral data; This represents the deviation of the i-th suspicious behavior; This represents the mean of the deviations from the expected behavior. The weighting coefficients are calculated based on the principle of temporal proximity and are expressed as follows: ； in, Indicates the time when the i-th suspicious behavior occurred; Indicates the time when the x-th cross-platform action occurred; This represents the time decay factor.

8. The SMS fraud early warning method based on abnormal behavior detection as described in claim 1, characterized in that: The fraud detection process includes: For the fraud risk confidence sequence corresponding to all suspicious user behaviors, the ratio of the standard deviation to the mean is calculated as the volatility ratio. If the confidence level of fraud risk is greater than the preset first confidence level threshold, it is directly judged as fraudulent behavior; if the confidence level of fraud risk is greater than the preset second confidence level threshold and the volatility ratio is greater than the preset volatility threshold, it is also judged as fraudulent behavior.

9. A text message fraud early warning system based on abnormal behavior detection, based on the text message fraud early warning method based on abnormal behavior detection as described in any one of claims 1 to 8, characterized in that: include, Data acquisition module: used to acquire user terminal device behavior data and financial transaction request behavior data, and integrate them according to time series to construct a continuous behavior sequence after the user receives SMS messages; Suspicious Behavior Generation Module: Used to build a dynamic baseline based on users' historical behavior data, calculate the deviation of individual behavior data in a continuous behavior sequence from the dynamic baseline, and generate a set of suspicious behaviors; Cross-platform behavior tracking module: used to track behaviors in a suspicious behavior set across platforms and obtain cross-platform behavior data; Fusion Analysis Module: This module is used to input the deviation degree corresponding to suspicious behavior and the sequence context information of the time point when the suspicious behavior occurs, along with cross-platform behavioral data, into the AI ​​fusion analysis model, output the fraud risk confidence level, and calculate the volatility ratio. Fraud Behavior Detection Module: Used to identify fraud behavior based on fraud risk confidence level and volatility ratio, and trigger real-time alerts when fraud is confirmed.

Images