Personal mobile network number anomaly detection method, device, equipment, medium and product

Abstract

The invention provides a personal mobile network number anomaly detection method, device and equipment, a medium and a product, and relates to the technical field of data processing and communication security. Comprising the following steps: acquiring mobile network signaling ticket data and user tag data; according to a preset double encryption algorithm and in combination with a preset salt value, performing encryption processing on the main-end mobile phone number to obtain a desensitized mobile phone number; performing association processing on the desensitized mobile phone number and the user tag data to obtain a user identifier corresponding to the desensitized mobile phone number; according to the account period field, determining the accumulated number of opposite-end mobile phone numbers on the day corresponding to the main-end mobile phone number in the current account period; and obtaining a detection result of the desensitized mobile phone number according to the opposite-end mobile phone number, the user identifier, the accumulated number of the opposite-end mobile phone numbers on the day corresponding to the main-end mobile phone number in the current account period, a pre-stored acquaintance call record and a historical call statistical table. According to the method provided by the invention, on the premise of ensuring the security of user data, the real-time anomaly detection of the mobile network number call behavior is realized.

Description

Technical Field

[0001] This application relates to the fields of data processing and communication security technology, and in particular to a method, apparatus, device, medium and product for detecting anomalies in personal mobile phone numbers. Background Technology

[0002] In modern communication networks, detecting abnormal call behavior of personal mobile numbers (such as personal mobile phone numbers) is a key link in ensuring network security and user service quality.

[0003] In existing technologies, anomaly detection for individual mobile phone numbers typically relies on user tagging and algorithmic model prediction. This method depends on user tags or machine learning models, followed by manual verification and offline analysis. Specifically, user tagging refers to a rule-based tagging system based on user profiles, which assigns various static anomalous tags to users through offline batch processing of historical call detail records. Algorithmic model prediction involves using machine learning or deep learning models, such as Isolation Forest, Long Short-Term Memory (LSTM), and Graph Neural Networks, to model user behavior sequences and predict the probability of anomalies.

[0004] However, existing methods for detecting anomalies in personal mobile phone numbers suffer from drawbacks such as high response delays, poor accuracy, and insufficient user data security. Summary of the Invention

[0005] This application provides a method, apparatus, device, medium, and product for detecting anomalies in personal mobile phone numbers. It uses a dual encryption algorithm combined with a preset salt value to encrypt the main mobile phone number, thereby enabling real-time anomaly detection of personal mobile phone number call behavior while ensuring user data security. It also comprehensively judges the call behavior of personal mobile phone number based on user identifiers, improving the accuracy of anomaly detection and achieving real-time detection and identification of anomalies in personal mobile phone numbers.

[0006] Firstly, this application provides a method for detecting anomalies in personal mobile phone numbers, the method comprising:

[0007] Obtain mobile network signaling call detail records (CDRs) and user tag data. The mobile network signaling CDRs include the billing period field, the primary mobile phone number and the corresponding peer mobile phone number, and the user tag data includes historical user tag data and new user tag data for the current day.

[0008] The main mobile phone number is encrypted using a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number;

[0009] The anonymized mobile phone number and user tag data are associated to obtain the user identifier corresponding to the anonymized mobile phone number;

[0010] Based on the billing period field, determine the cumulative number of peer mobile numbers corresponding to the master mobile number on the current billing period;

[0011] The detection results of the anonymized mobile phone numbers are obtained based on the peer's mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the master's mobile phone number in the current billing period, pre-stored acquaintance call records, and historical call statistics table.

[0012] In one possible implementation, the detection result of the de-identified mobile phone number is obtained based on the peer's mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the master's mobile phone number in the current billing period, pre-stored acquaintance call records, and historical call statistics table, including:

[0013] If the number of calls made by the mobile phone number of the other party in the current call within the first preset time period in the corresponding acquaintance call record is greater than or equal to the preset acquaintance call count threshold, then the current call is determined to be an acquaintance call, and the detection result of the de-identified mobile phone number is determined to be normal.

[0014] If the number of calls is less than the preset threshold for the number of calls to acquaintances, the de-identified mobile phone number will be associated with the historical call statistics table, which contains the median number of calls within the second preset time period.

[0015] Based on the mobile signaling call detail records, determine the region of origin of the primary mobile phone number and the region of origin of the secondary mobile phone number in the current call;

[0016] If the cumulative number of peer mobile phone numbers on a given day exceeds a preset multiple of the median number of calls, and the region of origin of the current call's primary mobile phone number is inconsistent with the region of origin of the peer mobile phone number, then it is determined that there is a sudden increase in the anonymized mobile phone numbers, and the detection result of the anonymized mobile phone numbers is determined to be abnormal.

[0017] In one possible implementation, after obtaining the detection result of the de-identified mobile phone number, the method further includes:

[0018] If the detection result is abnormal, the abnormal record containing the de-identified mobile phone number and the corresponding master mobile phone number will be sent to the specified topic of the message queue for downstream systems to make real-time alarms or manual outbound calls for verification.

[0019] If the test result is normal, the detailed record containing the anonymized mobile phone number and the corresponding master mobile phone number will be stored in the analytical database to support subsequent behavior backtracking and troubleshooting analysis.

[0020] In one possible implementation, the main mobile phone number is encrypted according to a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number, including:

[0021] The main mobile phone number is concatenated with a preset salt value to obtain the first concatenated string;

[0022] The first concatenated string is encrypted using a preset double encryption algorithm to obtain the first ciphertext;

[0023] The first ciphertext is encrypted using a preset double encryption algorithm to obtain the second ciphertext;

[0024] Use the second encrypted text as a de-identified mobile phone number.

[0025] In one possible implementation, the process of determining the preset salt value includes:

[0026] The main mobile phone number is concatenated with a preset fixed value to obtain the second concatenated string;

[0027] The hash value of the second concatenated string is calculated according to the preset secure hash algorithm;

[0028] Use the hash value as the preset salt value.

[0029] In one possible implementation, the cumulative number of peer mobile numbers corresponding to the primary mobile number in the current billing period is determined based on the billing period field, including:

[0030] Determine the current payment period based on the payment period field;

[0031] Using the anonymized mobile phone number as the key, aggregate the peer mobile phone numbers in all signaling records of the master mobile phone number corresponding to the anonymized mobile phone number within the current billing period, and obtain the cumulative number of peer mobile phone numbers for the day after deduplication.

[0032] In one possible implementation, acquiring user tag data includes:

[0033] Retrieve historical user tag data from the previous day's date in the offline data warehouse table partitioned by day;

[0034] Retrieve the tag data of newly joined users for the current date of the signaling call detail record from the real-time key-value storage system;

[0035] By merging historical user tag data with new user tag data, complete user tag data is obtained to ensure the timeliness and completeness of user identification information.

[0036] Secondly, this application provides a device for detecting anomalies in personal mobile phone numbers, the device comprising:

[0037] The acquisition module is used to acquire mobile network signaling call detail records (CDRs) and user tag data. The mobile network signaling CDRs include the billing period field, the primary mobile phone number and the corresponding peer mobile phone number, and the user tag data includes historical user tag data and new user tag data for the current day.

[0038] The encryption module is used to encrypt the main mobile phone number according to a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number;

[0039] The user verification module is used to associate de-identified mobile phone numbers with user tag data to obtain user identifiers corresponding to the de-identified mobile phone numbers;

[0040] The call count determination module is used to determine the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period based on the billing period field.

[0041] The detection module is used to obtain the detection results of the de-identified mobile phone number based on the peer mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period, pre-stored acquaintance call records, and historical call statistics table.

[0042] In one possible implementation, the detection module is further configured to query the pre-stored acquaintance call records based on the user identifier. If the number of calls made by the mobile phone number of the other end of the current call within the first preset time period in the acquaintance call records is greater than or equal to the preset acquaintance call count threshold, then the current call is determined to be an acquaintance call, and the detection result of the de-identified mobile phone number is determined to be normal.

[0043] The detection module is also used to associate the de-identified mobile phone number with the historical call statistics table if the number of calls is less than the preset threshold for the number of calls to acquaintances. The historical call statistics table contains the median number of calls within a second preset time period.

[0044] The detection module is also used to determine the region of origin of the primary mobile phone number and the region of origin of the secondary mobile phone number in the current call based on mobile network signaling call detail records.

[0045] The detection module is also used to determine if there is a sudden increase in the de-identified mobile phone numbers if the cumulative number of peer mobile phone numbers on a given day is greater than a preset multiple of the median number of calls, and the region of the current caller's mobile phone number is different from the region of the peer mobile phone number. In this case, the detection result of the de-identified mobile phone numbers is determined to be abnormal.

[0046] In one possible implementation, the detection module is further configured to send an abnormal record containing the de-identified mobile phone number and the corresponding master mobile phone number to a designated topic in the message queue if the detection result is abnormal, so that the downstream system can make real-time alarms or make manual outbound calls for verification.

[0047] The detection module is also used to store detailed records containing the anonymized mobile phone number and the corresponding master mobile phone number into an analytical database if the detection result is normal, so as to support subsequent behavior backtracking and troubleshooting analysis.

[0048] In one possible implementation, the encryption module is also used to concatenate the main mobile phone number with a preset salt value to obtain a first concatenated string;

[0049] The encryption module is also used to encrypt the first concatenated string according to a preset double encryption algorithm to obtain the first ciphertext;

[0050] The encryption module is also used to encrypt the first ciphertext according to a preset dual encryption algorithm to obtain the second ciphertext;

[0051] The encryption module is also used to transmit the second ciphertext as a de-identified mobile phone number.

[0052] In one possible implementation, the encryption module is also used to concatenate the main mobile phone number with a preset fixed value to obtain a second concatenated string;

[0053] The encryption module is also used to calculate the hash value of the second concatenated string according to a preset secure hash algorithm;

[0054] The encryption module is also used to use the hash value as a preset salt value.

[0055] In one possible implementation, the call count determination module is also used to determine the current billing period based on the billing period field;

[0056] The call count determination module is also used to aggregate the peer mobile phone numbers in all signaling records of the master mobile phone number corresponding to the de-identified mobile phone number in the current billing period, using the de-identified mobile phone number as the key, and obtain the cumulative number of peer mobile phone numbers for the day after deduplication.

[0057] In one possible implementation, the acquisition module is also configured to acquire historical user tag data from an offline data warehouse table partitioned by day, for the day preceding the date to which the current signaling call detail record belongs;

[0058] The acquisition module is also used to retrieve the tag data of newly joined users for the current signaling call detail record (CDR) date from the real-time key-value storage system;

[0059] The acquisition module is also used to merge historical user tag data with newly registered user tag data to obtain complete user tag data, so as to ensure the timeliness and completeness of user identification information.

[0060] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor.

[0061] The memory stores the instructions that the computer executes.

[0062] The processor executes computer execution instructions stored in the memory to implement the personal mobile number anomaly detection method of the first aspect of the invention.

[0063] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement a method for detecting anomalies in personal mobile phone numbers as described in the first aspect of the invention.

[0064] Fifthly, this application provides a computer program product, including a computer program, which, when executed by a processor, is used to implement a method for detecting anomalies in personal mobile phone numbers as described in the first aspect of the invention.

[0065] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods.

[0066] This application provides a method, apparatus, device, medium, and product for detecting anomalies in personal mobile phone numbers. The method includes: first, acquiring mobile signaling call detail records (CDRs) and user tag data; then, encrypting the primary mobile phone number using a preset double encryption algorithm and a preset salt value to obtain a de-identified mobile phone number; next, associating the de-identified mobile phone number with the user tag data to obtain a user identifier corresponding to the de-identified mobile phone number; then, determining the cumulative number of peer mobile phone numbers corresponding to the primary mobile phone number in the current billing period based on the billing period field; finally, obtaining the detection result of the de-identified mobile phone number based on the peer mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the primary mobile phone number in the current billing period, pre-stored acquaintance call records, and historical call statistics. This achieves the following technical effect: by employing a preset double encryption algorithm to double-encrypt the primary mobile phone number and combining it with a preset salt value for de-identification, the primary mobile phone number always exists in the form of an irreversibly de-identified mobile phone number throughout the entire data processing chain, effectively preventing the leakage of important user information. By introducing user identifiers and querying pre-stored call records of acquaintances, communication behaviors belonging to the same individual or frequent contacts are filtered out, avoiding misjudging normal social communication as abnormal outbound calls, significantly reducing the false alarm rate and improving the accuracy of anomaly detection. By using the median of call counts from historical call statistics to determine sudden increases in the number of peer mobile phone numbers on a given day, the concept of the mathematical median effectively identifies genuine behavioral mutations, overcoming the limitations of traditional fixed threshold methods in scenarios with varying user behavior, thereby further improving detection accuracy. Attached Figure Description

[0067] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0069] Figure 1 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure One ;

[0070] Figure 2 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure Two ;

[0071] Figure 3 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure Three ;

[0072] Figure 4 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure Four ;

[0073] Figure 5 This is a schematic diagram of the structure of a personal mobile phone number anomaly detection device provided in an embodiment of this application;

[0074] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0075] Figure label:

[0076] 510 - Acquisition module; 520 - Encryption module; 530 - User confirmation module; 540 - Call count determination module; 550 - Detection module; 610 - Processor; 620 - Memory; 630 - Communication component; 640 - Bus. Detailed Implementation

[0077] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0078] In the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply difference. It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate that something is being used as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being better or more advantageous than other embodiments or design schemes. Specifically, the use of "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more.

[0079] It should be noted that the phrase "at...time" in the embodiments of this application can refer to the instant at which a certain situation occurs, or to a period of time after the occurrence of a certain situation; the embodiments of this application do not specifically limit this. Furthermore, the personal mobile number anomaly detection method provided in the embodiments of this application is only an example; a personal mobile number anomaly detection method may include more or fewer elements.

[0080] In today's booming modern communication networks, detecting abnormal call behavior of personal mobile phone numbers (typically personal mobile phone numbers) has become a core aspect of ensuring network security and improving user service quality. With the rapid growth of communication traffic and the increasing complexity of communication scenarios, abnormal call behavior of personal mobile phone numbers is becoming more diverse and covert, posing a serious threat to network security and user rights.

[0081] While some progress has been made in detecting abnormal behavior of mobile phone numbers, current technologies generally suffer from significant limitations. Existing technologies primarily rely on user tagging and algorithmic model prediction for anomaly detection. Specifically, this involves two approaches: firstly, manually assigning various tags to users as a reference for judging abnormal behavior; and secondly, using machine learning models to train and analyze call data to predict the existence of abnormal call behavior. However, both methods have numerous drawbacks in practical applications.

[0082] In terms of response speed, existing methods typically involve manual verification and offline analysis after a call has occurred, which cannot react promptly to abnormal call behavior, resulting in high response delays. For example, the system may only detect the anomaly after the abnormal call has already reached multiple users and caused some impact, by which time the opportunity for accurate prevention has been missed.

[0083] Regarding detection accuracy, existing methods suffer from poor accuracy in detecting abnormal call behavior due to the difficulty in guaranteeing the accuracy and completeness of user tags, and the fact that the performance of machine learning models is affected by various factors such as data quality and feature selection. This leads to frequent false positives and false negatives. For example, some normal call behaviors may be misjudged as abnormal due to inaccurate tags or improper feature extraction by the model, while some subtle abnormal call behaviors may be missed.

[0084] Furthermore, regarding user data security, existing detection methods lack adequate protection measures for user data during data processing and storage. During data collection, transmission, and computation, the host mobile phone number often exists in plaintext throughout the detection process, posing a potential risk of user data leakage. As users increasingly prioritize personal data security, this issue has become more prominent, becoming a significant factor hindering the widespread application of existing detection technologies.

[0085] Therefore, existing methods for detecting anomalies in personal mobile phone numbers can no longer meet the security and real-time requirements of modern communication networks, and a new detection method is urgently needed to solve the above problems.

[0086] Based on this, this application proposes a method, apparatus, device, medium, and product for detecting anomalies in personal mobile phone numbers. These can be used in the fields of data processing and communication security technology, aiming to solve the aforementioned technical problems of the prior art. By encrypting the main mobile phone number using a dual encryption algorithm combined with a preset salt value, the security of user data is effectively enhanced, preventing the leakage or modification of user mobile phone numbers during transmission and storage, providing reliable data protection for subsequent anomaly detection. Secondly, while ensuring user data security, real-time anomaly detection of personal mobile phone number call behavior is achieved. By collecting mobile signaling call detail records in real time and comprehensively judging mobile phone number call behavior based on user identifiers, the accuracy of anomaly detection is improved, reducing false positives and false negatives, and achieving real-time detection and identification of anomalies in personal mobile phone numbers.

[0087] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0088] Figure 1 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure OneThe executing entity in this embodiment can be a data processing server or other devices with data processing capabilities, such as laptops, personal computers, tablets, etc. The data processing server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server, etc., without specific limitations. For ease of description, this application embodiment uniformly describes the executing entity of a method for detecting anomalies in personal mobile phone numbers as a server. Figure 1 As shown, the method includes:

[0089] S101. Obtain mobile network signaling call detail records (CDRs) and user tag data.

[0090] In this embodiment of the application, the mobile signaling call detail record data includes the billing period field, the primary mobile phone number and the corresponding peer mobile phone number, and the user tag data includes historical user tag data and new user tag data for the current day.

[0091] Specifically, the server can obtain mobile signaling call detail records (CDRs) from real-time data sources (such as Kafka message queues) and user tag data from offline and real-time storage systems. The mobile signaling CDRs at least include a billing period field (identifying the business date to which the signaling belongs), the originating mobile phone number (the party initiating the call), and the corresponding peer mobile phone number (the called party). User tag data comprises two parts: historical user tag data read from Hive offline data tables (typically T-1 billing period or earlier full user identification information, where T usually refers to the current billing period), and tag data of newly registered users obtained from a distributed (Hadoop Database, HBase) real-time database, ensuring the completeness and timeliness of user identification coverage.

[0092] S102. The main mobile phone number is encrypted according to the preset dual encryption algorithm and the preset salt value to obtain the de-identified mobile phone number.

[0093] Specifically, the server can employ a preset double encryption algorithm, such as two-iteration encryption based on a block cipher (ShangMi 4, SM4) algorithm, to de-identify the main mobile phone number. During the encryption process, a preset salt value can be introduced and concatenated or mixed with the main mobile phone number before performing double encryption to generate the de-identified mobile phone number.

[0094] Furthermore, it should be noted that, in order to support subsequent data association and aggregation based on the de-identified number, the preset salt value can adopt a deterministic generation strategy (such as derivation based on the system key or a globally fixed preset salt value), thereby ensuring that the de-identification results generated by the same master mobile number at different times are consistent, while still effectively resisting security threats such as rainbow table attacks.

[0095] S103. Associate the de-identified mobile phone number and user tag data to obtain the user identifier corresponding to the de-identified mobile phone number.

[0096] Specifically, the server can associate the anonymized mobile phone number with the aforementioned user tag data. Specifically, it can first attempt to match the anonymized mobile phone number with historical user tag data retrieved from the Hive offline data table. If a match is successful and the document type in the tag is a personal document, the corresponding user identifier (such as document ID) is extracted. If no match is found, it can further query the tag data of newly registered users for the current day retrieved from HBase, similarly filtering out successfully matched personal document types and obtaining the user identifier. If neither match is found, the signaling record can be filtered out and will not participate in subsequent anomaly detection.

[0097] S104. Based on the billing period field, determine the cumulative number of peer mobile numbers corresponding to the master mobile number on the current billing period.

[0098] Specifically, the server can utilize the MapState mechanism provided by the distributed stream processing engine (Flink) to maintain an independent state instance for the de-identified mobile phone number, using the de-identified mobile phone number as the stream processing key. The internal structure of this state instance stores the set of all peer phone numbers corresponding to the de-identified mobile phone number, with the billing period as the key.

[0099] Specifically, the server can categorize the current call record into the corresponding business day window based on the billing period field in the mobile signaling call detail record data. Using the anonymized mobile phone number as the key, and leveraging Flink's MapState backend, it maintains a deduplicated set of all peer phone numbers associated with that anonymized mobile phone number within the current billing period. The peer phone numbers are deduplicated before being stored in the set, ensuring that the same peer phone number is counted only once within a single billing period.

[0100] By deduplicating the set, the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period is obtained. This effectively solves the problem of data out-of-order due to network latency or system failure. Even if signaling from day T-1 is received on day T, it can be correctly classified into the historical window based on its billing period field, avoiding cross-day calculation errors.

[0101] S105. Based on the peer mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period, the pre-stored acquaintance call records and historical call statistics table, obtain the detection result of the de-identified mobile phone number.

[0102] In this embodiment, pre-stored call records of acquaintances can be stored in a remote dictionary server (Redis), using the user identifier as the key to record the call frequency between the user and each peer number in the past six months, in order to eliminate communication scenarios involving acquaintances. The historical call statistics table can be stored in a Hive offline data table, and can include indicators such as the median number of calls and the maximum number of call days calculated based on the call records of the past six months, in order to determine sudden changes in call behavior.

[0103] Specifically, the server can generate the final detection result by combining multi-dimensional information such as the peer mobile phone number in the current signaling, the associated user identifier (used to identify whether multiple numbers belong to the same natural person), the cumulative number of peer mobile phone numbers on the day (reflecting the problem of a sudden increase in the breadth of outgoing calls), pre-stored acquaintance call records, and historical call statistics tables.

[0104] If the anomaly is detected, for example: the cumulative number of peer mobile phone numbers in a given day exceeds N times the historical median (N is a preset value, which can be 2, 3, or 5, etc., without specific restrictions here), and the proportion of peer mobile phone numbers whose regions are inconsistent with the master mobile phone numbers exceeds a preset threshold, and the call is between unacquainted individuals, then an anomaly detection result will be output, and the record of the anomaly detection result will be written to an anomaly topic in the Kafka message queue for manual review. Otherwise, it is determined to be normal communication behavior, and the detailed data can be recorded in an analytical database (Doris) to support subsequent troubleshooting analysis.

[0105] Using the methods described above, this embodiment achieves stream-batch collaborative anomaly detection through SM4 double desensitization, acquaintance removal, median surge detection, isolation of signaling call detail records (CDRs) based on billing period, and fusion of historical user tags from Hive offline data tables and current-day user tags from HBase real-time databases. This enables secure, accurate, stable, and timely real-time detection of abnormal behavior by mobile network numbers.

[0106] This embodiment provides a method for detecting anomalies in personal mobile phone numbers. First, mobile signaling call detail records (CDRs) and user tag data are acquired. The CDRs include a billing period field, the primary mobile phone number, and the corresponding peer mobile phone number. The user tag data includes historical user tag data and tag data of newly registered users on the current day. Next, the primary mobile phone number is encrypted using a preset dual encryption algorithm combined with a preset salt value to obtain a de-identified mobile phone number. Then, the de-identified mobile phone number and user tag data are associated to obtain a user identifier corresponding to the de-identified mobile phone number. Then, based on the billing period field, the cumulative number of peer mobile phone numbers corresponding to the primary mobile phone number on the current billing period is determined. Finally, based on the peer mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the primary mobile phone number on the current billing period, pre-stored acquaintance call records, and historical call statistics table, the detection result of the de-identified mobile phone number is obtained.

[0107] The following technical effects were achieved: By employing a preset dual encryption algorithm to double-encrypt the main mobile phone number and combining it with a preset salt value for desensitization, the main mobile phone number always exists in an irreversibly desensitized form throughout the entire data processing chain, effectively preventing the leakage of important user information. By introducing user identifiers and querying pre-stored call records of acquaintances, communication behaviors belonging to the same natural person or high-frequency contacts are filtered out, avoiding misjudging normal social communication as abnormal outbound calls, significantly reducing the false alarm rate, and improving the accuracy of anomaly detection. By using the median of call counts in the historical call statistics table to determine sudden increases in the cumulative number of peer mobile phone numbers on a given day, the concept of the mathematical median is used to effectively identify real behavioral changes, overcoming the limitations of traditional fixed threshold methods in scenarios with different user behavior differences, thereby further improving detection accuracy. By using the billing period field in mobile network signaling call detail records (CDRs) as a dimension, and storing the set of peer mobile phone numbers corresponding to each master mobile phone number in Flink state according to the billing period, even if upstream data arrives out of order or across days due to network latency or system failure, it can still be accurately aggregated to the corresponding business day window based on the original billing period, avoiding statistical errors and misjudgments caused by time misalignment. By integrating the T-1 historical user tags in the Hive offline data table with the tags of newly added users on the same day in the HBase real-time database, a complete user identity view is constructed. This utilizes offline batch processing to ensure the comprehensiveness of historical data, while real-time querying covers newly added users on the same day, forming a hybrid data supply mechanism of stream and batch collaboration. This ensures that anomaly detection is not missed or interrupted, thus achieving high timeliness and data integrity. Through the synergistic effect of the above multiple technical means, a secure, accurate, stable, and timely real-time detection capability for abnormal behavior of mobile network numbers is achieved, solving key problems in existing technologies such as poor real-time performance, high false alarm rate, incomplete data coverage, and easy exposure of user information.

[0108] Figure 2 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure Two In one possible implementation, such as Figure 2 As shown in S105, based on the peer's mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the master's mobile phone number in the current billing period, pre-stored acquaintance call records, and historical call statistics table, the detection result of the de-identified mobile phone number is obtained, including:

[0109] S201. Query the pre-stored acquaintance call records based on the user identifier. If the number of calls made by the mobile phone number of the other party in the current call within the first preset time period in the acquaintance call records is greater than or equal to the preset acquaintance call count threshold, then determine that the current call is an acquaintance call and determine that the detection result of the de-identified mobile phone number is normal.

[0110] S202. If the number of calls is less than the preset threshold for the number of calls to acquaintances, then the anonymized mobile phone number will be associated with the historical call statistics table.

[0111] S203. Based on the mobile network signaling call detail record data, determine the region of origin of the primary mobile phone number and the region of origin of the secondary mobile phone number in the current call.

[0112] S204. If the cumulative number of peer mobile phone numbers on a given day is greater than a preset multiple of the median number of calls, and the region of the current caller's mobile phone number is different from the region of the peer mobile phone number, then it is determined that there is a sudden increase in the de-identified mobile phone numbers, and the detection result of the de-identified mobile phone numbers is determined to be abnormal.

[0113] In this embodiment of the application, the historical call statistics table includes the median number of calls within a second preset time period.

[0114] Specifically, the server can first query the pre-stored call records of acquaintances in Redis based on the user identifier (such as a personal identification ID) obtained from the aforementioned association processing. These call records, using the user identifier as the query key, store the historical communication frequency of the user with each peer mobile phone number within a first preset time period (e.g., the last 180 days). The data structure can be an ordered set, where the score is the call timestamp, and the value can include the peer mobile phone number (which can be anonymized) and call count statistics.

[0115] If the peer mobile phone number in the current signaling (which can also be a de-identified peer mobile phone number) exists in the acquaintance call record, and its cumulative number of calls within the first preset time period is greater than or equal to the preset acquaintance call threshold (e.g., 2 times), then the current call can be determined to be a acquaintance communication scenario, regarded as normal social behavior, and the detection result of the de-identified mobile phone number can be directly determined as normal, and the subsequent abnormal judgment process can be terminated.

[0116] If the number of calls is less than the preset threshold for the number of calls to acquaintances, or if the mobile phone number of the other party in the current signaling does not appear in the call record of acquaintances, the server can further perform a sudden increase anomaly detection.

[0117] Specifically, anonymized mobile phone numbers can be linked and matched with historical call statistics tables. These historical call statistics tables are stored in Hive offline data tables, partitioned by anonymized mobile phone numbers, and include key metrics calculated based on all call details within a second preset time period (usually consistent with the first preset time period, such as the last 180 days). These metrics include at least the median number of calls, which can be updated daily via an offline batch processing task to reflect the typical level of a user's historical outbound call behavior.

[0118] Simultaneously, the server can parse the originating mobile phone number's region (such as province and city code) and the originating mobile phone number's region in the current mobile network signaling call detail record data. The originating region information can be mapped and converted using the province and city code table file loaded by Flink's distributed caching mechanism, ensuring the accuracy and timeliness of region determination.

[0119] Based on this, the server can combine two conditions to jointly determine the detection result of the anonymized mobile phone number. The two conditions are as follows: First, whether the cumulative number of peer mobile phone numbers (after deduplication) of the anonymized mobile phone number in the current billing period is greater than a preset multiple of the median number of calls (e.g., 2 times, 3 times, or 5 times, which can be configured according to the business scenario); Second, whether the originating mobile phone number and the peer mobile phone number of the current call are inconsistent (i.e., whether it is cross-regional communication).

[0120] If both of the above conditions are met, it is determined that the de-identified mobile phone number has a sudden increase in outbound call behavior and is accompanied by abnormal geographical distribution characteristics, which is very likely to involve abnormal call behavior, and its detection result is determined to be abnormal.

[0121] Otherwise, the current call is judged as normal communication behavior, and the detection result is normal.

[0122] Through this multi-dimensional and hierarchical judgment mechanism, this embodiment effectively distinguishes between high-frequency but reasonable communication with acquaintances and low-frequency but sudden abnormal calls, significantly improving the accuracy of anomaly detection and business applicability.

[0123] Figure 3 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure Three In one possible implementation, such as Figure 3 As shown, after obtaining the detection results for the anonymized mobile phone number, the following is also included:

[0124] S301. If the detection result is abnormal, the abnormal record containing the anonymized mobile phone number and the corresponding master mobile phone number will be sent to the specified topic of the message queue for downstream systems to make real-time alarms or manual outbound calls for verification.

[0125] S302. If the test result is normal, the detailed record containing the anonymized mobile phone number and the corresponding master mobile phone number will be stored in the analytical database to support subsequent behavior backtracking and troubleshooting analysis.

[0126] Specifically, after obtaining the detection results of the anonymized mobile phone numbers, the server can further perform differentiated data output and persistence processing based on the category of the detection results, so as to achieve closed-loop management and high-quality data accumulation.

[0127] Specifically, if the detection result is abnormal, a structured abnormality record can be constructed. This abnormality record can include the anonymized master mobile phone number, the corresponding original master mobile phone number, the key basis for the abnormality judgment, and the original signaling fields.

[0128] The anonymized master mobile phone number can serve as a security identifier for end-to-end association. The corresponding original master mobile phone number can be used by downstream authorization systems for identity verification or manual outbound calls. Key criteria for anomaly detection may include the cumulative number of peer mobile phone numbers on a given day, the median number of historical calls, the preset threshold for calls to acquaintances, whether the calling and called parties have the same geographical location, and whether calls to acquaintances are excluded. Original signaling fields may include billing period fields, call start and end times, peer mobile phone number, user identifier, and other information.

[0129] After being serialized, the anomaly record can be sent by the sink operator in the Flink job to a pre-defined topic in a distributed message queue (such as Kafka). Downstream real-time consumption systems (such as risk control alarm platforms, intelligent outbound call robots, or manual review agent systems) can subscribe to this topic and trigger alarm pushes, automatic interception policies, or manual follow-up tasks within a second's delay, thereby achieving rapid response to abnormal call behavior and business closure.

[0130] If the detection result is normal, a communication detail record can be constructed, which can also include the anonymized master mobile phone number, the original master mobile phone number, complete signaling metadata, and intermediate detection status (such as the acquaintance judgment flag, the cumulative number of peer mobile phone numbers for the day, and the regional matching results). This detail record can be persisted to an analytical database (such as Doris) through a batch write interface (such as StreamLoad). Doris can partition and bucket the data by billing period, province, city, etc., and create materialized views or roll-up indexes to support ad-hoc queries with sub-second response times, multi-dimensional drill-down analysis, and full behavior backtracking. Based on this detail data, operations and maintenance personnel, security analysts, or audit teams can conduct in-depth investigations into the historical communication patterns of specific individual mobile phone numbers, analyze the effect of rules, or locate the root causes of faults, effectively supporting subsequent troubleshooting analysis, model iteration, and compliance auditing.

[0131] It should be noted that the original master mobile phone number is only carried in the encrypted transmission channel and is strictly limited to use by downstream systems with authorized permissions. All intermediate computations, state storage, and log records are uniquely identified by the anonymized mobile phone number to ensure end-to-end data security and privacy compliance. In addition, abnormal and normal streams are efficiently split within a single stream processing job through Flink's side output mechanism, avoiding additional network overhead and ensuring overall processing throughput and low latency.

[0132] Through the aforementioned dual-path output method, this embodiment not only achieves real-time linkage and handling capabilities for abnormal events, but also simultaneously constructs a data foundation of normal communication behavior with high integrity and high availability, providing solid support for continuous optimization of detection rules, training of artificial intelligence (AI) models, and improvement of operational efficiency.

[0133] Figure 4 A flowchart illustrating a method for detecting anomalies in personal mobile phone numbers provided in this application embodiment. Figure Four In one possible implementation, such as Figure 4 As shown, S102, the main mobile phone number is encrypted according to a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number, including:

[0134] S401. Concatenate the main mobile phone number with the preset salt value to obtain the first concatenated string.

[0135] S402. Encrypt the first concatenated string according to the preset double encryption algorithm to obtain the first ciphertext.

[0136] S403. Encrypt the first ciphertext according to the preset double encryption algorithm to obtain the second ciphertext.

[0137] S404. Use the second ciphertext as a de-identified mobile phone number.

[0138] Specifically, the preset salt value can be a fixed-length byte sequence (e.g., 16 bytes), represented in hexadecimal or Base64 encoding, to ensure that the generated de-identification results remain consistent when the same master mobile phone number appears in different signaling records.

[0139] Subsequently, the original host mobile phone number and the preset salt value are concatenated according to predefined rules to form a first concatenated string. The concatenation method can adopt a fixed order of "mobile phone number + preset salt value" or "preset salt value + mobile phone number". In this embodiment, the preferred method is to put the mobile phone number first and the preset salt value last.

[0140] Next, the server can invoke a preset double encryption algorithm (such as the Chinese national standard SM4 algorithm) to perform the first encryption operation on the first concatenated string, generating the first ciphertext. During the encryption process, a pre-configured fixed key and initialization vector (IV) are used, where the IV can be set to all zeros or a fixed value to ensure the consistency of the encryption results under the same input.

[0141] Furthermore, the server can use the same SM4 algorithm, the same key, and the same IV to perform a second encryption operation on the first ciphertext, generating the second ciphertext. This double encryption mechanism increases the difficulty of resisting differential analysis and cracking by increasing the number of encryption iterations, while maintaining a stable output format.

[0142] Ultimately, the server can Base64 or hexadecimal encode the second ciphertext as the de-identified mobile phone number of the master mobile phone number, which will be used in all subsequent data processing stages, including association with user tags, status aggregation, identification of acquaintances, and anomaly detection. It is important to note that no decryption operation is performed in this embodiment; the de-identified mobile phone number is used solely as a unique and irreversible security identifier.

[0143] Furthermore, to balance security and consistency, in this embodiment, a deterministic salt value generation strategy can be adopted to ensure that the same primary mobile number generates the same de-identified result within the same batch or billing period (e.g., for deduplication statistics of peer mobile numbers on the same day). For example, a salt value can be derived based on the primary mobile number and billing period field using a hash-based message authentication code (HMAC).

[0144] In streaming real-time detection scenarios, deterministic encryption with a fixed salt value and a fixed IV can be used because decryption is not required and the encryption relies on the consistency of the de-identified value. The purpose of the preset salt value is to prevent rainbow table attacks across systems or tenants, rather than to compromise the de-identification consistency of the same number.

[0145] This embodiment combines preset salt value perturbation with SM4 dual encryption, which not only meets the data desensitization compliance requirements, but also provides an anonymization identification mechanism for real-time stream processing methods that is both secure and usable.

[0146] In one possible implementation, the process of determining the preset salt value includes: concatenating the main mobile phone number with a preset fixed value to obtain a second concatenated string; calculating the hash value of the second concatenated string according to a preset secure hash algorithm; and using the hash value as the preset salt value.

[0147] Specifically, to balance the consistency of the de-identification results (to support subsequent data association based on the de-identified mobile phone numbers) and the security against rainbow table attacks, the server can adopt a deterministic salt generation mechanism. The preset salt value is not randomly generated, but dynamically derived through the following steps: First, the original host mobile phone number is concatenated with a preset fixed value in a predefined order to form a second concatenated string.

[0148] The preset fixed value is a high-entropy random string with a length of no less than 16 bytes configured during deployment. This preset fixed value is stored in the security configuration center, is not transmitted in plaintext with the data, and is not exposed to the outside world.

[0149] Subsequently, the server can invoke a cryptographically secure hash algorithm (such as SHA-256, SM3, or other national or international standard algorithms) to perform a one-way hash operation on the second concatenated string, generating a fixed-length hash value. This hash value has good avalanche effect and collision resistance; even if the input phone number differs by only one digit, the output preset salt value will be significantly different.

[0150] Finally, the hash value (optionally truncated to the first 16 bytes or converted to a hexadecimal string) is used as the preset salt value for this encryption.

[0151] Since the salt value generation process is entirely determined by the master-side mobile phone number and a preset fixed value, for the same mobile phone number, executing this process at any time and at any node will yield the exact same preset salt value. This ensures the determinism of the de-identified mobile phone number generated by subsequent SM4 double encryption, thereby supporting accurate association in Flink state aggregation, Redis acquaintance record query, Doris detailed storage, and other processes.

[0152] Meanwhile, due to the introduction of high-entropy fixed values ​​and strong hashing, the preset salt values ​​corresponding to different mobile phone numbers are independent of each other and unpredictable, effectively preventing attackers from using a general rainbow table to reverse-engineer de-identified mobile phone numbers in batches, thus significantly improving the overall data security level.

[0153] This embodiment achieves a security enhancement effect superior to traditional fixed salt value or no salt value schemes without sacrificing correlation capabilities through a deterministic derivation mechanism based on preset salt values, thus meeting the dual needs of the communications industry for user privacy protection and real-time computing collaboration.

[0154] It should be noted that, in the embodiments of this application, the process of determining the preset salt value of the de-identified mobile phone number is the same in all offline data tables, real-time databases and various calculation processes, and the double encryption algorithm is also the same.

[0155] In one possible implementation, the cumulative number of peer mobile numbers corresponding to the master mobile number in the current billing period is determined based on the billing period field. This includes: determining the current billing period based on the billing period field; using the de-identified mobile number as the key, aggregating the peer mobile numbers in all signaling records of the master mobile number corresponding to the de-identified mobile number in the current billing period, and obtaining the cumulative number of peer mobile numbers in the current billing period after deduplication.

[0156] Specifically, the server can extract the billing period field from the currently processed mobile signaling call detail record (CDR) data. This billing period field, provided by the signaling source system, identifies the service date to which the record belongs, rather than the system processing time. Based on this field, the current billing period of the current signaling can be clearly identified, serving as the time window benchmark for subsequent aggregation calculations.

[0157] Subsequently, the server can construct a composite status identifier using the anonymized master mobile phone number as the primary key and the current billing period. For example, anonymized mobile phone number - billing period. Utilizing Flink's MapState or ValueState backend, a set of peer mobile phone numbers isolated by billing period is maintained internally within the operator. Whenever a new signaling message arrives, if the status corresponding to the anonymized mobile phone number - billing period has not yet been initialized, a new empty set is created. The peer mobile phone number from the current signaling message (also processed with the same SM4 double encryption anonymization) is added to this set.

[0158] Because sets naturally have the property of deduplication, the same end number that appears repeatedly is only retained once.

[0159] Finally, by calling the method that returns the number of elements in the set, the cumulative number of different peer mobile phone numbers called by the de-identified mobile phone number of the master end during the current billing period can be obtained, that is, the cumulative number of peer mobile phone numbers for the day.

[0160] In this embodiment, accurate time attribution can be achieved. Even if signaling arrives on day T+1 or later due to network latency or system failure, as long as its billing period field is day T, it will still be correctly assigned to the aggregation window of day T, avoiding cross-day data contamination. Furthermore, based on a real-time update mechanism using in-memory sets, counting can be completed in milliseconds without needing to backtrack historical data, achieving efficient deduplication and statistics. Moreover, data from different billing periods are stored independently, preventing memory bloat or logical errors caused by state accumulation. In addition, all peer numbers are processed using the same de-identification rules as the calling number, ensuring accurate association.

[0161] Using the above method, this embodiment can accurately and stably calculate the outbound call breadth index of each de-identified master mobile number within a specified business day in a high-throughput, low-latency streaming processing environment, providing reliable input for subsequent rule-based judgments based on sudden anomalies.

[0162] In one possible implementation, obtaining user tag data includes: obtaining historical user tag data from the previous day of the current signaling call detail record (CDR) date from an offline data warehouse table partitioned by day; obtaining new user tag data for the current CDR date from a real-time key-value storage system; and merging the historical user tag data with the new user tag data to obtain complete user tag data, thereby ensuring the timeliness and completeness of user identification information.

[0163] Specifically, historical user tag data for the day preceding the current signaling call detail record (CDR) date (i.e., the T-1 billing period) is read from an offline data warehouse table partitioned by day (e.g., a Hive offline data table). This offline data warehouse table is generated by a batch processing task (e.g., Hive SQL) scheduled at midnight every day and contains all user tag information up to 24:00 on T-1 day. Historical user tag data includes at least: anonymized mobile phone number, document type, document ID, and network access time. Because the offline data warehouse table is partitioned by date field, the server can efficiently locate the target partition through the T-1 billing period, avoiding a full table scan and significantly improving read performance.

[0164] Secondly, to address the issue that offline data warehouse tables cannot cover new users joining on the same day (Day T), the server can synchronously query the tag data of new users joining on the current signaling call detail record (CDR) date (Day T) from a high-concurrency, low-latency real-time key-value storage system (such as HBase). The HBase table uses the anonymized mobile phone number as the row key and supports millisecond-level point lookups. Its data is continuously written by upstream Flink real-time tasks, ensuring that tag information for newly activated numbers within Day T can be obtained instantly.

[0165] The server can then logically merge the two data sets to form a complete user tag dataset. The specific merging rules are as follows:

[0166] If a specific de-identified mobile phone number exists in both the T-1 offline table and the T-day HBase table, the real-time tag in the HBase table shall prevail (applicable to the scenario of information update on the same day).

[0167] If it only exists in an offline table, its historical tags are retained.

[0168] If it only exists in HBase, it is considered a new user joining the network that day and included in the tagging system.

[0169] The final user tag data covers the full identity information of users from historical existing users to the latest users who joined the network on the current day. All mobile phone number fields have been de-identified using SM4 double encryption combined with a preset salt value strategy, which is consistent with the main process, to ensure the security and consistency of subsequent association operations.

[0170] This dual-source collaborative mechanism effectively addresses the limitations of traditional single data sources. For example, relying solely on offline data tables can lead to the loss of new users on the same day, resulting in association failures and missed detections; relying solely on real-time storage can cause excessive read pressure, easily leading to backpressure or even failures in Flink jobs.

[0171] This embodiment, through a hybrid architecture combining offline batch supply with real-time incremental replenishment, ensures processing stability while achieving high timeliness (covering newly added information on the same day) and high completeness (including all historical data) of user identification information, providing a solid data foundation for subsequent identification of acquaintance calls and analysis of abnormal behavior based on identification ID.

[0172] This application embodiment can divide an electronic device or main control device into functional modules according to the above method examples. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software functional module. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division; in actual implementation, there may be other division methods.

[0173] Figure 5 This is a schematic diagram of a personal mobile phone number anomaly detection device provided in an embodiment of this application. Figure 5 As shown, the device includes: an acquisition module 510, an encryption module 520, a user verification module 530, a call count determination module 540, and a detection module 550.

[0174] The acquisition module 510 is used to acquire mobile network signaling call detail data and user tag data. The mobile network signaling call detail data includes the billing period field, the main mobile phone number and the corresponding peer mobile phone number, and the user tag data includes historical user tag data and new user tag data for the current day.

[0175] The encryption module 520 is used to encrypt the main mobile phone number according to a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number;

[0176] The user verification module 530 is used to associate the de-identified mobile phone number and user tag data to obtain the user identifier corresponding to the de-identified mobile phone number;

[0177] The call count determination module 540 is used to determine the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period based on the billing period field.

[0178] The detection module 550 is used to obtain the detection result of the de-identified mobile phone number based on the peer mobile phone number, user identifier, the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period, pre-stored acquaintance call records and historical call statistics table.

[0179] In one possible implementation, the detection module 550 is further configured to query the pre-stored acquaintance call records based on the user identifier. If the number of calls made by the mobile phone number of the other end of the current call within the first preset time period in the acquaintance call records is greater than or equal to the preset acquaintance call count threshold, then the current call is determined to be an acquaintance call, and the detection result of the de-identified mobile phone number is determined to be normal.

[0180] The detection module 550 is also used to associate the de-identified mobile phone number with the historical call statistics table if the number of calls is less than the preset threshold for the number of calls to acquaintances. The historical call statistics table contains the median number of calls within a second preset time period.

[0181] The detection module 550 is also used to determine the region of origin of the primary mobile phone number and the region of origin of the secondary mobile phone number in the current call based on the mobile network signaling call detail record data;

[0182] The detection module 550 is also used to determine that there is a sudden increase in the de-identified mobile phone numbers if the cumulative number of peer mobile phone numbers on a given day is greater than a preset multiple of the median number of calls, and the region of the current caller's mobile phone number is different from the region of the peer mobile phone number. The detection result of the de-identified mobile phone numbers is then determined to be abnormal.

[0183] In one possible implementation, the detection module 550 is further configured to send an abnormal record containing the de-identified mobile phone number and the corresponding master mobile phone number to a designated topic in the message queue if the detection result is abnormal, so that the downstream system can perform real-time alarms or manual outbound calls for verification.

[0184] The detection module 550 is also used to store detailed records containing the anonymized mobile phone number and the corresponding master mobile phone number into an analytical database if the detection result is normal, so as to support subsequent behavior backtracking and troubleshooting analysis.

[0185] In one possible implementation, the encryption module 520 is further configured to concatenate the main mobile phone number with a preset salt value to obtain a first concatenated string;

[0186] The encryption module 520 is also used to encrypt the first concatenated string according to a preset double encryption algorithm to obtain the first ciphertext;

[0187] The encryption module 520 is also used to encrypt the first ciphertext according to a preset dual encryption algorithm to obtain the second ciphertext;

[0188] The encryption module 520 is also used to de-identify the second ciphertext as a mobile phone number.

[0189] In one possible implementation, the encryption module 520 is further configured to concatenate the main mobile phone number with a preset fixed value to obtain a second concatenated string;

[0190] The encryption module 520 is also used to calculate the hash value of the second concatenated string according to a preset secure hash algorithm;

[0191] The encryption module 520 is also used to use the hash value as a preset salt value.

[0192] In one possible implementation, the call count determination module 540 is further configured to determine the current billing period based on the billing period field;

[0193] The call count determination module 540 is also used to aggregate the peer mobile phone numbers in all signaling records of the master mobile phone number corresponding to the de-identified mobile phone number in the current billing period, using the de-identified mobile phone number as the key, and obtain the cumulative number of peer mobile phone numbers for the day after deduplication.

[0194] In one possible implementation, the acquisition module 510 is further configured to acquire historical user tag data from the day before the date to which the current signaling call detail record belongs from an offline data warehouse table partitioned by day;

[0195] The acquisition module 510 is also used to obtain the new user tag data of the current signaling call detail record to which the date belongs from the real-time key-value storage system;

[0196] The acquisition module 510 is also used to merge historical user tag data with newly registered user tag data to obtain complete user tag data, so as to ensure the timeliness and completeness of user identification information.

[0197] This embodiment provides a personal mobile number anomaly detection device, which can execute a personal mobile number anomaly detection method of the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0198] In the aforementioned specific implementation of a personal mobile number anomaly detection device, each module can be implemented as a processor. The processor can execute computer execution instructions stored in the memory, causing the processor to execute the aforementioned personal mobile number anomaly detection method.

[0199] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 6 As shown, the electronic device includes at least one processor 610 and a memory 620. The electronic device also includes a communication component 630. The processor 610, memory 620, and communication component 630 are connected via a bus 640.

[0200] In the specific implementation process, at least one processor 610 executes computer execution instructions stored in memory 620, causing at least one processor 610 to execute a personal mobile number anomaly detection method as executed on the electronic device side as described above.

[0201] The specific implementation process of processor 610 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0202] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0203] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage.

[0204] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0205] The above description of the functions implemented by electronic devices and main control devices has introduced the solutions provided by the embodiments of the present invention. It is understood that, in order to implement the above functions, the electronic device or main control device includes hardware structures and / or software modules corresponding to the execution of each function. By combining the units and algorithm steps of the various examples described in the embodiments of the present invention, the embodiments of the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the technical solutions of the embodiments of the present invention.

[0206] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the above-described method for detecting anomalies in personal mobile phone numbers.

[0207] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0208] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in an electronic device or a host device.

[0209] This application also provides a computer program product, which includes a computer program stored in a readable storage medium. At least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the electronic device to perform the solution provided in the above embodiments.

[0210] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.

[0211] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. The above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting anomalies in personal mobile phone numbers, characterized in that, include: Obtain mobile network signaling call detail records (CDRs) and user tag data. The mobile network signaling CDRs include a billing period field, the primary mobile phone number, and the corresponding peer mobile phone number. The user tag data includes historical user tag data and new user tag data for the current day. The main mobile phone number is encrypted according to a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number. The de-identified mobile phone number and the user tag data are associated to obtain a user identifier corresponding to the de-identified mobile phone number; Based on the billing period field, determine the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number on the current billing period; The detection result of the de-identified mobile phone number is obtained based on the peer mobile phone number, the user identifier, the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period, the pre-stored acquaintance call records, and the historical call statistics table.

2. The method according to claim 1, characterized in that, The step of obtaining the detection result of the de-identified mobile phone number based on the peer mobile phone number, the user identifier, the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period, the pre-stored acquaintance call records, and the historical call statistics table includes: According to the user identifier, the pre-stored acquaintance call records are queried. If the number of calls made by the mobile phone number of the other party in the current call within the first preset time period in the acquaintance call records is greater than or equal to the preset acquaintance call number threshold, then the current call is determined to be an acquaintance call, and the detection result of the de-identified mobile phone number is determined to be normal. If the number of calls is less than the preset threshold for the number of calls to acquaintances, then the de-identified mobile phone number is associated with the historical call statistics table, which contains the median number of calls within a second preset time period. Based on the mobile signaling call detail record data, determine the region of origin of the primary mobile phone number and the region of origin of the secondary mobile phone number in the current call; If the cumulative number of peer mobile phone numbers on a given day is greater than a preset multiple of the median number of calls, and the region of the current caller's mobile phone number is different from the region of the peer mobile phone number, then it is determined that there is a sudden increase in the de-identified mobile phone numbers, and the detection result of the de-identified mobile phone numbers is determined to be abnormal.

3. The method according to claim 2, characterized in that, After obtaining the detection result of the de-identified mobile phone number, the process also includes: If the detection result is abnormal, the abnormal record containing the de-identified mobile phone number and the corresponding master mobile phone number will be sent to the designated topic of the message queue for downstream systems to make real-time alarms or manual outbound calls for verification. If the test result is normal, the detailed record containing the anonymized mobile phone number and the corresponding master mobile phone number will be stored in the analytical database to support subsequent behavior backtracking and troubleshooting analysis.

4. The method according to claim 1, characterized in that, The step of encrypting the main mobile phone number according to a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number includes: The main mobile phone number is concatenated with the preset salt value to obtain the first concatenated string; The first concatenated string is encrypted according to the preset double encryption algorithm to obtain the first ciphertext; The first ciphertext is encrypted according to the preset dual encryption algorithm to obtain the second ciphertext; The second ciphertext is used as the de-identified mobile phone number.

5. The method according to claim 4, characterized in that, The process for determining the preset salinity includes: The main mobile phone number is concatenated with a preset fixed value to obtain a second concatenated string; The hash value of the second concatenated string is calculated according to a preset secure hash algorithm; The hash value is used as the preset salt value.

6. The method according to claim 1, characterized in that, The step of determining the cumulative number of peer mobile numbers corresponding to the master mobile number in the current billing period based on the billing period field includes: Determine the current payment period based on the payment period field; Using the de-identified mobile phone number as the key, aggregate the peer mobile phone numbers of the master mobile phone number corresponding to the de-identified mobile phone number in all signaling records within the current billing period, and obtain the cumulative number of peer mobile phone numbers for the day after deduplication.

7. The method according to any one of claims 1 to 6, characterized in that, Obtaining the user tag data includes: Retrieve historical user tag data from the previous day's date in the offline data warehouse table partitioned by day; Retrieve the tag data of newly joined users for the current date of the signaling call detail record from the real-time key-value storage system; The historical user tag data is merged with the newly registered user tag data to obtain complete user tag data, thereby ensuring the timeliness and completeness of user identification information.

8. A device for detecting anomalies in personal mobile phone numbers, characterized in that, include: The acquisition module is used to acquire mobile network signaling call detail records (CDRs) and user tag data. The mobile network signaling CDRs include a billing period field, the primary mobile phone number and the corresponding peer mobile phone number, and the user tag data includes historical user tag data and new user tag data for the current day. An encryption module is used to encrypt the main mobile phone number according to a preset dual encryption algorithm and a preset salt value to obtain a de-identified mobile phone number. The user verification module is used to associate the de-identified mobile phone number and the user tag data to obtain a user identifier corresponding to the de-identified mobile phone number; The call count determination module is used to determine the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period based on the billing period field. The detection module is used to obtain the detection result of the de-identified mobile phone number based on the peer mobile phone number, the user identifier, the cumulative number of peer mobile phone numbers corresponding to the master mobile phone number in the current billing period, the pre-stored acquaintance call records and historical call statistics table.

9. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images