Abnormal call detection method, electronic equipment and storage medium

Abstract

The invention discloses an abnormal call detection method, electronic equipment and a storage medium, which are applied to the technical field of communication, and the specific scheme is as follows: when a call request message is received, obtaining historical communication information of a call number corresponding to the call request message within a historical preset duration; analyzing the historical communication information according to the at least one service dimension, and determining at least one piece of service feature information of the call number under each service dimension and dimension weight information corresponding to each piece of service feature information; determining target business feature information and target weight information according to at least one piece of business feature information and dimension weight information under each business dimension; and when it is detected that the target weight information exceeds a preset weight threshold, determining that the call number is an abnormal number and intercepting the call request message. According to the invention, the detection of the calling number is realized, and the communication security is ensured.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an abnormal call detection method, electronic device, and storage medium. Background Technology

[0002] With the development of technology, 5G new voice services, leveraging artificial intelligence, have upgraded traditional voice calls based on the IP Multimedia Subsystem (IMS) to a comprehensive communication method integrating sound, images, and multimedia information. While 5G new voice services bring convenience to people's communication, the detection of abnormal numbers or calls is also crucial to ensure communication security.

[0003] Currently, the detection of abnormal numbers mainly involves identifying the network address (Internet Protocol, IP) of the caller number upon receiving a call request to determine if it is abnormal. However, with technological advancements, IP addresses can be spoofed, leading to inaccurate caller number detection and further compromising communication security. Summary of the Invention

[0004] This invention provides an abnormal call detection method, electronic device, and storage medium, which realizes the detection of call numbers and ensures the security of communication.

[0005] According to one aspect of the present invention, an abnormal call detection method is provided, the method comprising:

[0006] Upon receiving a call request message, retrieve the historical communication information of the call number corresponding to the call request message within a preset historical time period;

[0007] Based on at least one business dimension, historical communication information is analyzed to determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information; wherein, at least one business dimension includes at least one of the following: call frequency dimension, call type dimension, region dimension, and number association dimension of the call number, and the dimension weight information is used to characterize the importance of the business feature information under the business dimension.

[0008] Based on at least one business feature information and dimension weight information under each business dimension, target business feature information and target weight information are determined; wherein, target business feature information is feature information among at least one business feature information under at least one business dimension, and target weight information is used to characterize the importance of target business feature information relative to each business feature information of at least one business dimension;

[0009] If the target weight information is detected to exceed the preset weight threshold, the calling number is identified as an abnormal number and the call request message is intercepted.

[0010] According to another aspect of the present invention, an abnormal call detection device is provided, the device comprising:

[0011] The communication information determination module is used to obtain the historical communication information of the call number corresponding to the call request message within a preset historical time period when a call request message is received;

[0012] The communication information analysis module is used to analyze historical communication information based on at least one business dimension, and determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information; wherein, at least one business dimension includes at least one of the following: call frequency dimension, call type dimension, region dimension, and number association dimension, and the dimension weight information is used to characterize the importance of the business feature information under the business dimension.

[0013] The weight information determination module is used to determine the target business feature information and the target weight information based on at least one business feature information and dimension weight information under each business dimension; wherein, the target business feature information is the feature information in at least one business feature information under at least one business dimension, and the target weight information is used to characterize the importance of the target business feature information relative to each business feature information of at least one business dimension;

[0014] The number detection module is used to determine that the calling number is an abnormal number and to intercept the call request message when the target weight information exceeds a preset weight threshold.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory that is communicatively connected to at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the abnormal call detection method of any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the abnormal call detection method of any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, characterized in that the computer program, when executed by a processor, implements an abnormal call detection method as described in any embodiment of the present invention.

[0021] The technical solution of this invention, upon receiving a call request message, acquires historical communication information of the call number corresponding to the call request message within a preset historical time period. Based on at least one business dimension, the historical communication information is analyzed to determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information. This determines the degree of influence of each business feature information of the call number on determining that the call number is an abnormal number. Based on at least one business feature information and dimension weight information under each business dimension, a comprehensive weight for determining that each business feature information is an abnormal number is determined. The business feature information with the highest comprehensive weight is used as the target business feature information, and the highest comprehensive weight is used as the target weight information. When the target weight information exceeds a preset weight threshold, the call number is determined to be an abnormal number and the call number is intercepted. Based on this, accurate identification of abnormal call numbers and interception of call request messages are achieved from the access layer dimension. This solves the problems of inaccurate detection and poor interception reliability caused by interception based solely on IP addresses in existing technologies, improves the accuracy of abnormal number detection, ensures the accuracy of intercepting abnormal number call request messages, and enhances communication security.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of an abnormal call detection method provided in an embodiment of the present invention;

[0025] Figure 2 This is an example diagram of the hierarchical architecture of the access layer provided in an embodiment of the present invention;

[0026] Figure 3 This is an example diagram of a hierarchical model corresponding to a business dimension provided in an embodiment of the present invention;

[0027] Figure 4 This is a flowchart of an abnormal call detection method provided in an embodiment of the present invention;

[0028] Figure 5 This is an example diagram illustrating the use of temporary key information to detect anomalies in call numbers, as provided in this embodiment of the invention.

[0029] Figure 6 This is an architecture diagram corresponding to the 5G new voice service provided in the embodiments of the present invention;

[0030] Figure 7 This is an example diagram illustrating the interception effect before application, provided in an embodiment of the present invention.

[0031] Figure 8 This is an example diagram showing the interception effect after application provided in the embodiments of the present invention;

[0032] Figure 9 This is a schematic diagram of the structure of an abnormal call detection device provided in an embodiment of the present invention;

[0033] Figure 10 This is a schematic diagram of the structure of an electronic device that implements the abnormal call detection method of this invention. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0035] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in this invention are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0036] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] Before introducing the embodiments of the present invention, the application scenarios can be described first. The technical solutions provided by the embodiments of the present invention can be applied to 5G new voice services to solve the problem of low success rate of abnormal number interception due to video traffic characteristics when communicating based on 5G new voice services. Specifically, the principle of 5G new voice is to add an IMS data channel (IMS Data Channel, IMS DC) on top of the VoNR (VoiceNew Radio, 5G voice) audio and video channel, using a new encoding technology and transmission protocol. VoNR audio, video, and other multimedia data are transmitted rapidly on the DC channel, improving real-time interactivity while achieving high-definition audio and video calls.

[0038] Existing methods for blocking abnormal numbers primarily occur in IP Multimedia Subsystem (IMS) networks, intercepting calls based on the IP address of the call request message. However, with technological advancements, these methods suffer from low accuracy. Therefore, a method is needed to determine whether to block a call number based on historical call data at the IMS network data channel side, thereby improving the success rate of interception at the IMS network data stream side.

[0039] Example 1

[0040] Figure 1 This is a flowchart of an abnormal call detection method provided in Embodiment 1 of the present invention. This embodiment is applicable to detecting the number to which a call request message belongs when accessing an IP Multimedia Subsystem (IMS) is located, in order to determine whether to block or allow the call request message corresponding to that call number. This method can be executed by an abnormal call detection device, which can be implemented in hardware and / or software, and can be configured in electronic devices such as mobile phones, computers, or servers. Figure 1 As shown, the method includes:

[0041] S110. Upon receiving a call request message, obtain the historical communication information of the call number corresponding to the call request message within a preset historical time period.

[0042] The call request message can be a control signaling sent by a user equipment to initiate, establish, or manage sessions (such as voice, video, data transmission, etc.). The calling number can be the telephone number corresponding to the user equipment initiating the call request message. The historical preset duration can be a pre-set time period. For example, the historical preset duration can be the past month. Historical communication information can be used to characterize the communication (call) status of the calling number within the historical preset duration. For example, historical communication information can include the calling frequency of the calling number in the past month, the duration of each call, the frequency of IP address switching, etc.

[0043] It should be noted that the embodiments of the present invention identify and process call numbers and call request messages sequentially from three aspects: the access layer, control plane network elements, and the user plane and media stream. The access layer is responsible for the physical / logical connection between the user equipment and the IMS core network to ensure reliable transmission of signaling and media streams corresponding to the call request message. For example, the hierarchical architecture of the access layer can be as follows: Figure 2 As shown, the process of obtaining historical communication information described above is mainly handled by the access layer.

[0044] Specifically, when a call request message arrives at the access layer, the message is parsed to determine the corresponding call number. Using the call number as an index, historical communication information corresponding to that call number within a preset time period is retrieved. Based on this historical communication information, it is determined whether the call number is an abnormal number.

[0045] S120. Based on at least one business dimension, analyze historical communication information to determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information.

[0046] At least one business dimension includes at least one of the following: call frequency dimension, call type dimension, region dimension, and number association dimension. The business characteristic information under the call frequency dimension can be used to characterize the call frequency of the call number within a historical preset duration. Optionally, the business characteristic information under the call frequency dimension can be divided into three types: high frequency, low frequency, and regular. High frequency characterizes a relatively high call frequency for the call number. Correspondingly, low frequency characterizes a relatively low call frequency for the call number. Regular communication characterizes regular communication for the call number. Optionally, at least one communication frequency range can be set, corresponding to one of the high frequency, regular, or low frequency business characteristic information. When the number of communication transactions of the call number within the historical preset duration falls within the corresponding communication frequency range, determining the business characteristic information corresponding to that communication frequency range allows us to determine whether the call frequency of the call number is high frequency, low frequency, or regular. For example, if the historical preset duration is the past month, the communication frequency range corresponding to high frequency is 100 to 200 times, the communication frequency range corresponding to regular communication is 50 to 100 times, and the communication frequency range corresponding to low frequency is 0 to 50 times. If a calling number has been contacted 25 times in the past month, then the call frequency corresponding to that calling number is determined to be low frequency.

[0047] The service characteristic information under the call type dimension can be used to characterize the call type of a called number within a historical preset time period. Optionally, the service characteristic information under the call type dimension can be divided into two types: ordinary voice calls and international long-distance calls. Optionally, each historical call request message corresponding to a called number in the historical communication information can be analyzed to determine the number prefix information of the called number corresponding to each historical call request message, so as to determine whether the service characteristic information under the call type dimension is an ordinary voice call or an international long-distance call based on the number prefix information.

[0048] Service characteristic information at the region level can be used to characterize changes in the IP address corresponding to the calling number. Optionally, service characteristic information at the region level can be divided into three types: frequent IP address switching, IP address conflict, and IP address blocking. Frequent IP address switching can be understood as the IP address used by the user equipment to which the calling number belongs changing multiple times in a short period of time, for example, changing every few minutes. IP address conflict can be understood as the IP address corresponding to the user equipment to which the calling number belongs being the same as that of other user equipment on the same network, leading to communication abnormalities. IP address blocking can occur when the IP address used by the user equipment to which the calling number belongs belongs to a specific blocked IP address or IP range.

[0049] Business characteristic information under the number association dimension can be used to characterize the association between a calling number and other called numbers in historical communication information. Optionally, business characteristic information under the number association dimension can be divided into four types: social association, business association, geographic location association, and behavioral pattern association. Among them, social association can be used to characterize whether the user of the calling number and the user of other called numbers have a direct or indirect social relationship. Business association can be used to characterize whether the user of the calling number and the user of other called numbers are connected due to specific business needs. Geographic location association can be used to characterize whether the calling number and other called numbers are geographically close. Behavioral pattern association can be used to characterize the association between the calling number and other called numbers in terms of communication habits, consumption patterns, etc.

[0050] Dimension weight information is used to characterize the importance of a caller's business characteristic information within its respective business dimension. In other words, dimensional weight information characterizes the degree of influence of business characteristic information on determining whether a caller is an abnormal number. For example, see... Figure 3 , Figure 3 This is a pre-defined hierarchical model corresponding to business dimensions. The first level of the hierarchical model is the business dimension, and the second level is the business feature information associated with the business dimension. Taking social association as an example, the influence of social association on determining whether a call number is an abnormal number can be determined based on the historical communication information corresponding to this business feature, i.e., the dimension weight information is obtained. For example, in the number association dimension, if the dimension weight information of the call number under the business feature of social association is determined to be 0.3 and the dimension weight information under the business feature of business association is determined to be 0.5 based on historical communication information, it indicates that the business feature of business association has a greater influence on determining whether a call number is an abnormal number.

[0051] Specifically, based on at least one business dimension, historical communication information is analyzed to determine at least one business feature information corresponding to the call number under the call frequency dimension, at least one business feature information corresponding to the call type dimension, at least one business feature information corresponding to the region dimension, and at least one business feature information corresponding to the number association dimension. Based on the historical communication information under the corresponding business feature information, dimension weight information matching the business feature information is determined.

[0052] S130. Determine the target business feature information and target weight information based on at least one business feature information and dimension weight information under each business dimension.

[0053] The target business feature information refers to the feature information from at least one business feature information under at least one business dimension. For example, see... Figure 3 The target service feature information can be key service feature information determined from all service feature information corresponding to the call number. Optionally, the determination of the target service feature information is related to the target weight information. The target weight information is used to characterize the importance of the target service feature information relative to each service feature information in at least one service dimension. In other words, the target weight information can be used to characterize the importance of the target service feature information relative to all service feature information in determining that the call number is an abnormal number.

[0054] Specifically, based on at least one business feature information corresponding to the call number under each business dimension, and the dimension weight information corresponding to each business feature information, the dimension weight information is processed using the feature vector method to quantify the weight priority information of the current business feature information relative to other business feature information under the same business dimension. Based on the weight priority information corresponding to the same business dimension, the comprehensive weight of each business feature information relative to all business feature information under all business dimensions is evaluated, and the business feature information with the highest comprehensive weight is selected as the target business feature information, with the highest comprehensive weight used as the target weight information.

[0055] In this embodiment of the invention, the method for determining the target business feature information and the target weight information corresponding to the target business feature information may be as follows: Based on at least one business feature information and the corresponding dimension weight information under each business dimension, a pairwise comparison matrix corresponding to the business dimension is determined; wherein, the elements in the pairwise comparison matrix are used to characterize the relative importance between different business feature information under the same business dimension; for each business dimension, the pairwise comparison matrix is ​​processed to determine the maximum eigenvalue and the eigenvector corresponding to the maximum eigenvalue; if the consistency test result of the maximum eigenvalue is passed, the eigenvectors corresponding to each business dimension are integrated to obtain the target matrix; principal component analysis is performed on the target matrix to determine the global weight information corresponding to each business feature information; wherein, the global weight information is used to characterize the importance of the business feature information relative to each business feature information of at least one business dimension; based on the global weight information, the target business feature information and the target weight information are determined; wherein, the target weight information is the weight information in the global weight information.

[0056] In this pairwise comparison matrix, the elements represent the relative importance of different business feature information within the same business dimension. In other words, the pairwise comparison matrix quantifies the relative importance of the current business feature information relative to other business feature information within the same business dimension; that is, relative importance corresponds to the weighting priority information mentioned above. Optionally, the elements in the pairwise comparison matrix... It can be determined in the following ways.

[0057] ;

[0058] For example, see Figure 3 , This can be understood as the relative importance of business-related information (business association) to business-related information (social association).

[0059] The largest eigenvalue and its corresponding eigenvector can be obtained by processing the pairwise comparison matrix using the eigenvalue method or the power method. To ensure the accuracy of the obtained largest eigenvalue and eigenvector, a consistency check can be performed on the largest eigenvalue. Optionally, this check can be performed using a consistency index (CI), a random consistency index (RI), or a consistency ratio (CR). The consistency index measures the degree of deviation in the pairwise comparison matrix and can be determined using the following formula.

[0060] ;

[0061] in, This represents the largest eigenvalue corresponding to the pairwise comparison matrix. This indicates the order of the pairwise comparison matrix. It should be noted that... This indicates that there is no deviation. This indicates the existence of some deviation. The random consistency index can be used to eliminate the influence of the pairwise comparison matrix on the consistency index verification results. The consistency ratio is used to combine the consistency index CI and the random consistency index RI to obtain an acceptable consistency threshold. Optionally, the consistency ratio can be determined by the following formula:

[0062] ;

[0063] in, If the consistency of the pairwise comparison matrices is acceptable, then the consistency test result is "verification passed". If the consistency of the pairwise comparison matrices is unacceptable, then the consistency test result will be "failed".

[0064] The target matrix can be determined by normalizing and merging the feature vectors corresponding to each business dimension. Principal component analysis is used to reduce the dimensionality of the target matrix to determine the global weight information corresponding to each business feature information under each business dimension. The global weight information is used to characterize the importance of the business feature information relative to the business feature information of at least one business dimension. That is, the global weight information is used to characterize the degree of influence of the business feature information relative to all business feature information under all business dimensions on determining that the call number is an abnormal number. For example, see Figure 3 Taking business association as an example, the global weight information of business association is used to characterize the degree of influence of business association on determining whether a call number is an abnormal number relative to all business feature information under the four business dimensions. Optionally, the global weight information can be represented by a numerical value. That is, the global weight information corresponding to the largest value is taken as the target weight information, and the business feature information corresponding to the target weight information is taken as the target business feature information.

[0065] Specifically, based on at least one business feature information corresponding to the call number under each business dimension and the dimension weight information corresponding to each business feature information, a pairwise comparison matrix corresponding to the business dimension is constructed. The pairwise comparison matrix corresponding to each business dimension is iteratively calculated using the eigenvalue method or the power method to obtain the maximum eigenvalue and the corresponding eigenvector.

[0066] Consistency is verified for the largest eigenvalue of each business dimension based on consistency indices, random consistency indices, and the consistency ratio (CR), yielding a consistency verification result. If the consistency verification passes, the eigenvectors for each dimension are normalized to obtain normalized eigenvectors. These normalized eigenvectors for all business dimensions are then integrated to obtain the target matrix. Principal component analysis (PCA) is performed on the target matrix to determine the global weight information corresponding to each business feature. The global weight information with the largest value is used as the target weight information, and the business feature information corresponding to the target weight information is used as the target business feature information.

[0067] S140. If the target weight information is detected to exceed the preset weight threshold, the calling number is determined to be an abnormal number and the call request message is intercepted.

[0068] The preset weight threshold can be a pre-set weight standard value.

[0069] Specifically, when the target weight information corresponding to the call number is detected to exceed the preset weight threshold, the call number is determined to be an abnormal number, and the call request message is intercepted to achieve the interception of the call request message at the access layer.

[0070] The technical solution of this embodiment obtains historical communication information of the call number corresponding to the call request message within a preset historical time period upon receiving the call request message. Based on at least one business dimension, the historical communication information is analyzed to determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information. This determines the degree of influence of each business feature information of the call number on determining that the call number is an abnormal number. Based on at least one business feature information and dimension weight information under each business dimension, a comprehensive weight for determining that each business feature information is an abnormal number is determined. The business feature information with the highest comprehensive weight is used as the target business feature information, and the highest comprehensive weight is used as the target weight information. When the target weight information exceeds a preset weight threshold, the call number is determined to be an abnormal number and the call number is intercepted. Based on this, accurate identification of abnormal call numbers and interception of call request messages are achieved from the access layer dimension. This solves the problems of inaccurate detection and poor interception reliability caused by interception based solely on IP addresses in existing technologies, improves the accuracy of abnormal number detection, ensures the accuracy of interception of abnormal number call request messages, and enhances communication security.

[0071] Example 2

[0072] Figure 4 This is a flowchart of an abnormal call detection method provided in Embodiment 2 of the present invention. This embodiment is a preferred embodiment of the above embodiments. For specific implementation details, please refer to the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here. Figure 4 As shown, the method includes:

[0073] S210. Upon receiving a call request message, obtain the historical communication information of the call number corresponding to the call request message within a preset historical time period.

[0074] S220. Based on at least one business dimension, analyze historical communication information to determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information.

[0075] Among them, at least one business dimension includes at least one of the following: call frequency dimension of the calling number, call type dimension, region dimension, and number association dimension. The dimension weight information is used to characterize the importance of business feature information under the corresponding business dimension.

[0076] S230. Determine the target business feature information and target weight information based on at least one business feature information and dimension weight information under each business dimension.

[0077] Among them, the target business feature information is the feature information in at least one business feature information under at least one business dimension, and the target weight information is used to characterize the importance of the target business feature information relative to each business feature information in at least one business dimension.

[0078] It should be noted that this embodiment of the invention identifies and processes the call number and call request message sequentially from three aspects: the access layer, control plane network elements, and the user plane and media stream. The control plane network elements are responsible for establishing, modifying, releasing, and triggering service logic for sessions. If, based on the access layer, the target weight information exceeds a preset weight threshold, the call request message can be intercepted at the access layer. If the target weight information does not exceed the preset weight threshold, the call request message can be processed based on the control plane network elements to determine whether to intercept it. This can be achieved through the following steps.

[0079] S240. If the target weight information is detected to be less than the preset weight threshold, determine the temporary key information corresponding to the call request message.

[0080] The temporary key information is related to the timestamp and random number corresponding to the call request message. The timestamp can be the moment when the target weight information corresponding to the call request message does not exceed a preset weight threshold. The random number can be a random value generated based on a shift register. In the service scenario of 5G new calls, the random number corresponding to the call request message can be generated based on a linear feedback shift register during the two transmission processes of DC Stream (data stream) and RTP Stream (audio / video data stream). The temporary key information can be key information generated based on the timestamp and the random number. The temporary key information is used for code insertion interception processing of abnormal numbers.

[0081] Specifically, when the target weight information is detected to be less than the preset weight threshold, the timestamp and random number corresponding to the call request message are determined, and temporary key information is generated based on the timestamp and random number.

[0082] In this embodiment of the invention, the temporary key information can be determined as follows: when the target weight information is detected to be less than the preset weight threshold, a first timestamp is determined; a random number corresponding to the call request message is generated based on a linear feedback shift register; the first timestamp and the random number are substituted into the key generation function to determine the temporary key information corresponding to the call request message.

[0083] The first timestamp can be the moment when the target weight information is determined not to exceed a preset weight threshold. The linear feedback shift register (LFSR) is a pseudo-random number generator used to generate periodic binary sequences based on shift operations and linear feedback logic. The key generation function can be a pre-set function used to determine temporary key information.

[0084] Specifically, when the target weight information is detected to be less than the preset weight threshold, the first timestamp corresponding to the current time is determined. A random number corresponding to the call request message is generated based on a linear feedback shift register. The first timestamp and the random number are then substituted into the key generation function to obtain the temporary key information.

[0085] Optionally, when the target weight information is detected to be less than the preset weight threshold, the first timestamp is recorded. During the transmission of both the DCStream (data stream) and RTP Stream (audio / video data stream), the random number generated by the linear feedback shift register corresponds to the call request message. First timestamp and random numbers Substituting the values ​​into the following key generation function yields the temporary key message. .

[0086] ;

[0087] in, This indicates the previous temporary key information. This is temporary key information. Represents a random number. This represents the first timestamp. It should be noted that the temporary key message and the first timestamp are updated during processing.

[0088] S250. Based on the target business characteristic information and target weight information, determine the interception verification method that matches the call number.

[0089] The interception verification method can be determined based on the target business characteristic information and the target weight information, and it verifies the temporary key information. Optionally, if the target weight information is high, the determined interception verification method is more complex to improve the interception accuracy.

[0090] Specifically, based on the target business characteristic information and target weight information, an interception and verification method matching the call number is determined, and the temporary key information is verified based on the interception and verification method to determine whether the call number is an abnormal number.

[0091] S260. The temporary key information is verified based on the interception verification method to obtain the verification result.

[0092] The verification result can be either a successful or failed verification of the temporary key information.

[0093] Specifically, the temporary key information is decrypted according to the interception verification method to obtain the decryption result. If the decryption result matches the pass code configured in the interception verification method, the verification result is determined to be successful, and the call request message can be allowed to pass. Conversely, if the decryption result does not match the pass code configured in the interception verification method, i.e., decryption is abnormal, the verification result is determined to be verification failure, and the call request message is intercepted based on the verification failure result.

[0094] It should be noted that the temporary key information is only valid for the transmission of this call request message, and the parameters and algorithms will change for each generation, switching to a more efficient and lightweight encryption algorithm to improve transmission efficiency while ensuring communication security.

[0095] In this embodiment of the invention, the method for verifying temporary key information may be: decrypting temporary key information based on interception verification, so that if the decryption time exceeds the preset time or the decryption of temporary key information is abnormal, the verification result is determined to be verification failure, and based on the verification failure result, it is determined that the verification result does not meet the preset conditions.

[0096] The preset duration can be a pre-set standard duration for decrypting temporary key information. Decryption anomalies may include: failure to decrypt temporary key information, or the decryption result corresponding to the temporary key information being inconsistent with the release code configured in the interception verification method.

[0097] Specifically, the temporary key information is decrypted based on the interception verification method, and the decryption duration is determined in real time based on a corresponding timer. If the decryption duration reaches the preset duration and no decryption result corresponding to the temporary key information is obtained, or if the decryption of the temporary key information fails, or if the decryption result corresponding to the temporary key information is inconsistent with the release code configured in the interception verification method, the verification result is determined to be a verification failure, i.e., the verification result does not meet the preset conditions.

[0098] Optionally, in practical applications, such as Figure 5 As shown, the control plane network element performs anomaly detection on the call number by using temporary key information generated based on the first timestamp and random number as a "stepping stone," which mainly involves the following eight steps. Among them, Figure 5The AMF (Access and Mobility Management) network element is responsible for terminal access authentication and mobility management, and interacts with the UDM / HSS (User Data Management) network element to complete user authentication. The UDM / HSS network element stores user subscription information and provides authentication data to the AMF through the Sh interface.

[0099] First, initial access encryption / decryption failure of User Equipment (UE): When the security algorithm of the User Equipment (UE) does not match that of the core network or when the temporary key information is generated incorrectly during key negotiation (5G-AKA), the "knock-in" fails, and the encryption verification of Non-Access Stratum Signaling (NAS) between the User Equipment (UE) and the AMF (Access and Mobility Management Function) network element fails. Second, authentication interruption of the Sh interface between the Access and Mobility Management Function (AMF) network element and the User Data Management (UDM / HSS): The AMF requests user encryption / decryption parameters (such as Kausf, SQN) from the UDM / HSS through the Sh interface. When the response times out or the data is abnormal, the user's subscription data is missing in the UDM / HSS, and the request response is rejected. Third, encryption conflict during policy issuance by the Policy Control Function (PCF): When the Access and Mobility Management Function (AMF) obtains a QoS policy from the PCF containing an unsupported encryption algorithm, the door knocking verification fails. Fourth, session initiation protocol signaling (SIP) decryption failure of the IMS core network service control interface (ISC) of the Inquiry / Service Call Session Control Function (I / S-CSCF): When the Inquiry / Service Call Session Control Function (I / S-CSCF) receives encrypted SIP signaling (such as Invite) for VoLTE AS+ through the ISC interface, the keys between the IMS layer and the 5G New Call (VoNR+) capability network element are out of sync, resulting in decryption failure. Fifth, media key negotiation timeout in the Session Border Controller (VoLTE SBC-C): The VoLTE SBC-C does not receive a VoNR+ media plane response during media plane negotiation (such as SDES / SRTP keys). Sixth, VoLTE application server (VoLTE AS+) and media capability platform key synchronization failure: VoLTE AS+ attempts to synchronize encryption and decryption keys (such as media stream encryption keys) with the media capability platform, but returns an error, and the call is rejected. Seventh, User Plane Function Element (UPF) media stream decryption anomaly: The UPF attempts to decrypt user plane data (such as RTP packets) from the VoNR+ media plane. Due to the Key Lifetime Management (KMF) in the UPF policy issued by the Session Management Function Element (SMF) not aligning with the VoNR+ real-time update mechanism, the key decryption fails, resulting in a key index error. Eighth, VoNR+ capability element end-to-end verification interruption: The key derivation chain across network elements (AMF / UDM / VoNR+ network elements) is broken, or there is a network slicing security policy conflict. During end-to-end encryption verification, the VoNR+ capability element terminates the process because the initial keys between the UE and the AMF are incomplete.

[0100] S270. If the verification result does not meet the preset conditions, determine the calling number as an abnormal number and intercept the call request message.

[0101] The preset condition can be a condition where the verification result is successful. That is, if the verification result is successful, the verification result meets the preset condition. If the verification result is unsuccessful, the verification result does not meet the preset condition.

[0102] Specifically, when a verification failure is detected, it is determined that the verification result does not meet the preset conditions. At this time, the calling number can be identified as an abnormal number and the call request message of the abnormal number can be intercepted, so as to realize the interception and processing of the call request message at the control plane network element.

[0103] It should be noted that the embodiments of the present invention identify and process call numbers and call request messages sequentially from three aspects: the access layer, control plane network elements, and user plane and media stream. The user plane and media stream refer to the user plane and media processing plane, respectively. The user plane is the logical channel in the communication network responsible for transmitting actual user data (such as voice, video, files, etc.); the media processing plane is the set of logical functions in the communication network responsible for media content processing, including operations such as encoding / decoding conversion, mixing, transcoding, echo cancellation, and noise suppression. If, based on the control plane network elements, it is determined that the call request message does not meet preset conditions, the call request message can be intercepted at the control plane network elements. If the verification result meets the preset conditions, the call request message can be processed based on the user plane and media processing plane to determine whether to intercept the call request message. This can be achieved through the following steps.

[0104] In this embodiment of the invention, the method further includes: when it is determined that the verification result meets the preset conditions, analyzing the call request message based on the traffic evaluation model to determine the traffic float corresponding to the call request message and the float weight information corresponding to the traffic float; wherein, the traffic float is used to evaluate the traffic resources corresponding to the call request message, and the float weight information is related to the traffic resource evaluation result; when it is detected that the float weight information meets the preset interception conditions, determining that the call number is an abnormal number and intercepting the call request message.

[0105] The traffic assessment model can be a model used to evaluate and process traffic resources corresponding to call request messages. Optionally, the traffic assessment model can be a buoy network, that is, a distributed or centralized traffic assessment system responsible for real-time collection, storage, and analysis of call request messages, and generating a traffic buoy for each request. The traffic buoy is used to evaluate and process the traffic resources corresponding to the call request message, and the buoy weight information is related to the traffic resource assessment result. In other words, the buoy weight information can be determined based on the traffic resource assessment result corresponding to the call request message.

[0106] The buoy weight information can meet the preset interception conditions if the buoy weight information corresponding to the call request message is higher than the target weight information, or if the buoy weight information corresponding to the call request message is higher than the buoy weight information of other traffic buoys in the buoy database corresponding to the traffic assessment model.

[0107] Specifically, if the verification result is confirmed as passed, the call request message is analyzed and processed based on the traffic assessment model to obtain the traffic float corresponding to the call request message from the float database corresponding to the traffic assessment model. The traffic resources of the call request message are then assessed based on this traffic float to obtain a traffic resource assessment result. Based on the traffic resource assessment result, float weight information is determined. If the float weight information is detected to be higher than the target weight information, or if the float weight information corresponding to the call request message is higher than the float weight information of other traffic floats in the float database corresponding to the traffic assessment model, it is determined that the float weight information meets the preset interception conditions. At this time, the calling number can be treated as an abnormal number, and the call request message can be intercepted.

[0108] Optionally, the method for analyzing call request messages based on the traffic assessment model to determine traffic floats and float weight information can be as follows: analyze and process call request messages based on the traffic assessment model to determine the analysis results; determine the traffic float corresponding to the analysis results based on the float database corresponding to the traffic assessment model; evaluate and process call request messages based on the traffic floats to determine the traffic resource assessment results; and determine the float weight information corresponding to the call request message based on the traffic resource assessment results.

[0109] The analysis results can be the outcome of analyzing and processing call request messages. Based on the analysis results, the traffic float corresponding to the call request message can be determined. The float database corresponding to the traffic assessment model can include at least one traffic float and the float weight information corresponding to each traffic float. The traffic resource assessment results are used to characterize the traffic resource utilization of existing network resources corresponding to the call request message.

[0110] Specifically, the call request message is analyzed and processed according to the traffic assessment model to determine the analysis results. Based on the analysis results, a traffic float corresponding to the analysis results is determined from the float database corresponding to the traffic assessment model. The call request message is then processed for traffic resource assessment based on this traffic float to obtain the traffic resource assessment results. Based on the traffic resource assessment results, the network resource usage of the call request message is analyzed to obtain float weight information.

[0111] For example, see Figure 6 , Figure 6 This is the architecture diagram corresponding to the new 5G calling service. In the 5G new calling media path: UE (User Equipment) → SBC (Signaling Negotiation) → DSP (Media Processing) → Peer UE (Peer User Equipment), realizing high-definition, low-latency calls. SBC (Session Border Controller): Divided into Signaling SBC (L4-SBC) and Media SBC (I-SBC). The L4-SBC handles the signaling plane. As a load balancer or proxy for TCP / UDP (L4), its core function is to process SIP (L7 application layer protocol). The I-SBC handles the media plane. "I" usually refers to the Interconnect Border or the boundary behind the User Agent (UA), responsible for network security isolation, media stream forwarding, and codec adaptation. DSP (Digital Signal Processor): Processes audio and video media streams (RTP Stream), providing enhancement functions such as noise reduction, echo cancellation, and image quality optimization.

[0112] A check mechanism is set up for each DC Stream to analyze and intercept call numbers based on the FlowBouy principle, so that call request messages are intercepted when an abnormal call number is detected.

[0113] The following explanation uses a traffic assessment model as an example for the buoy network. Specifically, firstly, at least one parameter corresponding to the traffic buoy is defined. This at least one parameter includes at least one of the following: Flow anchor rate: The number of flow sessions generated per second, for example, 5 request sessions can be processed per second. Traffic buoy: Used to assess the traffic resources of the session corresponding to the call request message. When the traffic resource assessment result is abnormal, a buoy is added to the call request message to achieve anomaly localization. Anchor matching: If two or more traffic buoys are marked in the same session message, they are immediately strung together and a release message is inserted. Buoy network capacity: Sets the maximum number of sessions that can be processed.

[0114] Secondly, the buoy network is initialized by setting the timer's clock source, prescaler, and counting period to ensure the timer triggers interrupts at a preset rate. Optionally, a timer interrupt service function determines when to add flow buoys to the buoy network. The load on the buoy network is monitored in real time to ensure the number of flow buoys remains within a safe range and is always less than the network's maximum capacity.

[0115] It should be noted that when the buoy network approaches its maximum capacity, it can process multiple call request messages in a short period of time, thus effectively responding to sudden requests and attacks.

[0116] Next, in processing the audio and video media streams corresponding to the call request message ( Figure 6 When using an RTP Stream (in a buoy network), the following operations can be performed: Obtain the traffic buoy corresponding to the call request message from at least one traffic buoy contained in the buoy network; perform traffic resource assessment processing on the call request message based on the traffic buoy to obtain a traffic resource assessment result; and determine the buoy weight information corresponding to the call request message based on the traffic resource assessment result.

[0117] If the float weight information corresponding to the call request message is lower than the float weight information of other traffic floats in the float network, then the call request message is determined to be within the safe range of network resources, and the call request message is allowed, while the traffic float corresponding to the call request message is released. Conversely, if the float weight information corresponding to the call request message is higher than the float weight information of other traffic floats in the float network, then the call request message is determined to be potentially exceeding the safe range of current network resources, and the call request message is either warned or blocked.

[0118] Correspondingly, combined Figure 6The specific application process can be as follows: User Equipment (UE) initiates a call request message: The UE initiates a call request (call request message) through the 5G access network (VoNR), supporting DC (Data Channel) streams and RTP (Real-Time Transport Protocol) streams for transmitting interactive data (such as screen sharing, file transfer) and audio / video media streams. The UE interacts with the service platform (such as WITE AS, VoLTE AS) via the HTTP protocol. Signaling Control Layer (SIP / ISC protocol): The CSCF (Call Session Control Function) network element interacts with the terminal and application server (AS) via the SIP protocol. In the above process, based on the traffic buoy of the buoy network, traffic resource assessment is performed on the corresponding request message. When the buoy weight information corresponding to the traffic resource assessment result is detected to be higher than the buoy weight information of other traffic buoys in the buoy network, the request message is marked with a traffic buoy. The marking process of the traffic buoy can be found in [link to relevant documentation]. Figure 6 The red arrow in the image.

[0119] It should also be noted that if a call request message corresponds to two traffic floats, the call request message will be intercepted. If the call number corresponding to the call request message is detected to be in a call, the interception mechanism will be triggered immediately, the call will be interrupted, and the relevant request will be released.

[0120] Optionally, the method further includes: after determining that the call number is an abnormal number, adding the call number determined to be an abnormal number to the abnormal number blacklist, so that when a new call request message is detected, the call number to be detected corresponding to the new call request message is matched with the abnormal numbers stored in the abnormal number blacklist to determine whether to intercept the new call request message.

[0121] The blacklist of abnormal numbers can contain at least one abnormal number. The call number to be detected can be the call number corresponding to the new call request message.

[0122] Specifically, when the call request message is processed at the access layer, control plane network element and / or user plane and media processing plane, and the call number is determined to be an abnormal number, the call number is stored in the abnormal number blacklist. When a new call request message is received, the call number to be detected corresponding to the new call request message is matched with the abnormal numbers stored in the abnormal number blacklist.

[0123] If the number to be detected is determined to match an abnormal number stored in the abnormal number blacklist, the new call request message is intercepted. Alternatively, if the similarity between the number to be detected and an abnormal number stored in the abnormal number blacklist is determined to be higher than a preset similarity threshold, the number to be detected is marked as abnormal, and its abnormality is verified based on the target weight information and / or temporary key information and / or buoy weight information corresponding to the number to be detected. Accordingly, if the number to be detected is abnormal, the new call request message is intercepted. If the number to be detected is a normal number, the new call request message is allowed, and the abnormality mark on the number to be detected is removed.

[0124] For example, see Figure 7 and Figure 8 , Figure 7 The diagram shows an example of the blocking effect in region A where the abnormal call detection method provided in this embodiment of the invention is not used for abnormal number blocking. Figure 8 This is an example diagram showing the interception effect of abnormal number interception processing using the abnormal call detection method provided in this embodiment of the invention for area A.

[0125] The technical solution of this embodiment obtains historical communication information of the call number corresponding to the call request message within a preset historical time period upon receiving the call request message. Based on at least one business dimension, the historical communication information is analyzed to determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information. This determines the degree of influence of each business feature information of the call number on determining that the call number is an abnormal number. Based on at least one business feature information and dimension weight information under each business dimension, a comprehensive weight for determining that each business feature information is an abnormal number is determined. The business feature information with the highest comprehensive weight is used as the target business feature information, and the highest comprehensive weight is used as the target weight information. If the target weight information does not exceed a preset weight threshold, anomaly detection of the call number is performed using temporary key information generated by a timestamp and random number. This effectively solves the problem of false interception due to outbound call failures caused by network latency or configuration errors. By analyzing call request messages based on a traffic assessment model when the verification result corresponding to the temporary key information meets preset conditions, further anomaly detection of call request messages and calling numbers can be achieved. Furthermore, this method effectively handles sudden requests and resource releases, improving the success rate of intercepting call request messages from abnormal numbers. This invention solves the problems of inaccurate abnormal number detection and poor interception reliability caused by interception based solely on IP addresses in existing technologies. It improves the accuracy of abnormal number detection, ensures the precision of intercepting abnormal number call request messages, and enhances communication security.

[0126] Example 3

[0127] Figure 9 This is a schematic diagram of an abnormal call detection device provided in Embodiment 3 of the present invention. Figure 9 As shown, the device includes: a communication information determination module 310, a communication information analysis module 320, a weight information determination module 330, and a number detection module 340.

[0128] The communication information determination module 310 is used to obtain historical communication information of the call number corresponding to the call request message within a historical preset time period when a call request message is received; the communication information analysis module 320 is used to analyze the historical communication information according to at least one business dimension to determine at least one business feature information of the call number under each business dimension and dimension weight information corresponding to each business feature information; wherein, the at least one business dimension includes at least one of the call frequency dimension, call type dimension, region dimension, and number association dimension of the call number, and the dimension weight information is used to characterize the importance of the business feature information under the business dimension; the weight information determination module 330 is used to determine target business feature information and target weight information according to at least one business feature information and dimension weight information under each business dimension; wherein, the target business feature information is the feature information among at least one business feature information under at least one business dimension, and the target weight information is used to characterize the importance of the target business feature information relative to each business feature information of at least one business dimension; the number detection module 340 is used to determine the call number as an abnormal number and intercept the call request message when the target weight information is detected to exceed a preset weight threshold.

[0129] The technical solution of this embodiment obtains historical communication information of the call number corresponding to the call request message within a preset historical time period upon receiving the call request message. Based on at least one business dimension, the historical communication information is analyzed to determine at least one business feature information of the call number under each business dimension and the dimension weight information corresponding to each business feature information. This determines the degree of influence of each business feature information of the call number on determining that the call number is an abnormal number. Based on at least one business feature information and dimension weight information under each business dimension, a comprehensive weight for determining that each business feature information is an abnormal number is determined. The business feature information with the highest comprehensive weight is used as the target business feature information, and the highest comprehensive weight is used as the target weight information. When the target weight information exceeds a preset weight threshold, the call number is determined to be an abnormal number and the call number is intercepted. Based on this, accurate identification of abnormal call numbers and interception of call request messages are achieved from the access layer dimension. This solves the problems of inaccurate detection and poor interception reliability caused by interception based solely on IP addresses in existing technologies, improves the accuracy of abnormal number detection, ensures the accuracy of interception of abnormal number call request messages, and enhances communication security.

[0130] Based on the above embodiments, optionally, a weight information determination module is used to determine a pairwise comparison matrix corresponding to each business dimension based on at least one business feature information and corresponding dimension weight information under each business dimension; wherein, the elements in the pairwise comparison matrix are used to characterize the relative importance between different business feature information under the same business dimension; for each business dimension, the pairwise comparison matrix is ​​processed to determine the maximum eigenvalue and the eigenvector corresponding to the maximum eigenvalue; if the consistency check result of the maximum eigenvalue is passed, the eigenvectors corresponding to each business dimension are integrated to obtain a target matrix; principal component analysis is performed on the target matrix to determine the global weight information corresponding to each business feature information; wherein, the global weight information is used to characterize the importance of the business feature information relative to each business feature information of the at least one business dimension; based on the global weight information, target business feature information and target weight information are determined; wherein, the target weight information is the weight information in the global weight information.

[0131] Optionally, the device further includes: a key verification module, which includes: a key information determination unit, used to determine temporary key information corresponding to the call request message when the target weight information is detected not to exceed a preset weight threshold; wherein the temporary key information is related to the timestamp and random number corresponding to the call request message; a verification method determination unit, used to determine an interception verification method matching the call number based on the target service feature information and the target weight information; a verification result determination unit, used to perform verification processing on the temporary key information based on the interception verification method to obtain a verification result; and a number detection unit, used to determine the call number as an abnormal number and intercept the call request message when the verification result is detected not to meet a preset condition.

[0132] Optionally, the key information determination unit includes: a temporary key information generation subunit, used to determine a first timestamp when the target weight information is detected to be less than a preset weight threshold; generate a random number corresponding to the call request message based on a linear feedback shift register; and substitute the first timestamp and the random number into a key generation function to determine the temporary key information corresponding to the call request message.

[0133] Optionally, the verification result determination unit is used to decrypt the temporary key information based on the interception verification method, so as to determine that the verification result is a verification failure if the decryption time exceeds the preset time or the decryption of the temporary key information is abnormal, and to determine that the verification result does not meet the preset conditions based on the verification failure verification result.

[0134] Optionally, the device further includes: a buoy detection module, which includes: a buoy weight information determination unit, used to analyze the call request message based on a traffic evaluation model when the verification result meets preset conditions, and determine the traffic buoy corresponding to the call request message and the buoy weight information corresponding to the traffic buoy; wherein the traffic buoy is used to evaluate the traffic resources corresponding to the call request message, and the buoy weight information is related to the traffic resource evaluation result; and a number detection unit, used to determine that the calling number is an abnormal number and intercept the call request message when the buoy weight information meets preset interception conditions.

[0135] Optionally, the buoy weight information determination unit is used to analyze and process the call request message based on the traffic assessment model to determine the analysis result; determine the traffic buoy corresponding to the analysis result based on the buoy database corresponding to the traffic assessment model; evaluate and process the call request message based on the traffic buoy to determine the traffic resource assessment result; and determine the buoy weight information corresponding to the call request message based on the traffic resource assessment result.

[0136] Optionally, the device further includes a blacklist establishment module, used to add the call number identified as an abnormal number to an abnormal number blacklist after determining that the call number is an abnormal number, so that when a new call request message is detected, the call number to be detected corresponding to the new call request message is matched with the abnormal numbers stored in the abnormal number blacklist to determine whether to intercept the new call request message.

[0137] The abnormal call detection device provided in the embodiments of the present invention can execute the abnormal call detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0138] Example 4

[0139] Figure 10 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0140] like Figure 10As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0141] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0142] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as anomaly call detection methods.

[0143] In some embodiments, the abnormal call detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the abnormal call detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the abnormal call detection method by any other suitable means (e.g., by means of firmware).

[0144] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0145] Computer programs used to implement the abnormal call detection method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0146] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0147] Example 5

[0148] Embodiment 5 of the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to execute an abnormal call detection method, the method comprising:

[0149] Upon receiving a call request message, historical communication information of the call number corresponding to the call request message within a preset historical time period is obtained. Based on at least one business dimension, the historical communication information is analyzed to determine at least one business feature information of the call number under each business dimension and dimension weight information corresponding to each business feature information. The at least one business dimension includes at least one of the following: call frequency dimension, call type dimension, region dimension, and number association dimension of the call number. The dimension weight information is used to characterize the importance of the business feature information under its respective business dimension. Based on at least one business feature information and dimension weight information under each business dimension, target business feature information and target weight information are determined. The target business feature information is the feature information among at least one business feature information under the at least one business dimension, and the target weight information is used to characterize the importance of the target business feature information relative to each business feature information under the at least one business dimension. If the target weight information exceeds a preset weight threshold, the call number is determined to be an abnormal number, and the call request message is intercepted.

[0150] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0151] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0152] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0153] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0154] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0155] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An abnormal call detection method characterized by, Comprise: Upon receiving a call request message, obtain historical communication information of a call number corresponding to the call request message within a preset time length; According to at least one business dimension, the historical communication information is analyzed to determine at least one business characteristic information of the call number under each business dimension and the dimension weight information corresponding to each business characteristic information; wherein the at least one business dimension includes at least one of the call number's call frequency dimension, call type dimension, region dimension, and number correlation degree dimension, and the dimension weight information is used to represent the importance of the business characteristic information in the corresponding business dimension; According to at least one business characteristic information and dimension weight information under each business dimension, determine target business characteristic information and target weight information; wherein the target business characteristic information is the characteristic information in at least one business characteristic information under the at least one business dimension, and the target weight information is used to represent the importance of the target business characteristic information relative to each business characteristic information of the at least one business dimension; In the case where the target weight information exceeds the preset weight threshold, the call number is determined as an abnormal number and the call request message is intercepted and processed.

2. The method of claim 1, wherein, The method further comprises: According to at least one business characteristic information and corresponding dimension weight information under each business dimension, determine a pair-wise comparison matrix corresponding to the business dimension; wherein the elements in the pair-wise comparison matrix are used to represent the relative importance between different business characteristic information under the same business dimension; For each business dimension, the pair-wise comparison matrix is processed to determine the maximum eigenvalue corresponding to the pair-wise comparison matrix and the eigenvector corresponding to the maximum eigenvalue; In the case where the consistency test result of the maximum eigenvalue is verified, the eigenvectors corresponding to each business dimension are integrated to obtain a target matrix; Perform principal component analysis on the target matrix to determine the global weight information corresponding to each business characteristic information; wherein the global weight information is used to represent the importance of the business characteristic information relative to each business characteristic information of the at least one business dimension; According to the global weight information, determine the target business characteristic information and the target weight information; wherein the target weight information is the weight information in the global weight information.

3. The method of claim 1, wherein, The method further comprises: In the case where the target weight information does not exceed the preset weight threshold, determine temporary key information corresponding to the call request message; wherein the temporary key information is related to the timestamp and random number corresponding to the call request message; According to the target business characteristic information and the target weight information, determine an interception verification mode matching the call number; Based on the interception verification mode, the temporary key information is verified to obtain a verification result; In a case where it is detected that the check result does not satisfy a preset condition, the call number is determined as an abnormal number and the call request message is intercepted.

4. The method of claim 3, wherein, The temporary key information is determined in the following manner: In a case where it is detected that the target weight information does not exceed a preset weight threshold, a first timestamp is determined; A random number corresponding to the call request message is generated based on a linear feedback shift register; The first timestamp and the random number are substituted into a key generation function to determine temporary key information corresponding to the call request message.

5. The method of claim 3, wherein, The temporary key information is checked based on the interception check manner to obtain a check result, including: In a case where it is detected that the decryption duration exceeds a preset duration or the temporary key information is decrypted abnormally, the check result is determined as a check failure, and in a case where the check result is a check failure, it is determined that the check result does not satisfy a preset condition.

6. The method of claim 3, wherein, The method further includes: In a case where it is determined that the check result satisfies a preset condition, the call request message is analyzed based on a traffic evaluation model to determine a traffic float corresponding to the call request message and float weight information corresponding to the traffic float; wherein the traffic float is used to evaluate the traffic resource corresponding to the call request message, and the float weight information is related to the traffic resource evaluation result; In a case where it is detected that the float weight information satisfies a preset interception condition, the call number is determined as an abnormal number and the call request message is intercepted.

7. The method of claim 6, wherein, The call request message is analyzed based on the traffic evaluation model to determine a traffic float corresponding to the call request message and float weight information corresponding to the traffic float, including: The call request message is analyzed based on the traffic evaluation model to determine an analysis result; According to a float database corresponding to the traffic evaluation model, a traffic float corresponding to the analysis result is determined; The call request message is evaluated based on the traffic float to determine a traffic resource evaluation result; Based on the traffic resource evaluation result, float weight information corresponding to the call request message is determined.

8. The method according to any one of claims 1 to 7, characterized in that, After determining that the call number is an abnormal number, the method further includes: The call number determined as an abnormal number is added to an abnormal number blacklist, so that in a case where a new call request message is detected, a to-be-detected call number corresponding to the new call request message is matched with an abnormal number stored in the abnormal number blacklist to determine whether the new call request message is intercepted.

9. An electronic device, comprising: The electronic device includes: at least one processor; and a memory connected in communication with the at least one processor; wherein The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the abnormal call detection method of any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing the processor to implement the abnormal call detection method of any one of claims 1-8 when executed.

Images