Mobile network high-risk user risk identification method and system oriented to number change deception

Abstract

The invention relates to the technical field of information security, in particular to a mobile network high-risk user risk identification method and system oriented to number change deception, and the method comprises the steps: screening high-risk deception molecule and victim candidates based on signaling data, media statistical data, network routing attributes and call behavior characteristics in combination with a rule matching and density clustering algorithm; detecting deception molecule candidates by using a multi-cascade model in combination with triple training, detecting victim candidates by using a model based on a self-attention model, and outputting a risk probability; fusing the risk probability and the preliminary screening score to generate a high / medium / low risk level and a disposal strategy; and feeding back a disposal result and manual verification, and optimizing the rule and the model. The system correspondingly comprises a high-risk user preliminary screening module, a differentiation detection module, a disposal strategy generation module and a closed-loop feedback module. The method can reduce the calculation overhead, improves the recognition accuracy, and is suitable for large-scale real-time deployment of operators.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a method and system for identifying high-risk mobile network users who are susceptible to number spoofing. Background Technology

[0002] Caller ID spoofing attack refers to the act of an attacker using technical means to tamper with the caller ID in the telecommunications signaling of a mobile network and forge caller ID to deceive the victim and carry out telecommunications network fraud. There are three main ways for attackers to carry out this attack, including: (1) VoIP (Voice over IP) spoofing: fraudsters take advantage of the limitation that mobile network telecommunications operators have no right to verify calls initiated by other networks, rent VoIP services with lax supervision, and forge legitimate caller IDs to deceive the victim; (2) GoIP (GSM over IP) spoofing: attackers take advantage of the feature of GoIP devices that support the concurrent operation of multiple SIM cards to carry out concurrent spoofing. Some fraudulent activities also take advantage of the vulnerabilities of GoIP devices to modify the caller ID; (3) Fake base station spoofing: attackers set up fake base stations to simulate operator signals, induce nearby mobile phones to connect, induce the victim's device to fall back to the 2G network, and then send text messages or calls with fake numbers.

[0003] Abnormal user risk identification is a common method to prevent number spoofing. This method identifies potential risks by analyzing call behavior characteristics. Existing solutions mainly fall into two categories: ① Rule-based risk control strategies: Operators pre-set user behavior rule bases to control the risk of calling numbers. For example, a calling number that simultaneously meets the criteria of overseas registration, local number spoofing, and a large number of one-way calls will be identified as a high-risk number spoofing number, and the operator will immediately block its communication privileges and record it in a blacklist. ② Artificial Intelligence (AI)-based risk control strategies: Extracting user call characteristics and using AI models such as decision trees and convolutional neural networks for risk assessment. For example, operators collect features such as call frequency and call duration and input them into a trained model to predict whether a call is a number spoofing scam. However, existing AI-based methods have two main problems, including: 1. Excessive computational overhead: This is because this approach inputs all mobile network user data into the artificial intelligence model for computation, lacking an effective sample screening and preprocessing mechanism, which is not conducive to large-scale deployment in operator environments. 2. The accuracy of this type of scheme is relatively low because the model structure design in this type of method is relatively simple, and a single classifier is generally used. It is difficult to extract the spatial correlation and temporal evolution features in user behavior data at the same time, thus limiting the recognition performance.

[0004] In view of this, the present invention is hereby proposed. Summary of the Invention

[0005] To address the aforementioned technical problems in the existing technology, this invention provides a method and system for identifying high-risk mobile network users spoofed by number spoofing, which can accurately identify abnormal users while incurring less overhead.

[0006] To achieve the above objectives, the technical solution of the present invention is as follows: The first aspect involves risk identification methods for high-risk mobile network users susceptible to number spoofing fraud, including: S1. Based on mobile network signaling data, media statistics, network routing attributes and user call behavior characteristics, combined with rule matching and density-based spatial clustering algorithms, users are screened to obtain high-risk fraudster candidates and high-risk victim candidates. S2. The high-risk fraudster candidates are detected using a multi-cascade model combined with triplet training, and the high-risk victim candidates are detected using a model based on a self-attention model, and the risk probabilities of fraudsters and victims are output respectively. S3. The risk probability of the deceitful person and the risk probability of the victim are respectively weighted and fused with the initial screening score to obtain the risk level, and a corresponding handling strategy is generated based on the risk level. S4. Feedback the handling results and manual verification feedback to the false alarm database and rule base, and use them regularly for rule correction and incremental model training.

[0007] Furthermore, the signaling data, media statistics, network routing attributes, and user call behavior characteristics of the mobile network specifically include: Signaling data: This is the session initiation protocol signaling, which includes the calling / called number, signaling path, identity declaration, terminal identifier, call identifier, and signaling delay. Media statistics: Real-time transmission protocol media statistics, including packet loss rate, jitter mean / variance, packet interval distribution, sequence number jump count, media establishment rate, and load type; Network routing attributes include Autonomous System Number, source IP address / destination IP address, geographic location, and round-trip time / routing tracing path; User call behavior characteristics include: number of outbound calls / inbound calls, connection rate, short call ratio, average call duration, called party distribution entropy, blacklist / whitelist marking, number of historical anomalies, device registration information or billing information.

[0008] Furthermore, step S1 specifically includes: S11. Rule matching and filtering: Identify known high-risk patterns through preset rules. The high-risk patterns include abnormal overseas autonomous system numbers, forged session initiation protocol headers, INVITE signaling without media channel establishment, and short-term sudden calls, thereby eliminating most normal users. S12. Clustering Supplementary Screening: A density-based spatial clustering algorithm is used to perform multi-dimensional feature clustering on user samples not covered by the rules, automatically identify sample clusters of arbitrary shapes, and mark isolated points with insufficient density as noise samples to supplement the screening range of high-risk users, thereby achieving complementarity between rule matching and clustering analysis.

[0009] Furthermore, the multi-cascaded model in step S2 is a cascaded structure of "Long Short-Term Memory Network – Graph Convolutional Network – Long Short-Term Memory Network", and feature representation is achieved through the following modules respectively: Short-term temporal feature representation module: Processes user interaction behavior sequences within a short observation window, captures dynamic changes in behavior within short time segments, and outputs temporal interaction embedding vectors; Spatial feature representation module: Based on the temporal interaction embedding vector, a communication graph centered on the suspected fraudster is constructed within a short observation window. The feature information of the neighboring nodes in the communication graph is aggregated through graph convolution operation to model the social association and interaction structure between users and output window-level spatial embedding vector. Long-term temporal feature representation module: processes the sequence of window-level spatial embedding vectors arranged in chronological order, captures the behavioral evolution trend across multiple time windows, aggregates long-term behavioral patterns, and outputs multi-scale behavioral representation vectors.

[0010] Furthermore, the specific operations of the triplet training include: Sample construction: Construct a triplet of "anchor sample - positive sample - negative sample", where the anchor sample is the behavior sample of a certain fraudster, the positive sample is the multi-scale behavior representation vector of the same fraudster or fraudsters with similar fraud patterns, and the negative sample is the multi-scale behavior representation vector of normal users or other fraud groups. Distance calculation: The Eulerian distance is used to measure the feature difference between samples, and the feature distance between the anchor sample and the positive sample is calculated respectively. Feature distance between anchor samples and negative samples ,in This is a multi-scale behavior representation vector for anchor point samples. This is the multi-scale behavioral representation vector for positive samples. The multi-scale behavioral representation vector for negative samples; Loss optimization: The model parameters are optimized using a loss function through backpropagation. The specific formula is as follows:

[0011] in, , , These are the feature vectors of the anchor point, positive example, and negative example, respectively. The hyperparameter is used to control the minimum difference between positive and negative samples.

[0012] Furthermore, the communication graph constructed by the spatial feature representation module satisfies:

[0013] in, , Nodes suspected of being deceptionists. The set of all neighboring nodes with which it has communication interactions; the weights of edges in the communication graph. The calculation formula is:

[0014] in, For the number of calls, For average call duration, For connection rate, For average round-trip time, These are the weighting coefficients.

[0015] Furthermore, the model based on the self-attention model in step S2 takes as input data a fusion of multi-dimensional user behavior data and peer-to-peer personnel type information, specifically including: Multi-dimensional user behavior data: including session initiation protocol signaling characteristics, real-time transport protocol media characteristics, network routing and geographical characteristics, behavioral statistical characteristics, and contextual and historical characteristics; Reciprocal Person Type Information: This refers to the category of the object that interacted with the suspected victim. The object category includes normal users, other victims, and fraudsters.

[0016] Furthermore, the implementation process based on the self-attention model specifically includes: S221. Concatenate and fuse multi-dimensional user behavior data with the counterparty personnel type information according to feature dimensions to obtain a fused feature vector. S222. Input the fused feature vector into a Transformer encoder employing a multi-head attention mechanism, and first construct query vectors through linear transformations. Keyword vectors AND value vector The specific expression is:

[0017]

[0018]

[0019] in, , and These are query weight, keyword weight, and value weight, respectively, all of which are trainable weight matrices; Next, the attention weights are calculated to capture the implicit correlations between cross-stage behaviors, and the encoded features are output. The specific formula is as follows:

[0020] in, for and The dimension; S223. After passing through the transformer encoder, the overall characteristics of the suspected victim are obtained.

[0021] Furthermore, the risk levels are categorized into high, medium, and low, with corresponding response strategies as follows: High-risk level: At least one of the following mandatory actions: immediately blocking the user's communication privileges, adding the user's number to a blacklist, forcing the user to complete SMS verification code or voice challenge verification, or reporting the user's information to law enforcement. Medium-risk level: Implement at least one of the following mitigation measures: limit user communication rate, partially block user call requests, send risk warning SMS to user, or temporarily restrict user's high-risk services; Low risk level: User information is only recorded in the monitoring queue, and enhanced log collection is triggered for subsequent offline analysis.

[0022] Secondly, a risk identification system for high-risk mobile network users susceptible to number spoofing includes: High-risk user screening module: Based on mobile network signaling data, media statistics, network routing attributes and user call behavior characteristics, combined with rule matching and density-based spatial clustering algorithms, it screens out high-risk fraudster candidates and high-risk victim candidates. Differential detection module: used to detect the high-risk fraudster candidates using a multi-cascade model combined with triplet training, and to detect the high-risk victim candidates using a model based on a self-attention model, and output the risk probability of fraudsters and the risk probability of victims respectively; The handling strategy generation module is used to weight and fuse the risk probability of the fraudster, the risk probability of the victim, and the initial screening score to obtain a risk level, and generate a corresponding handling strategy based on the risk level. Closed-loop feedback module: Used to feed back the handling results and manual verification feedback to the false alarm database and rule base, and is used periodically for rule correction and incremental model training.

[0023] Compared with existing technologies, the present invention provides a method and system for identifying high-risk mobile network users spoofing. The method includes: screening high-risk spoofing candidates and high-risk victim candidates based on mobile network signaling data, media statistics data, network routing attributes, and user call behavior characteristics, combined with rule matching and density-based spatial clustering algorithms; using a multi-cascade model combined with triplet training for high-risk spoofing candidates and a self-attention model for high-risk victim candidates, outputting risk probabilities respectively; weighted fusion of the two risk probabilities with the initial screening score to obtain high / medium / low risk levels, generating corresponding handling strategies; feeding back the handling results and manual verification feedback to the database, and periodically optimizing the rules and models; the system includes modules for high-risk user initial screening, differential detection, handling strategy generation, and closed-loop feedback; the present invention can reduce computational overhead, improve identification accuracy, and adapt to the large-scale real-time deployment needs of operators. Attached Figure Description

[0024] Figure 1 A flowchart for identifying high-risk users in mobile networks provided in this embodiment of the invention; Figure 2 A flowchart for the initial screening of high-risk users provided in this embodiment of the invention; Figure 3 A schematic diagram of the deceptive molecule detection model provided in an embodiment of the present invention; Figure 4 An architecture diagram of the victim model provided in an embodiment of the present invention. Detailed Implementation

[0025] The technical solution of the present invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are not all embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0026] It should be noted that, unless otherwise specifically stated, the relative arrangement and numerical expressions of the components and steps described in these embodiments should not be construed as limiting the scope of the invention.

[0027] The following description of exemplary embodiments is merely illustrative and is not intended to limit the invention or its application or use in any way. Techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail herein, but where applicable, such techniques, methods, and apparatus should be considered part of this specification.

[0028] Example 1 See Figure 1 , Figure 1This invention proposes a risk identification method for high-risk mobile network users facing caller ID spoofing. This method aims to achieve lightweight identification in large-scale real-time environments while ensuring high recall and low false alarms. The overall implementation route is "high-risk initial screening → differentiated modeling → score fusion → closed-loop feedback". Specific steps may include: S1, Initial Screening of High-Risk Users Based on the Session Initiation Protocol (SIP) signaling, Real-time Transport Protocol (RTP) media statistics, Autonomous System Number (ASN) routing attributes, and call behavior characteristics of mobile networks, users are screened using rule matching and density-based spatial clustering algorithm (DBSCAN) to obtain high-risk fraudster candidates and high-risk victim candidates. Before performing deep analysis on session features, quickly screen out users or sessions that may be involved in deceptive behavior to avoid wasting computation and causing delays by directly feeding all data into complex models. High-risk users include: potential deceptives with obvious suspicious characteristics (such as a large number of short calls, abnormal ASNs from overseas, and forged SIP signaling) and potential victims who are frequently called or exhibit abnormal behavior; see [reference]. Figure 2 The specific steps for the initial screening of high-risk users include: S11. Collect necessary metadata, refer to Table 1, specifically including SIP (Session Initiation Protocol) signaling characteristics, RTP (Real-time Transport Protocol) media characteristics, network routing and geographical characteristics, behavioral statistics characteristics, and context and history characteristics; Table 1 Metadata Diagram

[0029] Among them, SIP signaling features can reveal abnormal behaviors such as number spoofing and path spoofing; RTP media features can reflect whether there is abnormal forwarding, packet loss or spoofing in the call; network routing and geographical features can help identify cross-border VoIP calls or suspicious traffic from high-risk ASNs; behavioral statistical features can help discover patterns of fraudsters making mass outbound calls or victims being frequently called by analyzing outbound call frequency, connection rate, short call ratio, number distribution, etc.; context and historical features can provide additional background information for rapid screening through blacklists, whitelists and blacklists and historical abnormal records.

[0030] The above features can comprehensively reflect the user's identity information, communication quality, network path, and behavioral patterns during the call, and are an important basis for identifying number spoofing fraud.

[0031] S12. Utilize a rule engine to quickly filter and score known high-risk patterns. First, identify known high-risk patterns through rule matching, specifically including scenarios such as abnormal overseas ASNs, SIP header forgery, the establishment of numerous INVITE channels without media access, and short-term sudden calls. This process relies on predefined features and thresholds, and can complete detection in milliseconds. It is both efficient and interpretable, eliminating most normal users in the shortest possible time and reducing subsequent computational load.

[0032] Rule-based methods suffer from static limitations, making them susceptible to insufficient coverage and missed detections when faced with constantly evolving new deception techniques, failing to comprehensively identify unknown threats. To compensate for the shortcomings of rule matching, a clustering detection method is further introduced, employing a density-based spatial clustering of applications with noise (DBSCAN) algorithm to perform multi-dimensional feature modeling and clustering of samples not covered by the rules. DBSCAN can automatically identify clusters of arbitrary shapes and mark points with insufficient density as noise, effectively detecting both mass outbound calls and isolated new deception behaviors.

[0033] Rule matching and cluster analysis complement each other: rule matching ensures fast and stable initial screening, while cluster analysis enhances the ability to discover unknown threats, ultimately achieving a balance between efficiency and comprehensiveness in the initial screening process.

[0034] In summary, this step profiles users based on SIP (Session Initiation Protocol) / RTP (Real-time Transport Protocol) signaling and media statistics, ASN (Autonomous System Number) routing attributes, and call behavior characteristics of the mobile network. It then combines rules and clustering algorithms to perform preliminary filtering and rapid traffic routing, identifying "high-risk fraudsters" and "high-risk victims," ​​significantly reducing the amount of subsequent computation.

[0035] S2, High-Risk User Detection After the initial high-risk screening stage in step S1, the system has generated a list of suspicious users based on rule matching and cluster analysis. This list includes callers and called parties who may exhibit abnormal calling behavior. The core task of the high-risk user detection stage is to further accurately identify and classify these candidates, clarify the truly high-risk individuals, and provide a basis for subsequent risk management.

[0036] To achieve multi-layered embedding modeling of fraudulent behavior in the temporal and spatial dimensions, this scheme designs a multi-cascaded model, which is a cascaded structure of "Long Short-Term Memory Network (LSTM) – Graph Convolutional Network (GCN) – Long Short-Term Memory Network (LSTM)". Triplet training is used for detection. The high-risk victim candidates are detected using a model based on the self-attention model (Transformer), and the risk probabilities of fraudulent individuals and victims are output respectively.

[0037] This step categorizes suspicious users into two groups: potential scammers and potential victims. These two groups differ significantly in behavioral characteristics, data distribution, and risk formation mechanisms, thus requiring a differentiated modeling strategy. Potential scammers exhibit characteristics such as single-direction calls, concentrated targets, short durations, and sudden actions, with a scarce overall sample size, representing a typical small sample size and class imbalance problem. Potential victims, on the other hand, primarily engage in passive communication, with behavioral characteristics spanning multiple stages, encompassing various levels of patterns including normal calls, guided communication, and fraudulent transactions, with a long time span and complex variations. Modeling both types of users uniformly would lead to feature confusion and blurred anomaly boundaries, thereby reducing model detection accuracy. Specifically, this includes: S21. Deceptive Detection: For potential deceptive individuals, an LSTM-GCN-LSTM cascade model based on a triplet learning mechanism is employed to address the challenges of sample scarcity, class imbalance, and multi-scale dependence of behavior in deceptive behavior detection. The model results are as follows: Figure 3 As shown.

[0038] Identifying deceptive individuals is a typical few-shot learning scenario: in the overall communication data, deceptive samples account for a very small percentage, and their behavioral patterns exhibit significant heterogeneity. Different deceptive individuals show large behavioral differences, while the same deceptive individual displays similar behaviors at different stages or targeting different objects. If classification training is performed directly, the model is easily dominated by the distribution of mainstream normal samples, causing the characteristics of anomalous samples to be masked.

[0039] To address this, this invention introduces a Triplet training mechanism: by constructing "anchor sample – positive sample – negative sample" triplets (where the anchor sample is a specific fraudster, the positive sample is a sample from the same fraudster or a similar behavioral pattern, and the negative sample is a sample from a normal user or another fraudulent group), the embedding distance between samples of the same class is explicitly reduced, while the distance between samples of different classes is increased, thereby forming a stable and generalizable category boundary in the embedding space. The core objective of Triplet learning is not to directly achieve classification, but to learn a discriminative behavioral representation space, enabling subsequent detection to achieve efficient recognition based on distance metrics.

[0040] The cascaded structure implements feature representation through the following modules respectively. S211. Short-term temporal feature representation (pre-processed LSTM): Utilizes LSTM (Long Short-Term Memory) network to process the short-term communication data of fraudsters, extracts temporal embeddings that reflect their recent communication dynamics (such as call frequency and target switching rhythm in a short period of time), and captures the dynamic changes in short-term behavioral patterns.

[0041] In the short observation window Within this framework, the sequence of interactions between a suspicious individual and their communication partner is represented as follows:

[0042] in For suspicious persons and the The multidimensional behavioral characteristics of each communication object within this window encompass statistical indicators from the signaling, media, network, and behavioral layers (such as INVITE latency, Call-ID reuse rate, packet loss rate, RTT, short call ratio, and connection rate). Since deceptive behavior often exhibits periodic characteristics within a short period (such as continuous outbound calls, fixed intervals, and repeated destinations), it is necessary to capture these short-term dynamic dependencies. Therefore, the sequence... Input the first layer of the LSTM network LSTM1, so that the model generates the second layer of the LSTM network. When representing each interaction, the hidden states of preceding interactions can be considered simultaneously to achieve temporal correlation modeling. The specific formula is as follows:

[0043] Each of them Indicates suspicious persons and the The temporal interactions of the communicating objects are embedded within this window. Through the memory gate mechanism of LSTM, the model can extract continuous behavioral patterns and dynamic change features within a short window, providing a temporal representation basis for subsequent spatial structure modeling.

[0044] S212, Spatial Association Feature Representation (Intermediate GCN): Since fraudsters often interact with multiple victims within the same time window, there are significant structural associations among these calls. Therefore, the model introduces a Graph Convolutional Network (GCN) to construct a graph structure representing the fraudsters and their interacting users (nodes represent users, and edge weights incorporate information such as call frequency, duration, and network attributes). Through graph convolution operations, the GCN aggregates information between different nodes, learning the interaction patterns of fraudsters in multi-target call scenarios, thereby revealing group behavior characteristics and abnormal communication structures.

[0045] To characterize the structural connections between a suspect and multiple communication partners, within a time window The built-in communication graph is centered on it, and the specific formula is as follows:

[0046] in , This represents the set of all neighboring nodes with which it has interacted. The initial features of each node are taken from the output of the previous LSTM step, specifically using the following formula:

[0047] Perform a single-layer graph convolution operation on the graph to aggregate information about neighboring nodes at the structural level and update the representation of the central node:

[0048] in, This is the structural weighting coefficient (edge ​​weight) between the central node and its neighboring nodes, used to control "who the information comes from and what percentage of it is". Its value is determined empirically based on communication statistical characteristics to quantify the interaction strength and stability. The specific formula is as follows:

[0049] in, For the number of calls, For average call duration, For connection rate, For average round-trip time, For the weighting coefficients, satisfying The larger the edge weight, the closer the relationship between the neighboring node and the suspicious person, and the greater the proportion of its information in the aggregation.

[0050] The feature mapping matrix of the central node, It is the feature mapping matrix of neighboring nodes, which controls the semantic transformation of information in the feature space; and These are learnable parameters that are automatically optimized through backpropagation, enabling the model to adaptively adjust the information fusion method across different node types. Emphasis on self-feature update ,and Determine the projection direction and weight balance of neighbor information .

[0051] It is a non-linear activation function (such as ReLU) used to enhance the model's ability to fit complex relationships.

[0052] The initial feature vector of the central node (suspicious person) represents its own behavioral pattern within the current time window. After... After linear mapping, we get This is used to preserve individual characteristics, so that the model can still distinguish its own behavioral characteristics when aggregating neighbor information.

[0053] The initial features of neighboring nodes (communication objects) are obtained from the output of a short-running LSTM, representing the interactive behavior of that object within the current window. These features are then processed... Mapping to the same semantic space enables the model to learn the "influence pattern of neighbor behavior on the central node", that is, the transformed part of the feature space.

[0054] Through the above transformation, the center node in the window is obtained. Spatial embedding representation within This embedding integrates the weighted features of neighboring nodes with the behavioral features of the central node itself, reflecting the communication patterns and spatial interaction structure of suspicious persons within the current window.

[0055] S213. Long-term evolutionary feature representation (post-LSTM): To capture long-term behavioral evolution trends across time windows (e.g., outbound call geographical migration, changes in call strategies, signaling feature drift, etc.), an LSTM layer is cascaded onto the window-level embedding sequence output by the GCN. This layer learns behavioral dependencies over a longer time scale, integrates historical and current behavioral features, and forms a continuous representation of the strategy evolution of fraudsters, improving the model's adaptability to changes in behavioral patterns.

[0056] The behavior patterns of fraudsters exhibit phased evolutionary characteristics, such as changes in outbound calling regions, shifts in target groups, or adjustments in communication strategies. Therefore, it is necessary to model the spatial embeddings of multiple windows on a longer timescale. The spatial representations of each window are sequentially arranged in time and input into a second-layer LSTM network (LSTM2) to capture long-term dependencies between windows. The specific formula is as follows:

[0057] in Indicates the first The state vectors of each time window encode the behavioral evolution trajectory of a suspicious person over a long period. The model uses a gating mechanism to retain and update long-term memory, enabling the establishment of associations between communication behaviors at different stages. The hidden state of the last time window is taken as the global behavior representation, with the specific formula as follows:

[0058] The vector By integrating short-term dynamics, spatial structure, and long-term evolutionary information, a unified feature representation of suspicious individuals over the overall time series is formed, providing input for subsequent Triplet metric learning and identification of high-risk deceptionists.

[0059] S214. Few-shot learning mechanism: To improve few-shot learning ability, a learning mechanism based on Triplet networks is adopted; Triplet networks are a distance metric learning method for scenarios with a small number of samples, receiving three samples (anchor points). , positive example and counterexamples () is used as input, and the input samples are embedded into the vector space. Based on (anchor points) , positive example ) and (anchor point) Counterexample The distance between input samples is used to determine whether they belong to the same category. The training goal is to minimize the distance between samples of the same category and maximize the distance between samples of different categories. Euclidean distance is used as the measure of distance between different samples.

[0060] During the training phase, the input consists of three samples: deceitful molecule 1, deceitful molecule 2, and a non-deceitful molecule. Deceitful molecule 2 serves as the anchor point. The deceitful element 1 and the non-deceitful element are positive examples, respectively. With negative examples .

[0061] For each sample, LSTM is first used to extract the temporal features of individual behavior, then GCN is used to extract the interactive behavior between different users, and then LSTM is used to further model the dynamic evolution of node states in the interaction graph. The output of the second LSTM encompasses the overall features of the sample. The overall characteristics are respectively denoted as , and The loss function used during training is defined as follows:

[0062] in, This is a hyperparameter used to control the minimum difference between positive and negative samples. During testing, the data of suspected fraudsters and the selected anchor points are used as input to the model, and the model will output a prediction of whether the suspected fraudster is indeed a fraudster.

[0063] In summary, this step employs a dual-channel detection structure: for potential fraudsters, a triplet-trained LSTM–GCN–LSTM cascade model is used to simultaneously learn short-term sequence features, spatial relationships within a window, and long-term dependency features, achieving high discriminative recognition even with small sample sizes; for potential victims, a Transformer-based self-attention model is used to capture cross-stage behavioral dependencies and the evolution of deception characteristics. This structured and differentiated detection mechanism can further accurately identify truly high-risk users in the initial screening results, providing solid support for subsequent risk classification and response strategy generation.

[0064] S22. Victim Detection: Behavioral data from suspected victims includes both normal and deceptive behaviors. A single deception may involve multiple stages, requiring the AI ​​model to effectively capture the dependencies between different behaviors and focus on deceptive behaviors. Furthermore, the type of the other party (i.e., the category of the person interacting with the suspected victim, including normal users, victims, or deception perpetrators) plays a supporting role in victim detection; for example, if a user receives multiple calls from deception perpetrators in a short period, that user is more likely to have been scammed. Based on these characteristics, this invention fuses multi-dimensional user behavior data with other party type data as input and designs a transformer-based victim detection model. The overall structure of the victim model is as follows: Figure 4 As shown, it includes three stages: feature fusion, encoding, and classification; specifically, it includes: S221, Feature Fusion: The input to this victim detection model includes two types of data: Multi-dimensional user behavior data This includes SIP signaling characteristics, RTP media characteristics, network routing and geographic characteristics, behavioral statistical characteristics, and contextual and historical characteristics; Information on the type of personnel on the other end This refers to the role labels of other users interacting with this user within the network, such as fraudster, potential victim, or legitimate user. These two types of data are then spliced ​​and merged. ,in This represents splicing, resulting in the merged features.

[0065] The S222 Transformer encoder uses multiple transformer encoders to extract user features. As input to the transformer encoder, the transformer employs a multi-head attention mechanism, which refers to executing the self-attention mechanism multiple times. The self-attention mechanism allows the model to simultaneously pay attention to information from other positions in the entire sequence at each position, thereby effectively capturing long-distance dependencies.

[0066] Specifically, firstly based on input Constructing a query vector using linear transformations. Keyword vectors (Key) Value vector ,in , and These are the query weight, keyword weight, and value weight, respectively, all of which are trainable weight matrices. Then, scaled dot products are used to calculate... With all The similarity is shown in the specific formula:

[0067] in, yes and The model then performs multiple self-attention mechanisms to concatenate the results, allowing it to focus more on spoofing calls / text messages and effectively extract the correlations between them.

[0068] S223, the classification model, after passing through the transformer encoder, obtains the overall characteristics of the suspected victim. This invention uses a two-layer fully connected neural network to predict the probability that the suspected victim is indeed the victim.

[0069] In summary, due to the significant differences in data distribution and behavioral characteristics between high-risk fraudsters and high-risk victims, this step requires differentiated modeling: the sample of fraudsters is scarce, and their behavior is characterized by unidirectional batches and concentrated outbreaks; victims do not have obvious unidirectional characteristics, but exhibit high-risk operational characteristics such as bank card transfers and significantly closer contact with specific contacts during a certain period. Hybrid modeling would sacrifice distinguishability due to the "averaging" representation.

[0070] S3, Generation Processing Strategy The risk level is obtained by weighting and fusing the risk probability of the fraudster, the risk probability of the victim and the initial screening score, and a corresponding handling strategy is generated based on the risk level. Specifically, the risk probabilities of the perpetrators and victims are obtained through the above steps. These probabilities are then weighted and integrated with the initial screening scores to form three risk levels: high, medium, and low. The system automatically generates corresponding handling strategies, including: High-risk samples: trigger immediate blocking / blacklisting, mandatory SMS verification code or voice challenge, reporting to law enforcement and other mandatory actions; Medium-risk cases: Mitigation measures include triggering rate limits / gray-scale blocking, sending risk warning SMS messages, and temporarily restricting high-risk services; Low-risk samples: Only recorded and added to the monitoring queue, while triggering enhanced log collection for offline analysis.

[0071] S4. False Alarm Feedback The processing results and manual verification feedback are fed back to the false alarm database and rule base, and are used regularly for rule correction and incremental training of the two types of models in step S2; To avoid inconveniencing normal users due to incorrect handling, a feedback mechanism is set up: after the incorrect handling strategy is manually verified and corrected, all handling results and manual verification information are fed back to the false alarm database and rule base, and are used regularly for rule correction and incremental model training to achieve the coordinated evolution of handling strategies and detection models, ensuring that in cross-border scenarios such as VoIP / GoIP / fake base stations, it can respond quickly while maintaining low false alarms and auditability.

[0072] Users are allowed to file appeals. When a user discovers that they have been wrongly judged, they can appeal to the operator. The operator will first verify the user's identity and send security personnel to check. If it is found to be a wrong judgment, the restriction measures will be stopped immediately, and the user's data will be stored in the wrong judgment database. The data in the wrong judgment database will be used regularly to update the fraudster detection model and the victim detection model, thereby improving the accuracy of the model.

[0073] Example 2 The risk identification system for high-risk mobile network users against number spoofing proposed in this invention includes: M1, High-Risk User Screening Module: Based on mobile network signaling data, media statistics, network routing attributes, and user call behavior characteristics, combined with rule matching and density-based spatial clustering algorithms, it screens out high-risk fraudster candidates and high-risk victim candidates. M2, Differentiated Detection Module: Used to detect the high-risk fraudster candidates using a multi-cascade model combined with triplet training, and to detect the high-risk victim candidates using a model based on a self-attention model, outputting the risk probability of fraudsters and the risk probability of victims respectively. M3, Disposal Strategy Generation Module: This module is used to weight and fuse the risk probability of the fraudster, the risk probability of the victim, and the initial screening score to obtain a risk level, and generate a corresponding disposal strategy based on the risk level. M4, Closed-Loop Feedback Module: Used to feed back the handling results and manual verification feedback to the false alarm database and rule base, and is used periodically for rule correction and incremental model training.

[0074] In summary, the present invention has the following advantages: 1. It can reduce the overhead of traditional AI-based mobile network abnormal user risk identification; before inputting data into the AI ​​model, a strict pattern matching strategy is designed for preliminary screening and classification, which removes a large amount of irrelevant data, significantly reduces the data scale that the subsequent model needs to process, and thus greatly reduces the overall system's computational burden. 2. It achieves high classification accuracy while reducing computational overhead; by deeply analyzing the differences in distribution characteristics and temporal structure of fraudster and victim behavior data, targeted model architectures were constructed to accurately extract key features of various types of samples, thereby improving classification accuracy.

[0075] The above specific embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for identifying high-risk mobile network users susceptible to number spoofing, characterized in that, include: S1. Based on mobile network signaling data, media statistics, network routing attributes and user call behavior characteristics, combined with rule matching and density-based spatial clustering algorithms, users are screened to obtain high-risk fraudster candidates and high-risk victim candidates. S2. The high-risk fraudster candidates are detected using a multi-cascade model combined with triplet training, and the high-risk victim candidates are detected using a model based on a self-attention model, and the risk probabilities of fraudsters and victims are output respectively. S3. The risk probability of the deceitful person and the risk probability of the victim are respectively weighted and fused with the initial screening score to obtain the risk level, and a corresponding handling strategy is generated based on the risk level. S4. Feedback the handling results and manual verification feedback to the false alarm database and rule base, and use them regularly for rule correction and incremental model training.

2. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 1, characterized in that, The signaling data, media statistics, network routing attributes, and user call behavior characteristics of the mobile network specifically include: Signaling data: This is the session initiation protocol signaling, which includes the calling / called number, signaling path, identity declaration, terminal identifier, call identifier, and signaling delay. Media statistics: Real-time transmission protocol media statistics, including packet loss rate, jitter mean / variance, packet interval distribution, sequence number jump count, media establishment rate, and load type; Network routing attributes include Autonomous System Number, source IP address / destination IP address, geographic location, and round-trip time / routing tracing path; User call behavior characteristics include: number of outbound calls / inbound calls, connection rate, short call ratio, average call duration, called party distribution entropy, blacklist / whitelist marking, number of historical anomalies, device registration information or billing information.

3. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 1, characterized in that, Step S1 specifically includes: S11. Rule matching and filtering: Identify known high-risk patterns through preset rules. The high-risk patterns include abnormal overseas autonomous system numbers, forged session initiation protocol headers, INVITE signaling without media channel establishment, and short-term sudden calls, thereby eliminating most normal users. S12. Clustering Supplementary Screening: A density-based spatial clustering algorithm is used to perform multi-dimensional feature clustering on user samples not covered by the rules, automatically identify sample clusters of arbitrary shapes, and mark isolated points with insufficient density as noise samples to supplement the screening range of high-risk users, thereby achieving complementarity between rule matching and clustering analysis.

4. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 1, characterized in that, In step S2, the multi-cascaded model is a cascaded structure of "Long Short-Term Memory Network – Graph Convolutional Network – Long Short-Term Memory Network", and feature representation is achieved through the following modules: Short-term temporal feature representation module: Processes user interaction behavior sequences within a short observation window, captures dynamic changes in behavior within short time segments, and outputs temporal interaction embedding vectors; Spatial feature representation module: Based on the temporal interaction embedding vector, a communication graph centered on the suspected fraudster is constructed within a short observation window. The feature information of the neighboring nodes in the communication graph is aggregated through graph convolution operation to model the social association and interaction structure between users and output window-level spatial embedding vector. Long-term temporal feature representation module: processes the sequence of window-level spatial embedding vectors arranged in chronological order, captures the behavioral evolution trend across multiple time windows, aggregates long-term behavioral patterns, and outputs multi-scale behavioral representation vectors.

5. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 4, characterized in that, The specific operations for triplet training include: Sample construction: Construct a triplet of "anchor sample - positive sample - negative sample", where the anchor sample is the behavior sample of a certain fraudster, the positive sample is the multi-scale behavior representation vector of the same fraudster or fraudsters with similar fraud patterns, and the negative sample is the multi-scale behavior representation vector of normal users or other fraud groups. Distance calculation: The Eulerian distance is used to measure the feature difference between samples, and the feature distance between the anchor sample and the positive sample is calculated respectively. Feature distance between anchor samples and negative samples ,in This is a multi-scale behavior representation vector for anchor point samples. This is the multi-scale behavioral representation vector for positive samples. The multi-scale behavioral representation vector for negative samples; Loss optimization: The model parameters are optimized using a loss function through backpropagation. The specific formula is as follows: in, , , These are the feature vectors of the anchor point, positive example, and negative example, respectively. The hyperparameter is used to control the minimum difference between positive and negative samples.

6. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 4, characterized in that, The communication graph constructed by the spatial feature representation module satisfies: in, , Nodes suspected of being deceptionists. The set of all neighboring nodes with which it has communication interactions; the weights of edges in the communication graph. The calculation formula is: in, For the number of calls, For average call duration, For connection rate, For average round-trip time, These are the weighting coefficients.

7. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 1, characterized in that, The model based on the self-attention model in step S2 takes as input data a fusion of multi-dimensional user behavior data and peer-to-peer personnel type information, specifically including: Multi-dimensional user behavior data: including session initiation protocol signaling characteristics, real-time transport protocol media characteristics, network routing and geographical characteristics, behavioral statistical characteristics, and contextual and historical characteristics; Reciprocal Person Type Information: This refers to the category of the object that interacted with the suspected victim. The object category includes normal users, other victims, and fraudsters.

8. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 7, characterized in that, The implementation process based on the self-attention model specifically includes: S221. Concatenate and fuse multi-dimensional user behavior data with the counterparty personnel type information according to feature dimensions to obtain a fused feature vector. S222. Input the fused feature vector into a Transformer encoder employing a multi-head attention mechanism, and first construct query vectors through linear transformations. Keyword vectors AND value vector The specific expression is: in, , and These are query weight, keyword weight, and value weight, respectively, all of which are trainable weight matrices; Next, the attention weights are calculated to capture the implicit correlations between cross-stage behaviors, and the encoded features are output. The specific formula is as follows: in, for and The dimension; S223. After passing through the transformer encoder, the overall characteristics of the suspected victim are obtained.

9. The method for identifying high-risk mobile network users resistant to number spoofing as described in claim 1, characterized in that, The risk levels are categorized into three levels: high, medium, and low, with corresponding response strategies as follows: High-risk level: At least one of the following mandatory actions: immediately blocking the user's communication privileges, adding the user's number to a blacklist, forcing the user to complete SMS verification code or voice challenge verification, or reporting the user's information to law enforcement. Medium-risk level: Implement at least one of the following mitigation measures: limit user communication rate, partially block user call requests, send risk warning SMS to user, or temporarily restrict user's high-risk services; Low risk level: User information is only recorded in the monitoring queue, and enhanced log collection is triggered for subsequent offline analysis.

10. A risk identification system for high-risk mobile network users spoofing, characterized in that: include: High-risk user screening module: Based on mobile network signaling data, media statistics, network routing attributes and user call behavior characteristics, combined with rule matching and density-based spatial clustering algorithms, it screens out high-risk fraudster candidates and high-risk victim candidates. Differential detection module: used to detect the high-risk fraudster candidates using a multi-cascade model combined with triplet training, and to detect the high-risk victim candidates using a model based on a self-attention model, and output the risk probability of fraudsters and the risk probability of victims respectively; The handling strategy generation module is used to weight and fuse the risk probability of the fraudster, the risk probability of the victim, and the initial screening score to obtain a risk level, and generate a corresponding handling strategy based on the risk level. Closed-loop feedback module: Used to feed back the handling results and manual verification feedback to the false alarm database and rule base, and is used periodically for rule correction and incremental model training.

Images