Communication supervision method and apparatus, and electronic device

Abstract

The invention provides a communication supervision method and device and electronic equipment, and belongs to the technical field of artificial intelligence. The communication supervision method comprises the following steps: generating a communication behavior network and a communication social relation network according to collected communication data and social data; identifying an abnormal communication behavior by using the communication behavior network, and identifying an abnormal communication social node by using the communication social relation network; and generating an alarm signal and a communication supervision strategy according to the abnormal communication behavior and the abnormal communication social node. According to the invention, abnormal communication behaviors and abnormal communication social nodes can be identified, and normal communication is guaranteed.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of artificial intelligence technology, and in particular to a communication monitoring method and device, and an electronic device. Background Technology

[0002] Artificial intelligence (AI) is an important component of the discipline of intelligence. It attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI is a very broad science, encompassing fields such as robotics, speech recognition, image recognition, natural language processing, expert systems, machine learning, and computer vision.

[0003] Communication refers to the exchange and transmission of information between people or between people and nature through some behavior or medium. In a broad sense, it refers to the accurate and secure transmission of information from one party to another by any method and any medium without violating their own wishes.

[0004] In existing technologies, communication methods between people typically include telephone, WeChat, QQ, etc. When using these communication methods, issues such as information leakage, abnormal communication content, and abnormal communication social relationships often arise. In existing technologies, abnormal data is usually obtained by setting thresholds for comparison, but this method cannot identify potential abnormal data, thus leading to communication abnormalities. Summary of the Invention

[0005] This invention provides a communication monitoring method, device, and electronic device that can identify abnormal communication behavior and abnormal communication social nodes, thereby ensuring normal communication.

[0006] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0007] In a first aspect, embodiments of the present invention provide a communication monitoring method, comprising:

[0008] Based on the collected communication and social data, a communication behavior network and a communication-social relationship network are generated.

[0009] The communication behavior network is used to identify abnormal communication behaviors, and the communication social relationship network is used to identify abnormal communication social nodes.

[0010] Alarm signals and communication monitoring strategies are generated based on the abnormal communication behavior and the abnormal communication social nodes.

[0011] In a second aspect, embodiments of the present invention provide a communication monitoring device, comprising:

[0012] The generation module is used to generate communication behavior networks and communication social relationship networks based on the collected communication and social data;

[0013] The identification module is used to identify abnormal communication behaviors using the communication behavior network and to identify abnormal communication social nodes using the communication social relationship network.

[0014] The processing module is used to generate alarm signals and communication monitoring strategies based on the abnormal communication behavior and the abnormal communication social nodes.

[0015] Thirdly, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the communication monitoring method described in the first aspect above.

[0016] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the communication monitoring method described in the first aspect above.

[0017] Fifthly, embodiments of the present invention provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the communication monitoring method described in the first aspect above.

[0018] In this embodiment of the invention, a communication behavior network and a communication social relationship network are generated based on the collected communication data and social data. The communication behavior network is used to identify abnormal communication behaviors, and the communication social relationship network is used to identify abnormal communication social nodes. Alarm signals and communication monitoring strategies are generated based on the abnormal communication behaviors and abnormal communication social nodes. Through the technical solution of this invention, the comprehensiveness and timeliness of communication monitoring can be improved, abnormal communication behaviors and abnormal communication social nodes can be accurately identified, and the normal operation of communication can be ensured. Attached Figure Description

[0019] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0020] Figure 1 This is a flowchart illustrating the communication monitoring method according to an embodiment of the present invention;

[0021] Figure 2 This is a structural block diagram of the communication monitoring device according to an embodiment of the present invention;

[0022] Figure 3 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] This invention provides a communication monitoring method, device, and electronic device that can identify abnormal communication behavior and abnormal communication social nodes, thereby ensuring normal communication.

[0025] Please refer to Figure 1 This invention provides a communication monitoring method, comprising:

[0026] Step S1: Generate a communication behavior network and a communication social relationship network based on the collected communication data and social data;

[0027] Step S2: Use the communication behavior network to identify abnormal communication behavior and use the communication social relationship network to identify abnormal communication social nodes;

[0028] Step S3: Generate alarm signals and communication monitoring strategies based on the abnormal communication behavior and the abnormal communication social nodes.

[0029] In this embodiment of the invention, a communication behavior network and a communication social relationship network are generated based on the collected communication data and social data. The communication behavior network is used to identify abnormal communication behaviors, and the communication social relationship network is used to identify abnormal communication social nodes. Alarm signals and communication monitoring strategies are generated based on the abnormal communication behaviors and abnormal communication social nodes. Through the technical solution of this invention, the comprehensiveness and timeliness of communication monitoring can be improved, abnormal communication behaviors and abnormal communication social nodes can be accurately identified, and the normal operation of communication can be ensured.

[0030] In this embodiment, a communication behavior network and a communication social relationship network can be generated based on the collected communication data and social data, thereby establishing a communication center model.

[0031] Specifically, the process of establishing the communication center model includes the following steps:

[0032] The system acquires various communication model networks and collects communication data corresponding to each communication mode in real time through these networks. The communication data includes at least one of the following: communication characteristics, communication duration, communication frequency, communication content, communication identity, and communication traffic. The system also connects the communication characteristics with the communication duration, communication frequency, communication content, communication identity, and communication traffic.

[0033] The system sets communication data characteristics, generates corresponding characteristic communication data packets through data mapping, obtains the communication data characteristic database, schedules the communication characteristics corresponding to the communication data, and sends the communication characteristics corresponding to the communication data to the communication data characteristic database for data matching. If the match is successful, the corresponding communication data is sent to the corresponding characteristic communication data packet for storage. If the match is unsuccessful, the corresponding communication data is marked as abnormal characteristic communication data and integrated to generate abnormal characteristic communication data.

[0034] In specific implementation, the communication model network includes, but is not limited to, telephone, WeChat, QQ, email, etc.; the communication data features and communication characteristics include, but are not limited to, voice, text, images, videos, files, etc.; wherein, the communication data includes, but is not limited to, one communication characteristic.

[0035] The system acquires each communication data in the feature communication data packet, generates corresponding feature communication data nodes and connects them to form a corresponding feature communication data network, and then connects each feature communication data network to form a communication behavior network.

[0036] Based on the communication identity corresponding to the feature communication data nodes, the communication initiator and communication receiver corresponding to each feature communication data node in the communication behavior network are obtained, and corresponding communication initiator nodes and communication receiver nodes are generated for real-time collection of corresponding social data; then the communication initiator nodes are connected to the communication receiver nodes through the corresponding feature communication data nodes to generate a communication social relationship network; finally, a communication center model is constructed based on the communication behavior network and the communication social relationship network.

[0037] The social data includes, but is not limited to, social time, social frequency, and number of communications.

[0038] It should be noted that, in the specific implementation process, the communication initiator is used to represent the interactive party that initiates the communication, and the communication receiver is used to represent the interactive party that receives the communication; by setting up a communication center model, the communication data collected in real time by each communication model network is sent to the communication center model in real time, and then the communication data is processed according to the communication behavior network and the communication social relationship network; thus improving the security of communication data.

[0039] In some embodiments, abnormal communication behaviors can be identified based on the communication behavior network, and abnormal communication social nodes can be identified based on the communication social relationship network. A level analysis can be performed to obtain the corresponding abnormality level. For example, different abnormality levels can be determined based on the number of abnormal communication behaviors and the number of abnormal communication social nodes. The more abnormal communication behaviors and the more abnormal communication social nodes there are, the higher the abnormality level.

[0040] Specifically, the process of acquiring abnormal communication behavior includes:

[0041] Based on the characteristics of the communication data, an abnormal data comparison database is set up for each communication data and connected to the communication center model. The communication data corresponding to the characteristic communication data node is compared with the corresponding abnormal data comparison database according to the communication characteristics. If the comparison is successful, the corresponding communication data is marked as abnormal communication data and the corresponding characteristic communication data node is marked as abnormal communication behavior; otherwise, it is marked as the first normal communication behavior.

[0042] It should be noted that in the specific implementation process, for example, if the communication data feature is voice, a corresponding abnormal data comparison database is set up, including but not limited to prohibited languages, special statements, etc.; the abnormal data comparison database includes abnormal data comparison databases corresponding to communication duration, communication frequency, communication content, communication identity, and communication traffic.

[0043] Next, the communication data corresponding to the first normal communication behavior is obtained and processed to obtain the corresponding potential anomaly probability value. The specific formula is as follows:

[0044] ;

[0045] in, This represents the potential anomaly probability value corresponding to the first normal communication behavior. , and Let t represent the communication duration, communication frequency, and communication traffic, respectively; L represents the communication mode network corresponding to the characteristic communication data node. , and These represent the anomaly coefficients corresponding to communication duration, communication frequency, and communication traffic, respectively, and all of them have a value range of (0, 1).

[0046] Set an anomaly probability threshold. And compare it with the above-mentioned anomaly probability values, if If the first normal communication behavior is positive, then the corresponding first normal communication behavior will be marked as a potential abnormal communication behavior; otherwise, the corresponding first normal communication behavior will be marked as a normal communication behavior.

[0047] The system obtains the communication content corresponding to potential abnormal communication behaviors, preprocesses the communication content, obtains key communication fields, schedules the corresponding abnormal communication comparison library according to the corresponding communication characteristics, compares the key communication fields with the abnormal communication comparison library, and if the comparison is successful, marks the corresponding potential abnormal communication behavior as abnormal communication behavior; otherwise, no processing is performed.

[0048] It should be noted that in the specific implementation process, the preprocessing is used to remove noise and invalid information; for example, for text, operations such as word segmentation and removal of stop words can be performed; for speech, operations such as noise reduction and speech recognition to text conversion can be performed; however, in the existing technology, abnormal communication behavior is usually obtained through a single abnormal comparison, and potential abnormal behavior is not identified again, resulting in potential abnormal communication behavior not being monitored, thus causing communication danger.

[0049] Specifically, the process of acquiring the abnormal communication social node includes:

[0050] The number of communication initiator nodes connected to communication receiver nodes corresponding to each characteristic communication node in the communication social relationship network is obtained and marked as the communication count; the social cycle length is set, and the number of times the communication initiator node sends a communication within the social cycle length is obtained, thereby obtaining the social frequency;

[0051] Using the communication initiator node as the origin, and social time, social frequency, and number of communications as the x, y, and z axes of a three-dimensional coordinate system; the collected social data is then used to generate corresponding coordinate points p(x, y, z). p y p , z p Similarly, the social data collected by the communication receiver node is obtained, and the corresponding coordinate point q(x) is generated. q y q , z q );

[0052] The communication distance between the communication initiator node and each connected communication receiver node is obtained based on coordinate points P and q. The specific formula is as follows:

[0053] ;

[0054] The nearest communication distance is obtained based on the communication distance itself, using the following formula:

[0055] ;

[0056] in, This represents the shortest communication distance corresponding to point k; k represents the shortest communication distance between the kth communication receiver node and the communication initiator node.

[0057] Merge the communication receiver nodes corresponding to k to generate a node dataset, denoted as . The cluster density corresponding to point p is obtained from the node dataset, and the specific formula is as follows:

[0058]

[0059] Then, the abnormal social value corresponding to the communication initiator node is obtained, and the specific formula is as follows:

[0060]

[0061] in, Expressed as cluster density; This is indicated as an abnormal social value;

[0062] Set threshold for abnormal social values And compare it with the corresponding abnormal social value, if If the communication initiator node is not found, it will be marked as an abnormal communication social node; otherwise, it will be marked as a normal communication social node.

[0063] In this embodiment, a joint supervision center can be set up, which includes a reporting unit and an improvement unit. The reporting unit reports abnormal communication behaviors and abnormal communication social nodes, and improves the supervision strategy according to the level of abnormality to obtain the latest supervision strategy. For example, the higher the level of abnormality, the stricter the supervision strategy.

[0064] Specifically, the reporting unit is used to report in real time based on alarm signals; it merges abnormal characteristic communication data, abnormal communication behavior, potential abnormal communication behavior, and abnormal communication social nodes to generate abnormal behavior, and generates corresponding alarm signals for each, and sends the alarm signals to the reporting unit in real time; the reporting unit receives the alarm signal, obtains the abnormal behavior corresponding to the alarm signal, and obtains the communication identity and communication address corresponding to the abnormal behavior, and then manages the abnormal behavior;

[0065] The improvement unit sets monitoring strategies corresponding to abnormal behaviors, obtains management results, and then improves the monitoring strategies based on the management results to obtain the latest monitoring strategies.

[0066] In this embodiment, several historical communication data points can also be obtained from the communication center model, visualized, and sent to the joint regulatory center for data analysis, thereby optimizing the latest regulatory strategy and obtaining the optimal regulatory strategy.

[0067] Specifically, several historical communication data points can be obtained based on abnormal behavior. These historical communication data can be visualized to obtain graphs of the nodes corresponding to abnormal behavior in the communication behavior network and communication social relationship network of the communication center model. Then, the graphs can be analyzed to optimize the latest regulatory strategy and obtain the optimal regulatory strategy.

[0068] This invention collects communication data and social data corresponding to communication mode networks to generate communication behavior networks and communication social relationship networks, and then establishes a communication center model. Based on the communication center model, it processes and analyzes the communication data and social data, improving the comprehensiveness of communication monitoring. By setting up a joint supervision center, which includes a reporting unit and an improvement unit, abnormal communication behaviors and abnormal communication social nodes are reported through the reporting unit. The supervision strategy is improved based on the anomaly level to obtain the latest supervision strategy. Several historical communication data points are acquired from the communication center model, visualized, and sent to the joint supervision center for data analysis, thereby optimizing the latest supervision strategy and obtaining the optimal supervision strategy, improving the timeliness and real-time updating of communication monitoring.

[0069] Please refer to Figure 2 This invention also provides a communication monitoring device 100, comprising:

[0070] The generation module 101 is used to generate a communication behavior network and a communication social relationship network based on the collected communication data and social data;

[0071] The identification module 102 is used to identify abnormal communication behavior using the communication behavior network and to identify abnormal communication social nodes using the communication social relationship network.

[0072] The processing module 103 is used to generate alarm signals and communication monitoring strategies based on the abnormal communication behavior and the abnormal communication social nodes.

[0073] In this embodiment of the invention, a communication behavior network and a communication social relationship network are generated based on the collected communication data and social data. The communication behavior network is used to identify abnormal communication behaviors, and the communication social relationship network is used to identify abnormal communication social nodes. Alarm signals and communication monitoring strategies are generated based on the abnormal communication behaviors and abnormal communication social nodes. Through the technical solution of this invention, the comprehensiveness and timeliness of communication monitoring can be improved, abnormal communication behaviors and abnormal communication social nodes can be accurately identified, and the normal operation of communication can be ensured.

[0074] In some embodiments, the generation module 101 is specifically used to acquire various communication model networks and collect communication data corresponding to each communication mode in real time through the communication model networks; match the communication features of the communication data with the communication data feature database; if the match is successful, store the communication data in the corresponding feature communication data packet; if the match is not successful, mark the communication data as abnormal feature communication data; acquire the communication data in the feature communication data packet, generate corresponding feature communication data nodes, connect the feature communication data nodes to each other to generate a feature communication data network, connect the various feature communication data networks to generate a communication behavior network; according to the communication identity corresponding to the feature communication data node, acquire the communication initiator and communication receiver corresponding to each feature communication data node in the communication behavior network, generate corresponding communication initiator nodes and communication receiver nodes, connect the communication initiator node to the communication receiver node through the corresponding feature communication data node to generate a communication social relationship network.

[0075] In some embodiments, the communication data includes at least one of the following: communication characteristics, communication duration, communication frequency, communication content, communication identity, and communication traffic.

[0076] In some embodiments, the identification module 102 is specifically configured to set up an abnormal data comparison database corresponding to each communication data according to the communication characteristics of the communication data, compare the communication data corresponding to the characteristic communication data node with the abnormal data comparison database corresponding to the communication characteristics, if the comparison is successful, mark the corresponding communication data as abnormal communication data and mark the corresponding characteristic communication data node as abnormal communication behavior, if the comparison is unsuccessful, mark the corresponding communication data as the first normal communication behavior; obtain the potential abnormal probability value corresponding to the first normal communication behavior, compare the potential abnormal probability value with the abnormal probability value threshold, if it is greater than or equal to the abnormal probability value threshold, mark the first normal communication behavior as potential abnormal communication behavior; if it is less than the abnormal probability value threshold, mark the first normal communication behavior as normal communication behavior; obtain the communication content of the potential abnormal communication behavior, compare the key communication fields of the communication content with the abnormal communication comparison database, if the comparison is successful, mark the potential abnormal communication behavior as abnormal communication behavior.

[0077] In some embodiments, the identification module 102 is specifically used to obtain the number of communication initiator nodes connecting to communication receiver nodes in the communication social relationship network, denoted as the number of communications; set a social cycle length, and obtain the number of times the communication initiator node sends communications within the social cycle length, and determine the social frequency based on the number of communications; with the communication initiator node as the origin, and with social time, social frequency, and number of communications as the x-axis, y-axis, and z-axis of the three-dimensional coordinate system respectively, generate corresponding coordinate point p based on the social data collected by the communication initiator node, and generate corresponding coordinate point q based on the social data collected by the communication receiver node; and generate corresponding coordinate point q based on coordinate point p and the coordinates of the communication receiver node. The communication distance between the communication initiator node and each connected communication receiver node is obtained by punctuation q. The target communication receiver node corresponding to the minimum communication distance is determined. The target communication receiver nodes are merged to generate a node dataset. The clustering density corresponding to coordinate point p is obtained based on the node dataset. The abnormal social value corresponding to the communication initiator node is obtained based on the clustering density. The abnormal social value is compared with the abnormal social value threshold. If it is greater than or equal to the abnormal social value threshold, the corresponding communication initiator node is marked as an abnormal communication social node. If it is less than the abnormal social value threshold, the corresponding communication initiator node is marked as a normal communication social node.

[0078] In some embodiments, the processing module 103 is specifically used to merge the abnormal feature communication data, the abnormal communication behavior, the potential abnormal communication behavior, and the abnormal communication social nodes to generate abnormal behavior, and generate corresponding alarm signals respectively.

[0079] In some embodiments, the apparatus further includes:

[0080] An optimization module is used to obtain corresponding historical communication data based on the abnormal behavior, and to optimize the communication monitoring strategy based on the historical communication data.

[0081] Please refer to Figure 3 The present invention also provides an electronic device 200, including a processor 201, a memory 202, and a computer program stored in the memory 202 and executable on the processor 201. When the computer program is executed by the processor 201, it implements the various processes of the above-described communication monitoring method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0082] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described communication monitoring method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0083] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0084] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0085] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0086] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A communication monitoring method, characterized in that, include: Based on the collected communication and social data, a communication behavior network and a communication-social relationship network are generated. The communication behavior network is used to identify abnormal communication behaviors, and the communication social relationship network is used to identify abnormal communication social nodes. Alarm signals and communication monitoring strategies are generated based on the abnormal communication behavior and the abnormal communication social nodes.

2. The method according to claim 1, characterized in that, The generation of communication behavior networks and communication social relationship networks based on the collected communication and social data includes: Acquire each communication model network, and collect communication data corresponding to each communication mode in real time through the communication model network; The communication characteristics of the communication data are matched with the communication data characteristic database. If a match is found, the communication data is stored in the corresponding characteristic communication data packet; if no match is found, the communication data is marked as abnormal characteristic communication data. The communication data in the feature communication data packet is obtained, the corresponding feature communication data node is generated, the feature communication data node is connected to each other to generate a feature communication data network, and the feature communication data networks are connected to generate a communication behavior network. Based on the communication identity corresponding to the feature communication data node, the communication initiator and communication receiver corresponding to each feature communication data node in the communication behavior network are obtained, and corresponding communication initiator nodes and communication receiver nodes are generated. The communication initiator node is connected to the communication receiver node through the corresponding feature communication data node to generate a communication social relationship network.

3. The method according to claim 2, characterized in that, The communication data includes at least one of the following: communication characteristics, communication duration, communication frequency, communication content, communication identity, and communication traffic.

4. The method according to claim 2, characterized in that, The method of using the communication behavior network to identify abnormal communication behavior includes: Based on the communication characteristics of the communication data, an abnormal data comparison database is set up for each communication data. The communication data corresponding to the characteristic communication data node is compared with the abnormal data comparison database corresponding to the communication characteristics. If the comparison is successful, the corresponding communication data is marked as abnormal communication data and the corresponding characteristic communication data node is marked as abnormal communication behavior. If the comparison is unsuccessful, the corresponding communication data is marked as the first normal communication behavior. Obtain the potential anomaly probability value corresponding to the first normal communication behavior, compare the potential anomaly probability value with the anomaly probability value threshold, if it is greater than or equal to the anomaly probability value threshold, mark the first normal communication behavior as a potential abnormal communication behavior; if it is less than the anomaly probability value threshold, mark the first normal communication behavior as a normal communication behavior. Obtain the communication content of the potential abnormal communication behavior, compare the key communication fields of the communication content with the abnormal communication comparison database, and if the comparison is successful, mark the potential abnormal communication behavior as abnormal communication behavior.

5. The method according to claim 4, characterized in that, The method of identifying abnormal communication social nodes using the communication social relationship network includes: The number of communication initiator nodes connected to communication receiver nodes in the communication social relationship network is recorded as the number of communications. Set the social cycle length, and obtain the number of times the communication initiator node sends a communication within the social cycle length, and determine the social frequency based on the number of times; With the communication initiator node as the origin, and social time, social frequency, and number of communications as the x-axis, y-axis, and z-axis of the three-dimensional coordinate system, the corresponding coordinate point p is generated based on the social data collected by the communication initiator node, and the corresponding coordinate point q is generated based on the social data collected by the communication receiver node. Based on coordinate points p and q, obtain the communication distance between the communication initiator node and each connected communication receiver node, determine the target communication receiver node corresponding to the minimum communication distance, merge the target communication receiver nodes to generate a node dataset, and obtain the clustering density corresponding to coordinate point p based on the node dataset. The abnormal social value corresponding to the communication initiator node is obtained based on the aggregation density. The abnormal social value is compared with the abnormal social value threshold. If it is greater than or equal to the abnormal social value threshold, the corresponding communication initiator node is marked as an abnormal communication social node; if it is less than the abnormal social value threshold, the corresponding communication initiator node is marked as a normal communication social node.

6. The method according to claim 5, characterized in that, The step of generating an alarm signal based on the abnormal communication behavior and the abnormal communication social node includes: The abnormal communication data, the abnormal communication behavior, the potential abnormal communication behavior, and the abnormal communication social nodes are combined to generate abnormal behavior, and corresponding alarm signals are generated for each.

7. The method according to claim 6, characterized in that, The method further includes: Based on the abnormal behavior, obtain the corresponding historical communication data, and optimize the communication monitoring strategy based on the historical communication data.

8. A communication monitoring device, characterized in that, include: The generation module is used to generate communication behavior networks and communication social relationship networks based on the collected communication and social data; The identification module is used to identify abnormal communication behaviors using the communication behavior network and to identify abnormal communication social nodes using the communication social relationship network. The processing module is used to generate alarm signals and communication monitoring strategies based on the abnormal communication behavior and the abnormal communication social nodes.

9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the communication monitoring method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the communication monitoring method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the communication supervision method as described in any one of claims 1 to 7.

Images