Fraud recognition method and system combining knowledge graph and graph clustering

Abstract

The invention relates to a fraud recognition method and system combining a knowledge graph and graph clustering, and the method comprises the steps: constructing a multi-dimensional heterogeneous communication network graph according to entities and relationships in a communication network; calculating the comprehensive similarity between every two card number nodes in the network atlas, and constructing a card number relation graph: when the comprehensive similarity is greater than a similarity threshold, creating a connection edge between the two card number nodes, and the weight is the comprehensive similarity; clustering all card number nodes in the card number relation graph by using a graph clustering algorithm to generate a plurality of communities, and marking risk card numbers and suspicious devices in the communities; the base stations with the card numbers visited in each community form a base station set of the community, then the base stations with the geographical distance smaller than an aggregation distance threshold value and the visited suspicious device number or risk card number larger than the threshold value in the base station set form a pit base station group, and therefore the fraud pit position is determined. The invention relates to the field of security, and can realize accurate positioning of fraud by combining time and space network attributes.

Description

Technical Field

[0001] This invention relates to a method and system for identifying fraud dens that combines knowledge graphs and graph clustering, and relates to the field of security. Background Technology

[0002] Telecommunications fraud is a type of fraud that uses telephones, the internet, and text messages to meticulously fabricate false information and construct fraudulent scenarios to defraud victims remotely and without face-to-face interaction. In recent years, telecommunications fraud cases have shown a significant trend of clustering in criminal dens, reflecting a high degree of professionalism and organized crime. These criminal gangs utilize professional outbound calling network equipment and a sophisticated division of labor to build a contactless black market industrial chain that includes multiple links such as SIM card farming, SIM card sales, outbound calling, and bank cash withdrawals. These interconnected links form a criminal network.

[0003] Existing technologies primarily rely on traditional clustering algorithms combined with neural networks to identify GOIP (GoIP fraud) dens. For example, CN114066490A discloses a method, system, and computer-readable storage medium for identifying GOIP fraud dens. The method includes: S1, collecting historical sample datasets; S2, training a neural network model; performing Gaussian Mixture Model (GMM) clustering analysis on the historical sample dataset and the confidence scores output by the corresponding neural network model to obtain historical clustering results; S3, inputting the test sample into the neural network model and outputting a confidence score; if the confidence score exceeds a preset threshold, it is considered a GOIP fraud call, and proceeding to step S4; S4, performing probability matching between the test samples belonging to GOIP fraud calls and the historical clustering results to obtain target clustering results; S5, determining, based on the target clustering results, whether there exists a fraud den cluster where the number of test samples exceeds a preset threshold and the average confidence score of all test samples exceeds a preset confidence threshold. Traditional clustering algorithms rely on the Gaussian assumption, are sensitive to noise and outliers, do not consider spatiotemporal data characteristics, and have weak interpretability and visualization of neural network models.

[0004] Methods using graph computation that consider spatiotemporal characteristics are only focused on identifying fraudulent phone calls and do not extend to identifying fraudulent dens. For example, the graph computation-based fraudulent number detection method proposed in public disclosure CN117640822A constructs and classifies graph structures through communication data, and then performs detection based on type matching graph computation models to determine whether a number is fraudulent. Another example is a method for identifying phone number fraud patterns based on graph networks and machine learning disclosed in public disclosure CN115174745B. Based on preliminary analysis using graph networks, it then obtains corresponding GoIP fraud models through machine learning algorithms such as random forest, XGBooost, or LightGBM, thereby identifying GoIP fraudulent numbers.

[0005] Therefore, how to combine time and space network attributes to accurately locate fraud dens has become a key technical issue of concern for technicians. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method and system for identifying fraud dens that combines knowledge graphs and graph clustering, which can accurately locate fraud dens by combining temporal and spatial network attributes.

[0007] To achieve the above objectives, this invention provides a method for identifying fraud dens that combines knowledge graphs and graph clustering, comprising:

[0008] Step 1: Based on the entities and relationships in the communication network, construct a multi-dimensional heterogeneous communication network graph. The multi-dimensional heterogeneous communication network graph consists of various types of nodes and edges. Node types include: card number, ID card number, base station address, and terminal IMEI. Edge types include: CONTACT communication relationship; IS_SIGNED_BY contract relationship; LOCATED_AT geographical location relationship; USE_IMEI terminal relationship.

[0009] Step 2: Based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, calculate the comprehensive similarity between every two card number nodes. Then, construct a card number relationship graph based on the comprehensive similarity. The card number relationship graph includes all card number nodes in the multidimensional heterogeneous communication network graph. When the comprehensive similarity between two card number nodes is greater than the similarity threshold, create a connection edge between the corresponding two card number nodes in the card number relationship graph. The weight of the connection edge is the comprehensive similarity between the two card number nodes.

[0010] Step 3: Using a graph clustering algorithm, cluster all card number nodes in the card number relationship graph to generate multiple communities, and determine whether there are card number nodes with the "fraudulent" label in each community. If so, mark suspicious devices according to the number of card numbers shared by devices in the community, and mark risky card numbers according to the weight of the connection edges between the card number nodes with the fraudulent label or the shared suspicious devices.

[0011] Step 4: Construct a base station set for each community by including all base stations visited by all card numbers. Then, calculate the geographical distance between any two base stations in each community's base station set. Base stations whose geographical distance from each other is less than the cluster distance threshold and whose number of suspicious devices or risk card numbers visited is greater than the risk quantity threshold are grouped into a base station cluster for a fraud den. Finally, determine the location of the fraud den based on the locations of all base stations in each base station cluster.

[0012] To achieve the above objectives, the present invention also provides a fraud den identification system combining knowledge graphs and graph clustering, comprising:

[0013] A multidimensional heterogeneous network construction device is used to construct a multidimensional heterogeneous communication network graph based on entities and relationships in a communication network. The multidimensional heterogeneous communication network graph consists of various types of nodes and edges. Node types include: card number, ID card number, base station address, and terminal IMEI. Edge types include: CONTACT communication relationship; IS_SIGNED_BY contract relationship; LOCATED_AT geographical location relationship; USE_IMEI terminal relationship.

[0014] A card number relationship graph construction device is used to calculate the comprehensive similarity between every two card number nodes based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, and then construct a card number relationship graph based on the comprehensive similarity. The card number relationship graph includes all card number nodes in the multidimensional heterogeneous communication network graph. When the comprehensive similarity between two card number nodes is greater than the similarity threshold, a connection edge is created between the corresponding two card number nodes in the card number relationship graph, and the weight of the connection edge is the comprehensive similarity between the two card number nodes.

[0015] The community identification device uses a graph clustering algorithm to cluster all card number nodes in the card number relationship graph to generate multiple communities. It then determines whether there are card number nodes with the "fraudulent" label in each community. If so, it marks suspicious devices based on the number of card numbers in the community that are shared by the devices. It also marks risky card numbers based on the weight of the connection edges between the card number nodes with the fraudulent label or the shared suspicious devices.

[0016] The location detection device is used to form a base station set for each community by identifying all base stations visited by all card numbers in each community. Then, it calculates the geographical distance between every two base stations in each community's base station set. Base stations whose geographical distance from each other is less than the clustering distance threshold and whose number of suspicious devices or risk card numbers visited is greater than the risk quantity threshold are grouped into a base station cluster for the fraud den. Finally, the location of the fraud den is determined based on the location of all base stations in each base station cluster.

[0017] To achieve the above objectives, the present invention also provides a computing device, comprising:

[0018] Memory and processor;

[0019] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method for identifying fraud dens by combining knowledge graphs and graph clustering are implemented.

[0020] To achieve the above objectives, the present invention also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the method for identifying fraud dens combining knowledge graphs and graph clustering.

[0021] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention constructs a multi-dimensional heterogeneous communication network map using graph technology, combining temporal and spatial network attributes to overcome the dependence of traditional clustering algorithms on the Gaussian assumption and their sensitivity to noise and outliers. Through base station clustering and personnel call behavior analysis, it significantly improves the accuracy of fraud den identification, especially when facing the problems of fraud gangs' normalized calls, rapid behavioral changes, and strong concealment, achieving more accurate den identification. This invention enhances the node attributes in the multi-dimensional heterogeneous network through information fusion and transmission, enabling more effective identification of fraud characteristics. Unlike traditional methods that rely solely on call records, this invention comprehensively considers multiple data sources, making risk identification more comprehensive and accurate, overcoming the limitations of existing technologies in feature extraction. The multi-dimensional heterogeneous network structure of this invention has good scalability, easily integrating other data sources to provide richer background information for subsequent risk analysis. This characteristic allows the model to adapt to the needs of different scenarios, enhancing its versatility in practical applications, especially in dealing with new fraud methods. This invention offers rapid adjustment and optimization. Its design emphasizes model interpretability, utilizing the interactive visualization capabilities of the graph database Neo4j to display the identification results and their basis, effectively overcoming the shortcomings of existing technologies in interpretability and visualization. This advantage allows users to more intuitively understand the identification results, thereby improving the transparency and credibility of the decision-making process. The invention employs a spatiotemporal graph algorithm, designing a complete behavioral process for telecom fraud activities. Utilizing a one-to-hundred radiation scanning strategy, it significantly reduces computational complexity and the difficulty of generalization. Compared to existing methods, this invention also optimizes the data processing flow through subgraph filtering technology, improving computational efficiency and enabling large-scale data analysis, thus solving the performance bottleneck of traditional methods when processing large-scale data. Based on communication signaling data, this invention identifies potential fraud dens through base station clustering and personnel call behavior analysis. This method breaks through the limitations of traditional monitoring methods, providing a more effective risk identification strategy, enabling dynamic monitoring and real-time identification of fraud activities. Compared to existing static methods, it significantly improves the accuracy and timeliness of monitoring. Attached Figure Description

[0022] Figure 1 This is a flowchart illustrating an exemplary embodiment of the present invention of a method for identifying fraud dens that combines knowledge graphs and graph clustering.

[0023] Figure 2 This is an exemplary embodiment of the present invention. Figure 1The detailed implementation flowchart for step one.

[0024] Figure 3 This is a schematic diagram illustrating the structure of a fraud den identification system that combines knowledge graphs and graph clustering, as shown in an exemplary embodiment of the present invention.

[0025] Figure 4 This is a schematic diagram of the structure of a computer device shown in an exemplary embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings.

[0027] This invention combines big data analytics and graph data mining techniques to construct a multidimensional heterogeneous network. This network integrates call, location, and time information of risky entities. Based on this, graph clustering technology is applied for risky personnel identification and community group analysis, effectively identifying potential fraud gangs and high-risk individuals, and accurately locating fraud dens. By constructing a graph database and knowledge graph, business analysts can gain a deeper understanding and uncover the complex relationships between risky entities, thereby improving the accuracy and efficiency of the analysis. Furthermore, the model of this invention has good scalability and can be directly applied to the analysis of other risky individuals.

[0028] like Figure 1 As shown, this invention discloses a method for identifying fraud dens that combines knowledge graphs and graph clustering, including:

[0029] Step 1: Construct a multi-dimensional heterogeneous communication network graph based on the entities and relationships in the communication network. The multi-dimensional heterogeneous communication network graph consists of various types of nodes and edges. Node types may include: card number, ID card number, base station address, and terminal IMEI. Edge types may include: CONTACT (connecting different card number nodes); IS_SIGNED_BY (connecting ID card number nodes and card number nodes); LOCATED_AT (connecting card number nodes and base station address nodes); and USE_IMEI (connecting card number nodes and terminal IMEI nodes).

[0030] The multidimensional heterogeneous communication network graph can also be expanded to include other entities and relationships according to actual business needs. For example, for risk channels, a node type can be added: account opening channel, and an edge type OPEN_ACCOUNT_AT channel account opening relationship can be added to connect card number nodes and account opening channel nodes.

[0031] Step 2: Based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, calculate the comprehensive similarity between any two card number nodes. Then, construct a card number relationship graph based on the comprehensive similarity. The card number relationship graph includes all card number nodes in the multidimensional heterogeneous communication network graph. When the comprehensive similarity between two card number nodes is greater than the similarity threshold, create a connection edge between the corresponding two card number nodes in the card number relationship graph. The weight of the connection edge is the comprehensive similarity between the two card number nodes. The similarity threshold can be set according to actual business needs.

[0032] Step 3: Using a graph clustering algorithm, cluster all card number nodes in the card number relationship graph to generate multiple communities, and determine whether there are card number nodes with the "fraudulent" label in each community. If so, mark suspicious devices according to the number of card numbers shared by devices in the community, and mark risky card numbers according to the weight of the connection edges between the card number nodes with the fraudulent label or the shared suspicious devices.

[0033] The process for marking suspicious devices is as follows: count the number of card numbers shared by each device in the community, and mark devices with a number of shared card numbers greater than the suspicious device threshold as suspicious devices. The process for marking risky card numbers is as follows: mark card number nodes in the card number relationship graph whose edge weight between them and card number nodes labeled "fraudulent" is greater than the suspicious card number threshold as risky card numbers, and also mark all card numbers that share suspicious devices as risky card numbers. The suspicious device threshold and suspicious card number threshold can be set according to actual business needs.

[0034] Step 4: Construct a base station set for each community by including all base stations visited by all card numbers. Then, calculate the geographical distance between any two base stations in each community's base station set. Base stations whose geographical distance from each other is less than the clustering distance threshold and whose number of visited suspicious devices or risk card numbers is greater than the risk quantity threshold are grouped into a base station cluster for a fraud den. Finally, determine the location of the fraud den based on the locations of all base stations in each base station cluster. The clustering distance threshold and the risk quantity threshold can be set according to actual business needs.

[0035] Step one can leverage knowledge graph and graph database technologies to construct a multidimensional heterogeneous network containing various node and edge types, thereby providing temporal and spatial network attributes for identifying fraud dens. For example... Figure 2 As shown, Figure 1 Step one may further include:

[0036] Step 11: Define the node types and edge types of the multidimensional heterogeneous communication network graph;

[0037] Step 12: Perform entity relationship modeling, establish multiple relational data tables to store the relationships between entities, different relational data tables store different types of relationship features, and then construct a multidimensional heterogeneous communication network graph from entities and relationships. Create nodes and edges in the graph database, and map the entity and relationship information in the relational data tables to the graph. That is, each entity corresponds to a node in the graph, and the relationship between two entities corresponds to an edge in the graph.

[0038] For example, the relational data tables that are established may include the following: nbr_edge table: stores the relationship between connected card numbers (caller points to called party); id_edge table: stores the relationship between card number and ID card number (card number points to ID card number); imii_edge table: stores the relationship between card number and terminal IMEI (card number points to terminal IMEI); address_edge table: stores the relationship between card number and base station address (card number points to base station address);

[0039] Step 13: Extract the representation of different user behavior attributes and update the node attributes or edge attributes corresponding to the multidimensional heterogeneous communication network graph with different representation types. The user behavior attribute representation may further include: the user's own feature representation, the user's call time information representation, the user's call spatial information representation, and the information representation between the user's communication nodes.

[0040] Step 14: Using existing manually labeled data, label known fraudulent card number nodes as "fraudulent".

[0041] For example, collect and integrate existing manually labeled data, extract numbers from the fraud number database and user-reported numbers, extract existing voice fraud model-hit numbers from the model-hit number database, and summarize labeling information from other sources. Then, label known fraudulent card numbers, known crime base stations, or terminal devices used by fraudulent card numbers during the crime period with a "fraudulent" tag.

[0042] Step 13 may further include:

[0043] 1) Extract the user's own feature representation:

[0044] Key features of users can be extracted from the user information data table, including user subscription information, user attribute information, and user personal information. The extracted fields cover tariff amount, average monthly consumption, age, network access channel, star rating, whether it is a group user, number status, network access district / county, gender, security label, and whitelist name, etc. The extracted characteristic data is then updated in the card number node attributes.

[0045] 2) Extracting and representing the time information of user calls:

[0046] The time period can be divided into multiple levels, such as the most recent 1 day, 7 days, and 30 days, in order to capture recent changes in user behavior and compare them with historical data. User behavior characteristics can be extracted from call log data, including but not limited to call, SMS, and Internet behavior. Specific indicators extracted and calculated may include the number of outgoing calls, the percentage of outgoing calls, the dispersion of incoming calls, the percentage of outgoing calls from other provinces, the average call duration, the number of roaming calls, the percentage of roaming calls, the number of device switching times, and the dispersion of base stations. For key feature indicators, daily, weekly, and monthly calculations are performed, and the extracted representation data is updated in the card number node attributes.

[0047] 3) Extract spatial information representation of user calls:

[0048] The base station information related to the call can be extracted from the call record to obtain its corresponding geographical coordinates (latitude and longitude), including the city, region or specific address, as well as information such as base station type and coverage area. The extracted representation data can then be updated to the base station node attributes.

[0049] Based on the timestamps and base station information in the call records, a time-series geographical path and the user's call trajectory can be formed, and the extracted representation data can be updated in the LOCATED_AT geographic location relationship edge attribute;

[0050] By combining the call frequency in the call log, a threshold can be set to determine the user's frequently used call locations. Geographic information is subdivided into multi-level geographic labels, including base station level, district / county level, and city level. Based on the subdivision, the user's frequently used call base stations, districts / counties, and cities can be identified and extracted. The extracted representation data is then updated in the LOCATED_AT geographic location relationship edge attribute.

[0051] 4) Extract information representations between user-connected nodes:

[0052] Information about neighboring users who have call records with the target user can be extracted from communication records. Then, a feature vector can be created for each neighboring user, including but not limited to: call frequency (e.g., number of calls per month), call duration (e.g., average duration of each call), and call time period (e.g., call distribution during peak and off-peak hours). The extracted representation data is then updated in the CONTACT communication relationship edge attribute.

[0053] It can count the frequency of calls between the target user and all contacts, then sort the contacts according to the call frequency, identify the contacts with the highest call frequency to the target user, and set a threshold (such as the top 10% of the number of calls) to determine the core contacts, and add a "core contact" label to the card number node.

[0054] This invention can also reduce computational complexity, accelerate the training process, and enhance the model's generalization ability and robustness by extracting small-scale subgraphs, thereby achieving more efficient and flexible analysis when processing large-scale graph data. This invention can employ an attribute-based sampling method, filtering nodes or edges based on their attributes (such as type, weight, etc.) to select nodes and their connected edges that meet specific conditions (such as node degree, attribute values, etc.). First, an evaluation is conducted to determine whether to use a subgraph; evaluation strategies include, but are not limited to:

[0055] [1] Graph size assessment

[0056] Number of nodes: If the number of nodes > 10,000, consider sampling.

[0057] Number of edges: If the number of edges > 100,000, sampling is recommended.

[0058] [2] Computational resource assessment

[0059] Memory limit: Sampling is required if available memory is less than 2GB.

[0060] Computation time: If the full map analysis is expected to take >30 minutes, then sampling will be considered.

[0061] [3] Experiments and verification

[0062] Comparative experiment: Conduct a small-scale comparative experiment to ensure that the difference between the sampling results and the full image results is within an acceptable range (e.g., <10%).

[0063] Performance monitoring: Monitor runtime and memory usage after sampling to ensure significant performance improvements (e.g., reducing computation time by >50%).

[0064] Then set the sampling strategy, which includes, but is not limited to:

[0065] [1] When a user accesses multiple base stations using the same card number, conditions can be set such as the number of times the user makes a call at the base station ≥ x times, and sub-graph sampling can be performed to exclude noise information from irrelevant base stations.

[0066] [2] When a user accesses multiple base stations within a specific time window, conditions such as access time interval ≤ t minutes can be set to perform sub-map sampling, so as to focus on geographic information in a short period of time and exclude irrelevant data brought by long time intervals.

[0067] In step two, based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, the comprehensive similarity between any two card number nodes is calculated, which may further include:

[0068] Step 21: Read the attribute vector of each card number node from the multidimensional heterogeneous communication network graph, and calculate the Euclidean distance between each two card number nodes: d(A,B), where d(A,B) is the Euclidean distance between card number nodes A and B.

[0069] Step 22: Obtain the set of neighboring nodes for each card number node in the multidimensional heterogeneous communication network graph, and calculate the weighted Jaccard similarity between any two card number nodes accordingly. Among them, J weighted (A,B) is the weighted Jaccard similarity between card number nodes A and B, common(A,B) represents the intersection of the neighbor node sets of A and B (i.e., the common neighbor node set), A∪B represents the union of the neighbor node sets of A and B, i and j represent a neighbor node in common(A,B) and A∪B respectively, w i (or w) j ) is the time weight of neighbor node i (or j), which is used to indicate the similarity of the time when two card number nodes A and B and neighbor node i (or j) become associated;

[0070] Traditional Jaccard calculations only consider the "existence" of an element, neglecting other differences. However, in communication relationships, the value of a card number being analyzed differs depending on when it is associated with a neighboring node. Therefore, this invention incorporates a time factor into Jaccard calculations, using w i w j Identify the similarity in the timing of association between two card number nodes and the same neighbor node;

[0071] Step 23: Calculate the overall similarity between every two card number nodes: These are the weights for relational structure similarity and attribute similarity, respectively, which can be set according to business needs. For example, if the similarity of relational structure is considered more important, then increase the [adjustment]. If attribute similarity is considered more important, then increase the value.

[0072] In step 22, the time weight w corresponding to any neighbor node z in the neighbor node set of the two card number nodes A and B is calculated. z It can further include:

[0073] Step 221: Determine if neighbor node z is a common neighbor of card number nodes A and B. If yes, continue to the next step; otherwise, remove w. z Set to 1, and this process ends;

[0074] Step 222: Obtain the timestamp t of the association between card number nodes A and B and neighbor node z. A t B Then calculate the time difference (in minutes) between the two timestamps: Δt = |t A -t B |, where |·| represents the operation of taking the absolute value, and the time weight is determined according to Δt. If a card number node is associated with the same neighbor node at multiple time points, the maximum value is selected as the final time weight from all time weights obtained based on multiple time differences.

[0075] When performing analysis using a sliding time window, the time weights should also be updated synchronously as t changes with the time window.

[0076] In step 222, the time weight is determined based on Δt. This can be achieved through methods such as, but is not limited to, simple time segmentation or time decay functions. The specific process is as follows:

[0077] 1. Simple time segmentation method

[0078] Based on expert experience and pre-defined parameters, the corresponding time weight is obtained according to the time interval to which Δt belongs. For example, if the time difference is 0 (i.e., within the same time period), the time weight is 1; if the time difference is within 2 hours (including ±2 hours on the same day), the time weight is 0.8; if the time difference is within the same day but exceeds 2 hours, the weight is 0.6; if they are not on the same day, the time weight is 0.4; and if it has exceeded 1 week, the time weight is 0.1.

[0079] 2. Time decay function

[0080] The general-purpose time decay function is not entirely suitable for communication anti-fraud scenarios. Based on the time characteristics of communication anti-fraud, this function design needs to strengthen short-term correlations, followed by segmented and rapid decay of long-interval correlations. This decay mode can strengthen short-term correlation signals, filter long-term noise, and reduce false identification of normal user behavior. This invention, addressing the specific needs of communication anti-fraud scenarios, designs a segmented exponential decay time weight function. The formula for calculating the time weight w is as follows: Where T1, T2, and T3 represent extremely short, short, and medium time thresholds, respectively. For example, Δt≤T1 represents an extremely short time window, T1<Δt≤T2 represents a short time window, T2<Δt≤T3 represents a medium time window, and Δt>T3 represents a long time window. α, β, and γ represent the basic weights of the short, medium, and long time windows, respectively, and λ1, λ2, and λ3 represent the decay rates of the short, medium, and long time windows, respectively. The suggested values ​​for the above parameters are as follows: T1 = 15 minutes, T2 = 60 minutes, T3 = 360 minutes, α = 0.8, β = 0.3, γ = 0.05, λ1 = 0.2, λ2 = 0.1, and λ3 = 0.3.

[0081] Furthermore, this invention also considers the differences in time sensitivity among different entity types. Device sharing typically has strong time sensitivity, allowing for the setting of shorter time thresholds and faster attenuation rates. Base stations, with their larger coverage areas and relatively lower time accuracy requirements, can be configured with longer time thresholds and slower attenuation rates. Therefore, the corresponding weights can also be differentiated, with specific parameters adjusted according to the actual business scenario, which will not be elaborated here.

[0082] This invention creates a weighted card number relationship graph in step two, and applies graph clustering technology in step three to identify risky individuals and analyze community groups within the graph, thereby uncovering potential fraud gangs and high-risk individuals, and accurately locating the hideouts of fraudulent activities. Graph clustering algorithms divide nodes in a graph into multiple clusters or communities by analyzing the connections between nodes. Compared to traditional clustering algorithms, it can flexibly handle various types of data, naturally capture complex structures, does not require pre-specifying the number of clusters, and has better robustness to noise and outliers, making the results easier to interpret. This invention can use the Weakly Connected Components (WCC) algorithm for community identification and use the obtained community ID as a new attribute for the card number nodes.

[0083] Step four also involves establishing a fraud location monitoring database based on the identified fraud den locations. This database is used not only to combat confirmed fraud dens but also to quickly identify unknown risk individuals visiting these dens. The database can include the following data categories to facilitate comprehensive monitoring and analysis of risk individuals' activities: Base Station ID: A unique identifier for each base station; Den Location: The geographical coordinates (latitude and longitude) of the confirmed den; Coverage Area: The signal coverage area of ​​the base station and its radius; Base Station Type: For example, different types of base stations such as 2G, 3G, 4G, and 5G; Risk Level: The assessed risk level, subdivided into high-risk, medium-risk, and low-risk levels; Risk Number: A list of risk numbers that visited the den; Community ID: A unique identifier for each community; Verification Result: Records of verification results for the numbers that triggered the monitoring; Processing Records: Records of actions taken against confirmed fraud dens and subsequent processing.

[0084] For locations identified as fraudulent activity sites, daily monitoring of visiting phone numbers will be implemented. Once a number matching specific characteristics is detected, a notification and verification instruction will be immediately sent to ensure timely response and handling of potential risks. For example, monitoring rules could be formulated as follows:

[0085] (1) Numbers with abnormal call behavior: This focuses on numbers that are engaged in fraudulent activities near the location of the fraud operation. Common characteristics include: call frequency >= x in the past hour, percentage of calls to other provinces >= y, and geographical dispersion of the other party's number >= z. Rules can be formulated based on actual circumstances. Here, we suggest the following values: x = 7, y = 0.85, z = 0.85.

[0086] (2) Numbers discovered in this way can be marked as suspected fraud numbers and audited; for the other party numbers with more than 2 calls and a total call duration of more than 120 seconds, a suspected victim alert can be issued.

[0087] (3) For numbers, dens, and gangs that have been audited but have not yet yielded clear results, they will be subject to real-time monitoring as key targets.

[0088] like Figure 3 As shown, the present invention provides a fraud den identification system combining knowledge graphs and graph clustering, comprising:

[0089] A multidimensional heterogeneous network construction device is used to construct a multidimensional heterogeneous communication network graph based on entities and relationships in a communication network. The multidimensional heterogeneous communication network graph consists of various types of nodes and edges. Node types may include: card number, ID card number, base station address, and terminal IMEI. Edge types may include: CONTACT (connecting different card number nodes); IS_SIGNED_BY (connecting ID card number nodes and card number nodes); LOCATED_AT (connecting card number nodes and base station address nodes); and USE_IMEI (connecting card number nodes and terminal IMEI nodes).

[0090] A card number relationship graph construction device is used to calculate the comprehensive similarity between every two card number nodes based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, and then construct a card number relationship graph based on the comprehensive similarity. The card number relationship graph includes all card number nodes in the multidimensional heterogeneous communication network graph. When the comprehensive similarity between two card number nodes is greater than the similarity threshold, a connection edge is created between the corresponding two card number nodes in the card number relationship graph, and the weight of the connection edge is the comprehensive similarity between the two card number nodes.

[0091] The community identification device uses a graph clustering algorithm to cluster all card number nodes in the card number relationship graph to generate multiple communities, and then determines whether there are card number nodes with fraud-related labels in each community. If so, it marks suspicious devices based on the number of card numbers shared by devices in the community, and marks risky card numbers based on the weight of the connection edges between the card number nodes with fraud-related labels or the sharing of suspicious devices.

[0092] The location detection device is used to form a base station set for each community by identifying all base stations visited by all card numbers in each community. Then, it calculates the geographical distance between every two base stations in each community's base station set. Base stations whose geographical distance from each other is less than the clustering distance threshold and whose number of suspicious devices or risk card numbers visited is greater than the risk quantity threshold are grouped into a base station cluster for the fraud den. Finally, the location of the fraud den is determined based on the location of all base stations in each base station cluster.

[0093] See Figure 4 , Figure 4 This is a structural block diagram of a computing device 400 illustrated in an exemplary embodiment of this specification. The components of the computing device 400 include, but are not limited to, a memory 410 and a processor 420. The processor 420 is connected to the memory 410 via a bus 430, and a database 450 is used to store data.

[0094] The computing device 400 also includes an access device 440, which enables the computing device 400 to communicate via one or more networks 460. Examples of these networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 440 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 402.11 Wireless Local Area Network (WLAN) interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0095] In one embodiment of this specification, the aforementioned components of the computing device 400 and Figure 4 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 4 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0096] The computing device 400 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. The computing device 400 can also be a mobile or stationary server or cloud server, etc.

[0097] The processor 420 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-described method for identifying fraud dens by combining knowledge graphs and graph clustering.

[0098] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device belongs to the same concept as the technical solution of the fraud den identification method combining knowledge graph and graph clustering described above. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the fraud den identification method combining knowledge graph and graph clustering described above.

[0099] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described method for identifying fraud dens combining knowledge graphs and graph clustering.

[0100] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the above-described method for identifying fraud dens combining knowledge graphs and graph clustering. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the above-described method or system for identifying fraud dens combining knowledge graphs and graph clustering.

[0101] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described method for identifying fraud dens combining knowledge graphs and graph clustering.

[0102] The above is an illustrative example of a computer program in this embodiment. It should be noted that the technical solution of this computer program belongs to the same concept as the technical solution of the above-described method for identifying fraud dens combining knowledge graphs and graph clustering. Details not described in detail in the computer program's technical solution can be found in the description of the above-described method or system for identifying fraud dens combining knowledge graphs and graph clustering.

[0103] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0104] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0105] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying fraud dens combining knowledge graphs and graph clustering, characterized in that, Including: Step 1: Based on the entities and relationships in the communication network, construct a multi-dimensional heterogeneous communication network graph. The multi-dimensional heterogeneous communication network graph consists of various types of nodes and edges. Node types include: card number, ID card number, base station address, and terminal IMEI. Edge types include: CONTACT communication relationship; IS_SIGNED_BY contract relationship; LOCATED_AT geographical location relationship; USE_IMEI terminal relationship. Step 2: Based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, calculate the comprehensive similarity between every two card number nodes. Then, construct a card number relationship graph based on the comprehensive similarity. The card number relationship graph includes all card number nodes in the multidimensional heterogeneous communication network graph. When the comprehensive similarity between two card number nodes is greater than the similarity threshold, create a connection edge between the corresponding two card number nodes in the card number relationship graph. The weight of the connection edge is the comprehensive similarity between the two card number nodes. Step 3: Using a graph clustering algorithm, cluster all card number nodes in the card number relationship graph to generate multiple communities, and determine whether there are card number nodes with fraud-related labels in each community. If so, mark suspicious devices according to the number of card numbers shared by devices in the community, and mark risky card numbers according to the weight of the connection edges between the card number nodes with fraud-related labels or the shared suspicious devices. Step 4: Construct a base station set for each community by including all base stations visited by all card numbers. Then, calculate the geographical distance between any two base stations in each community's base station set. Base stations whose geographical distance from each other is less than the cluster distance threshold and whose number of suspicious devices or risk card numbers visited is greater than the risk quantity threshold are grouped into a base station cluster for a fraud den. Finally, determine the location of the fraud den based on the locations of all base stations in each base station cluster.

2. The method according to claim 1, characterized in that, Step one further includes: Step 11: Define the node types and edge types of the multidimensional heterogeneous communication network graph; Step 12: Perform entity relationship modeling, establish multiple relational data tables to store the relationships between entities, different relational data tables store different types of relationship features, and then construct a multidimensional heterogeneous communication network graph from entities and relationships. Create nodes and edges in the graph database, and map the entity and relationship information in the relational data tables to the graph. That is, each entity corresponds to a node in the graph, and the relationship between two entities corresponds to an edge in the graph. Step 13: Extract the representations of different user behavior attributes and update the node attributes or edge attributes corresponding to the multidimensional heterogeneous communication network graph with different representation types; Step 14: Using existing manually labeled data, label known fraudulent card number nodes with fraudulent tags.

3. The method according to claim 2, characterized in that, Step 13 further includes: 1) Extract the user's own feature representation: Extract the user's own characteristics from the user information data table, and update the extracted characteristic data into the card number node attribute; 2) Extracting and representing the time information of user calls: The time period is divided into multiple levels, user behavior characteristics are extracted from call log data, and the extracted representation data is updated in the card number node attribute. 3) Extract spatial information representation of user calls: Extract call-related base station information from call records, obtain their corresponding geographical coordinates, and update the extracted representation data into the base station node attributes. Based on the timestamps and base station information in the call records, a time-series geographical path and the user's call trajectory are formed, and the extracted representation data is updated in the LOCATED_AT geographic location relationship edge attribute. By combining the call frequency in the call logs, a threshold is set to determine the user's frequently used call locations. Geographic information is divided into multi-level geographic labels, and the user's frequently used call base stations, districts, counties, and cities are identified and extracted. The extracted representation data is then updated in the LOCATED_AT geographic location relationship edge attribute. 4) Extract information representations between user-connected nodes: Extract information about neighboring users who have call records with the target user from the communication records, then create a feature vector for each neighboring user, and update the extracted representation data into the CONTACT communication relationship edge attribute; The system counts the frequency of calls between the target user and all contacts, sorts the contacts according to the call frequency, identifies the contact with the highest call frequency to the target user, sets a threshold to determine the core contacts, and adds a core contact tag to the card number node.

4. The method according to claim 1, characterized in that, In step two, based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, the comprehensive similarity between any two card number nodes is calculated, which further includes: Step 21: Read the attribute vector of each card number node from the multidimensional heterogeneous communication network graph, and calculate the Euclidean distance between each two card number nodes: d(A,B), where d(A,B) is the Euclidean distance between card number nodes A and B. Step 22: Obtain the set of neighboring nodes for each card number node in the multidimensional heterogeneous communication network graph, and calculate the weighted Jaccard similarity between any two card number nodes accordingly. Among them, J weighted (A,B) is the weighted Jaccard similarity between card number nodes A and B, common(A,B) represents the intersection of the neighbor sets of A and B, A∪B represents the union of the neighbor sets of A and B, i and j represent a neighbor node in common(A,B) and A∪B respectively, w i or w j It is the time weight of neighbor node i or j, used to indicate the similarity of the time when two card number nodes A and B and neighbor node i or j become associated; Step 23: Calculate the overall similarity between every two card number nodes: These are the weights for relational structure similarity and attribute similarity, respectively.

5. The method according to claim 4, characterized in that, In step 22, the time weight w corresponding to one of the neighbor nodes z in the neighbor node set of the two card number nodes A and B is calculated. z Further including: Step 221: Determine if neighbor node z is a common neighbor of card number nodes A and B. If yes, continue to the next step; otherwise, remove w. z Set to 1, and this process ends; Step 222: Obtain the timestamp t of the association between card number nodes A and B and neighbor node z. A t B Then calculate the time difference between the two timestamps: Δt = |t A -t B |, where |·| represents the operation of taking the absolute value, and the time weight is determined according to Δt. If a card number node is associated with the same neighbor node at multiple time points, the maximum value is selected as the final time weight from all time weights obtained based on multiple time differences.

6. The method according to claim 5, characterized in that, In step 222, the time weight is determined based on Δt. When a simple time segmentation method is adopted, this further includes: Based on expert experience and pre-defined parameters, the corresponding time weight is obtained according to the time interval to which Δt belongs. When using a time decay function, the time weight w is calculated using the following formula: Where T1, T2, and T3 represent extremely short, short, and medium time thresholds, respectively; α, β, and γ represent the basic weights of short, medium, and long time windows, respectively; and λ1, λ2, and λ3 represent the decay rates of short, medium, and long time windows, respectively.

7. The method according to claim 1, characterized in that, In step three, the process of marking suspicious devices is as follows: count the number of card numbers shared by each device in the community, and mark devices with a number of shared card numbers greater than the suspicious device threshold as suspicious devices. The process of marking risk card numbers is as follows: mark card number nodes in the card number relationship graph whose edge weight between them and card number nodes with fraudulent tags is greater than the suspicious card number threshold as risk card numbers, and mark all card numbers that share suspicious devices as risk card numbers.

8. The method according to claim 1, characterized in that, Step four also includes: A fraud den location monitoring database is established based on the identified locations of fraud dens. The database includes the following types of data: Base station ID: a unique identifier for each base station; Den location: the geographical coordinates of the confirmed dens; Coverage area: the signal coverage area of ​​the base station and its radius. Base station type; Risk level: Assessed risk level; Risk Numbers: A list of risky phone numbers that have visited this location; Community ID: A unique identifier for each community; Verification Result: A record of the verification results for the numbers that triggered monitoring; Processing Record: Records of crackdowns and follow-up actions on confirmed locations. For locations identified as fraud dens, daily monitoring of the behavioral characteristics of visiting phone numbers will be implemented.

9. A fraud den identification system combining knowledge graphs and graph clustering, characterized in that, Including: A multidimensional heterogeneous network construction device is used to construct a multidimensional heterogeneous communication network graph based on entities and relationships in a communication network. The multidimensional heterogeneous communication network graph consists of various types of nodes and edges. Node types include: card number, ID card number, base station address, and terminal IMEI. Edge types include: CONTACT communication relationship; IS_SIGNED_BY contract relationship. LOCATED_AT is related to geographical location; USE_IMEI is related to the terminal used. A card number relationship graph construction device is used to calculate the comprehensive similarity between every two card number nodes based on the attribute vector of each node in the multidimensional heterogeneous communication network graph and its set of neighboring nodes, and then construct a card number relationship graph based on the comprehensive similarity. The card number relationship graph includes all card number nodes in the multidimensional heterogeneous communication network graph. When the comprehensive similarity between two card number nodes is greater than the similarity threshold, a connection edge is created between the corresponding two card number nodes in the card number relationship graph, and the weight of the connection edge is the comprehensive similarity between the two card number nodes. The community identification device uses a graph clustering algorithm to cluster all card number nodes in the card number relationship graph to generate multiple communities. It then determines whether there are card number nodes with fraud-related labels in each community. If so, it marks suspicious devices based on the number of card numbers shared by devices in the community, and marks risky card numbers based on the weight of the connection edges between the card number nodes with fraud-related labels or the shared suspicious devices. The location detection device is used to form a base station set for each community by identifying all base stations visited by all card numbers in each community. Then, it calculates the geographical distance between every two base stations in each community's base station set. Base stations whose geographical distance from each other is less than the clustering distance threshold and whose number of suspicious devices or risk card numbers visited is greater than the risk quantity threshold are grouped into a base station cluster for the fraud den. Finally, the location of the fraud den is determined based on the location of all base stations in each base station cluster.

10. A computing device, characterized in that, include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the fraud den identification method combining knowledge graph and graph clustering as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, It stores computer-executable instructions, which, when executed by a processor, implement the steps of the fraud den identification method combining knowledge graph and graph clustering as described in any one of claims 1-8.

Images