A telecommunications fraud identification method based on multi-modal data causal modeling

Abstract

The application relates to the technical field of network security, and specifically provides a telecommunications fraud behavior identification method based on multi-modal data causal modeling. First, entities and entity relationships in telecommunications behaviors are extracted, and a heterogeneous knowledge graph of the telecommunications behaviors is constructed. Entity representation vectors are obtained by using a graph learning technology, necessary conditions of normal telecommunications behaviors are mined, a causal analysis model is trained by taking the normal telecommunications behaviors as samples, a reverse causal reasoning mechanism is used to identify whether potential fraudulent behaviors exist in the telecommunications behaviors to be measured, and the potential fraudulent behaviors are traced back to the fraud behaviors based on the heterogeneous knowledge graph. The application realizes accurate identification and tracing of the fraud behaviors through multi-modal data fusion and causal reasoning as well as reverse causal reasoning, can be widely applied to scenarios such as telecommunications operation and anti-fraud application, and provides a powerful guarantee for telecommunications network security.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling. Background Technology

[0002] With the rapid development of the digital economy, telecommunications networks have become deeply integrated into daily communication, travel, consumption, and other aspects of people's lives, becoming a core infrastructure supporting social operation and economic activities. However, at the same time, telecommunications fraud has exploded, directly causing financial losses to the public and posing a significant threat to the healthy development of the digital economy. Against this backdrop, developing technologies capable of accurately identifying fraudulent activities and efficiently tracing the source of fraud has become a core need urgently needing to be addressed in the field of telecommunications network security.

[0003] Current mainstream methods for detecting telecom fraud fall into three main categories, but all suffer from insurmountable limitations: First, rule-based detection methods rely on manually summarizing fraudulent features such as "frequent calls to unknown numbers" and "abnormal surges in traffic at night" to build rule bases. While these methods offer advantages such as high analytical efficiency and easily interpretable results, rule updates are entirely manual, resulting in poor adaptability to rapidly evolving new fraudulent tactics and a significant "lag." Second, traditional machine learning-based detection methods extract statistical features such as call duration distribution and traffic usage periods to build classification models like support vector machines and random forests. However, these methods heavily depend on large-scale labeled fraudulent samples, while fraudulent behavior accounts for a very low percentage in real-world scenarios (usually less than 0.1%). Furthermore, there are no historical samples to refer to for new types of fraudulent behavior, and manually designing features is time-consuming and labor-intensive, making it difficult to cover implicit correlations in multimodal data. Third, analysis methods based on single-modal data rely solely on call data or location data for analysis, failing to capture cross-modal combination features such as "unknown numbers, overseas locations, and fake identity text descriptions." Summary of the Invention

[0004] In view of this, the present invention aims to provide a method for identifying telecommunications fraud based on causal modeling of multimodal data. By integrating multimodal telecommunications data to construct a heterogeneous knowledge graph, and combining causal reasoning technology to mine the logical connections behind the behavior, it achieves accurate identification and efficient tracing of fraudulent behavior. It breaks through the limitations of traditional methods by using a "black and white" reverse causal reasoning mechanism, and avoids the problem that traditional models that directly identify whether telecommunications behavior has potential fraud require a large amount of novel training data.

[0005] To achieve the above objectives, the technical solution created by this invention is implemented as follows: This invention provides a method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling, comprising: S1: Based on predefined rule parsing methods and pre-trained large language models, entities and entity relationships in telecommunications behavior are extracted, and a heterogeneous knowledge graph of telecommunications behavior is constructed based on entities and entity relationships; S2: Utilize graph learning techniques to obtain entity representation vectors based on heterogeneous knowledge graphs; Collect and label normal telecommunications behavior, and determine the necessary conditions for normal telecommunications behavior through causal mining tools; Using pre-calibrated normal telecommunications behaviors as samples, the entity representation vectors of the samples are input into the causal analysis model for training. The reasonableness score of the telecommunications behavior to be tested is obtained through the trained causal analysis model. Using a reverse causal reasoning mechanism, based on the reasonableness score of the telecommunications behavior under test and whether the telecommunications behavior under test meets the necessary conditions, it identifies whether there is potential fraud in the telecommunications behavior under test. S3: Based on heterogeneous knowledge graphs, analyze the information dissemination path of potential fraudulent activities, trace the entities and entity relationships associated with potential fraudulent activities, and generate a fraud-related behavior tracing report.

[0006] Preferably, telecommunications behavior includes: structured data and unstructured data, wherein structured data includes: call detail records, data usage bills, user information, and location tracking; and unstructured data includes: user text notes, customer service interaction records, and SMS content.

[0007] Preferably, initial entities and entity relationships are extracted from structured data using a predefined rule parsing method to form initial entity-relation triples; a pre-trained large language model is used to perform semantic understanding on unstructured data to extract entities and potential entity relationships; the initial entities extracted from structured data are matched and fused with the entities extracted from unstructured data to obtain a heterogeneous knowledge graph of telecommunications behavior. for: ; in, Let n represent the set of entities, and n represent the number of entities. Represents a set of entity relations. and It represents any two entities.

[0008] Preferably, entity representation vectors are obtained based on heterogeneous knowledge graphs using graph learning techniques, including: Construct a graph neural network to extract attribute features of entities. Relationship characteristics and spectral structural features The features are then concatenated to obtain the initial feature matrix for each entity. ,in, The dimension representing the attribute feature. Dimensions representing relational features Dimensions representing the structural features of the graph; A multi-layer attention mechanism is used to aggregate features of entities, and a low-density vector of each entity is calculated.

[0009] Preferably, the causal analysis model includes at least two Transformer encoder layers and one fully connected layer, and outputs a reasonableness score of the telecommunications behavior under test based on a multi-head self-attention mechanism.

[0010] Preferably, the causal mining tool is the causal forest model, which obtains at least 50 necessary conditions for normal telecommunications behavior.

[0011] Preferably, a reverse causal reasoning mechanism is adopted, based on the reasonableness score of the telecommunications behavior under test and the determination of whether the telecommunications behavior under test meets the necessary conditions, to identify whether the telecommunications behavior under test has potential fraudulent behavior, including: The reasonableness score of the telecommunications behavior to be tested is obtained by inputting it into the trained causal analysis model. If the reasonableness score of the telecommunications behavior to be tested is greater than the preset score threshold, and the number of necessary conditions satisfied by the telecommunications behavior to be tested is greater than the preset condition threshold, then the telecommunications behavior to be tested is considered to be without fraudulent behavior; otherwise, the telecommunications behavior to be tested is judged to have potential fraudulent behavior.

[0012] Preferably, the loss function L during the training process of the causal analysis model is: ; Where M represents the number of samples, For reasonableness scoring, This indicates normal electrical behavior. Indicating fraudulent behavior, is the entity representation vector of the sample.

[0013] Preferably, in S3, multiple quantification dimensions are set and weights are assigned for different entity relationships in the heterogeneous knowledge graph, and the initial entity relationship strength values ​​of different entities are calculated. The initial entity relationship strength value is then adjusted based on the duration of the entity relationship to obtain the final entity relationship strength value used for source tracing analysis. Starting with entities with potential fraudulent behavior, directly related entities with relationship strength values ​​not lower than a first threshold are selected to form the first layer of related sets; Starting from the entities in the first-level association set, select directly related entities with an entity relationship strength value not lower than the second threshold to form the second-level association set; thus forming a multi-level propagation path that includes at least the starting node, the first-level association set, and the second-level association set. Based on the analysis of multi-level propagation paths, this study identifies potential fraudulent activities in each entity and its relationships, and generates a report on the source of fraudulent activities.

[0014] Compared with the prior art, the present invention can achieve the following beneficial effects: This invention combines rule parsing and a large language model to analyze and align users' structured and unstructured data, achieving accurate extraction of entities and relationships from multimodal data. It also corrects erroneous information based on semantic understanding, avoiding the risk of false alarms and fraud caused by erroneous information that is common in traditional methods. This invention constructs a high-quality heterogeneous knowledge graph based on multimodal data and supports dynamic updates, solving the problem of unified representation of multimodal data.

[0015] This invention trains a causal analysis model using normal behavior data as the core, employing a "black and white" reverse causal reasoning approach to transform the "fraud behavior identification problem" into a "normal telecommunications behavior identification problem." This overcomes limitations such as the scarcity of fraudulent samples and the rapid updating of fraudulent behaviors, improving the model's adaptability to new types of fraudulent behavior. Based on a two-way constraint of reasonableness scoring and a causal rule base for normal behavior, it identifies normal telecommunications behavior, improving the accuracy of normal telecommunications behavior identification. Furthermore, fraudulent telecommunications behavior can be used as negative samples to deepen the analytical capabilities of the causal analysis model. Training with normal telecommunications behavior samples allows the causal analysis model to acquire highly universal analytical logic, while further reinforcement training with negative samples enhances the model's identification accuracy, preventing the causal analysis model from misidentifying new fraudulent behaviors as normal behavior.

[0016] This invention, based on knowledge graph relationship strength quantification and information propagation path analysis, enables in-depth tracing of fraudulent behavior, providing comprehensive support for anti-fraud decision-making. Simultaneously, by employing a strategy of "shallow filtering + deep analysis," it balances detection efficiency with user experience, avoiding resource waste caused by over-analysis, thus possessing significant practical application value. Attached Figure Description

[0017] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments and descriptions of the invention are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of a telecommunications fraud identification method based on multimodal data causal modeling provided in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the construction of a heterogeneous knowledge graph according to an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only for explaining the invention and do not constitute a limitation thereof. Similar elements in different embodiments are referred to by associated similar element reference numerals. In the following embodiments, many details are described to facilitate a better understanding of the invention. However, those skilled in the art will readily recognize that some features may be omitted in different situations, or may be replaced by other elements, materials, or methods. In some cases, some operations related to the invention are not shown or described in the specification. This is to avoid obscuring the core parts of the invention with excessive description. For those skilled in the art, detailed description of these related operations is not necessary; the relevant operations can be fully understood based on the description in the specification and general technical knowledge in the art.

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this invention can be combined to form various implementations. Furthermore, the order of the steps or actions in the method description can be changed or adjusted in a manner readily apparent to those skilled in the art. Therefore, the various orders in the specification and drawings are merely for the clear description of a particular embodiment and do not imply a mandatory order, unless otherwise stated that a particular order must be followed.

[0020] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on this invention. Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0021] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0022] The invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] Please see Figure 1 In one embodiment of the present invention, a method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling is provided to overcome the shortcomings of existing fraudulent behavior identification methods, such as "difficulty in adapting to new types of fraudulent behavior, poor fusion of multimodal information, and shallow causal logic mining". The method specifically includes the following steps: S1: Based on predefined rule parsing methods and pre-trained large language models, entities and entity relationships in telecommunications behavior are extracted, and a heterogeneous knowledge graph of telecommunications behavior is constructed based on entities and entity relationships; S2: Utilize graph learning techniques to obtain entity representation vectors based on the heterogeneous knowledge graph; Collect and label normal telecommunications behavior, and determine the necessary conditions for normal telecommunications behavior through causal mining tools; Using pre-calibrated normal telecommunications behaviors as samples, the entity representation vectors of the samples are input into the causal analysis model for training. The reasonableness score of the telecommunications behavior to be tested is obtained through the trained causal analysis model. Using a reverse causal reasoning mechanism, based on the reasonableness score of the telecommunications behavior under test and whether the telecommunications behavior under test meets the necessary conditions, it identifies whether there is potential fraud in the telecommunications behavior under test. S3: Based on the heterogeneous knowledge graph, analyze the information dissemination path of potential fraudulent activities, trace the entities and entity relationships associated with potential fraudulent activities, and generate a fraud-related behavior tracing report.

[0024] In step S1, multimodal telecommunications behavior data needs to be transformed into a structured heterogeneous knowledge graph to provide a data structure foundation for subsequent causal analysis. Specifically, for example... Figure 2 As shown, the first step is to collect large-scale telecommunications data that aligns with real-world application scenarios. The data source should cover no fewer than 1 million users. Based on the attributes of telecommunications data, the data format for telecommunications behavior can be divided into structured data and unstructured data. Structured data is represented as follows: Unstructured data is represented as Structured data This includes data with fixed fields and formats, such as call detail records, data usage bills, user profiles, and location tracking. Unstructured data. This includes free-format text data such as user notes, customer service interaction records, and SMS messages.

[0025] After data collection and classification, initial entities and entity relationships are extracted from structured data, and entity extraction matching and error correction are performed on unstructured data. Specifically, structured data is processed based on a predefined rule parsing method. The predefined rules are as follows: First, based on prior knowledge in the telecommunications field, entities and entity relationships are predefined: Entities are described by their attributes. For example, entity A may have attributes such as user identification, SIM card information, and device IMEI code. Typically, an entity can predefine 5-8 core attributes to facilitate entity identification.

[0026] Entity relationships are used to describe the interactive behavior between entities, depicting their dynamic interactions and avoiding the difficulty in identifying potential fraud risks by relying solely on entity attributes. Specifically, entity relationships can include: "User-Holder-SIM Card", "Number-Caller-Number", "User-Appearance-Location", etc. Typically, 4-6 core types of entity relationships can be predefined.

[0027] For structured data on input telecommunications behavior Structured data is processed according to the predefined rules mentioned above. Extract initial entities and entity relationships; the initial entity set is represented as follows. Any entity in the set is represented as .

[0028] For each pair of initial entities, establish an initial entity and entity relation triplet. ,in, This represents the two initial entities extracted. This describes the entity relationship between two initial entities. Further, it involves a triplet representing the initial entities and their relationship. Perform a validity check, such as verifying that the call duration is not negative and the number format is compliant. Remove erroneous data that clearly does not conform to the logic of telecommunications services and retain valid triples. Using triples after removing error messages As the data foundation for constructing heterogeneous knowledge graphs.

[0029] For unstructured data inputting telecommunications behavior This requires the use of a large language model for deep semantic understanding, re-extracting entities based on semantic understanding, and re-processing the triples obtained from structured data. Entity matching and alignment are performed on the data to correct errors. Specifically, the ChatGPT large language model is first selected as the unstructured data. This data processing tool utilizes the BERT-CRF algorithm to extract entities and potential entity relationships. Unstructured data, such as text descriptions of user information and customer service interaction records from telecommunications transactions, are input into a pre-trained ChatGPT large language model. The ChatGPT model performs semantic understanding on the unstructured data and captures the entity sets within it. Any one of the entities is represented as Deep data mining based on semantic understanding cannot be achieved from structured data. Directly obtained potential entity relationships .

[0030] After extracting entities and entity relationships from telecommunications behavior using predefined rule parsing methods and pre-trained large language models, the unstructured data will be transformed into... Acquired entity and structured data The initial entities obtained directly are aligned and matched, specifically through vector similarity calculation. The calculation formula is: ; Setting a similarity threshold of 0.8, when dealing with unstructured data... Entities obtained With structured data The initial entity obtained directly vector similarity If the value is greater than 0.8, the two are considered to belong to the same entity. After entity alignment, errors in entity attribute information obtained from structured data are corrected. Errors may include user-incorrectly entered or outdated data. This is achieved by utilizing unstructured data... Entities obtained The attribute information automatically corrects or completes the error information, and outputs the correct data after correction to ensure the accuracy of the final entity information.

[0031] The revised entities and entity relationships are further transformed into graph data to construct a heterogeneous knowledge graph of telecommunications behavior. for: ; in, Let n represent the set of entities, and n represent the number of entities. Represents a set of entity relations. and Represents any two entities, where each entity is the modified result.

[0032] As an optional implementation, a batch processing and graph fusion strategy is used to dynamically update the heterogeneous knowledge graph. Specifically, after the initial construction of the heterogeneous knowledge graph, newly added telecommunications data is processed in batches according to a preset time period (e.g., daily, weekly). New entities and entity relationships are extracted using the same method described above, generating new triples. A graph fusion algorithm is then used to merge the new triples with the existing heterogeneous knowledge graph. If some entities in the new entity overlap with those in the existing heterogeneous knowledge graph, a strategy such as attribute-weighted averaging is used for fusion. If the addition of a new entity causes conflicts between newly generated entity relationships and existing entity relationships in the heterogeneous knowledge graph, the data source's reliability is considered for selection, and the heterogeneous knowledge graph is updated accordingly. Each update requires detailed logging, including the update time, the number of newly added / merged entities and entity relationships, to support system traceability and backtracking queries.

[0033] In step S2, a causal analysis model needs to be trained based on the constructed heterogeneous knowledge graph and a large amount of normal behavior data. Through the "black and white" reverse causal reasoning concept, a preliminary and accurate identification of potential fraudulent behavior is achieved. Specifically, firstly, to transform the complex graph structure information into numerical features that can be processed by a deep learning model, a graph neural network (GAT) model is constructed. The heterogeneous knowledge graph is used as input, and the GAT model extracts three types of features from each node of the heterogeneous knowledge graph: attributes, relationships, and structure. The nodes of the heterogeneous knowledge graph are entities. The attribute features of each node are then... Relationship characteristics and spectral structural features Concatenate them into a 256-dimensional initial vector, where n represents the number of nodes (entities). The dimension representing the attribute feature. Dimensions representing relational features R represents the dimension of the graph structure features, and R is a real number. Among these, attribute features... Attributes derived from the entity itself, such as user age and package type. Relationship features derived from the type and attributes of the edges connected to the entity. Graph structure features. It originates from the topological location of an entity in the graph and information about adjacent entities.

[0034] The three types of features are concatenated to form the initial feature vector of the node. Then, a multi-layer self-attention mechanism is used to aggregate neighborhood information and extract features. Finally, an entity representation vector is generated for each entity. The entity representation vector is a 256-dimensional low-dimensional dense vector.

[0035] Further collection and labeling of normal telecommunications behavior, and determination of the necessary conditions for normal telecommunications behavior through causal mining tools. In this embodiment of the invention, no less than 100,000 samples verified as normal telecommunications behavior (such as regular calls, reasonable data usage) are collected to construct a normal behavior dataset. Normal behavior dataset Samples of normal telecommunications behavior are mapped to entity representation vectors using a heterogeneous knowledge graph. A causal forest model is then used as a causal mining tool, inputting these entity representation vectors into the model. The task of the causal forest model is not to find fraud patterns, but rather to reverse-engineer the core necessary conditions and statistical regularities for normal behavior to occur. At least 50 necessary conditions for normal telecommunications behavior (such as rules regarding normal call periods and data usage ranges) are mined and compiled into a causal rule base for normal behavior. This rule base can be further automatically divided into a core necessary rule subset and a general association rule subset based on the importance of the rules and the severity of the consequences of violations, assigning higher decision weights to the core necessary rules.

[0036] A causal analysis model is further constructed, which includes a two-layer Transformer encoder. It utilizes a multi-head self-attention mechanism to capture the complex nonlinearities and dependencies between behavioral features, and finally outputs a behavior rationality score between [0,1] through a fully connected layer. A higher score indicates that the behavior is more in line with normal patterns. The causal analysis model is trained using pre-labeled normal telecommunications behavior as samples. Cross-entropy loss is used as the loss function to drive the model to predict a score close to 1 for normal behavior. A typical training configuration is 20 rounds with a learning rate of 0.0001. The loss function L during the training process of the causal analysis model is: ; Where M represents the number of samples, For reasonableness scoring, This indicates normal electrical behavior. Indicating fraudulent behavior, is the entity representation vector of the sample.

[0037] After constructing the causal rule base for normal behavior and training the causal analysis model, for the telecommunications behavior to be tested, entity representation vectors are extracted according to the heterogeneous knowledge graph and input into the causal analysis model and the causal forest model. The causal forest model is used to analyze whether the telecommunications behavior to be tested meets the necessary conditions for normal telecommunications behavior in the causal rule base for normal behavior. Finally, the causal analysis model is used to output a reasonableness score for the telecommunications behavior to be tested.

[0038] Based on a "black and white" reverse causal reasoning mechanism, the tested telecommunications behavior is identified through dual verification using a reasonableness score and necessary conditions. The specific dual verification rules are as follows: If score If the score is 0.8 and meets the necessary condition of having more than the judgment threshold in the causal rule base, then the telecommunications behavior under test is judged as normal behavior; if the score is <0.8 and does not meet the necessary condition of having more than the judgment threshold in the causal rule base, and cannot be proven through the preset reasonableness proof standards (such as identity verification, business purpose verification, etc.), then it is judged as potential fraudulent behavior.

[0039] Traditional methods for identifying fraudulent activities directly determine whether each entity in a telecommunications transaction has potential fraudulent behavior. This approach requires a large number of fraudulent samples, which are updated and iterated very quickly, making sample acquisition difficult. Traditional methods also cannot identify new fraudulent activities, resulting in low accuracy. This invention, however, takes a different approach. By identifying whether each entity in a telecommunications transaction is engaging in legitimate activity, it uses a "black and white" approach to reverse-engineer whether fraudulent activity exists, reducing the probability of missed fraud detections and overcoming the difficulty of obtaining sufficient fraudulent samples in traditional methods.

[0040] In step S3, to investigate the association between the fraudulent entity and other entities whose potential fraudulent activities were not identified, quantification dimensions (such as call count, duration, and frequency) are set for different types of relationships, and weights are assigned to each dimension (e.g., call duration has a weight of 0.4). After configuring the weights for entity relationships, the dimension data is normalized, and the initial entity relationship strength value is calculated by weighted summation. for: ; in, This represents the weight of each dimension. It can represent any dimension, such as the number of calls, duration, frequency, etc.

[0041] The initial entity relationship strength value is further adjusted based on the duration of the entity relationship to obtain the final entity relationship strength value used for source tracing analysis. for: ; in, , For correction factor, The duration of the entity relationship. This is the configuration coefficient, with a value of 0.1. Entity relationship strength value. It can be used to guide the search for tracing paths.

[0042] Entities with potential fraud Starting from this node, conduct information propagation path analysis: First, filter the starting node. Entities with a relationship strength value no lower than a first threshold that are directly related constitute the first-level association set. Entities in the first-level association set are the second nodes in each fraud-related tracing. The first threshold is set to 0.5. The first-level association set is represented as... .

[0043] Continue to sort and trace multi-level related entities by entity relationship strength value to form a propagation path. Taking the second-level association set of the path as an example, starting with entities in the first-level association set, directly related entities with a relationship strength value not lower than a second threshold are selected to form the second-level association set. The second threshold can be 0.5 or 0.8. Following the above method, the fraud propagation path is traced layer by layer, forming multiple levels and multiple propagation paths, including at least the starting node, the first-level association set, and the second-level first-level association set. The potential for fraudulent behavior is analyzed in each entity and its relationships. Based on the reasonableness score of each entity in each path, each entity is marked, forming a complete fraud-related behavior tracing report.

[0044] As an optional implementation, real fraud cases can be collected periodically as negative samples. The negative samples are then used to update and train the causal analysis model, adjusting the feature weights and causal rule parameters, and retraining for 50 rounds.

[0045] In summary, the above are merely preferred embodiments of this specification and are not intended to limit the scope of protection of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

[0046] The systems, apparatuses, modules, or units described in one or more of the above embodiments may be implemented by a computer chip or entity, or by a product having a certain function. A typical implementation device is a computer. Specifically, a computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0047] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0048] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling, characterized in that, include: S1: Based on predefined rule parsing methods and pre-trained large language models, entities and entity relationships in telecommunications behavior are extracted, and a heterogeneous knowledge graph of telecommunications behavior is constructed based on entities and entity relationships; S2: Utilize graph learning techniques to obtain entity representation vectors based on the heterogeneous knowledge graph; Collect and label normal telecommunications behavior, and determine the necessary conditions for normal telecommunications behavior through causal mining tools; Using pre-calibrated normal telecommunications behaviors as samples, the entity representation vectors of the samples are input into the causal analysis model for training. The reasonableness score of the telecommunications behavior to be tested is obtained through the trained causal analysis model. Using a reverse causal reasoning mechanism, based on the reasonableness score of the telecommunications behavior under test and whether the telecommunications behavior under test meets the necessary conditions, it identifies whether there is potential fraud in the telecommunications behavior under test. S3: Based on the heterogeneous knowledge graph, analyze the information dissemination path of potential fraudulent activities, trace the entities and entity relationships associated with potential fraudulent activities, and generate a fraud-related behavior tracing report.

2. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 1, characterized in that, The telecommunications activities include structured data and unstructured data. Structured data includes call detail records, data usage bills, user information, and location tracking. Unstructured data includes user text notes, customer service interaction records, and SMS content.

3. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 2, characterized in that, Initial entities and entity relationships are extracted from the structured data using a predefined rule parsing method, forming initial entity and entity relationship triples. A pre-trained large language model is then used to perform semantic understanding on the unstructured data, extracting entities and potential entity relationships. The initial entities extracted from the structured data are then matched and fused with the entities extracted from the unstructured data to obtain a heterogeneous knowledge graph of telecommunications behavior. for: ； in, Let n represent the set of entities, and n represent the number of entities. Represents a set of entity relations. and It represents any two entities.

4. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 1, characterized in that, The method of obtaining entity representation vectors based on the heterogeneous knowledge graph using graph learning techniques includes: Construct a graph neural network to extract attribute features of entities. Relationship characteristics and spectral structural features The features are then concatenated to obtain the initial feature matrix for each entity. ,in, The dimension representing the attribute feature. Dimensions representing relational features Dimensions representing the structural features of the graph; A multi-layer attention mechanism is used to aggregate features of entities, and a low-dimensional dense vector is calculated for each entity.

5. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 1, characterized in that, The causal analysis model includes at least two Transformer encoder layers and one fully connected layer, and outputs a reasonableness score of the telecommunications behavior under test based on a multi-head self-attention mechanism.

6. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 1, characterized in that, The causal mining tool is a causal forest model, which obtains at least 50 necessary conditions for normal telecommunications behavior.

7. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 6, characterized in that, The method employs a reverse causal reasoning mechanism, based on a reasonableness score of the telecommunications behavior under test and a determination of whether the telecommunications behavior under test meets necessary conditions, to identify whether the telecommunications behavior under test has potential fraudulent activity, including: The reasonableness score of the telecommunications behavior to be tested is obtained by inputting it into the trained causal analysis model. If the reasonableness score of the telecommunications behavior to be tested is greater than the preset score threshold, and the number of necessary conditions satisfied by the telecommunications behavior to be tested is greater than the preset condition threshold, then the telecommunications behavior to be tested is considered to be without fraudulent behavior; otherwise, the telecommunications behavior to be tested is judged to have potential fraudulent behavior.

8. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 1, characterized in that, The loss function L during the training process of the causal analysis model is: ； Where M represents the number of samples, For reasonableness scoring, This indicates normal electrical behavior. Indicating fraudulent behavior, is the entity representation vector of the sample.

9. The method for identifying telecommunications fraudulent behavior based on multimodal data causal modeling according to claim 1, characterized in that, In step S3, multiple quantization dimensions are set and weights are assigned to different entity relationships in the heterogeneous knowledge graph, and the initial entity relationship strength values ​​of different entities are calculated. The initial entity relationship strength value is then adjusted based on the duration of the entity relationship to obtain the final entity relationship strength value used for source tracing analysis. Starting with entities with potential fraudulent behavior, directly related entities with relationship strength values ​​not lower than a first threshold are selected to form the first layer of related sets; Starting from the entities in the first-level association set, directly associated entities with an entity relationship strength value not lower than the second threshold are selected to form the second-level association set; thus forming a multi-level propagation path that includes at least the starting node, the first-level association set, and the second-level association set. Based on the analysis of the multi-level propagation path, it is possible to identify potential fraudulent activities in each entity and the relationships between entities, and generate a fraud-related behavior tracing report.

Images