GOIP fraud site identification method, apparatus and device, medium and product

Abstract

The invention discloses a GOIP fraud site identification method, apparatus and device, a medium and a product. The method comprises the steps of collecting a training sample data set based on a real-time stream and performing preprocessing; training a BERT model according to the preprocessed training sample data set to obtain a GOIP fraud number recognition model; acquiring to-be-tested sample data from the full-amount GOIP equipment based on the real-time stream, and inputting the to-be-tested sample data into the GOIP fraud number recognition model to obtain a suspected GOIP fraud number; grouping the suspected GOIP fraud numbers according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; and carrying out statistical analysis on the suspected GOIP fraud numbers of each suspected GOIP fraud number group according to the position information, dividing the suspected GOIP fraud numbers into high, medium and low levels, and determining the position of a fraud site in combination with a triangulation positioning mode. According to the method and the device, the GOIP fraud spot can be efficiently and accurately identified.

Description

Technical Field

[0001] This invention relates to the field of IT application technology, and in particular to a method, apparatus, equipment, medium and product for identifying GOIP fraud dens based on the BERT model. Background Technology

[0002] With the rapid development of information technology, telecommunications fraud methods are becoming increasingly diversified. One common type of fraud involves using GOIP devices. GOIP is a network numbering technology that enables global voice calls. However, some criminals use GOIP devices for fraudulent activities, causing significant harm to society. Therefore, effectively identifying and combating GOIP-based fraud rings has become a crucial issue.

[0003] Current methods for identifying GOIP fraud dens suffer from several problems: In terms of clustering algorithms, density-based clustering is affected by data quality, and Gaussian Mixture Model (GMM) clustering is sensitive to initial values, leading to poor clustering results; regarding data real-time performance, a real-time computing framework is not employed, resulting in untimely acquisition of phone numbers; and in terms of data dependency, LSTM requires a large amount of labeled data for training, but in reality, datasets of both GOIP fraud devices and legitimate communication devices are scarce, affecting prediction accuracy. These issues make it difficult to efficiently and accurately identify GOIP fraud dens. Summary of the Invention

[0004] The purpose of this invention is to provide a method, apparatus, device, medium, and product for identifying GOIP fraud dens based on the BERT model. It uses real-time streaming to collect and preprocess data, identifies suspected GOIP fraud numbers using the BERT model without relying on a large amount of labeled data, and uses KD-tree combined with decision tree algorithm, random forest algorithm, and clustering algorithm for grouping, effectively improving the accuracy and efficiency of grouping, thereby achieving efficient and accurate identification of GOIP fraud dens.

[0005] To achieve the above objectives, embodiments of the present invention provide a method for identifying GOIP fraud dens based on the BERT model, including: The training sample dataset is collected based on real-time streaming and preprocessed; wherein, the training sample dataset includes communication information of GOIP fraud devices and communication information of normal communication devices; The BERT model was trained using the preprocessed training sample dataset to obtain the GOIP fraud number identification model; Based on real-time streaming, test sample data is obtained from all GOIP devices, and the test sample data is input into the GOIP fraud number identification model to obtain the suspected GOIP fraud number output by the GOIP fraud number identification model; The suspected GOIP fraud numbers are grouped according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; wherein, the grouping algorithm is a combination of KD tree, decision tree algorithm, random forest algorithm and clustering algorithm; For each suspected GOIP fraud number cluster, the suspected GOIP fraud numbers are statistically analyzed according to their location information to classify them into high, medium, and low levels, and the location of the fraud den is determined by combining the triangulation method.

[0006] As an improvement to the above scheme, the step of acquiring the training sample dataset based on real-time streaming and preprocessing the training sample dataset includes: The communication information of the GOIP fraud device and the normal communication device is collected in real time using a Kafka message queue; wherein, the communication information includes the caller number, the called number, the call duration, the call frequency, the call time, the call direction, the caller number characteristics, the location information, and the network behavior; Based on the Flink distributed computing system, the communication information of the GOIP fraud device and the communication information of the normal communication device are preprocessed in real time. The preprocessing includes data cleaning and data standardization. The preprocessed data is analyzed and features are extracted in real time using a streaming machine learning algorithm, and the data processed by the streaming machine learning algorithm is labeled to obtain a preprocessed training sample dataset.

[0007] As an improvement to the above scheme, the step of training the BERT model based on the preprocessed training sample dataset to obtain the GOIP fraud number identification model includes: The preprocessed training sample dataset is divided into training set, validation set and test set according to a preset ratio; The phone numbers in the training set are segmented and encoded to generate ID sequences and attention masks; The ID sequence and the attention mask are input into the pre-trained BERT model. The output of the BERT model is mapped to the output space of the binary classification task through a 2-dimensional fully connected layer. The Softmax function is used to convert the output of the BERT model into a probability distribution to obtain the prediction result of the BERT model. The difference between the prediction results of the BERT model and the true labels is calculated based on the binary cross-entropy loss function. The gradient of the binary cross-entropy loss function with respect to the model parameters is calculated using the backpropagation algorithm, and the model parameters are updated using the AdamW optimizer. The model is evaluated based on the validation set and the test set until the optimal model parameters are obtained, and the trained GOIP fraud number identification model is output.

[0008] As an improvement to the above scheme, the step of calculating the gradient of the binary cross-entropy loss function with respect to the model parameters using the backpropagation algorithm and updating the model parameters using the AdamW optimizer includes: Backpropagation is performed layer by layer to calculate the gradient of the binary cross-entropy loss function relative to the output of the fully connected layer; Calculate the gradient of the binary cross-entropy loss function with respect to the weights and biases of the fully connected layer; Calculate the gradient of the binary cross-entropy loss function relative to the hidden layers of the BERT model; Calculate the gradient of the binary cross-entropy loss function with respect to each layer of the BERT model; Update the model's weights and gradients using the AdamW optimizer.

[0009] As an improvement to the above scheme, the step of grouping the suspected GOIP fraud numbers according to a preset grouping algorithm to obtain suspected GOIP fraud number groups includes: Based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraud number, a KD tree is constructed; The nearest neighbor search algorithm of the KD tree is used to find other numbers that are similar to each of the suspected GOIP fraud numbers in terms of location information, call duration, call frequency, call time and call direction, so as to obtain multiple sets of neighboring numbers; For each set of neighboring numbers, feature analysis is performed using a decision tree algorithm to obtain a decision tree for each set of neighboring numbers; For each set of neighboring numbers, the decision tree is used to perform pattern recognition using the random forest algorithm to obtain the initial classification result; The numbers in the initial classification results are clustered using the K-means algorithm. Based on feature similarity, the numbers are divided into different groups, resulting in multiple suspected GOIP fraud number clusters.

[0010] As an improvement to the above solution, the step of constructing a KD-tree based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraudulent number includes: Calculate the variances of longitude, latitude, call duration, call frequency, call time, and call direction respectively, and select the dimension with the largest variance to divide the dataset of suspected GOIP fraud numbers into two subtrees; For each subtree, calculate the variance of each dimension other than the dimension with the largest variance, select the dimension with the largest variance from the variances of the other dimensions, and divide the subtree into a left subtree and a right subtree. For the left subtree and the right subtree, repeat the variance calculation and segmentation process until the preset stopping condition is met.

[0011] This invention also provides a GOIP fraud den identification device based on the BERT model, comprising: The data acquisition module is used to acquire training sample datasets based on real-time streams and to preprocess the training sample datasets; wherein, the training sample datasets include communication information of GOIP fraud devices and communication information of normal communication devices; The model training module is used to train the BERT model based on the preprocessed training sample dataset to obtain the GOIP fraud number identification model. The fraud identification module is used to obtain test sample data from all GOIP devices based on real-time stream, and input the test sample data into the GOIP fraud number identification model to obtain the suspected GOIP fraud number output by the GOIP fraud number identification model; The fraud grouping module is used to group the suspected GOIP fraud numbers according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; wherein, the grouping algorithm is a combination of KD tree algorithm, decision tree algorithm, random forest algorithm and clustering algorithm; The location module is used to statistically analyze the location information of each suspected GOIP fraud number group, classify them into high, medium and low levels, and determine the location of the fraud den by combining triangulation.

[0012] This invention also provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the GOIP fraud den identification method based on the BERT model described above.

[0013] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the GOIP fraud den identification method based on the BERT model described above.

[0014] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the BERT-based GOIP fraud den identification method described above.

[0015] Compared to existing technologies, the beneficial effects of the BERT-based GOIP fraud den identification method, apparatus, device, medium, and product provided in this invention are as follows: A training sample dataset is collected based on real-time streaming and preprocessed; the training sample dataset includes communication information of GOIP fraud devices and communication information of normal communication devices; the BERT model is trained based on the preprocessed training sample dataset to obtain a GOIP fraud number identification model; test sample data is obtained from all GOIP devices based on real-time streaming and input into the GOIP fraud number identification model to obtain suspected GOIP fraud numbers output by the model; the suspected GOIP fraud numbers are grouped according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; the grouping algorithm is a combination of KD-tree, decision tree, random forest, and clustering algorithms; the suspected GOIP fraud numbers in each suspected GOIP fraud number group are statistically analyzed according to location information to classify them into high, medium, and low levels, and the location of the fraud den is determined by combining triangulation. This invention employs real-time streaming for data acquisition and preprocessing. It uses a BERT model, which does not rely on a large amount of labeled data, to identify suspected GOIP fraud numbers. Furthermore, it utilizes KD-trees combined with decision tree algorithms, random forest algorithms, and clustering algorithms for grouping, effectively improving the accuracy and efficiency of grouping. This enables efficient and accurate identification of GOIP fraud dens. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating a preferred embodiment of a GOIP fraud den identification method based on the BERT model provided by the present invention. Figure 2 This is a schematic diagram of a preferred embodiment of a GOIP fraud den identification device based on the BERT model provided by the present invention; Figure 3 This is a schematic diagram of a preferred embodiment of a terminal device provided by the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 , Figure 1 This is a flowchart illustrating a preferred embodiment of a GOIP fraud den identification method based on the BERT model provided by the present invention. The BERT model-based GOIP fraud den identification method includes: S1, based on real-time stream acquisition of training sample dataset, and preprocessing the training sample dataset; wherein, the training sample dataset includes communication information of GOIP fraud devices and communication information of normal communication devices; S2, Train the BERT model based on the preprocessed training sample dataset to obtain the GOIP fraud number identification model; S3, acquire the sample data to be tested from all GOIP devices based on real-time stream, and input the sample data to be tested into the GOIP fraud number identification model to obtain the suspected GOIP fraud number output by the GOIP fraud number identification model; S4, the suspected GOIP fraud numbers are grouped according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; wherein, the grouping algorithm is a combination of KD tree, decision tree algorithm, random forest algorithm and clustering algorithm; S5, perform statistical analysis on the suspected GOIP fraud numbers in each of the suspected GOIP fraud number groups according to their location information, classify them into high, medium and low levels, and determine the location of the fraud den by combining the triangulation method.

[0019] Specifically, this invention provides a method for identifying GOIP fraud dens based on the BERT model. First, a training sample dataset is collected via real-time streaming and preprocessed to remove outliers and noise. The training sample dataset includes communication information from both GOIP fraud devices and legitimate communication devices. Then, the preprocessed training sample dataset is input into a modified and pre-trained BERT model for training, resulting in a GOIP fraud number identification model. It should be noted that this invention modifies the BERT model to make it suitable for binary classification tasks, identifying legitimate phone numbers and suspected GOIP fraud numbers. Next, test sample data is obtained from all GOIP devices via real-time streaming and input into the GOIP fraud number identification model to obtain the suspected GOIP fraud numbers output by the model. Finally, the suspected GOIP fraud numbers are grouped according to a preset clustering algorithm, resulting in suspected GOIP fraud number groups. The clustering algorithm used in this invention is a combination of KD-tree, decision tree, random forest, and clustering algorithms. Finally, the suspected GOIP fraud numbers in each suspected GOIP fraud number cluster were statistically analyzed according to their location information. The number of fraud numbers in different locations was divided into high, medium and low levels from high to low. Suspected GOIP fraud numbers were extracted from the high to low levels, and the location of the fraud den was determined by combining the triangulation method.

[0020] The embodiments of this invention employ real-time streaming for data acquisition and preprocessing, which effectively improves the real-time performance of the data; the BERT large model is pre-trained on a large amount of text data, which can achieve good performance with less labeled data; the spatial indexing technology KD tree combined with decision tree algorithm, random forest algorithm and clustering algorithm are used to group suspected GOIP fraud numbers, which can effectively improve the accuracy and efficiency of grouping.

[0021] In a preferred embodiment, step S1, based on real-time streaming acquisition of the training sample dataset, and preprocessing the training sample dataset, includes: S11, using a Kafka message queue to collect real-time communication information of the GOIP fraud device and the normal communication device; wherein, the communication information includes the calling number, the called number, the call duration, the call frequency, the call time, the call direction, the call number characteristics, the location information, and the network behavior; S12, Based on the Flink distributed computing system, the communication information of the collected GOIP fraud device and the communication information of the normal communication device are preprocessed in real time. The preprocessing includes data cleaning and data standardization. S13, perform real-time analysis and feature extraction on the preprocessed data according to the streaming machine learning algorithm, and label the data processed by the streaming machine learning algorithm to obtain the preprocessed training sample dataset.

[0022] Specifically, this embodiment of the invention utilizes a Kafka message queue to collect real-time communication information from GOIP fraud devices and normal communication devices. This communication information includes the calling number, called number, call duration, call frequency, call time, call direction, call number characteristics, location information, and network behavior. Then, based on the Flink distributed computing system, the collected communication information from both GOIP fraud devices and normal communication devices is preprocessed in real-time. This preprocessing includes data cleaning and standardization, and extracting key features from the call records, such as the calling number, called number, call duration (T), call frequency (F), location information (L), and call time (t).

[0023] For example, data cleaning uses Flink's DataStream API to clean the collected information, removing missing and outlier values. Outliers can be detected using the Z-score method. ; Where x is a data point, It is the mean. This is the standard deviation. If |z| > 3, then the data point is considered an outlier.

[0024] Data standardization uses formulas This ensures that all eigenvalues ​​are in the range [0, 1].

[0025] Secondly, streaming machine learning algorithms are run in Flink to perform real-time analysis and feature extraction on the preprocessed data. These algorithms provide more accurate data for subsequent model training. This involves online learning algorithms, such as online gradient descent (OGD). The formula is as follows: ; in, These are model parameters. It's the learning rate. It is a loss function. It is a model function. It is a feature of the t-th sample. It is the label of the t-th sample.

[0026] The data processed by the streaming machine learning algorithm is labeled, for example, labeled as fraudulent numbers (1) and normal numbers (0), to obtain a preprocessed training sample dataset, which is then saved to the database for use by subsequent models.

[0027] This invention employs a combination of Flink and Kafka with streaming machine learning algorithms to enable immediate analysis upon data arrival, thereby providing real-time insights and decision support.

[0028] In another preferred embodiment, step S2, training the BERT model based on the preprocessed training sample dataset to obtain a GOIP fraud number identification model, includes: S21, the preprocessed training sample dataset is divided into training set, validation set and test set according to a preset ratio; S22, Segment and encode the phone numbers in the training set to generate ID sequences and attention masks; S23, input the ID sequence and the attention mask into the pre-trained BERT model, map the output of the BERT model to the output space of the binary classification task through a 2-dimensional fully connected layer, and use the Softmax function to convert the output of the BERT model into a probability distribution to obtain the prediction result of the BERT model; S24, Calculate the difference between the prediction results of the BERT model and the true labels based on the binary cross-entropy loss function; S25, calculate the gradient of the binary cross-entropy loss function with respect to the model parameters using the backpropagation algorithm, and update the model parameters using the AdamW optimizer; S26. Evaluate the model based on the validation set and the test set until the optimal model parameters are obtained, and output the trained GOIP fraud number identification model.

[0029] Specifically, this embodiment of the invention utilizes the large-scale BERT model to identify GOIP fraudulent numbers. The BERT model excels in processing sequence data and capturing complex patterns. Through a multi-layer Transformer encoder, the BERT model can extract multi-level feature representations, which are highly effective in identifying complex patterns in fraudulent numbers. Furthermore, the BERT model can learn online, continuously updating and optimizing its parameters to adapt to evolving fraud methods. In addition, the BERT model performs well in tasks across multiple domains, and this generalization ability can be applied to different fraud scenarios, improving the model's robustness. This embodiment of the invention first divides the preprocessed training sample dataset into training, validation, and test sets according to a preset ratio, for example, 70% training, 15% validation, and 15% test. Then, a suitable BERT model is selected and the pre-trained model and word segmenter are loaded. Since the dataset size is not too large, this embodiment of the invention preferably uses bert-base-uncased. The BERT tokenizer converts the phone numbers obtained in step S11 into a format acceptable to the model. A [CLS] marker is added to the beginning of the phone number string, and a [SEP] marker is added to the end. These markers help the model understand the beginning and end of sentences. Then, the tokenize method of the tokenizer is called to tokenize the specially marked phone numbers and returns a list containing the tokenization results. The convert_tokens_to_ids method of the tokenizer converts the tokenization results into corresponding ID sequences. Next, an attention mask is created; when using the BERT model, the input text is encoded as an ID sequence. To ensure the model can correctly handle input sequences of different lengths, shorter sequences are typically padded to make them of uniform length.

[0030] For example, given two input texts, Input Text 1: This is a GOIP scam call. Its encoded ID sequence is: [101, 2023, 2024, 2025, 2026, 2027, 2028, 2029, 102], where 101 is the [CLS] marker and 102 is the [SEP] marker. The padded ID sequence is: [101, 2023, 2024, 2025, 2026, 2027, 2028, 2029, 102, 0, 0, ..., 0] (assuming the maximum length is 128, the total length here is 128). Then the generated attention mask is [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, ..., 0] (total length is 128). Input text 2: This is a normal phone call. Its encoded ID sequence is: [101, 2030, 2031,2032, 2033, 102], where 101 is the [CLS] marker and 102 is the [SEP] marker. The padded ID sequence is: [101,2030, 2031, 2032, 2033, 102, 0, 0, ..., 0] (assuming the maximum length is 128, the total length here is 128). The generated attention mask is [1, 1, 1, 1, 1, 1, 0, 0, ..., 0] (total length is 128).

[0031] In this way, all input text is processed into sequences of the same length. The encoded ID sequences and attention masks are then converted into PyTorch or TensorFlow tensors to facilitate inputting this data into the BERT model for computation. Because tensors are multidimensional arrays, they support efficient mathematical operations and automatic differentiation, making them ideal for deep learning models.

[0032] It should be noted that, in order to adapt the BERT model to a binary classification task, i.e., distinguishing between legitimate and fraudulent calls, this embodiment of the invention adds a fully connected layer at the end of the BERT model. This layer is also called a linear layer or affine transformation layer. The purpose of this layer is to map the last hidden state of the BERT model output to the class space. Since the task of this embodiment is a binary classification problem, the output dimension of the fully connected layer is set to 2, corresponding to the two classes: legitimate and fraudulent calls. After adding the fully connected layer, the output needs to be activated using the Softmax function to obtain the probability distribution of each class. Then, the class with the highest probability is selected as the model's prediction result, which is crucial for decision-making in classification tasks. In addition, for the initialization of the weights in the fully connected layer, this embodiment uses the Xavier initialization method (also known as Glorot initialization). This is a weight initialization technique commonly used in deep neural networks, which helps maintain the consistency of variance across layers of the network, thereby promoting stable gradient propagation. Xavier initialization adjusts the initial values ​​of the weights based on the square root of the number of input and output nodes, and is suitable for activation functions such as Sigmoid and Tanh. By modifying the BERT model, this embodiment of the invention can effectively apply it to the binary classification task of normal calls and scam calls. The relevant algorithm formula is as follows: Assume the output of the BERT model is the hidden state of the last layer. Its shape is ,in, It refers to the batch size. It is the hidden layer dimension, the weight matrix of the fully connected layer. Shape The shape of the bias term b is .

[0033] Forward propagation formula for fully connected layers: ; in, It is the output of the fully connected layer, with the shape of... .

[0034] Sigmoid formula: ; in, It is the probability of the i-th category. It is the i-th element output by the fully connected layer.

[0035] Tanh function formula: ; Xavier initialization formula: ; in, This is the number of input nodes. This represents the number of output nodes, where u indicates a uniform distribution.

[0036] To optimize model parameters and minimize cross-entropy loss, this embodiment of the invention selects the AdamW optimizer. When using the AdamW optimizer, the parameters first need to be initialized. For example, the initial learning rate is 0.00002. Other hyperparameters, such as β1 and β2, are used to control the weight distribution of momentum and RMSprop. The other hyperparameters are set to β1 = 0.9 and β2 = 0.999, and weight decay is set. The learning rate is set to 0.01 to prevent overfitting. In subsequent use, the AdamW optimizer adjusts the learning rate based on gradient and historical gradient information and applies weight decay.

[0037] Formula for binary cross-entropy loss function: ; Where N is the number of samples, It is the first The actual label (0 or 1) of each sample. It is the probability value predicted by the model (a real number between 0 and 1).

[0038] During model training, this embodiment of the invention employs multiple epochs of training. In each epoch, for each training sample, forward propagation is first performed. Data converted to PyTorch or TensorFlow tensors is input into a modified BERT model adapted for binary classification for training, obtaining the probability distribution of suspected GOIP fraud numbers. Numbers with higher probabilities are selected as suspected GOIP fraud numbers. This process ultimately generates the model's prediction result for the input data. Next, the model needs to be fine-tuned. First, loss calculation is performed, using the binary cross-entropy loss function to calculate the loss between the model's prediction result and the true label. Then, backpropagation is performed, the goal of which is to calculate the loss function. For model parameters (weights) and bias The gradients of each parameter are calculated. These gradients reflect the degree of influence of each parameter on the loss function, i.e., how changes in the parameters affect the value of the loss function. Parameter updates are then performed; using the calculated gradients, the AdamW optimizer can be used to update the model's parameters. These updates allow the model to get closer to the optimal solution in the next iteration, thus gradually reducing the value of the loss function. Finally, validation set monitoring and test set evaluation are performed. After each epoch, the validation set is used to evaluate the model's performance. The input data from the validation set is passed to the optimized model to obtain prediction results. Then, accuracy, precision, recall, and F1 score are calculated using the true labels and prediction results. If the performance on the validation set reaches a new high, the current model weights are saved. The final performance of the model is then evaluated using the test set. The input data from the test set is passed to the model to obtain prediction results. Similarly, accuracy, precision, recall, and F1 score are calculated based on the true labels and prediction results. Based on the calculated metrics, the model's performance is analyzed to determine whether the model has achieved the expected results.

[0039] Unlike traditional methods that utilize LSTM for pre-training, this invention introduces the BERT model. The BERT model is pre-trained on a large amount of text data, achieving good performance with less labeled data. The training data in this invention comes from GOIP fraud devices and legitimate communication devices, resulting in a limited dataset. Using BERT allows for more accurate predictions. Furthermore, to adapt the BERT model to fraud call identification scenarios, it is modified for binary classification tasks. A fully connected layer is added to the end of the BERT model, mapping the last hidden state of the output layer to the class space, thereby distinguishing between legitimate and fraudulent calls.

[0040] In another preferred embodiment, step S25, which involves calculating the gradient of the binary cross-entropy loss function with respect to the model parameters using a backpropagation algorithm and updating the model parameters using the AdamW optimizer, includes: S251, backpropagate layer by layer to calculate the gradient of the binary cross-entropy loss function relative to the output of the fully connected layer; S252, Calculate the gradient of the binary cross-entropy loss function with respect to the weights and biases of the fully connected layer; S253, Calculate the gradient of the binary cross-entropy loss function with respect to the hidden layer of the BERT model; S254, Calculate the gradient of the binary cross-entropy loss function with respect to each layer of the BERT model; S255 uses the AdamW optimizer to update the model's weights and gradients.

[0041] Specifically, in this embodiment of the invention, the output layer of the model is a fully connected layer with an output dimension of 2, corresponding to the two categories of legitimate calls and fraudulent calls. Starting from the output layer, the gradient of the loss function with respect to each parameter is calculated layer by layer, as follows: 1. Calculate the gradient of the output layer: 1.1 The forward propagation formula for the output layer is: ; in, This is the last hidden state output by the BERT model. This is the weight matrix of the fully connected layer, and b is the bias term. It is the output of the fully connected layer, with the shape of... .

[0042] 1.2. Use the Softmax function to convert the output into a probability distribution: ; in, It is the probability of the i-th category. It is the i-th element output by the fully connected layer.

[0043] 1.3 Calculate the gradient of the loss function with respect to the output layer: .

[0044] 2. Calculate the gradient of the fully connected layer and the loss function relative to the weights of the fully connected layer. and bias gradient: ; .

[0045] 3. Backpropagate to the hidden layers of the BERT model and calculate the gradient of the loss function relative to the last hidden state H of the BERT model: .

[0046] 4. Backpropagate layer by layer, continuing to backpropagate the gradient to each layer of the BERT model.

[0047] 4.1 Assuming the BERT model has L layers, the forward propagation formula for each layer is: ; in, It is an activation function.

[0048] 4.2 Calculate the gradient of the loss function with respect to each layer: ; ; .

[0049] 5. Update parameters using the AdamW optimizer. Parameters have already been initialized and the learning rate set. The values ​​are 0.00002, β1 is 0.9, β2 is 0.999, and the weights decay. It is 0.01. Then set the first moment. =0, second moment The time step t is 0, which is 0. for , is a small constant used to prevent division by zero errors.

[0050] 5.1. Increase the time step t and calculate the first and second moments: ; ; ; in, It is a first-order moment. It is a second moment. This is the current weight gradient. and It is the exponential decay rate of momentum and RMSprop.

[0051] 5.2 Deviation Correction: Correct the deviations of the first and second moments. ; ; 5.3 Update weights and biases: ; .

[0052] In another preferred embodiment, step S4, which involves grouping the suspected GOIP fraud numbers according to a preset grouping algorithm to obtain suspected GOIP fraud number groups, includes: S41, construct a KD tree based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraud number; S42, use the nearest neighbor search algorithm of the KD tree to find other numbers that are similar to each of the suspected GOIP fraud numbers in terms of location information, call duration, call frequency, call time and call direction, and obtain multiple sets of neighboring numbers; S43, For each set of neighboring numbers, feature analysis is performed using a decision tree algorithm to obtain a decision tree for each set of neighboring numbers; S44, For each decision tree of the neighboring number set, use the random forest algorithm to perform pattern recognition and obtain the initial classification result; S45, the numbers in the initial classification results are clustered using the K-means algorithm, and the numbers are divided into different groups according to feature similarity to obtain multiple suspected GOIP fraud number groups.

[0053] Specifically, this embodiment of the invention first cleans the location information data of suspected GOIP fraudulent numbers output by the GOIP fraudulent number identification model, removing invalid or erroneous location information. The location information, call duration, call frequency, call time, and call direction are converted into a multi-dimensional spatial data format suitable for KD-tree construction. Based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraudulent number, a KD-tree is constructed for rapid retrieval and classification. The nearest neighbor search algorithm of the KD-tree is used to find other numbers with similar location information, call duration, call frequency, call time, and call direction to each suspected GOIP fraudulent number, resulting in multiple sets of neighboring numbers.

[0054] For each set of neighboring numbers found through the KD-tree, a decision tree algorithm is applied for further feature analysis. This embodiment of the invention uses the CART (Classification and Regression Trees) algorithm to construct the decision tree model. In this process, feature selection is first required, choosing features that may influence the results. In this embodiment, location information, call time, call duration, and call frequency are selected. The decision tree algorithm can automatically handle feature selection, but if the data volume is large and there are many features, feature importance can be ranked first, selecting the most important features for modeling. Next, the data needs to be partitioned, choosing a suitable splitting criterion, such as information gain or the Gini index, to determine how to divide the dataset into different subsets based on the selected features. For example, users can be divided into different regions based on location information, or a day can be divided into day and night based on call time, or into different duration segments based on call duration. The tree is then recursively constructed, repeating the feature selection and data partitioning steps on each subset until stopping conditions are met. These conditions may include: all samples belong to the same category, no more features can be used to partition the data, and a predetermined maximum depth has been reached. For example, a split can be made based on call duration <= 120 seconds. When the call duration is <= 120 seconds, call frequency is chosen as the next splitting feature. If the call frequency is <= 5, it is predicted as non-fraudulent; if the call frequency is > 5, it is predicted as fraudulent. When the call duration is > 120 seconds, the call time period is chosen as the next splitting feature. If the call time period is at night, it is predicted as non-fraudulent; if the call time period is during the day, it is predicted as fraudulent. Finally, pruning is performed. To avoid overfitting, the generated decision tree may need to be pruned. This can be done by comparing the training error and the validation error, retaining those branches that bring significant improvement, thus constructing a complete decision tree model.

[0055] Gini impurity: Used to measure the impurity of nodes, defined as: ; in, It is a dataset. It is the number of categories. It is the first The probability of the category.

[0056] Information gain: Used to measure the importance of a feature, defined as: ; in, It is a dataset. It is an attribute. It is the value of attribute 'a'. It is a subset of the dataset where attribute a takes the value v. It is a dataset The entropy.

[0057] Once multiple decision trees are available for different sets of neighboring numbers, a random forest algorithm can be applied to each set for pattern recognition to obtain initial classification results. The random forest algorithm improves overall classification accuracy by combining their predictions. Finally, the numbers in the initial classification results are clustered using the K-means algorithm. Based on the similarity of location information and other features, the numbers are divided into different groups, resulting in multiple clusters of suspected GOIP fraud numbers.

[0058] This invention combines the advantages of multiple machine learning algorithms. First, it utilizes KD-trees for efficient spatial search and preliminary classification. Then, it employs decision tree and random forest algorithms for in-depth feature analysis and pattern recognition. Finally, it uses clustering algorithms to achieve the final group division. Compared to traditional single-grouping techniques, this method can more comprehensively consider the multidimensional features of the data, improving the accuracy and efficiency of grouping.

[0059] In another preferred embodiment, step S41, based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraudulent number, constructs a KD tree, including: S411, calculate the variances of longitude, latitude, call duration, call frequency, call time, and call direction respectively, and select the dimension with the largest variance to divide the dataset of suspected GOIP fraudulent numbers into two subtrees; S412, For each subtree, calculate the variance of each dimension other than the dimension with the largest variance, select the dimension with the largest variance from the variances of the other dimensions, and divide the subtree into a left subtree and a right subtree; S413, For the left subtree and the right subtree, repeat the variance calculation and segmentation process until the preset stopping condition is met.

[0060] It should be noted that in constructing a KD-tree, the dataset first needs to be segmented. Traditional methods typically select dimensions for segmentation in a fixed order, such as longitude and latitude. However, this invention dynamically selects the optimal segmentation dimension based on the data's distribution characteristics. This adaptive dimension selection ensures tree balance, reduces tree height, and improves search efficiency. Specifically, this invention calculates the variance of longitude, latitude, call duration, call frequency, call time, and call direction, and selects the dimension with the largest variance for segmentation. For example, after calculation, longitude is selected as the first segmentation latitude, and the median of longitude is chosen as the segmentation point, dividing the dataset into two parts, D1 and D2. Then, the above steps are repeated for D1 and D2 respectively, calculating the variance of each subset in the other dimensions besides longitude, namely latitude, call duration, call frequency, call time, and call direction, and selecting the dimension with the largest variance for segmentation. The variance calculation and segmentation process is repeated for the segmented results until a preset stopping condition is met, completing the construction of the KD-tree.

[0061] In constructing a KD-tree, this invention dynamically selects the optimal splitting dimension based on the data distribution characteristics. Specifically, by calculating the variance of multiple preset dimensions, the dimension with the largest variance is selected for splitting. This adaptive dimension selection ensures tree balance, reduces tree height, and improves search efficiency.

[0062] This invention, through the ingenious integration of multi-dimensional analysis capabilities of KD-tree, decision tree, random forest, and clustering algorithms, achieves in-depth mining of complex data features and efficient group partitioning, significantly improving clustering accuracy and computational efficiency. Simultaneously, relying on the real-time data stream processing framework of Flink and Kafka, combined with streaming machine learning algorithms, it enables real-time collection and analysis of scarce labeled data from GOIP fraud devices and legitimate communication devices. In particular, by leveraging the superior performance of the BERT model with limited labeled data, it effectively overcomes the high dependence of the LSTM model on data scale, thus achieving a level of real-time performance and accuracy that is difficult to attain with traditional methods.

[0063] Accordingly, the present invention also provides a GOIP fraud den identification device based on the BERT model, which can implement all the processes of the GOIP fraud den identification method based on the BERT model in the above embodiments.

[0064] Please see Figure 2 , Figure 2 This is a schematic diagram of a preferred embodiment of a GOIP fraud den identification device based on the BERT model provided by the present invention. The BERT model-based GOIP fraud den identification device includes: The data acquisition module 201 is used to acquire training sample datasets based on real-time streams and preprocess the training sample datasets; wherein, the training sample datasets include communication information of GOIP fraud devices and communication information of normal communication devices; The model training module 202 is used to train the BERT model based on the preprocessed training sample dataset to obtain the GOIP fraud number identification model. Fraud identification module 203 is used to obtain test sample data from all GOIP devices based on real-time stream, and input the test sample data into the GOIP fraud number identification model to obtain the suspected GOIP fraud number output by the GOIP fraud number identification model; Fraud grouping module 204 is used to group the suspected GOIP fraud numbers according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; wherein, the grouping algorithm is a combination of KD tree, decision tree algorithm, random forest algorithm and clustering algorithm; The location module 205 is used to perform statistical analysis on the suspected GOIP fraud numbers in each of the suspected GOIP fraud number groups according to their location information, classify them into high, medium and low levels, and determine the location of the fraud den by combining triangulation.

[0065] Preferably, the data acquisition module 201 includes: The data acquisition unit is used to collect real-time communication information of the GOIP fraud device and the normal communication device using a Kafka message queue; wherein, the communication information includes the caller ID, the called number, the call duration, the call frequency, the call time, the call direction, the caller ID characteristics, the location information, and the network behavior; The data processing unit is used to preprocess the communication information of the GOIP fraud device and the communication information of the normal communication device in real time based on the Flink distributed computing system. The preprocessing includes data cleaning and data standardization. The data labeling unit is used to perform real-time analysis and feature extraction on the preprocessed data according to the streaming machine learning algorithm, and to label the data processed by the streaming machine learning algorithm to obtain the preprocessed training sample dataset.

[0066] Preferably, the model training module 202 includes: The set partitioning unit is used to divide the preprocessed training sample dataset into training set, validation set and test set according to a preset ratio; The word segmentation and encoding unit is used to segment and encode the telephone numbers in the training set to generate ID sequences and attention masks; The output mapping unit is used to input the ID sequence and the attention mask into the pre-trained BERT model, map the output of the BERT model to the output space of the binary classification task through a 2-dimensional fully connected layer, and use the Softmax function to convert the output of the BERT model into a probability distribution to obtain the prediction result of the BERT model. The difference calculation unit is used to calculate the difference between the prediction results of the BERT model and the true labels based on the binary cross-entropy loss function; The parameter update unit is used to calculate the gradient of the binary cross-entropy loss function with respect to the model parameters through the backpropagation algorithm, and to update the model parameters using the AdamW optimizer. The model output unit is used to evaluate the model based on the validation set and the test set until the optimal model parameters are obtained, and output the trained GOIP fraud number identification model.

[0067] Preferably, the parameter update unit is specifically used for: Backpropagation is performed layer by layer to calculate the gradient of the binary cross-entropy loss function relative to the output of the fully connected layer; Calculate the gradient of the binary cross-entropy loss function with respect to the weights and biases of the fully connected layer; Calculate the gradient of the binary cross-entropy loss function relative to the hidden layers of the BERT model; Calculate the gradient of the binary cross-entropy loss function with respect to each layer of the BERT model; Update the model's weights and gradients using the AdamW optimizer.

[0068] Preferably, the fraud grouping module 204 includes: The KD-tree construction unit is used to construct a KD-tree based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraud number. The spatial search unit is used to use the nearest neighbor search algorithm of the KD tree to find other numbers that are similar to each of the suspected GOIP fraud numbers in terms of location information, call duration, call frequency, call time and call direction, and to obtain multiple sets of neighboring numbers; The feature analysis unit is used to perform feature analysis on each of the neighboring number sets using a decision tree algorithm to obtain a decision tree for each of the neighboring number sets. The pattern recognition unit is used to perform pattern recognition using the random forest algorithm for the decision tree of each set of neighboring numbers to obtain the initial classification result; The clustering analysis unit is used to perform clustering analysis on the numbers in the initial classification results using the K-means algorithm, and divide the numbers into different groups according to feature similarity to obtain multiple suspected GOIP fraud number clusters.

[0069] Preferably, the KD-tree construction unit is specifically used for: Calculate the variances of longitude, latitude, call duration, call frequency, call time, and call direction respectively, and select the dimension with the largest variance to divide the dataset of suspected GOIP fraud numbers into two subtrees; For each subtree, calculate the variance of each dimension other than the dimension with the largest variance, select the dimension with the largest variance from the variances of the other dimensions, and divide the subtree into a left subtree and a right subtree. For the left subtree and the right subtree, repeat the variance calculation and segmentation process until the preset stopping condition is met.

[0070] In specific implementation, the working principle, control process and technical effects of the GOIP fraud den identification device based on the BERT model provided in this embodiment of the invention are the same as those of the GOIP fraud den identification method based on the BERT model in the above embodiments, and will not be repeated here.

[0071] Please see Figure 3 , Figure 3 This is a schematic diagram of a preferred embodiment of a terminal device provided by the present invention. The terminal device includes a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301. When the processor 301 executes the computer program, it implements the GOIP fraud den identification method based on the BERT model described in any of the above embodiments.

[0072] Preferably, the computer program can be divided into one or more modules / units (such as computer program 1, computer program 2, ...), and the one or more modules / units are stored in the memory 302 and executed by the processor 301 to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

[0073] The processor 301 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor 301 can be any conventional processor. The processor 301 is the control center of the terminal device, connecting various parts of the terminal device through various interfaces and lines.

[0074] The memory 302 mainly includes a program storage area and a data storage area. The program storage area can store the operating system, applications required for at least one function, etc., and the data storage area can store related data, etc. In addition, the memory 302 can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, and a flash card, etc., or the memory 302 can also be other volatile solid-state storage devices.

[0075] It should be noted that the aforementioned terminal devices may include, but are not limited to, processors and memory, as will be understood by those skilled in the art. Figure 3 The structural diagram is merely an example of the terminal device described above and does not constitute a limitation on the terminal device described above. It may include more or fewer components than shown in the diagram, or combine certain components, or use different components.

[0076] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the BERT-based GOIP fraud den identification method described in any of the above embodiments.

[0077] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the BERT-based GOIP fraud den identification method described in any of the above embodiments.

[0078] This invention provides a method, apparatus, device, medium, and product for identifying GOIP fraud dens based on the BERT model. The method involves acquiring a training sample dataset based on real-time streaming and preprocessing the dataset. The training sample dataset includes communication information from both GOIP fraud devices and legitimate communication devices. The BERT model is trained using the preprocessed dataset to obtain a GOIP fraud number identification model. Test sample data is acquired from all GOIP devices via real-time streaming and input into the GOIP fraud number identification model to obtain suspected GOIP fraud numbers. These suspected GOIP fraud numbers are then grouped according to a preset clustering algorithm, which combines KD-tree, decision tree, random forest, and clustering algorithms. For each suspected GOIP fraud number group, the suspected GOIP fraud numbers are statistically analyzed based on their location information to classify them into high, medium, and low levels. The location of the fraud den is then determined using triangulation. This invention employs real-time streaming for data acquisition and preprocessing. It uses a BERT model, which does not rely on a large amount of labeled data, to identify suspected GOIP fraud numbers. Furthermore, it utilizes KD-trees combined with decision tree algorithms, random forest algorithms, and clustering algorithms for grouping, effectively improving the accuracy and efficiency of grouping. This enables efficient and accurate identification of GOIP fraud dens.

[0079] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0080] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying GOIP fraud dens, characterized in that, include: The training sample dataset is collected based on real-time streaming and preprocessed; wherein, the training sample dataset includes communication information of GOIP fraud devices and communication information of normal communication devices; The BERT model was trained using the preprocessed training sample dataset to obtain the GOIP fraud number identification model; Based on real-time streaming, test sample data is obtained from all GOIP devices, and the test sample data is input into the GOIP fraud number identification model to obtain the suspected GOIP fraud number output by the GOIP fraud number identification model; The suspected GOIP fraud numbers are grouped according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; wherein, the grouping algorithm is a combination of KD tree, decision tree algorithm, random forest algorithm and clustering algorithm; For each suspected GOIP fraud number cluster, the suspected GOIP fraud numbers are statistically analyzed according to their location information to classify them into high, medium, and low levels, and the location of the fraud den is determined by combining the triangulation method.

2. The GOIP fraud den identification method as described in claim 1, characterized in that, The process of acquiring training sample datasets based on real-time streaming and preprocessing the training sample datasets includes: The communication information of the GOIP fraud device and the normal communication device is collected in real time using a Kafka message queue; wherein, the communication information includes the caller number, the called number, the call duration, the call frequency, the call time, the call direction, the caller number characteristics, the location information, and the network behavior; Based on the Flink distributed computing system, the communication information of the GOIP fraud device and the communication information of the normal communication device are preprocessed in real time. The preprocessing includes data cleaning and data standardization. The preprocessed data is analyzed and features are extracted in real time using a streaming machine learning algorithm, and the data processed by the streaming machine learning algorithm is labeled to obtain a preprocessed training sample dataset.

3. The GOIP fraud den identification method as described in claim 2, characterized in that, The step of training the BERT model based on the preprocessed training sample dataset to obtain the GOIP fraud number identification model includes: The preprocessed training sample dataset is divided into training set, validation set and test set according to a preset ratio; The phone numbers in the training set are segmented and encoded to generate ID sequences and attention masks; The ID sequence and the attention mask are input into the pre-trained BERT model. The output of the BERT model is mapped to the output space of the binary classification task through a 2-dimensional fully connected layer. The Softmax function is used to convert the output of the BERT model into a probability distribution to obtain the prediction result of the BERT model. The difference between the prediction results of the BERT model and the true labels is calculated based on the binary cross-entropy loss function. The gradient of the binary cross-entropy loss function with respect to the model parameters is calculated using the backpropagation algorithm, and the model parameters are updated using the AdamW optimizer. The model is evaluated based on the validation set and the test set until the optimal model parameters are obtained, and the trained GOIP fraud number identification model is output.

4. The GOIP fraud den identification method as described in claim 3, characterized in that, The step of calculating the gradient of the binary cross-entropy loss function with respect to the model parameters using the backpropagation algorithm and updating the model parameters using the AdamW optimizer includes: Backpropagation is performed layer by layer to calculate the gradient of the binary cross-entropy loss function relative to the output of the fully connected layer; Calculate the gradient of the binary cross-entropy loss function with respect to the weights and biases of the fully connected layer; Calculate the gradient of the binary cross-entropy loss function relative to the hidden layers of the BERT model; Calculate the gradient of the binary cross-entropy loss function with respect to each layer of the BERT model; Update the model's weights and gradients using the AdamW optimizer.

5. The GOIP fraud den identification method as described in claim 1, characterized in that, The step of grouping the suspected GOIP fraud numbers according to a preset grouping algorithm to obtain suspected GOIP fraud number groups includes: Based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraud number, a KD tree is constructed; The nearest neighbor search algorithm of the KD tree is used to find other numbers that are similar to each of the suspected GOIP fraud numbers in terms of location information, call duration, call frequency, call time and call direction, so as to obtain multiple sets of neighboring numbers; For each set of neighboring numbers, feature analysis is performed using a decision tree algorithm to obtain a decision tree for each set of neighboring numbers; For each set of neighboring numbers, the decision tree is used to perform pattern recognition using the random forest algorithm to obtain the initial classification result; The numbers in the initial classification results are clustered using the K-means algorithm. Based on feature similarity, the numbers are divided into different groups, resulting in multiple suspected GOIP fraud number clusters.

6. The GOIP fraud den identification method as described in claim 5, characterized in that, The step of constructing a KD-tree based on the location information, call duration, call frequency, call time, and call direction of the suspected GOIP fraud number includes: Calculate the variances of longitude, latitude, call duration, call frequency, call time, and call direction respectively, and select the dimension with the largest variance to divide the dataset of suspected GOIP fraud numbers into two subtrees; For each subtree, calculate the variance of each dimension other than the dimension with the largest variance, select the dimension with the largest variance from the variances of the other dimensions, and divide the subtree into a left subtree and a right subtree. For the left subtree and the right subtree, repeat the variance calculation and segmentation process until the preset stopping condition is met.

7. A GOIP fraud den identification device, characterized in that, include: The data acquisition module is used to acquire training sample datasets based on real-time streams and to preprocess the training sample datasets; wherein, the training sample datasets include communication information of GOIP fraud devices and communication information of normal communication devices; The model training module is used to train the BERT model based on the preprocessed training sample dataset to obtain the GOIP fraud number identification model. The fraud identification module is used to obtain test sample data from all GOIP devices based on real-time stream, and input the test sample data into the GOIP fraud number identification model to obtain the suspected GOIP fraud number output by the GOIP fraud number identification model; The fraud grouping module is used to group the suspected GOIP fraud numbers according to a preset grouping algorithm to obtain suspected GOIP fraud number groups; wherein, the grouping algorithm is a combination of KD tree algorithm, decision tree algorithm, random forest algorithm and clustering algorithm; The location module is used to statistically analyze the location information of each suspected GOIP fraud number group, classify them into high, medium and low levels, and determine the location of the fraud den by combining triangulation.

8. A terminal device, characterized in that, The device includes a processor and a memory, wherein the memory stores a computer program and the computer program is configured to be executed by the processor, wherein the processor, when executing the computer program, implements the GOIP fraud den identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the GOIP fraud den identification method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which, when executed by a processor, implement the GOIP fraud den identification method as described in any one of claims 1 to 6.

Images