Fraud number identification method and system

Abstract

The invention relates to a fraud number recognition method and system, and the method comprises the steps: carrying out the voice abnormality recognition, text abnormality recognition and behavior abnormality recognition of the obtained multi-mode communication data of each number; weighted dynamic scoring is carried out on the voice abnormity recognition result, the text abnormity recognition result and the behavior abnormity recognition result obtained by each number through a weighted fusion mechanism, so that current case-related numbers are obtained, and each case-related number is used as a core node. Constructing a case-related association network based on a core node according to the multi-mode communication data of each case-related number, performing semantic learning on the case-related association network by adopting a GAT map attention network, and generating a fraud prediction model based on the captured fraud mode and the active period of the core node; and carrying out identification and early warning on future case-related numbers through the fraud prediction model. Therefore, according to the method and the system, the fraud number is accurately identified, and meanwhile, early warning can be performed on the occurrence of future fraud behaviors.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and system for identifying fraudulent phone numbers. Background Technology

[0002] In today's communication networks, fraudulent calls have become a serious challenge threatening public property safety and social trust. To address this problem, the industry has proposed various technical solutions, but all have revealed their limitations when applied to fraudulent number identification scenarios.

[0003] For example, methods based on dynamic biometric detection identify recorded or synthesized speech by analyzing features such as speech spectrum and speech rate fluctuations during calls. However, their recognition accuracy is easily affected by environmental noise and network transmission quality. Methods based on intelligent relationship graphs rely heavily on existing call records. For new fraudulent numbers that have not yet established contact with victims, the graph cannot establish effective association nodes due to the lack of historical call link data. This results in almost zero early warning capability before fraud occurs. Furthermore, relying solely on historical call link data makes it difficult to distinguish the behavioral differences between legitimate business numbers and fraudulent numbers, leading to insufficient recognition accuracy and a high false alarm rate.

[0004] Therefore, there is an urgent need for a method to identify fraudulent numbers that can balance accuracy and foresight.

[0005] A novel identification method that can break through the dependence on a single call link and integrate multi-dimensional behavioral characteristics can achieve more accurate and forward-looking insights into fraudulent numbers. Summary of the Invention

[0006] The technical problem to be solved by the present invention is: the present invention provides a method and system for identifying fraudulent numbers, which can accurately identify fraudulent numbers and provide early warning of future fraudulent activities.

[0007] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention provides a method for identifying fraudulent phone numbers, comprising: Acquire multimodal communication data from all numbers, and perform voice anomaly recognition, text anomaly recognition, and behavior anomaly recognition on the multimodal communication data of each number to obtain the corresponding voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results; The voice anomaly recognition result, text anomaly recognition result, and behavior anomaly recognition result of each number are weighted and dynamically scored through a weighted fusion mechanism to obtain the weighted dynamic score result of each number. All the currently involved numbers are obtained based on the weighted dynamic score results. Using each currently involved number as a core node, and constructing a case-related association network based on the multimodal communication data of each currently involved number, a GAT graph attention network is used to perform semantic learning on the case-related association network to capture the fraud patterns and activity cycles of the core nodes. A fraud prediction model is generated based on the fraud patterns and activity cycles, and the fraud prediction model is used to identify and warn of future involved numbers.

[0008] The beneficial effects of this invention are as follows: It performs voice anomaly recognition, text anomaly recognition, and behavioral anomaly recognition on multimodal communication data of all numbers. This not only breaks the limitation of screening only key numbers and avoids the omission of currently involved numbers due to targeted screening, but also weakens the misjudgment impact of single-dimensional anomaly recognition by using a weighted fusion mechanism for weighted dynamic scoring through multi-dimensional anomaly recognition, thus improving the accuracy of identifying currently involved numbers. A case-related association network is constructed with each currently involved number as a core node, and semantic learning is performed on the case-related association network using a GAT graph attention network to achieve focus on core nodes, avoid interference from irrelevant numbers, improve the accuracy of capturing fraud patterns and activity cycles, and build a fraud prediction model based on the captured fraud patterns and activity cycles. This breaks through the limitation of only being able to identify currently involved numbers and can identify and warn of future involved numbers, improving the initiative and foresight of risk prevention and control.

[0009] Optionally, the multimodal communication data includes communication voice data, communication text data, and communication behavior data. The step of performing voice anomaly recognition, text anomaly recognition, and behavior anomaly recognition on the multimodal communication data of each number to obtain corresponding voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results includes: By using voiceprint recognition technology to identify abnormal intonation and AI-synthesized speech in the communication voice data of each number, the voice anomaly recognition results including abnormal intonation and AI-synthesized speech are obtained. The first pre-trained model is used to identify abnormal keywords and abnormal semantics in the communication text data of each number, and the text anomaly identification results including abnormal keywords and abnormal semantics are obtained. The second pre-trained model is used to identify abnormal calls, abnormal transactions, and abnormal changes in the communication behavior data of each number, resulting in abnormal behavior identification results including abnormal calls, abnormal transactions, and abnormal changes.

[0010] As described above, multimodal communication data is subdivided into communication voice data, communication text data, and communication behavior data. Each type of data is further subdivided into different dimensions for anomaly identification, which improves the comprehensiveness of anomaly identification. In addition, dedicated anomaly identification technologies are used for different types of data to improve the accuracy of anomaly identification.

[0011] Optionally, the abnormal semantics include emotional abnormal semantics and logical abnormal semantics. The step of performing abnormal keyword identification and abnormal semantic identification on the communication text data of each number using the first pre-trained model to obtain a text abnormality identification result including abnormal keywords and abnormal semantics includes: The first pre-trained model identifies abnormal keywords in the communication text data of each number based on a preset fraud script template. Obtain the complete abnormal statement of the abnormal keyword, perform sentiment change detection on the complete abnormal statement through the sentiment perception model, and obtain the sentiment change detection result. If the sentiment change detection result is an abnormal sentiment mutation, then generate sentiment abnormal semantics. Simultaneously, a large language model is used to perform contextual contradiction analysis on the complete abnormal statement to generate logical abnormal semantics.

[0012] As described above, identifying abnormal keywords based on pre-set fraud script templates avoids the generalization problem of common keyword identification and improves the efficiency of abnormal keyword identification. The dual-dimensional identification of emotion and logic enhances the comprehensiveness and accuracy of abnormal semantic recognition.

[0013] Optionally, the weighted dynamic scoring of the voice anomaly recognition result, text anomaly recognition result, and behavior anomaly recognition result for each number through a weighted fusion mechanism to obtain the weighted dynamic score result for each number includes: Based on the voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results for each number, the current anomaly scenario corresponding to each number is obtained; The initial weighting formula of the weighted fusion mechanism is obtained. When the current abnormal scenario is a dialect fraud scenario, the voice weight in the initial weighting formula is adjusted to obtain an adjusted initial weighting formula. When the current abnormal scenario is a loan fraud scenario, the text weight in the initial weighting formula is adjusted to obtain an adjusted initial weighting formula. When the current abnormal scenario is a remote fraud scenario, the behavior weight in the initial weighting formula is adjusted to obtain an adjusted initial weighting formula. The voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results of each number are input into the corresponding adjusted initial weighting formula for weighted dynamic scoring to obtain the weighted dynamic score result of each number; The initial weighting formula is as follows: ; in, This represents the weighted dynamic score result for the i-th number. This represents the speech weights that affect the speech anomaly recognition results. This indicates the results of speech anomaly recognition. The text weights represent the factors that influence the results of text anomaly detection. This indicates the text anomaly detection result. The weights of behaviors that influence the results of anomaly identification are represented. This indicates the result of abnormal behavior identification.

[0014] As described above, adjusting the weights of corresponding anomaly identification results for different fraud scenarios strengthens the impact of core anomaly identification results, prevents anomaly identification results from being diluted by fixed weights, improves the rationality and accuracy of weighted dynamic scoring results, and adapts to diverse fraud scenarios, thus enhancing adaptability.

[0015] Optionally, the step of constructing a case-related association network based on each currently involved number as a core node and according to the multimodal communication data of each currently involved number includes: Using each currently involved number as the core node, the associated devices and IPs corresponding to each currently involved number are obtained, and the associated devices are used as the first extended nodes and the associated IPs are used as the second extended nodes. Based on the multimodal communication data of each currently involved number, calculate the relationships between all core nodes, all first extended nodes, and all second extended nodes, and construct connection edges between all core nodes, all first extended nodes, and all second extended nodes according to the relationships to form the involved network.

[0016] As described above, each related device and IP address corresponding to the current number involved in the case is included as an extended node in the network of related cases. Based on the multimodal communication data of the current number involved in the case, all related relationships are calculated, which expands the analysis dimensions of the network of related cases and constructs a complete link.

[0017] Optionally, the step of using a GAT graph attention network to perform semantic learning on the case-related network to capture the fraud patterns and activity cycles of the core nodes, and generating a fraud prediction model based on the fraud patterns and activity cycles, includes: A CNN convolutional neural network is used to aggregate adjacent core nodes in the network of connections involved in the case, resulting in all aggregated nodes; The GAT graph attention network is used to perform semantic learning on all core nodes and all aggregate nodes of the network involved in the case, in order to capture the fraud patterns and activity cycles of the core nodes and the gang crime characteristics of the aggregate nodes. A fraud prediction model is generated based on the fraud pattern, the activity cycle, and the characteristics of the gang's modus operandi.

[0018] As described above, the core nodes of adjacent nodes in the network of cases are aggregated, that is, the current numbers involved in the case are converted into clusters of associations, forming a two-dimensional feature system of individuals and groups. This avoids missing the characteristics of gang crimes by analyzing a single core node alone, provides rich input features for subsequent semantic learning, and improves the quality and accuracy of the constructed fraud prediction model.

[0019] Optionally, it also includes: The prediction results and feedback information of the fraud prediction model are obtained according to a preset period. The prediction results and feedback information are compared to generate difference data. The fraud prediction model is then optimized based on the difference data to obtain an optimized fraud prediction model.

[0020] As described above, the fraud prediction model is periodically optimized to dynamically adapt to changing fraud patterns. This optimization is based on the differences between the prediction results and feedback information, avoiding the blindness of subjectively setting the optimization direction and improving the accuracy of the optimization.

[0021] In a second aspect, the present invention provides a fraudulent number identification system, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the fraudulent number identification method described in the first aspect.

[0022] The technical effect of the fraud number identification system provided in the second aspect is the same as that of the fraud number identification method provided in the first aspect. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating a method for identifying fraudulent phone numbers provided in this embodiment; Figure 2 This is a schematic diagram of the overall process of a method for identifying fraudulent phone numbers provided in this embodiment; Figure 3 This is a schematic diagram of the structure of a fraudulent number identification system provided in this embodiment.

[0024] [Explanation of Labels in the Attached Image] 1. A system for identifying fraudulent phone numbers; 2. Processor; 3. Memory. Detailed Implementation

[0025] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention can be understood more clearly and thoroughly, and that the scope of the present invention can be fully conveyed to those skilled in the art.

[0026] Example 1 Please refer to Figures 1 to 2 This invention provides a method for achieving zero-intrusion dynamic data desensitization, comprising the following steps: S1. Obtain multimodal communication data for all numbers, and perform voice anomaly recognition, text anomaly recognition, and behavior anomaly recognition on the multimodal communication data of each number to obtain the corresponding voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results; In this embodiment, as Figure 2 As shown, multimodal communication data for all numbers is acquired. This multimodal communication data includes, but is not limited to, voice data, text data, and behavioral data. Text data includes SMS and social media text data, while behavioral data includes call activity, transaction activity, and number association change activity. Voice anomaly recognition, text anomaly recognition, and behavioral anomaly recognition are then performed on the multimodal communication data for each number to obtain the corresponding voice anomaly recognition results, text anomaly recognition results, and behavioral anomaly recognition results.

[0027] At this point, the multimodal communication data in step S1 includes communication voice data, communication text data, and communication behavior data. The step of performing voice anomaly recognition, text anomaly recognition, and behavior anomaly recognition on the multimodal communication data of each number to obtain the corresponding voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results includes: S11. Using voiceprint recognition technology, abnormal tone recognition and AI synthesized voice recognition are performed on the communication voice data of each number to obtain voice anomaly recognition results including abnormal tone and AI synthesized voice. S12. The communication text data of each number is subjected to abnormal keyword recognition and abnormal semantic recognition through the first pre-trained model to obtain the text anomaly recognition result including abnormal keywords and abnormal semantics. At this point, step S12 includes: S121. The first pre-trained model identifies abnormal keywords in the communication text data of each number based on a preset fraud script template, and obtains abnormal keywords. S122. Obtain the complete abnormal statement of the abnormal keyword, perform emotional change detection on the complete abnormal statement through the emotional perception model, and obtain the emotional change detection result. If the emotional change detection result is an abnormal emotional mutation, then generate emotional abnormal semantics. S123. Simultaneously, the complete abnormal statement is subjected to contextual contradiction analysis using a large language model to generate logical abnormal semantics.

[0028] S13. The second pre-trained model is used to identify abnormal calls, abnormal transactions, and abnormal changes in the communication behavior data of each number, resulting in abnormal behavior identification results including abnormal calls, abnormal transactions, and abnormal changes.

[0029] In this embodiment, as Figure 2 As shown, specific anomaly identification methods are set for different types of data in multimodal communication data. For communication voice data, abnormal tone identification and AI synthesized voice identification are performed using voiceprint recognition technology. For communication text data, abnormal keyword identification and abnormal semantic identification are performed using a first pre-trained model. Abnormal semantics include emotional abnormal semantics and logical abnormal semantics. When identifying abnormal keywords, it is based on a preset fraud script template. The fraud script template contains existing high-frequency fraud keywords, such as: transfer, project, office, private, verification code, security account, million-dollar guarantee, remote operation, sharing, etc. After identifying abnormal keywords, the complete abnormal sentence of the abnormal keyword is obtained. Emotional change detection is performed using an emotion perception model. If the emotion change detection result is an abnormal emotional abrupt change, such as: suddenly using oppressive or threatening language, then emotional abnormal semantics are generated. At the same time, the complete abnormal sentence is analyzed for contextual contradictions using a large language model. For example, if the complete abnormal sentence contains a notice / content of a meeting tomorrow, but the time of sending is early morning, then it is considered to have a logical contradiction, and logical abnormal semantics are generated. For communication behavior data, abnormal call identification, abnormal transaction identification, and abnormal change identification are performed through a second training model. Abnormal call identification refers to: cross-regional calls exceeding a first threshold within a preset first time period, such as: more than 50 cross-regional calls within 24 hours. Abnormal transaction identification refers to: transactions concentrated in the early morning, such as: 2:00-5:00. Abnormal change identification refers to: the number of changes of the associated accounts under the number exceeding a second threshold within a preset second time period, such as: the average number of changes of associated accounts exceeding 10 per month.

[0030] S2. The voice anomaly recognition result, text anomaly recognition result, and behavior anomaly recognition result of each number are weighted and dynamically scored through a weighted fusion mechanism to obtain the weighted dynamic score result of each number. All the currently involved numbers are obtained based on the weighted dynamic score results. At this point, the weighted dynamic scoring of the voice anomaly recognition result, text anomaly recognition result, and behavior anomaly recognition result for each number through the weighted fusion mechanism described in step S2, to obtain the weighted dynamic scoring result for each number, includes: S21. Based on the voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results for each number, obtain the current anomaly scenario corresponding to each number; S22. Obtain the initial weighting formula of the weighted fusion mechanism. When the current abnormal scenario is a dialect fraud scenario, adjust the voice weight in the initial weighting formula to obtain the adjusted initial weighting formula. When the current abnormal scenario is a loan fraud scenario, adjust the text weight in the initial weighting formula to obtain the adjusted initial weighting formula. When the current abnormal scenario is a remote fraud scenario, adjust the behavior weight in the initial weighting formula to obtain the adjusted initial weighting formula. S23. Input the voice anomaly recognition result, text anomaly recognition result and behavior anomaly recognition result of each number into the corresponding adjusted initial weighting formula for weighted dynamic scoring to obtain the weighted dynamic scoring result of each number. The initial weighting formula is as follows: ; in, This represents the weighted dynamic score result for the i-th number. This represents the speech weights that affect the speech anomaly recognition results. This indicates the results of speech anomaly recognition. The text weights represent the factors that influence the results of text anomaly detection. This indicates the text anomaly detection result. The weights of behaviors that influence the results of anomaly identification are represented. This indicates the result of abnormal behavior identification.

[0031] In this implementation, such as Figure 2As shown, based on the voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results for each number, the corresponding current anomaly scenario can be obtained. When the current anomaly scenario is a dialect fraud scenario, it indicates that the influence of communication voice data is significant. Therefore, the voice weights affecting the voice anomaly recognition results in the initial weighting formula are adjusted, with the adjustment being increased. When the current anomaly scenario is a loan fraud scenario, it usually involves abnormal keywords in fraudulent script templates. Therefore, the text weights affecting the text anomaly recognition results in the initial weighting formula are adjusted, with the adjustment being increased. When the current anomaly scenario is a remote fraud scenario, abnormal calls and transactions are usually frequent. Therefore, the behavior weights affecting the behavior anomaly recognition results in the initial weighting formula are adjusted, with the adjustment being increased. This yields the corresponding adjusted initial weighting formula. The voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results for each number are input into the corresponding adjusted initial weighting formula for weighted dynamic scoring to obtain the weighted dynamic score result for each number. Numbers whose weighted dynamic score results exceed the scoring threshold are designated as the currently involved numbers, thus obtaining all currently involved numbers.

[0032] S3. Using each currently involved number as a core node, and constructing a case-related association network based on the multimodal communication data of each currently involved number, using a GAT graph attention network to perform semantic learning on the case-related association network to capture the fraud patterns and activity cycles of the core nodes, generating a fraud prediction model based on the fraud patterns and activity cycles, and using the fraud prediction model to identify and warn of future involved numbers.

[0033] At this point, step S3, which involves using each currently involved number as a core node and constructing a case-related association network based on the multimodal communication data of each currently involved number, includes: S31. Taking each currently involved number as the core node, simultaneously obtain the involved related device and involved related IP corresponding to each currently involved number, and take the involved related device as the first extended node and the involved related IP as the second extended node; S32. Calculate the association relationships between all core nodes, all first extended nodes, and all second extended nodes based on the multimodal communication data of each current number involved in the case, and construct the connection edges of all core nodes, all first extended nodes, and all second extended nodes according to the association relationships to form the case-related association network.

[0034] In this embodiment, as Figure 2As shown, the associated devices and IPs corresponding to each current number involved in the case are obtained. The associated devices are used as the first extension node, and the associated IPs are used as the second extension node. That is, the nodes are extended to avoid problems such as missed detection of crimes committed by changing numbers or failure to detect shared devices, which may be caused by only analyzing the number itself. Based on the multimodal communication data of each current number involved in the case, the relationships between all core nodes, the first extension node, and the second extension node are calculated, such as the same associated IP, the same associated device, the same geographical location, etc. The connection edges of all nodes are constructed in this way to form a network of connections involved in the case.

[0035] At this point, step S3, which involves using a GAT graph attention network to perform semantic learning on the case-related network to capture the fraud patterns and activity cycles of the core nodes, and generating a fraud prediction model based on the fraud patterns and activity cycles, includes: S33. Use a CNN convolutional neural network to aggregate adjacent core nodes in the network of connections involved in the case to obtain all aggregated nodes; S34. Use GAT graph attention network to perform semantic learning on all core nodes and all aggregate nodes of the case-related network to capture the fraud patterns and activity cycles of the core nodes and the gang crime characteristics of the aggregate nodes. S35. Generate a fraud prediction model based on the fraud pattern, the activity cycle, and the characteristics of the gang's criminal activities.

[0036] In this embodiment, as Figure 2 As shown, a CNN convolutional neural network is used to aggregate adjacent core nodes in the case-related network to obtain all aggregate nodes. That is, the case-related features of scattered single core nodes can be transformed into common case-related features of number clusters. A GAT graph attention network is used to perform semantic learning on all core nodes and all aggregate nodes in the case-related network to capture the fraud patterns and activity cycles of core nodes and the gang crime characteristics of aggregate nodes. A fraud prediction model is generated based on the fraud patterns, activity cycles and gang crime characteristics.

[0037] Because fraud patterns are constantly evolving and updated, the fraud prediction model will be periodically optimized in the future. The specific steps are as follows: The prediction results and feedback information of the fraud prediction model are obtained according to a preset period. The prediction results and feedback information are compared to generate difference data. The fraud prediction model is then optimized based on the difference data to obtain an optimized fraud prediction model.

[0038] In this embodiment, as Figure 2As shown, the prediction results and feedback information of the fraud prediction model are obtained according to a preset period, and the fraud prediction model is optimized based on the difference data generated by the two, so as to obtain the optimized fraud prediction model.

[0039] Example 2 Please refer to Figure 3 The present invention provides a fraudulent number identification system 1, including a memory 3, a processor 2, and a computer program stored on the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, it implements the steps in Embodiment 1.

[0040] Since the systems / devices described in the above embodiments of the present invention are systems / devices used to implement the methods of the above embodiments of the present invention, those skilled in the art can understand the specific structure and modifications of the systems / devices based on the methods described in the above embodiments of the present invention, and therefore will not be repeated here. All systems / devices used in the methods of the above embodiments of the present invention fall within the scope of protection of the present invention.

[0041] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0042] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0043] It should be noted that any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims that enumerate several means, several of these means may be embodied by the same hardware. The use of the terms first, second, third, etc., is merely for convenience of expression and does not indicate any order. These terms can be understood as part of the component names.

[0044] Furthermore, it should be noted that in the description of this specification, the terms "one embodiment," "some embodiments," "embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0045] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the claims should be interpreted to include both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0046] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, then this invention should also include these modifications and variations.

Claims

1. A method for identifying fraudulent phone numbers, characterized in that, include: Acquire multimodal communication data from all numbers, and perform voice anomaly recognition, text anomaly recognition, and behavior anomaly recognition on the multimodal communication data of each number to obtain the corresponding voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results; The voice anomaly recognition result, text anomaly recognition result, and behavior anomaly recognition result of each number are weighted and dynamically scored through a weighted fusion mechanism to obtain the weighted dynamic score result of each number. All the currently involved numbers are obtained based on the weighted dynamic score results. Using each currently involved number as a core node, and constructing a case-related association network based on the multimodal communication data of each currently involved number, a GAT graph attention network is used to perform semantic learning on the case-related association network to capture the fraud patterns and activity cycles of the core nodes. A fraud prediction model is generated based on the fraud patterns and activity cycles, and the fraud prediction model is used to identify and warn of future involved numbers.

2. The method for identifying fraudulent phone numbers as described in claim 1, characterized in that, The multimodal communication data includes communication voice data, communication text data, and communication behavior data. The process of performing voice anomaly recognition, text anomaly recognition, and behavior anomaly recognition on the multimodal communication data of each number to obtain corresponding voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results includes: By using voiceprint recognition technology to identify abnormal intonation and AI-synthesized voice in the communication voice data of each number, the voice anomaly recognition results including abnormal intonation and AI-synthesized voice are obtained. The first pre-trained model is used to identify abnormal keywords and abnormal semantics in the communication text data of each number, and the text anomaly identification results including abnormal keywords and abnormal semantics are obtained. The second pre-trained model is used to identify abnormal calls, abnormal transactions, and abnormal changes in the communication behavior data of each number, resulting in abnormal behavior identification results including abnormal calls, abnormal transactions, and abnormal changes.

3. The method for identifying fraudulent phone numbers as described in claim 2, characterized in that, The abnormal semantics include emotional abnormal semantics and logical abnormal semantics. The step of using a first pre-trained model to identify abnormal keywords and abnormal semantics in the communication text data of each number, resulting in text anomaly identification results including abnormal keywords and abnormal semantics, includes: The first pre-trained model identifies abnormal keywords in the communication text data of each number based on a preset fraud script template. Obtain the complete abnormal statement containing the abnormal keywords, perform sentiment change detection on the complete abnormal statement using a sentiment perception model, and obtain the sentiment change detection result. If the sentiment change detection result is an abnormal sentiment mutation, then generate sentiment abnormal semantics. Simultaneously, a large language model is used to perform contextual contradiction analysis on the complete abnormal statement to generate logical abnormal semantics.

4. The method for identifying fraudulent phone numbers as described in claim 1, characterized in that, The weighted fusion mechanism is used to dynamically score the voice anomaly recognition results, text anomaly recognition results, and behavioral anomaly recognition results for each number, resulting in a weighted dynamic score for each number, including: Based on the voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results for each number, the current anomaly scenario corresponding to each number is obtained; The initial weighting formula of the weighted fusion mechanism is obtained. When the current abnormal scenario is a dialect fraud scenario, the voice weight in the initial weighting formula is adjusted to obtain an adjusted initial weighting formula. When the current abnormal scenario is a loan fraud scenario, the text weight in the initial weighting formula is adjusted to obtain an adjusted initial weighting formula. When the current abnormal scenario is a remote fraud scenario, the behavior weight in the initial weighting formula is adjusted to obtain an adjusted initial weighting formula. The voice anomaly recognition results, text anomaly recognition results, and behavior anomaly recognition results of each number are input into the corresponding adjusted initial weighting formula for weighted dynamic scoring to obtain the weighted dynamic score result of each number; The initial weighting formula is as follows: ； in, This represents the weighted dynamic score result for the i-th number. This represents the speech weights that affect the speech anomaly recognition results. This indicates the results of speech anomaly recognition. The text weights represent the factors that influence the results of text anomaly detection. This indicates the text anomaly detection result. The weights of behaviors that influence the results of anomaly identification are represented. This indicates the result of abnormal behavior identification.

5. The method for identifying fraudulent phone numbers as described in claim 1, characterized in that, The construction of a case-related association network based on each currently involved number as a core node and according to the multimodal communication data of each currently involved number includes: Using each currently involved number as the core node, the associated devices and IPs corresponding to each currently involved number are obtained, and the associated devices are used as the first extended nodes and the associated IPs are used as the second extended nodes. Based on the multimodal communication data of each currently involved number, calculate the relationships between all core nodes, all first extended nodes, and all second extended nodes, and construct connection edges between all core nodes, all first extended nodes, and all second extended nodes according to the relationships to form the involved network.

6. The method for identifying fraudulent phone numbers as described in claim 1, characterized in that, The step of employing a GAT graph attention network to perform semantic learning on the case-related network to capture the fraud patterns and activity cycles of the core nodes, and generating a fraud prediction model based on the fraud patterns and activity cycles, includes: A CNN convolutional neural network is used to aggregate adjacent core nodes in the network of connections involved in the case, resulting in all aggregated nodes; The GAT graph attention network is used to perform semantic learning on all core nodes and all aggregate nodes of the network involved in the case, in order to capture the fraud patterns and activity cycles of the core nodes and the gang crime characteristics of the aggregate nodes. A fraud prediction model is generated based on the fraud pattern, the activity cycle, and the characteristics of the gang's modus operandi.

7. The method for identifying fraudulent phone numbers as described in claim 1, characterized in that, Also includes: The prediction results and feedback information of the fraud prediction model are obtained according to a preset period. The prediction results and feedback information are compared to generate difference data. The fraud prediction model is then optimized based on the difference data to obtain an optimized fraud prediction model.

8. A system for fraudulent phone numbers, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 7.

Images