Abnormal account determination method and related device

Abstract

The invention provides an abnormal account determination method and a related device, and the method comprises the steps: analyzing business domain metadata, and determining an answering scene when a target answering end answering a short call answers the short call according to an analysis result; and according to the answering scene, determining whether a dialing end for dialing the short call to the target answering end is an abnormal account. According to the embodiment of the invention, whether the dialing end dialing the short call to the target answering end is the abnormal account is determined according to the business domain metadata, so that the accuracy of determining the abnormal account is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of telecommunications security technology, and in particular to a method and related apparatus for determining abnormal accounts. Background Technology

[0002] In telecommunications operations, there is a problem of criminals using abnormal accounts (i.e., phone numbers) to harass users or engage in illegal activities. This not only affects the user experience but also threatens the reputation and security of telecommunications operators. Therefore, identifying abnormal accounts is of paramount importance.

[0003] The existing method for identifying abnormal accounts involves users marking the incoming phone number in a mobile application after receiving a call. This method relies on users actively marking abnormal accounts; some users may not mark abnormal accounts, and some may not mark all abnormal accounts they receive, making it difficult to accurately identify abnormal accounts and resulting in low accuracy in identifying them. Summary of the Invention

[0004] This invention provides a method and related apparatus for determining abnormal accounts, in order to solve the problem of low accuracy in determining abnormal accounts by existing methods.

[0005] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a method for determining abnormal accounts, comprising:

[0007] Parse the business domain metadata and determine the receiving scenario of the target receiving end when receiving the short call based on the parsing results;

[0008] Based on the receiving scenario, determine whether the calling terminal that made the short call to the target receiving terminal is an abnormal account.

[0009] Optionally, the analysis result includes the location information of the target receiving end when answering the short call, and the acceleration information of the target receiving end during the time period of answering the short call.

[0010] Optionally, the receiving scenario of the target receiving end when answering the short call is determined based on the parsing results, including:

[0011] Based on the location information and the acceleration information, the receiving scenario of the target receiving end when answering the short call is determined.

[0012] Optionally, based on the location information and the acceleration information, determining the receiving scenario of the target receiving end when answering the short call, further includes:

[0013] The location information and acceleration information are calibrated using monitoring data from sensors pre-installed at the target receiver.

[0014] Optionally, based on the receiving scenario, determining whether the calling terminal that made the short call to the target receiving terminal is an abnormal account includes:

[0015] Based on a preset risk assessment function, a risk score for the call receiving scenario is determined; and based on the call receiving scenario and the analysis result, a feature vector for the short call is constructed, and the feature vector is input into a pre-trained anomaly recognition model to obtain the anomaly probability of the short call.

[0016] A comprehensive risk score is determined based on the risk score and the anomaly probability.

[0017] If the overall risk score exceeds a preset risk threshold, the calling terminal is determined to be an abnormal account.

[0018] Optionally, the analysis result includes the location information of the target receiving end when answering the short call, and the acceleration information of the target receiving end during the time period of answering the short call.

[0019] Optionally, the parsing result may further include at least one of the following:

[0020] The call duration of the short call, the environmental adaptability score of the short call, the time characteristics of the short call, and the historical call data of the dialing terminal.

[0021] Secondly, embodiments of the present invention provide an apparatus for determining abnormal accounts, comprising:

[0022] The parsing module is used to parse business domain metadata and determine the receiving scenario of the target receiving end when receiving the short call based on the parsing results.

[0023] The execution module is used to determine, based on the receiving scenario, whether the calling terminal that makes the short call to the target receiving terminal is an abnormal account.

[0024] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps in the method for determining an abnormal account as described in any one of the first aspects.

[0025] Fourthly, embodiments of the present invention provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps in the method for determining an abnormal account as described in any one of the first aspects.

[0026] Fifthly, embodiments of the present invention provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the method for determining an abnormal account as described in any one of the first aspects.

[0027] In this embodiment of the invention, by parsing the service domain metadata, the receiving scenario of the target receiving end when receiving the short call is determined based on the parsing result; based on the receiving scenario, it is determined whether the calling end that made the short call to the target receiving end is an abnormal account. This embodiment of the invention improves the accuracy of determining abnormal accounts by determining whether the calling end that made the short call to the target receiving end is an abnormal account based on the service domain metadata. Attached Figure Description

[0028] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0029] Figure 1 This is a flowchart illustrating the method for determining abnormal accounts according to an embodiment of the present invention;

[0030] Figure 2 This is a flowchart illustrating the anomaly detection process.

[0031] Figure 3 This is a schematic block diagram of the device for determining abnormal accounts according to an embodiment of the present invention;

[0032] Figure 4 This is a schematic block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0033] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] The terms "first," "second," etc., used in this embodiment of the invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, without limiting the number of objects; for example, the first object can be one or more. Furthermore, in this embodiment of the invention, "or" indicates at least one of the connected objects. For example, "A or B" covers three scenarios: Scenario 1: includes A but does not include B; Scenario 2: includes B but does not include A; Scenario 3: includes both A and B. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0035] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0036] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of personal information involved in the technical solutions of this invention comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to personal information data and to maintain personal information security and network security.

[0037] This invention provides a method for determining abnormal accounts, see [link to relevant documentation]. Figure 1 As shown, Figure 1 This is a flowchart illustrating the method for determining abnormal accounts according to an embodiment of the present invention. The method for determining abnormal accounts includes:

[0038] Step 11: Parse the business domain metadata and determine the receiving scenario of the target receiving end when answering the short call based on the parsing results;

[0039] Step 12: Based on the receiving scenario, determine whether the calling end that made the short call to the target receiving end is an abnormal account.

[0040] Business domain metadata, also known as B-domain (business support system data domain) data, comes from telecom operators' billing, business analysis, customer relationship management (CRM), business operation support system (BOSS) and other systems, as well as value-added service integrated operation platforms. It mainly consists of business analysis data, such as dynamic communication consumption data, static user base data and network attribute data.

[0041] Understandably, since the business domain metadata contains precise data about when a user makes or receives a call, analyzing and parsing the results of this metadata can determine the context in which the user makes or receives the call. In other words, the parsing results can accurately determine the context in which the target receiving end of a short call is receiving the call.

[0042] In some embodiments, a short call may optionally be a call with a duration less than or equal to a preset call duration threshold. In some specific embodiments, the preset call duration threshold may be 30 seconds.

[0043] It should be noted that the call duration threshold can be set by the user according to actual needs, and this invention does not impose further limitations on it.

[0044] In some embodiments, the answering scenario may optionally include at least one of the following: stationary state, walking state, fast-moving state, and driving state.

[0045] At rest: acceleration is approximately zero and the rate of position change is very low, making it suitable for answering calls.

[0046] Walking status: Acceleration changes but not drastically, and the rate of position change is moderate, which may be suitable for answering calls.

[0047] Rapid movement or driving: Rapid acceleration and high rate of position change make it unsuitable for answering calls.

[0048] It's important to note that different call scenarios can be used to determine whether a short call is abnormal, and thus whether the caller is an abnormal account. For example, in a fast-moving situation where it's not appropriate to answer, a short call might be quickly disconnected by the recipient due to the call being unsuitable for answering. In this case, the probability of the caller being an abnormal account is low, and the caller will not be marked as an abnormal account. On the other hand, if a short call occurs in a stationary situation suitable for answering, it's highly likely that the caller initiated the call with marketing advertisements or other forms of spam, causing the recipient to quickly disconnect. In this case, the probability of the caller being an abnormal account is high.

[0049] Based on this, a big data analysis system is formed by accumulating data over a certain period, which can determine whether the calling end that makes a short call to the target receiving end is an abnormal account based on the receiving scenario.

[0050] In this embodiment of the invention, by parsing the service domain metadata, the receiving scenario of the target receiving end when receiving the short call is determined based on the parsing result; based on the receiving scenario, it is determined whether the calling end that made the short call to the target receiving end is an abnormal account. This embodiment of the invention improves the accuracy of determining abnormal accounts by determining whether the calling end that made the short call to the target receiving end is an abnormal account based on the service domain metadata.

[0051] In some embodiments, optionally, the parsing result includes the location information of the target receiving end when answering the short call, and the acceleration information of the target receiving end during the short call period. Understandably, the location information can determine the user's specific location when answering the call, and the acceleration information can determine whether the user is active at that specific location. Combining the location information and the acceleration information allows for an accurate determination of the receiving scenario of the target receiving end when answering the short call.

[0052] In some embodiments, optionally, the receiving scenario of the target receiving end when answering the short call is determined based on the parsing result, including:

[0053] Step a: Based on location and acceleration information, determine the receiving scenario of the target receiving end when answering the short call.

[0054] The service domain metadata includes the location information (e.g., latitude and longitude) of the target receiver obtained through GNSS (Global Navigation Satellite System) and / or communication base station data. By analyzing the temporal sequence of the location information, the rate of location change can be calculated to assess the user's activity status.

[0055] The likelihood of being suitable to answer a phone call varies depending on the user's activity level. The system determines whether the user is stationary, moving rapidly, or driving based on the rate of change of location. It also uses predefined rate thresholds (e.g., <1 m / s for stationary, >5 m / s for rapid movement) to determine the scenario. Furthermore, it analyzes acceleration changes to assess the user's activity. For example, if acceleration is constantly changing, the user may be walking or moving rapidly; if acceleration is close to zero, the user may be stationary.

[0056] In some embodiments, optionally, the receiving scenario of the target receiving end when answering the short call is determined based on location information and acceleration information, further including:

[0057] Step b: Use the monitoring data from the sensor pre-installed at the target receiver to calibrate the position and acceleration information.

[0058] The target receiving device, such as a smartphone, is equipped with an accelerometer and a GNSS sensor. Therefore, the sensor monitoring data contains more precise acceleration and location data than the service domain metadata. Using this more precise acceleration and location data to calibrate the location and acceleration information improves their accuracy. Furthermore, the step of determining the receiving scenario of the target receiving device when answering a short call based on the location and acceleration information improves the accuracy of the determined receiving scenario.

[0059] In some embodiments, optionally, depending on the receiving scenario, determining whether the calling client making the short call to the target receiving client is an abnormal account includes:

[0060] Step c: Determine the risk score of the call receiving scenario based on the preset risk assessment function; and construct the feature vector of the short call based on the call receiving scenario and the analysis results, and input the feature vector into the pre-trained anomaly recognition model to obtain the anomaly probability of the short call.

[0061] Step d: Determine the comprehensive risk score based on the risk score and the probability of anomalies;

[0062] Step e: If the overall risk score exceeds the preset risk threshold, the calling terminal is determined to be an abnormal account.

[0063] In some embodiments, the risk assessment function may optionally be expressed as follows:

[0064]

[0065] in, ~ These are weight parameters; It can characterize the impact of short call duration on risk; for example, the shorter the duration, the higher the risk contribution. Characterize the impact of motion state and posture on risk; for example, short calls are more suspicious when moving at high speed and in a holding posture. Characterize the moderating effect of environmental suitability scores on risk; Characterize the cumulative impact of historical behavioral characteristics on risk.

[0066] By configuring the weights and function form, the risk assessment function can achieve differentiated modeling, such as short call scores tending to be normal in a stationary state and short call scores tending to be abnormal in a rapidly moving state.

[0067] In some embodiments, optionally, the parsing results include: the location information of the target receiving end when answering the short call, the acceleration information of the target receiving end during the time period of answering the short call, the call duration of the short call, the environmental adaptability score of the short call, the time characteristics of the short call, and the historical call data of the calling end.

[0068] The feature vector of a short call is x=(d, v, a). mean a var (p, e, t, h)

[0069] Where: d represents the short call duration; v represents the average rate of location change during the call, for example, based on the ratio of the start and end location difference to the call duration; a mean and a var, representing the average and variance of the acceleration modulus during the call, respectively, are used to distinguish between states such as stationary, walking, and vigorous movement; p represents the pose category, for example, using discrete encoding to map poses such as stationary holding, walking holding, horizontal placement in a vehicle, and talking at the ear to different integer labels; e represents the environment category or environment suitability score, which can be quantified by the aforementioned environment recognition module based on the recognition results of closed spaces, open spaces, vehicles, building elevators, etc.; t represents the time characteristics of the call, for example, hourly encoding or weekday and rest day markings can be used to reflect the differences in call behavior at different times; h represents historical behavior-related characteristics, such as the number of short calls made by the dialing number in the past period, the user's subjective marking status, and the frequency of occurrence in different scenarios.

[0070] To avoid imbalances caused by different dimensional features in subsequent models, the continuous features can be standardized based on historical data. For example, linear standardization based on mean and standard deviation can be used to map each continuous feature to zero mean, unit variance, or a defined interval.

[0071] In some embodiments, optionally, the training method for the anomaly detection model includes:

[0072] Obtain the historical characteristic vector xi of the historical short calls (the data structure of xi is the same as the data structure of the feature vector of the aforementioned short calls (i.e., x = (d, v, a)). mean a var (p, e, t, h) are consistent). Historical feature vectors are labeled based on whether the calling terminal is an abnormal account, resulting in a training sample set {(x)}. i y i )}, where x i For historical feature vectors, y i ∈{0,1} represent normal numbers (1) and abnormal numbers (0), respectively.

[0073] The anomaly detection model is obtained by training the training sample set {(xi, yi)}.

[0074] The identification model can include any of the following: support vector machine, decision tree, gradient boosting tree, random forest.

[0075] During training, the recognition model learns from the training sample set {(xi, yi)} to obtain a mapping function from feature vectors to anomaly probabilities. Taking Support Vector Machines (SVMs) as an example, kernel functions can be used to map features to a high-dimensional space, and the maximum margin hyperplane can be used to distinguish between normal and abnormal samples. Taking Decision Trees as an example, the feature space can be recursively partitioned to construct a tree structure that can express the differences in the probability of anomalies under different scenario combinations.

[0076] In some embodiments, the feature vector is optionally input into a pre-trained anomaly detection model to obtain the anomaly probability P of the short call. ml .

[0077] Based on the preset risk assessment function, the risk score R for the call answering scenario is determined.

[0078] Based on the risk score and the probability of anomalies, a comprehensive risk score is determined, including:

[0079] The risk score R is compared with the anomaly probability P of the short call. ml Substituting into the comprehensive risk scoring model, we obtain the comprehensive risk score. .

[0080] In some embodiments, the expression for the comprehensive risk scoring model may optionally be as follows:

[0081]

[0082] in, This is the result after normalizing the rule score (i.e., the risk score R). This approach integrates weights. In the early stages, the rule-based model provides interpretable initial decisions. As training data accumulates and the model improves, the weight of machine learning results in the overall score gradually increases, thus achieving a dual constraint of rules and data-driven approaches.

[0083] After obtaining a comprehensive risk score Subsequently, in some embodiments, a dual-threshold decision mechanism and a caller account-level cumulative score can be set to reduce the impact of a single false positive. Specifically: an upper threshold T can be set. high With lower threshold T low For example, two values ​​between 0 and 1, when ≥T high When this occurs, the call is considered a high-risk short call event, and the corresponding abnormal score for the calling account is accumulated; when ≤T low When this occurs, the call is considered a low-risk short call event, and the normal score of the caller's account is increased or the abnormal score is decreased; when When the value falls between the two thresholds, the call is temporarily stored as an event to be observed, used only for model statistics, and without making significant adjustments to the account score.

[0084] In some embodiments, the parsing results may optionally include the location information of the target receiving end when answering the short call, and the acceleration information of the target receiving end during the time period of answering the short call.

[0085] Based on the above analysis results, a feature vector that accurately represents the characteristics of short calls can be constructed, laying the foundation for accurately determining whether the dialing end is abnormal.

[0086] In some embodiments, the parsing result may optionally include at least one of the following:

[0087] Short call duration, short call environmental adaptability score, short call time characteristics, and historical call data of the calling end.

[0088] Based on the above analysis results, the dimension of the feature vector has been increased, which can further improve the accuracy of the feature vector in representing the characteristics of short calls and improve the accuracy of judging whether the dialing end is abnormal.

[0089] The following description is based on specific embodiments.

[0090] See Figure 2 As shown, Figure 2 This is a flowchart illustrating the anomaly identification process. From a telecom operator's perspective, B-domain data can be used to analyze the location information associated with the short call of the receiving user, combined with the phone's pose information, to determine whether the receiving user was in a suitable scenario for answering the call. Based on this, through data accumulation and big data analysis, it can be inferred whether the calling user is an abnormal account, such as making spam calls. For example, if the analysis based on the location information associated with the short call, combined with the phone's pose information, indicates that the receiving user was in a scenario of rapid movement, exercise, using public transportation, or driving, the calling end of the short call in these scenarios is usually not marked as an abnormal account. Conversely, the probability of the calling end being identified as an abnormal account increases.

[0091] S1: Identify short call logs:

[0092] Short call logs may indicate that the user received harassing or scam calls. Set a call duration threshold (e.g., less than 30 seconds) to filter short calls.

[0093] Collect users' call records and filter out short call records with a duration below a threshold to form a preliminary dataset.

[0094] S2: Extract location information and rate of change of location.

[0095] The location information of the user receiving the call is obtained through GPS and base station data, and the rate of location change is calculated to assess the user's activity status. At the moment the short call occurs, the user's location information (latitude and longitude) is extracted, and the rate of location change during the call is calculated.

[0096] S3: Analyze suitable scenarios for answering phone calls.

[0097] The likelihood of being able to answer a phone call varies depending on the user's activity level. The system determines whether the user is stationary, moving rapidly, or driving based on the rate of change of location. Scenario determination is made based on a set rate threshold (e.g., speed < 1 m / s indicates stationary, speed > 5 m / s indicates rapid movement).

[0098] Step S3 includes steps S31 and S32.

[0099] Step S31 includes steps S311 to S313, step S313 includes steps S3131 to S3134, and step S32 includes steps S321 to S323.

[0100] S31, utilizing the phone's pose and acceleration information can indeed further improve the recognition accuracy of the user's location on the receiving end. The following is a detailed explanation of how this information is integrated into the solution:

[0101] S311: For acquiring posture and acceleration data, the phone's built-in sensors (such as accelerometers and gyroscopes) can monitor the user's posture (such as being stationary, walking, running, driving, etc.) and acceleration changes in real time. This data can reflect the user's activity status.

[0102] For example, when answering a short call, the user's acceleration data can be collected, and changes in acceleration can be analyzed to determine the user's activity level. For instance, if the acceleration is constantly changing, the user may be walking or moving quickly; if the acceleration is close to zero, the user may be stationary.

[0103] S312: Scene Recognition and Classification

[0104] Based on the acquired pose and acceleration data, combined with the rate of position change, it is determined whether the user is in a suitable scenario to answer the phone.

[0105] For example, by combining acceleration data with call duration and rate of location change, the following criteria can be used for scenario classification:

[0106] At rest: acceleration is approximately zero and the rate of position change is very low, making it suitable for answering calls.

[0107] Walking status: Acceleration changes but not drastically, and the rate of position change is moderate, which may be suitable for answering calls.

[0108] Rapid movement: The acceleration is intense and the rate of position change is high, making it unsuitable for answering calls.

[0109] S313: Comprehensive Judgment Mechanism

[0110] By comprehensively analyzing multiple data sources (call duration, location information, acceleration, and pose information), a more accurate abnormal account identification model is formed. A scoring system is established, assigning weights to different scenario combinations. For example, short calls in a stationary state score higher (potentially normal), while short calls in a rapidly moving state score lower (potentially abnormal). As data accumulates, the model is continuously optimized to better adapt to changes in user behavior. Call records from different scenarios can be collected, and machine learning algorithms (such as support vector machines or decision trees) can be used to dynamically adjust and optimize the identification rules to improve accuracy. For example, if user J receives a short call on a bus, acceleration data analysis (high acceleration and rate of position change) determines that the call is unsuitable to answer, and the caller's number is marked as abnormal. For example, if user K receives a short call at home, the acceleration data is close to zero; combined with stationary location information, the system determines it is a normal call and records the caller's number.

[0111] By integrating the phone's pose and acceleration information, the ability to identify short call scenarios can be further improved, thereby enhancing the accuracy of identifying abnormal accounts while still protecting user privacy.

[0112] S3131: Upon receiving a call record that meets the conditions for a short call, the system extracts multi-dimensional features associated with the call from B-domain data and terminal sensor data, and constructs them into a feature vector for abnormal account identification. Specifically, a feature vector x=(d, v, a) can be constructed for each call sample. mean a var , p, e, t, h), where: d represents the short call duration; v represents the average rate of location change during the call, for example, based on the ratio of the start and end location difference to the call duration; a mean and a varThe values ​​represent the average and variance of the acceleration modulus during the call, used to distinguish between stationary, walking, and strenuous movement states; p represents the pose category, for example, using discrete encoding to map poses such as static holding, walking holding, horizontal placement in a vehicle, and talking at the ear to different integer labels; e represents the environment category or environment suitability score, which can be quantified by the aforementioned environment recognition module based on the recognition results of enclosed spaces, open spaces, vehicles, building elevators, etc.; t represents the time feature of the call, for example, using hourly encoding or weekday and rest day markings to reflect differences in call behavior at different times; h represents historical behavior-related features, such as the number of short calls made by the dialing number in the past period, the user's subjective labeling status, and the frequency of occurrence in different scenarios. To avoid the imbalance caused by different dimensional features to subsequent models, the above continuous features can be standardized based on historical training data, for example, using linear standardization based on mean and standard deviation to uniformly map each continuous feature to zero mean, unit variance, or a limited interval, so as to facilitate the training and inference of subsequent scoring models and machine learning models.

[0113] S3132: After completing feature construction and standardization, in some examples, a scenario scoring model can be built first based on rules and expert experience to provide a quantitative assessment of whether the short call is reasonable in the current scenario. Specifically, an environmental suitability score S can be pre-set for each scenario combination. scene For example, when the acceleration is close to zero, the rate of position change is low, the posture is sitting or standing and holding, and the environment is home or office, the suitability score of this combination of scenarios is set to high; when the acceleration changes drastically or the rate of position change is high, the posture is horizontal in a vehicle or talking to the ear, and the environment is bus, subway or high-speed moving vehicle, the suitability score of this combination of scenarios is set to low; for scenarios identified as enclosed spaces with drastic signal changes, such as elevators or underground parking garages, a lower scenario suitability score can be given separately to reflect the characteristic that short calls are less common in such scenarios.

[0114] Based on this, a call-level comprehensive risk scoring function 𝑅 can be constructed, for example:

[0115]

[0116] in, ~ For weight parameters, This can characterize the impact of short call duration on risk; for example, the shorter the duration, the higher the risk contribution. Characterizing the impact of motion state and posture on risk, for example, short calls are more suspicious during high-speed movement and while holding the device. The moderating effect of environmental suitability scores on risk is characterized. It characterizes the cumulative impact of historical behavioral features on risk. By configuring the weights and function form, it is possible to achieve differentiated modeling, such as short call scores tending to be normal in a stationary state and short call scores tending to be abnormal in a rapidly moving state.

[0117] S3133: To further improve the adaptability and accuracy of abnormal account identification, in some examples, a supervised machine learning model can be introduced based on the above rule-based scoring model. Specifically, this includes:

[0118] By utilizing historical call records, and while protecting user privacy, labels are assigned to certain call samples indicating whether the caller ID is abnormal. These labels can originate from user-generated tagging, the operator's internal risk control list, or indirect labeling methods based on rule-based scoring and subsequent verification, thus forming the training sample set {(x i y i )}, where x i Let y be the eigenvector mentioned above. i ∈{0,1} represents normal numbers and abnormal numbers, respectively.

[0119] Models such as Support Vector Machines, Decision Trees, Gradient Boosting Trees, or Random Forests can be selected to learn from training samples and obtain a mapping function P from feature vectors to anomaly probabilities. ml (y=1|x). Taking support vector machines as an example, kernel functions can be used to map features to a high-dimensional space, and the maximum margin hyperplane can be used to distinguish normal samples from abnormal samples. Taking decision trees as an example, the feature space can be recursively divided to construct a tree structure that can express the differences in abnormal probability under different combinations of scenarios.

[0120] During the online judgment phase, for each new short call sample, on the one hand, the risk score R is calculated using the rule model in S3132, and on the other hand, the feature vector is input into the trained machine learning model to obtain the anomaly probability P. ml Subsequently, the final comprehensive risk score can be obtained through linear or nonlinear fusion methods. ,For example:

[0121]

[0122] in, The result after normalizing the rule scores is denoted as , and the fusion weights are denoted as . This approach allows the rule model to provide interpretable initial decisions in the early stages. As training data accumulates and the model improves, the weight of machine learning results in the overall score gradually increases, thus achieving a dual constraint of rules and data-driven approaches.

[0123] S3134: After obtaining the comprehensive risk score Subsequently, in some examples, the system can be configured with a dual-threshold decision mechanism and a caller account-level cumulative score to reduce the impact of a single false positive. Specifically: an upper threshold T can be set. high With lower threshold T low For example, two values ​​between 0 and 1, when ≥T high When this occurs, the call is considered a high-risk short call event, and the corresponding abnormal score for the calling account is accumulated; when ≤T low When this occurs, the call is considered a low-risk short call event, and the normal score of the caller's account is increased or the abnormal score is decreased; when When the value falls between the two thresholds, the call is temporarily stored as an event to be observed, used only for model statistics, and without making significant adjustments to the account score.

[0124] For each calling account, a set of account-level statistics can be maintained, such as the count of high-risk events, the count of low-risk events, and the risk distribution under different scenarios within a certain time window. If the count of high-risk events or the overall anomaly score exceeds the account-level threshold, the account is marked as an abnormal account or added to the key observation list; if there are many low-risk events and no obvious high-risk events appear during long-term observation, the account can be marked as normal or its risk level can be reduced. In addition, personalized parameters can be maintained at the individual user level, such as automatically adjusting the short call threshold and the weight of motion scenarios based on the historical call habits of the receiving user, thereby achieving differentiated evaluation of the same calling account on different receiving users and avoiding misjudgments caused by a one-size-fits-all approach.

[0125] S32 combines environmental suitability analysis with abnormal account identification, using environmental identification to support the determination of abnormal accounts.

[0126] S321: Environmental recognition and association with abnormal accounts. The environment in which a user answers a call can affect the legitimacy of the call, especially in enclosed spaces (such as elevators or vehicles), where short calls are more likely to be flagged as abnormal. For example, by combining acceleration, pose, and location information, it can be determined whether the user is in an enclosed environment and the corresponding data can be recorded.

[0127] S322: Establish an abnormal account identification model, combining environmental suitability scores and short call data to enhance the ability to identify abnormal accounts. For example, combine a user's call duration, answering status, and environmental suitability (such as whether they are in an enclosed space) to establish a comprehensive scoring model. Short calls in enclosed spaces score low, increasing the probability of them being marked as abnormal; while calls in open spaces score high and may be considered normal.

[0128] S323: Real-time feedback and decision-making. Through real-time environment recognition, the system promptly assesses the rationality of calls, providing support for anomaly detection. When a user answers a call and the system identifies that they are in an unsuitable environment, it issues a warning and records the call data for subsequent analysis. If short calls received in enclosed spaces occur frequently, the weight for marking the dialed number as abnormal is increased. For example, if user N receives a short call in an elevator, the system identifies the environment as unsuitable for answering, records the call, and increases the probability of marking the dialed number as abnormal. If user O receives a short call in an open space, the system determines that it is suitable for answering, and the call will not affect the normality marking of the dialed number.

[0129] By combining environmental suitability analysis with anomaly account identification, potential harassing or fraudulent calls can be identified more accurately while ensuring user privacy is protected. This approach improves both the accuracy of anomaly detection and the user's calling experience.

[0130] S4: Apply association rule learning to help identify the relationship between short calls and specific scenarios (such as location and rate).

[0131] Understandably, after completing steps S1-S3, the system is already able to extract multi-dimensional features from each call record, including call duration, location region, rate of location change, acceleration fluctuation, pose type, and environmental scene labels, and makes a preliminary judgment on the rationality of short calls based on a comprehensive judgment mechanism. To automatically discover potential patterns between short calls and specific scene combinations on a larger scale of historical data, thereby guiding the optimization of short call identification rules and abnormal account judgment thresholds, in some examples, the system further introduces an association rule learning mechanism based on the aforementioned historical feature data. Association rule learning can be applied to help identify the relationship between short calls and specific scenes.

[0132] The Apriori algorithm can be used to mine frequent itemsets and generate association rules, helping to identify the relationship between short calls and specific scenarios (such as location and rate). By using historical data, it determines which combinations of conditions are most likely to lead to short calls. The Apriori algorithm expands candidate itemsets layer by layer, calculates the support of each itemset in historical transactions, and utilizes the pruning property that any subset of a frequent itemset must also be a frequent itemset to obtain frequent scenario combinations that meet a preset minimum support threshold. Based on this, the confidence and lift of short calls as outcome items in these frequent itemsets are calculated, thereby filtering out high-value association rules under which scenario combinations significantly increase the probability of short calls.

[0133] Specifically, data preparation involves converting user call logs, location information, and change rates into transactional data format, forming a feature set for each call. For example, each record might contain: {short call, speed < 1 m / s, office location}.

[0134] Frequent itemset mining: Use the Apriori algorithm to analyze historical call data and extract frequent itemsets (e.g., combinations of short calls and “suitable to answer” scenarios).

[0135] Generate association rules: Generate association rules based on frequent itemsets to determine the probability of short calls in specific scenarios. For example: Rule example: {Short call, Office location} => {Normal call}.

[0136] Rule evaluation: Calculate the confidence and lift of each rule to assess its reliability. For example, a confidence of 0.8 means that in 80% of cases, when a short call and a specific location occur simultaneously, the call is marked as normal.

[0137] S5: Obtain the calling end account and accumulate abnormal indicators.

[0138] If a short call occurs in a suitable context for answering, the caller's number is considered a potentially legitimate call; otherwise, it is marked as abnormal. Based on the evaluation results of the association rules, if the short call matches the generated association rules, the caller's account is recorded and marked as legitimate; otherwise, it is not recorded.

[0139] Abnormal Account Identification System Architecture:

[0140] Data Acquisition Layer: Data Collection Module: Collects call metadata, environmental suitability data, and sensor data from user terminals in real time.

[0141] Data Processing Layer: Data Preprocessing Module: Cleans and organizes collected data, removing noise and redundant information. Environmental Recognition Module: Analyzes sensor data to determine the user's environment (open or enclosed space). Anomaly Recognition Module: Combines call metadata and environmental information, using machine learning algorithms to identify abnormal accounts.

[0142] Decision-making level: Scoring and labeling module: Based on environmental suitability and anomaly identification results, generate scores for caller accounts and label them.

[0143] User feedback layer: Feedback system: Allows users to provide feedback on calls (e.g., labeling them as harassment or normal) for model optimization and adjustment.

[0144] Cloud storage: Data storage module: Stores user feedback, recognition results, and model training data in the cloud for subsequent analysis and training.

[0145] Management: Data Analytics Module: Regularly analyze user data and feedback, optimize recognition models and rules, and update the system.

[0146] By exploring the correlation between short calls and user scenarios, normal and abnormal calls can be identified more accurately. As data accumulates, the association rules can be continuously updated to adapt to different users' call behaviors. The application of association rules allows the system to consider multiple factors when making judgments, reducing the probability of normal calls being mistakenly marked as abnormal. More importantly, this solution does not involve the acquisition and analysis of user call content, but relies on call metadata (such as call duration, call time, the recipient's location information and speed, etc.) to infer whether the caller's account is abnormal. This ensures that user call privacy is fully protected. By analyzing call duration and the user's activity state (such as stationary or moving) during the call, it is possible to identify whether short calls conform to normal patterns. For example, short call records are more likely to be normal when the user is stationary, while they may indicate anomalies when the user is moving rapidly. A dynamic threshold method can be used, combined with the user's historical call behavior, to establish a personalized anomaly identification model. This means that the identification criteria for each user are tailored to their unique behavioral patterns, thereby improving accuracy and further reducing the impact on privacy. Only necessary data, such as call duration, answering time, and location change rate, is collected, without involving users' personal information or call content. This principle of data minimization effectively reduces potential privacy risks.

[0147] This invention provides a device for identifying abnormal accounts, see [link to relevant documentation]. Figure 3 As shown, Figure 3 This is a schematic block diagram of an abnormal account determination device according to an embodiment of the present invention. The abnormal account determination device 30 includes:

[0148] Parsing module 31 is used to parse business domain metadata and determine the receiving scenario of the target receiving end when receiving the short call based on the parsing result.

[0149] The execution module 32 is used to determine, based on the receiving scenario, whether the calling terminal that makes the short call to the target receiving terminal is an abnormal account.

[0150] In some embodiments, the parsing result may optionally include the location information of the target receiving end when answering the short call, and the acceleration information of the target receiving end during the time period of answering the short call.

[0151] In some embodiments, optionally, the parsing module 31 is further configured to determine the answering scenario of the target receiving end when answering the short call based on the location information and the acceleration information.

[0152] In some embodiments, optionally, the parsing module 31 is further configured to calibrate the position information and the acceleration information using monitoring data from a sensor pre-installed on the target receiver.

[0153] In some embodiments, optionally, the execution module 32 is further configured to determine the risk score of the answering scenario according to a preset risk assessment function; and to construct the feature vector of the short call according to the answering scenario and the parsing result, and input the feature vector into a pre-trained anomaly recognition model to obtain the anomaly probability of the short call;

[0154] The execution module 32 is further configured to determine a comprehensive risk score based on the risk score and the anomaly probability;

[0155] The execution module 32 is further configured to determine that the dialing terminal is an abnormal account if the comprehensive risk score exceeds a preset risk threshold.

[0156] In some embodiments, the parsing result may optionally include the location information of the target receiving end when answering the short call, and the acceleration information of the target receiving end during the time period of answering the short call.

[0157] In some embodiments, the parsing result may optionally include at least one of the following:

[0158] The call duration of the short call, the environmental adaptability score of the short call, the time characteristics of the short call, and the historical call data of the dialing terminal.

[0159] The device for determining abnormal accounts provided in this embodiment of the invention can implement the various processes implemented in the method embodiment and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0160] This invention provides an electronic device 40, see [link to relevant documentation]. Figure 4 As shown, Figure 4 This is a schematic block diagram of an electronic device 40 according to an embodiment of the present invention, including a processor 41, a memory 42, and a program or instructions stored in the memory 42 and executable on the processor 41. When the program or instructions are executed by the processor, they implement the steps in any of the abnormal account determination methods of the present invention.

[0161] This invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements various processes of the embodiment of the method for determining abnormal accounts as described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0162] The readable storage medium may include, for example, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk. In some examples, the readable storage medium may be a non-transient readable storage medium.

[0163] This invention also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the method embodiment for determining abnormal accounts described above, and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0164] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0165] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0166] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A method of determining an abnormal account, characterized by, The method comprises: analyzing business domain metadata to determine a listening scenario of a target listening end listening to a short call according to an analysis result; determining whether a calling end calling the target listening end is an abnormal account according to the listening scenario.

2. The method of claim 1, wherein: the analysis result comprises position information of the target listening end when listening to the short call, and acceleration information of the target listening end within a time period of listening to the short call.

3. The method of claim 2, wherein: determining the listening scenario of the target listening end listening to the short call according to the analysis result comprises: determining the listening scenario of the target listening end listening to the short call according to the position information and the acceleration information.

4. The method of claim 3, wherein: determining the listening scenario of the target listening end listening to the short call according to the position information and the acceleration information further comprises: calibrating the position information and the acceleration information by using monitoring data of a sensor pre-installed in the target listening end.

5. The method of claim 1, wherein: determining whether the calling end calling the target listening end is an abnormal account according to the listening scenario comprises: determining a risk score of the listening scenario according to a preset risk assessment function; constructing a feature vector of the short call according to the listening scenario and the analysis result, inputting the feature vector into a pre-trained abnormality recognition model to obtain an abnormality probability of the short call; determining a comprehensive risk score according to the risk score and the abnormality probability; and determining that the calling end is an abnormal account if the comprehensive risk score exceeds a preset risk threshold.

6. The method of claim 5, wherein: the analysis result comprises position information of the target listening end when listening to the short call, and acceleration information of the target listening end within a time period of listening to the short call.

7. The method of claim 6, wherein: the analysis result further comprises at least one of the following: a call duration of the short call, an environmental adaptability score of the short call, a time characteristic of the short call, and historical call data of the calling end. The method comprises: an analysis module configured to analyze business domain metadata to determine a listening scenario of a target listening end listening to a short call according to an analysis result; 8. An abnormal account determining apparatus characterized by comprising: an execution module configured to determine whether a calling end calling the target listening end is an abnormal account according to the listening scenario. The device comprises a processor, a memory, and a program or instructions stored in the memory and executable on the processor, and the program or instructions are executed by the processor to implement the steps of the method of claim 1 to 7. ​ 9. An electronic device, comprising: ​ 10. A readable storage medium characterized by: The readable storage medium stores programs or instructions, which, when executed by a processor, implement the steps in the determination method of the abnormal account according to any one of claims 1 to 7.

11. A computer program product, characterised in that, The readable storage medium stores programs or instructions, which, when executed by a processor, implement the steps in the determination method of the abnormal account according to any one of claims 1 to 7.

Images